This is a nightly release of Vibepollo and contains several bug fixes and may contain new features. Check the commit log for more information.
Windows installer · Linux (Arch x86_64)
Nightly Windows installers are unsigned and include self-signed gamepad components. They may cause false-positive antivirus alerts.
Source: 83bb31680419
Since the preceding successfully published nightly Commit log
2.0.2-daily.d20261018.1: compare exact sources.
fix(display): honor session virtual preparation precedence
Resolve client generic preparation above dedicated or generic application
settings. Let a higher-tier explicit virtual selection lift inherited
VerifyOnly only while preparing an intended or actual virtual target.
Keep physical fallback and explicit same/higher-tier VerifyOnly intact,
and carry the ephemeral policy through Windows snapshots and Linux apply.
Validation: 76 source-based RTSP/WebRTC and Windows/Linux preparation cases
pass (40 failed on unchanged source); 1,156 physical-output fallback cases,
virtual-refresh checks, and five request-policy tests pass. Reviewed with
four independent Luna High confirm/deny pairs per selected claim and
same-agent rebuttals. Windows build and live topology remain unverified.
Refs Nonary/Vibepollo#599
Codex-Model: gpt-6.1-sol
Codex-Reasoning-Effort: xhigh
(cherry picked from commit 97835dbfb14faafd8b4f13d98bc00cc921d45296)
fix(focus): wait for eligible game windows before timing out
Slow launches could spend the focus timeout before a game window existed.
Give managed focus bounded discovery and per-window allowances across Steam,
Lutris, and both Playnite game paths. Preserve confirmation limits, lifecycle
cancellation, and Lossless Scaling refocus behavior.
Adapted from Nonary/Vibepollo#573 (026775b930ceb481db984dbb3f2e1439ef2610b8).
Co-authored-by: Jonathan Malmaud <malmaud@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Generated with [Codex](https://openai.com/codex/)
Model: GPT 6.1-Sol X-High
(cherry picked from commit d55d41459f16abc5b0ddb47b343044b532af630b)
feat(display): report explicit client virtual-display disables
Keep physical streaming successful when an explicit client disable overrides
an otherwise virtual host or app mode. Return an optional recognized warning
code after admission, without changing display policy or authorization.
Ignore inheritance, existing-output joins and unrelated display failures.
Generated with [Codex](https://openai.com/codex/)
Model: GPT 6.1-Sol X-High
(cherry picked from commit e261a059974bc9de43a92e4b8ba2b41e3bf07276)
fix(display): capture warning intent with session display snapshots
Keep warning attribution tied to the app and client settings that prepared
the session. Store ephemeral intent during assembly and reuse it after
admission, so concurrent settings edits cannot fabricate or erase a warning.
Preserve all display, authorization and successful-stream behavior.
Generated with [Codex](https://openai.com/codex/)
Model: GPT 6.1-Sol X-High
(cherry picked from commit 75d127ec0232ae18be57444ca6bd2a0b70cf1db8)
fix(ui): explain disabled tray in the Linux machine service
The machine service overrides the saved tray preference, so both Web UIs
could show an enabled control that cannot take effect. Report the launch
policy and show an explained, disabled control without rewriting the saved
preference. Standalone desktop launches keep their existing behavior.
Partial correction for Nonary/Vibepollo#578; a service tray companion is
still absent and the issue remains open pending reporter confirmation.
Generated with [Codex](https://openai.com/codex/)
Model: GPT 6.1-Sol X-High
(cherry picked from commit 10d2a13add0196429f0c628d794e2258f85154b6)
fix(installer): Recover retained virtual display devices
Equal/newer stored packages could skip setup without a usable display device.
Repair missing/failed Sunshine/Vibepollo nodes from a validated retained INF meeting the numeric floor; preserve healthy/disabled devices and defer unknown/reboot states.
Never force the bundled older package, delete packages or add trust. Windows ranks activation; lower-version postchecks report failure without rollback.
Reuse service/broker stop and nested restoration attempts. Standalone processes may need manual relaunch; PnP scanning is global.
The original installer freeze remains unresolved. Native Windows/service/device/streaming behavior and 36 PowerShell fixtures remain unverified.
