A launcher tile (role: "launcher", design D4) shipped no art on purpose:
a launcher's own icon is square, every client cover-crops a 2:3 poster,
and the crop turns a mark into a strip. So the tiles were the launcher's
name on a flat accent face — legible, and the blandest thing in the grid.

Entries now carry an optional `icon`: the NAME of a brand mark, never
image bytes and never a URL. `[a-z][a-z0-9-]{0,31}`, shape-validated by
the host on every lane (a client interpolates the value into a resource
name or an asset lookup, so the guard belongs upstream of all of them,
and each client re-checks rather than trusting the peer).

A token rather than art because the alternative is closed by
construction, and deliberately: the art proxy serves what the bytes ARE
(sniff_image_type) and SVG is not on that list — it is script-capable
XML and the console renders library art in a browser. Widening that
sniff would trade a rendering nicety for a stored-XSS surface. Naming
the mark keeps the refusal intact, keeps the glyph vector at whatever
size a tile happens to be, lets it take the tile's ink, and adds nothing
to a reconcile payload that is already body-limited. The cost is that a
third-party plugin cannot ship a mark no client bundles; its tile falls
back to the launcher's name, exactly as before, and the fix is a PR
adding the master.

assets/launcher-icons/ holds seven monochrome masters with per-mark
provenance and licensing (Simple Icons CC0: lutris, heroic, epic, gog;
Font Awesome CC BY: steam, xbox; Playnite's own logo, MIT). steam is
generated FROM assets/os-icons/steam.svg so the SteamOS host badge and
the Steam launcher tile can never drift.

scripts/gen-launcher-icons.sh bakes the three derivatives that cannot
consume a master (GTK symbolic SVG, Windows PNG, Apple template PDF)
and — unlike gen-os-icons.sh, which prints path data for a human to
paste — GENERATES the three inline registries (web console, Android
ImageVector, pf-console-ui Skia). Three clients x seven paths of up to
3 kB is a transcription error waiting to happen, and a mangled character
is a silently wrong logo rather than a build failure. The generated Rust
goes through rustfmt, since `cargo fmt --all --check` is a CI gate and a
generated file that fails it would fail every regeneration.

All six renderers draw the mark CONTAINED, never cover-cropped: the
masters' viewports are not square (steam 496x512, playnite 1024x1024)
and filling a 2:3 frame would reproduce the strip this exists to avoid.
Every one keeps its old fallback for a token it has no art for.

Epic, GOG and Xbox marks ship dormant. Those plugins' launcher switches
are off by default and emit nothing, because the host has no verified
launcher_ui activation for them yet — shipping the art now keeps turning
one on the one-line plugin change those plugins promise, instead of also
needing a release of all six clients.

api/openapi.json and the SDK are regenerated (the spec's version field
was stale at 0.25.0 and now reads 0.26.0, which is the crate's actual
version — an unrelated line that regeneration necessarily corrects).

Verified: host cargo check, clippy -D warnings across pf-client-core /
pf-console-ui / punktfunk-client-session / punktfunk-client-linux, plain
build, pf-console-ui tests (77, including a new one asserting all seven
masters parse under Skia and one asserting the letterbox stays inside
its box), pf-client-core tests (188), cargo fmt --all --check, Apple
swift build, Android compileDebugKotlin, web tsc + vite build,
plugin-kit tsc, biome. The Windows client is NOT compile-verified — it
cannot be built from a Mac (scripts/xcheck.sh covers only the capture
stack by design) and CI does not build it either; its tile change needs
a real box before it ships.

2026-08-10 23:26:47 +02:00

src

feat(library): launcher tiles get their launcher's logo — a brand token on the wire, the vector in every client

2026-08-10 23:26:47 +02:00

tests

test(client): CI runs the binaries it ships

2026-07-30 10:58:44 +02:00

build.rs

fix(client): punktfunk-session is the session binary again — 0.22.0 shipped the shell's stub

2026-07-30 10:58:44 +02:00

Cargo.toml

feat: M10 — FFmpeg is gone from the client

2026-08-07 08:58:47 +02:00

README.md

fix(dxvadec): the review round — a vacuous predicate, an overstated claim, and the H.264 twin of this defect

2026-08-07 21:34:59 +02:00

README.md

punktfunk-session

The Vulkan session binary: one stream per invocation in an SDL3 window — no UI toolkit, no widgets, terminal stats. The power-user / gamescope stream client, and the stage-2 presenter of the Linux client re-architecture (punktfunk-planning: linux-client-rearchitecture.md).

This binary is deliberately dumb: a renderer the front-ends call INTO — the GTK shell (punktfunk-client), the WinUI shell, and the punktfunk CLI all spawn it through the same brain (pf_client_core::orchestrate), which resolves policy (profiles, settings, wake) and hands the result down, normally as a --resolved-spec file. It reads the shared stores only as the compat fallback for a bare hand-launched invocation.

punktfunk-session --connect host[:port] [--fp HEX] [--launch id] [--fullscreen] [--stats]
punktfunk-session --browse host[:port] [--mgmt PORT] [--fullscreen]

--browse opens the console game library (the Skia coverflow over the animated aurora) instead of connecting: A launches the focused title as a stream in the same window, session end returns to the library, B quits (Gaming Mode returns). Paired hosts only — pairing is the desktop client / Decky plugin's job. PUNKTFUNK_FAKE_LIBRARY=<file.json> feeds canned entries with no host (portrait paths starting with / load from disk).

Reads the same identity / known-hosts / settings stores as the desktop client (punktfunk-client), so enrolling on either side makes the other work; this binary never connects to a host it has no pinned fingerprint for (--fp HEX overrides the store).

