enricobuehlerandClaude Opus 5 33a31427ae fix(vdisplay): locks held across seconds-long work, an AB/BA inversion, and a panic that poisons the manager ...

Phase 7's contained half. 7.1's writer split and 7.3's reservation are NOT here — see
the plan; both need more than a local edit.

**Lock-order inversion, gamescope.** `create_managed_session_steamos` held
MANAGED_SESSION while taking STEAMOS_TOOK_OVER (and `persist_takeover`'s locks), while
`do_restore_tv_session` takes STEAMOS_TOOK_OVER first and MANAGED_SESSION second —
AB/BA between a connect and the restore worker, which genuinely run concurrently
(`vd.create` runs off the registry lock; the worker is its own thread). The connect
path now drops its guard before the pair and re-acquires after `poll_managed_node`, the
shape `create_managed_session` already used. And `takeover_live` held all four statics
at once — in a `||` chain every `.lock()` temporary lives to the end of the statement —
for four reads; scoped bindings drop each guard before the next, taking it out of the
ordering graph entirely.

**`observe_session_instance` decided and acted under one lock.** It held LAST_INSTANCE
across `invalidate_backend` (which drops keep-alive displays through the registry lock)
and a `systemctl` shell-out on a 10 s budget, from three call sites including a
per-second watcher. It decides under the lock and acts outside now; the baseline is
advanced inside it, so a concurrent observer cannot run the action twice.

**`admit` held the live-session table across the budget checks** — `manager::snapshot()`
blocks on the manager `state` lock, which is itself held across DDC round trips and
three 3 s activation ladders. Every connect, disconnect and mgmt read queued behind one
slow display operation. The guard is scoped to `decide` alone.

**GameStream never registered**, so its display was invisible to both Windows budgets
(they gate on `!live.is_empty()`) and a native connect could be admitted past capacity
the box had already spent. It registers now, anonymously, for the session's lifetime.

**`ensure_exclusive_watch` panicked on a failed thread spawn** while holding BOTH
`exclusive_watch` and (via its caller) `state` — poisoning the two locks the whole
manager runs on, so every later acquire and mgmt read would panic on `.lock().unwrap()`.
It logs and degrades instead: no re-assert watchdog is a degradation, a wedged manager
is not.

Also fixes two things only a Windows build shows, both mine: Phase 2.3 left
`gamescope_route` unused there (every reader is Linux-gated), which `-D warnings` in
Windows CI would have rejected — I had only run the host clippy on Linux. And Phase
5.4's helper-safening reaches a FOURTH crate, pf-inject, which xcheck does not lint.

Verified on .173: `cargo clippy -p punktfunk-host -p pf-vdisplay --all-targets` clean
across the whole tree; local fmt, both xcheck targets and 53 tests green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-07-28 19:46:15 +02:00

..

apps.rs

refactor(host/W6.1): extract secret/config-dir helpers into the pf-paths leaf crate

2026-07-17 01:07:26 +02:00

audio.rs

fix(gamestream/session): end the session when the client disconnects or vanishes

2026-07-24 02:10:23 +02:00

cert.rs

fix(gamestream): generate the RSA host identity via the rsa crate, not rcgen (ring can't RSA-keygen)

2026-07-18 01:59:28 +02:00

control.rs

fix(gamestream): the termination type comes from the version we advertise

2026-07-26 20:04:54 +02:00

crypto.rs

fix: complete the docs/→design/ and openapi→api/ rename references

2026-06-26 11:53:02 +00:00

gamepad.rs

refactor(host/W6.0): drop gamestream BTN_* aliases; injectors read core directly

2026-07-17 00:55:44 +02:00

input.rs

fix(gamestream): tolerate NaN pressureOrDistance — VoidLink's finger touches were dropped whole

2026-07-23 17:48:17 +02:00

mdns.rs

feat(host): PUNKTFUNK_HOST_NAME names the host in Moonlight and the clients

2026-07-28 17:01:59 +02:00

mod.rs

fix(gamestream): advertise AV1 Main10, and honour HDR per negotiated codec

2026-07-28 18:03:30 +02:00

nvhttp.rs

feat(session/gamestream): the compat plane learns a game's lifetime too

2026-07-26 18:28:13 +02:00

pairing.rs

fix(security): land the 2026-07 audit fixes — SSRF guards, roster lane, SYSTEM path hygiene

2026-07-17 17:20:15 +02:00

pen.rs

debug(gamestream): surface the pointer plane's silent failure modes

2026-07-23 17:48:17 +02:00

rtsp.rs

fix(gamestream): advertise AV1 Main10, and honour HDR per negotiated codec

2026-07-28 18:03:30 +02:00

serverinfo.rs

fix(gamestream): advertise AV1 Main10, and honour HDR per negotiated codec

2026-07-28 18:03:30 +02:00

stream.rs

fix(vdisplay): locks held across seconds-long work, an AB/BA inversion, and a panic that poisons the manager

2026-07-28 19:46:15 +02:00

tls.rs

fix(gamestream): accept legacy X.509 v2 Moonlight client certs in mTLS pairing

2026-07-22 21:35:03 +02:00

video.rs

perf(core): FEC encoder reuse — cached codecs + pooled parity, no per-block setup

2026-07-14 23:19:21 +02:00