Generated with [Codex](https://openai.com/codex/)
Model: GPT 6.1-Sol X-High
(cherry picked from commit 09ba40ef518516b9d9a8550a937a38872fa34c0e)
fix(linux): build the portal probe without SUNSHINE_BUILD_DRM
The portal capture probe passes sources[source::KMS], but the KMS
enumerator only exists when SUNSHINE_BUILD_DRM is defined. Builds with
-DSUNSHINE_ENABLE_DRM=OFF and the portal enabled (for example the SteamOS
user bundle) fail with:
misc.cpp:1683: error: 'KMS' is not a member of 'platf::source'
Pass false when KMS support is not compiled in, since KMS capture can
never be available then.
Port the unchanged guard from Nonary/Vibepollo PR #640.
UltraCode72 Luna/High source review passed; C++ and runtime unverified.
Generated with [Codex](https://openai.com/codex/)
Model: GPT 6.1-Sol X-High
Original-Commit: 271997c32eadf9c3aa6b3bf4570bee4af66cfeaf
PR-Origin: https://github.com/Nonary/Vibepollo/pull/640
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 69e163f33179860b8c63e6dd36ecc73f144e6fbd)
fix(linux): use AMD-compatible native buffer row pitches
Native RGB backing rows must satisfy AMD linear DMA-BUF import alignment.
Consume libvirtualdisplay 3f9c1c2a5eff85ca2a6218674523ccaadf917d01,
which pads backing pitch without changing logical display dimensions and
retains overflow checks and kernel-era PRIME callbacks. The exact dependency
contract suite passes; installed-driver and AMD runtime remain unverified.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 5cc4562ce3392f11023d9e435fccb002dffe3d90)
test(linux): consume the production allocator test seam
Keep the AMD pitch fix tied to the implementation exercised by component tests.
Advance libvirtualdisplay to cd7f0eede104d8ed35b4ec0f1f581fbe261eeecd,
which shares the allocator with Kbuild and proves the historical pitch mismatch.
Installed-driver and AMD runtime qualification remain unverified.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 582a769df4a5778e823410c196747e34f71aadcb)
test(linux): run native allocator checks in host CTest
Nested dependency builds do not include its standalone tests, leaving the
allocator regression outside the host suite. Register the production component
runner with the configured dependency source or the vendored standalone path.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit e12c29d32d2f51e34e0a3dd0d35a7e67f619bf11)
feat(pairing): prepare explicit offline recovery candidates
Duplicate pairing records can block startup, while guessing a survivor risks
reviving disabled access. Inspect copied state and require explicit choices
bound to both snapshot hashes before writing a private recovery candidate.
Preserve original bytes and authority; installation remains an administrator
action and normal startup validation stays strict. Windows runtime is unverified.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 931db73a664506c419b09bf21e93b554addbe2a3)
fix(process): defer catalog refresh across teardown
Catalog refresh could wait on teardown gates or replace active preparation
storage and its undo environment. Retry contended admission without retaining
gates, then read the latest catalog and hand off its environment after teardown.
Direct component tests cover the lock cycle and active-state preservation.
Original-Commit: 56c5de32a3bf05833a50d3e0dba2861ebbc840d2
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 28568166cb05e7f579cf7c2d0e2674ae20b516bc)
fix(pairing): retain verified identity for live connections
Endpoint cache eviction could forget a live client and lose queued request
identity. Bind verified certificate identity to its transport connection,
resolve current enabled pairing records under the client lock, and revoke
cached authority when a client is disabled or unpaired. Direct component
coverage exercises real TLS keepalive, eviction, and queued requests.
Use the reviewed maintained Simple-Web-Server copy with its upstream history
and MIT notice preserved.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 577ba9ed1e3c0647f325b36f57576978a018f3cf)
fix(nvhttp): keep bitrate cleanup off accept loop
Run bitrate cleanup on the existing blocking mutation worker so broadcast
teardown waits do not stall the listener. Acquire an existing broadcast for
bitrate changes while retaining native pacing admission and permissions.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit f6621d6ea575d3255e9cede42a8554fa5ad85bb5)
fix(stream): keep stopped packet queues alive through teardown
The mail registry uses weak references, so late workers could get new
running queues after stop released its only owner. Retain both stopped
queues through every worker join and reset retained objects for the next
broadcast. Idle bitrate and IDR controls use existing-only references.