Pairing is punktfunk pair <host> — the CLI, which ships alongside this binary in every package and needs no window and no toolkit either. punktfunk-session --pair still works for one release (someone's provisioning script calls it today) but prints a deprecation notice: pairing is a trust ceremony and belongs to the brain, not a renderer.

Stdout is the machine interface: {"ready":true} after the first presented frame, stats: … once per second while the overlay tier isn't Off (always the full detailed text, whatever the OSD shows; --stats forces the overlay on), one {"error"|"ended": …} JSON line on the way out. Logs go to stderr. Exit codes: 0 clean end, 2 connect failed, 3 trust rejected / pairing required, 4 presenter init failed.

In-stream keys match the desktop client: click captures input (Ctrl+Alt+Shift+Q releases), Ctrl+Alt+Shift+D disconnects, F11 toggles fullscreen; the controller escape chord (L1+R1+Start+Select, hold to disconnect) works the same.

The default build carries the Skia console UI (ui feature): the stats OSD and capture hint render in-window. Ctrl+Alt+Shift+S cycles the OSD tier live — Off → Compact (one line: fps · latency · Mb/s) → Normal (mode + end-to-end percentiles) → Detailed (decoder path + per-stage latency equation); any tier but Off also emits the stdout mirror. --no-default-features is the ~5 MB power-user build — same streaming, stats on stdout only, no Skia anywhere in the dependency tree.

Decode follows the Settings preference (auto is vendor-ordered: Vulkan Video → VAAPI → software on Linux, Vulkan Video → D3D11VA → software on Windows, with VAAPI/D3D11VA first on Intel — every rung native since M10; see "Decode rungs" below): the Vulkan decoder runs on the presenter's own device where the stack supports it (every vendor, zero copy); VAAPI dmabufs import per-plane elsewhere (D3D11VA textures on Windows); software is the universal fallback. 10-bit Main10 and HDR10 are advertised (VIDEO_CAP_10BIT|HDR): P010 decodes through the Vulkan and VAAPI/D3D11VA paths (the CPU rung is 8-bit by contract and refuses 10-bit rather than mis-scaling it), and PQ streams present on an HDR10/ST.2084 swapchain when the desktop offers one (KDE HDR, gamescope) or tone-map in-shader to SDR when it doesn't (PUNKTFUNK_TONEMAP_PEAK tunes the rolloff, default ≈1000 nits). The host still gates the upgrade behind its PUNKTFUNK_10BIT policy.

Decode rungs (M10: native only)

This binary contains no FFmpeg. auto walks native rungs — pf-vkdecode over Vulkan Video, then the platform's own (pf-dxvadec on Windows, pf-vaadec on Linux), then the CPU rung (openh264/rav1d). The libavcodec rungs that used to sit under each of them are deleted, along with pf-ffvk and the ffmpeg-next dependency.

One of the native rungs has never decoded a frame on real hardware (native VAAPI's H.264 and H.265 legs; its AV1 leg has decoded but has never been parity-checked). It runs anyway — with the libavcodec twins gone, the only thing below them is the CPU, so barring them would cost the session hardware decode outright rather than move it one rung down. What replaces the safety net is the log: every session names the rung it landed on with its evidence state,

decode rung active  rung=native-vulkan codec=HEVC hardware_verified=true evidence=...

…and that line is a WARNING when nothing has ever decoded a frame through the rung/codec pair the session chose. pf-client-core's video.rs module docs carry the full table; read any field report about M10 against it.

Debug/bisect knobs: PUNKTFUNK_DECODER=native-vulkan|native-vaapi|native-d3d11va|software (a pin skips the vendor order, which is how a lab run reaches a rung auto will not pick on this device; a pinned rung that cannot open still falls through to the standard ladder, loudly; native-vaapi also takes PUNKTFUNK_VAAPI_DEVICE=/dev/dri/renderDNNN to choose the GPU). The pre-M10 spellings vulkan/vaapi/d3d11va named the libavcodec rungs specifically; they are MIGRATED onto the native rung for the same hardware family, with a warn line saying so — every desktop Settings UI offered those values, so refusing them would end a session over a dropdown someone picked long ago. PUNKTFUNK_PRESENT_MODE= mailbox|fifo|immediate|fifo_relaxed (default MAILBOX, FIFO where the surface offers no MAILBOX — AMD on Windows), PUNKTFUNK_VK_DEVICE=<index> (multi-GPU), and PUNKTFUNK_HW_FAULT=import (fault every VAAPI dmabuf import — proves the three-strike demotion to software on healthy hardware).

PUNKTFUNK_AU_FAULT=drop|truncate|flip[:period] deliberately corrupts decoder input on the native Vulkan lane (default period 60 — one AU a second at 60 fps; inert everywhere else, and inert entirely if the value doesn't parse). drop swallows the AU, so the next one references a picture that was never decoded — the bitstream planner catches it immediately. truncate delivers a picture whose slice data stops mid-frame and flip alters one byte deep in the payload: both parse perfectly, so only the driver's per-frame decode-status query can see them, and neither is visible at all on a driver without queryResultStatusSupport. Watch the result on the Detailed stats line's integrity: term (damaged = concealment the planner caught, refused = AUs the decoder rejected outright, driver-failed = the hardware's own verdict, run = consecutive frames with no picture, worst run = the longest such stretch of the session — the once-a-second run sample misses the bad moment almost every time — and no driver status = this device cannot answer the driver question at all). A session that lands on any other lane says so in the log rather than faulting silently.

Note that PUNKTFUNK_AU_DUMP records the AU as it arrived from the HOST, while the fault injector runs later, at the native decoder's own entry. On a faulted run the dump is therefore the clean bitstream — reconstruct the damaged bytes from the spec if you need them (the injector is pure and deterministic).