Retain PR309's original commit and bitrate dispatch contribution. Shared
single-flight admission moves lifecycle waits to the blocking worker and
rejects competing mutations without queuing stale requests.
Preserve native pacing admission under the session lock. Check native
permissions before busy admission and recheck the TLS identity on the worker.
(cherry picked from commit 00ef429ff186397ff29bf8598938a363ff185d74)
PR-Origin: https://github.com/Nonary/vibeshine/pull/309
Original-Commit: f6621d6ea575d3255e9cede42a8554fa5ad85bb5
Co-authored-by: strifeforlyfe <hbashton13@gmail.com>
Co-authored-by: Codex <noreply@openai.com>
fix(audio): retain pre-display defaults through capture teardown
Display changes could remove monitor endpoints before defaults were captured.
Take a best-effort snapshot after effective configuration is installed and
retain its ownership through normal RTSP/WebRTC rollback and capture joins.
Keep optional acquisition failures from aborting preparation, including first
and repeated fallback attempts. Production component tests cover sequencing,
role choices and ownership failure paths.
Preserve Vibepollo's paused-app restore ordering by retiring only an
exclusively owned metadata audio guard before terminal display cleanup.
Synchronize RTSP guard copies and retain capture ownership through joins.
(cherry picked from commit c91bfa83780c2bb51a695a2f177960a23c563dda)
Co-authored-by: Codex <noreply@openai.com>
fix(web): preview the configured Moonlight cover
Saved-app previews could show UUID-named or web-only alternate artwork that
Moonlight could not read from the configured path. Resolve the parsed app
by UUID and use its PNG validator and bounded reader for the preview.
Explain unavailable configured covers, possible default artwork, and PNG
conversion and size requirements without changing saves or asset caching.
Preserve native app metadata, permissions and remote-session controls while
previewing the configured PNG; retain the native artwork fallback.
(cherry picked from commit d084267cca9b94ee3301b7e7360725075f04f869)
Co-authored-by: Codex <noreply@openai.com>
fix(logs): bound support export reads across log sources
Growing or oversized logs could make support export read beyond its
64 MiB allowance. Share that input budget across sources and read each
opened file only to its initial end, preserving sanitized complete tails.
Include truncation or omission notices for selected logs outside the
remaining budget; leave source files and retention policies untouched.
Retain Vibepollo's export manifest, packaging, TTL and final ZIP-size policy
while bounding source reads and preserving fallback discovery.
(cherry picked from commit 62ce2ec44d88e843025d3660987fc94962a1fe16)
Co-authored-by: Codex <noreply@openai.com>
fix(linux): explain PyroWave modifier import rejections
Generic modifier errors hid which capture layout and initialized GPU
could not interoperate. Add bounded device, format, modifier and plane
details to existing prevalidation failures, separating the configured
node path from the selected GPU's DRM render identity.
Keep import acceptance, feature-bit treatment and fallback unchanged.
(cherry picked from commit def48bbddbc01908f182af2c839c219460a7db83)
Co-authored-by: Codex <noreply@openai.com>
fix(nvenc): distinguish completion wait failures from timeouts
The boolean wait result labeled every unsuccessful encode wait a timeout.
Preserve the raw wait status and capture the Win32 error on WAIT_FAILED
before diagnostics, so logs distinguish failure, timeout and other results.
Keep the 100 ms timeout and existing encode recovery behavior unchanged.
(cherry picked from commit 422d48f20e154f3cb7b633c47542816ec33e05eb)
Co-authored-by: Codex <noreply@openai.com>
docs(display): clarify manual settings and session precedence
Manual display help implied a host value always won. Explain fresh-session
client, application and global precedence, plus settings retained by shared
sessions. Describe client display-mode and scaling priority and per-value
remapping exceptions consistently across the app and global editors.
Verify all three English UI bindings without changing host settings.
Retain native locale keys, branding and settings bindings. Qualify priority
for a new app launch with no app or stream running, because native
paused-app launches can retain the prior override layer.
(cherry picked from commit 2ccd1ce50d7b4642f515a09d3e16c67bd7c92e53)
Co-authored-by: Codex <noreply@openai.com>
fix(web): align cover revisions with the runtime catalog
Saved app paths could be stamped while cover requests used an older
runtime catalog, leaving stale artwork under a new URL. Version the parsed
path and file stamp, reject mismatched requested revisions and avoid new
preview caches. Keep deferred publication and Moonlight fallback, and
accept opaque versions in both web app models.
(cherry picked from commit dee595d0630270d265234fed8afbc12e62ea3138)
Co-authored-by: Codex <noreply@openai.com>
fix(logs): validate duplicate paths before skipping their reads
A ZIP name collected from a different source could make a missing
Playnite path look present and suppress fallback discovery. Check the
requested regular-file path and open it before duplicate-name success,
while skipping the duplicate body read and preserving budgets and counters.
(cherry picked from commit ff06efcc7266355529a30d4cecbc3cc24f0f3c67)
Co-authored-by: Codex <noreply@openai.com>
fix(web): diagnose HTTPS listener errors without request data
Connection failures before an HTTP response lacked useful configuration
listener diagnostics. Add fixed, rate-limited warnings for TLS, protocol
and request-handler errors while preserving responses and access policy.
Keep normal disconnects quiet and prevent logging failures from escaping.
This adds observability; the reported LAN incident cause is unproven.
(cherry picked from commit 8695843fa8a59f73d99b40b56a54284ebb1dc5ef)
Co-authored-by: Codex <noreply@openai.com>
fix(input): diagnose unnegotiated waveform feedback
PCM feedback could reach the sender without session negotiation and be
discarded without explaining why. Warn once per session at that discard
while preserving negotiated packets and other gamepad feedback paths.
The reported macOS ordinary-rumble cause remains unproven.
(cherry picked from commit 3353ee33b34cc6ee99642913459ac9732c91cf06)
Co-authored-by: Codex <noreply@openai.com>
test: replace source-text guards with behavior checks
Source-text checks could pass despite runtime regressions. Execute production
recovery, pairing, display and controller decisions with fixed outcomes,
and mount or drive actual frontend components instead of scanning Vue.
Extract the unchanged session classifier for deterministic behavior tests.
Retain deployment contracts and explicitly weak native integration guards.
(cherry picked from commit f8e122bf520151a969b688140482c10429949f04)
Co-authored-by: Codex <noreply@openai.com>
fix(installer): Validate display INF identities across locales
Turkish and Azerbaijani casing can reject the bundled ClassGUID key
before package validation. Match Windows package identifiers with
invariant case folding while retaining every identity and trust gate.
Addresses Nonary/Vibepollo#639.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 6a198eddf14305199d94499923df5c40426d61dd)
fix(web): Keep device save actions visible in long editors
The existing submit controls sit below long device settings forms.
Keep Save and Cancel visible while editing and cover both desktop and
phone layouts without changing explicit save or payload behavior.
Addresses Nonary/Vibepollo#651; native persistence still needs validation.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit e4b47b1ae621b7fbf7ad4473aed095016c9fd341)
fix(build): Include Winsock before NVENC Windows headers
The Windows nightly fails when NVENC or logging imports Windows.h
before winsock2.h. Load the D3D11 platform header first so its Winsock
include precedes those transitive Windows headers.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 2cb38123db6cdd356270d421ae9fad8fe7bad943)
fix(tests): Run release checks with their actual dependencies
Nightly checks used an unset Python interpreter and assumed Boost was
installed system-wide. Pass configured dependencies, execute the staged
upgrade guard in removal fixtures, and drop an unused Playnite default.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 2c90b7ef9a08e5deeaaf41ef67c40bcf1e47ee0b)
fix(linux): Map machine-host touch through the session broker
The isolated machine host intentionally lacks WAYLAND_DISPLAY, so the
local session guard skipped automatic touch mapping before the existing
broker path. Admit that path while preserving standalone session guards.
Addresses Nonary/Vibepollo#515; compositor validation remains pending.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b7b25aa9f3218362516e3d8b431544793afad4ba)
fix(display): Restore the physical desktop while games stay paused
A retained normal-game display blocked configured disconnect restoration.
Allow physical REVERT after capture owners drain while retaining the
reservation for Resume and protecting Remote Monitor and removal guards.
Dispatch is covered locally; physical Windows restore remains unverified.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b26d933437419ec4d8d9b79fb2a72bdbefa094c2)
fix(lutris): Launch synced games through the fixed session operation
Auto-synced Lutris entries used generic shell authorization and failed
with an empty command manifest. Generate and recognize the reserved
numeric-ID operation, preserving HDR launch behavior and custom approval.
Addresses Nonary/Vibeshine#322. Re-sync managed entries after upgrading.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 99f96b390968b951cbbe31b52fc85a88dd2edc42)
fix(audio): Diagnose muted capture sinks without changing volume
Silent monitor capture offered no explanation when the selected sink
was muted or at zero volume. Warn from a read-only startup snapshot,
using a shared best-effort query deadline so diagnostics yield to capture.
Addresses Nonary/Vibeshine#323. User mute and volume remain unchanged.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit dd8a64d93a1727f9ae19dd21cea9e58c44154f94)
fix(tests): Resolve modular Boost headers for display checks
Fetched Boost keeps algorithm headers outside Boost::headers, leaving
nightly display precedence checks unable to compile. Pass the algorithm
target's transitive include paths while preserving every regression case.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 7edf25f4c1612818ade835f985c09ccdc58b86d7)
fix(tests): Pass Boost headers to wake recovery backend checks
The nightly's nested backend removal checks compiled without the modular
Boost include paths already supplied to their fixture. Forward those paths
to both backend compiles so the full recovery regression runs in packaging.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit ede772556d4e9de469769f6144ace08bd113514f)
fix(state): Flush Windows files before atomic replacement
Require full writes and a checked OS-buffer flush on the temporary
handle before replacing state/config files. Keep prior targets when
write, flush or close fails; existing corrupt snapshots still need recovery.
Related: Nonary/Vibepollo#643
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 9dbf5607a97fd408242b40d70ba724b26a888707)
fix(tests): Link Windows socket extensions in network checks
The live HTTPS listener test calls AcceptEx and GetAcceptExSockaddrs,
which MinGW resolves from mswsock rather than ws2_32. Include that import
library in the shared Windows socket dependencies so network checks link.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 322d9678959472f72d53a1b0f306d9a10f8084ca)
fix(web): Forward touch gestures from browser stream views
Map primary content touches to taps or drags and cancel stale gestures
when capture ends. Focus admitted classic touches before forwarding keys,
and keep classic input messages ordered with zero retransmissions.
Related: Nonary/Vibepollo#188
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit c6c3d032765f09416a7c541e89e17494cf85eb98)
feat(network): Configure timeouts for new control peers
Publish a bounded, default-off timeout after configuration parsing, then
snapshot it once per matched peer. Keep the prior completed value during
reloads without changing established peers, ping expiry or explicit stop.
Adapted-from: https://github.com/Nonary/Vibepollo/pull/523
Original-commit: ebcce9f5d5145adf8e294e3a788394fa68aa4026
Related: Nonary/Vibepollo#522
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b06d3f81b7d4295c316b5f9fb6d7ab574ed372e3)
feat(display): Remove ended-session VDDs after verified restore
Add an opt-in policy that removes only owned virtual displays after a
matching final restore acknowledgment. Fence cleanup against new launches
and monitor owners; retain paused displays and uncertain recovery.
Related: Nonary/Vibepollo#517
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 5f45757fb0ef7a3368d0f81ea93395b52e0d6927)
feat(linux): Add a desktop companion for host control
Provide native tray status and controller actions without blocking the
desktop. Fence stale replies and coalesce polling while actions are pending.
Related: Nonary/Vibepollo#578
Adapted-from: https://github.com/Nonary/Vibepollo/pull/601
Co-authored-by: funkyotc <88894342+funkyotc@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit eb9494ea387d73ed2d2ab4675190e63e42fe97c1)
fix(web): Preserve Monitor settings when editing applications
Hide ineffective routing controls while preserving their saved values.
Keep virtual display overrides available regardless of the stored route.
Related: Nonary/Vibepollo#501
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit d914fbbcb3ca07f05f50905c5d8eb2abb90a927d)
feat(metrics): Expose opt-in samples to paired stream owners
Offer cached samples to authenticated owners of running video sessions.
Keep collection disabled by default and recheck current policy after waits.
Related: Nonary/Vibepollo#627
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 5745ca5c3c8c5783a445950076fce83295a2378a)
fix(tests): Keep Linux touch mapping checks on Linux
The touch mapping fixture compiles the Linux Wayland caller and uses POSIX
setenv and unsetenv. Register it only on Linux so the Windows nightly can
run its portable regression suite while Linux retains the mapping checks.
Co-authored-by: Codex <noreply@openai.com>
feat(input): Map a keyboard key to the client's Guide button
Keep the binding in each session and consume it before host injection.
Release synthetic holds on cleanup and respect downstream input permissions.
Related: Nonary/Vibepollo#444
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 0619cd51e56f76576363fb876b32bb1454d75c2b)
fix(display): Recover the helper before virtual startup
Share one bounded reconnect attempt across preflight and display admission
so a recent restore cannot kill the helper before startup recovery runs.
Keep existing input-only display gates and restore ownership intact.
Related: Nonary/Vibepollo#582
Adapted-from: https://github.com/Nonary/Vibepollo/pull/572
Original-commit: 5ad0ae88b358df07f89c906a3ea9e7c423921ed3
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 333fc526ee47ce08ef045590d8e5cb352c612f61)
feat(packaging): Add a checked portable Windows package
Build a separate ZIP with its runtime closure and a local-state launcher.
Reject incompatible or truncated selected PE files before creating an archive.
Related: Nonary/Vibepollo#409
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 60598c22e77d615ec9712de07421193634c95529)
fix(linux): Refresh KMS HDR metadata through owned encoder generations
KMS capture could reuse metadata selected at initialization after the current
connector payload changed. Keep immutable metadata bytes with each capture
generation, stop frame delivery on a readable change, and commit replacement
only after the previous encoder references have drained.
Keep the existing selection when a later observation is unavailable, and
retain the capture device only for an owned metadata handoff. Add worker,
event-loop and metadata regression coverage.
Refs: Nonary/Vibepollo#649
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit e436f48b94676bfbf8c6f25d278f9dae522b3fec)
feat(linux): Add an opt-in verified SDR capture path for Hyprland
Allow the machine-session controller and broker to bind an explicitly enabled
Hyprland desktop while keeping KDE behavior and the existing HDR launch gate.
Require complete current connector properties and structurally valid SDR
metadata before capture admission and frame delivery.
Seed the validated factory observation before initial encoder getters can
reuse an older HDR blob. Preserve the owned metadata generation handoff,
refuse unknown or non-SDR strict observations, and cover lifecycle, startup,
property failure and combined capture ordering.
Refs: Nonary/Vibepollo#631
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 9804dbe5fe427b978bdd95b9c6a674329d864c5c)
fix(tests): Match display recovery's final-restore contract
The portable recovery fixture still modeled the older revert API, so its
generated translation unit failed before any assertions could execute.
Model the final-restore policy and captured cleanup/control generations;
preserve existing checks and cover all ownership/display-policy pairs.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 87b35f0c81cda5e8e5caaa581d211b0cbb8f25b8)
ci(windows): Validate portable ZIPs in qualifying package jobs
Existing Windows package jobs did not exercise the portable archive, so its
runtime payload could drift while MSI and Setup packaging stayed green.
Build a fresh portable ZIP in qualifying non-PR jobs, validate its pristine
profile and extracted runtime with the production hook, and upload it as a
separate CI artifact. Reject stale or repair-dependent archives; retain the
existing release gates and public asset selection.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit c73120b7cef757c2a8d6fb206afb95681e21055f)
test: Match disconnect fixtures to current input and admission APIs
Guide permission updates made the generated disconnect fixture fail to
compile before its lifecycle assertions could run. Record and assert the
permission handoff, and include the actual host admission header when the
selected production revision provides it. Keep all existing lifecycle cases
and production extraction intact.
Co-authored-by: Codex <noreply@openai.com>
feat(power): Add separately granted idle-only sleep requests
Let a paired client request host sleep without starting a streaming session.
Require a separate default-off device grant, an expiring one-shot token and
an idle host, then flush a framed acceptance before the Windows sleep call.
Recheck the live paired identity and grant at invocation; preserve wake
sources and never terminate active sessions or retry a failed response.
Expose capability fields and a modern device permission control for the
companion client protocol, with explicit native qualification limits.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 9bf0802af281cc9d66235adf1e70057d833f77a0)
feat(display): Verify private requested-resolution catalogs before capture
Require the opened producer to report support before enabling a per-client
requested-resolution catalog. Reconcile changes only at an idle private
session boundary with exact capability-backed ownership, and reject
unverified shared or peer capture instead of falling back.
Resolve retained device UUIDs to active GDI names for readiness while keeping
lease authorization bound to the UUID. Preserve legacy full-catalog behavior,
surface explicit errors, and leave driver payload pins unchanged.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit aad42e1cfce787694a7bbf6122d8972ca2a59878)
fix(nvenc): End streams when output picture identity is lost
Reject nonempty native NVENC output whose index differs from the submitted
picture before packet timestamps can be assigned to the wrong pixels.
Latch the failure for the session and signal async shutdown before teardown,
so capture cannot recreate an encoder for the same client decoder after
continuity is lost. Keep synchronous failures on the existing shutdown path.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 40c5f8411f26e7592f4a10789c7b2f1febbef03a)
test(stream): Track requested-resolution flags in display fixtures
Model requested_resolution_only in both generated client and session
structures so production launch-session extraction compiles. Assert the
default-off and enabled values through the actual assembly path while
preserving override, resume and WebRTC precedence coverage.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 67e5ffeccee287ab9a3312f2fc4fcef7db07a5e7)
feat(windows): Add an authenticated shortcut to end host streams
Add a disabled-by-default local helper that validates the active console
identity and its private pipe before ending streams. Close startup admission
and drain owned application, RTSP and peer callbacks before terminal cleanup
and physical display recovery. Carry the original web request ticket through
CSRF, authentication and queued execution so stale requests cannot restart
across the shortcut. Keep ordinary management routes and paired sleep fencing.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 0e04bd7cb9156ff73a11f43456b5c22faa0235a2)
fix(windows): Support MinGW power capability headers
Read the named Modern Standby member when available and its documented ABI
byte in MinGW's reserved array otherwise. Keep capability-query failures and
unrelated power flags from admitting sleep, and exercise both header layouts.
Refs: Nonary/Vibepollo#652.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 8bfc9bf5bd5450a872112b33050b7854ea4843f1)
fix(apps): Preserve configured IDs when adding native actions
Check generated native action IDs against reserved controls, current app IDs
and configured aliases that still resolve. Apply the same collision check to
all four append paths so native actions cannot take an existing app's ID.
Refs: Nonary/Vibepollo#501.
Co-authored-by: Codex <noreply@openai.com>
fix(installer): Recover the verified legacy MSI source safely
Missing source blocks maintenance of the audited legacy MSI. Verify its native
identity and pinned original source before retry or replacement, retaining a
verified rollback payload. Handle damaged MSI markers within populated
registration-root matching; native MSI and rollback behavior remain unqualified.
Refs: Nonary/Vibepollo#650.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit f34ff8cda862da0b9d1acfe446c975192505aaee)
feat(profiles): Retain explicit Monitor profile identity and settings
Keep each marked Monitor profile distinct and retain its selected settings
through the paired-client session. Validate app publications and protect
profiles during provider maintenance; preserve invalid rows for explicit repair.
Shared/physical target leases and native runtime qualification remain pending.
Partially addresses Nonary/Vibepollo#501.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit bb40ce4ebeece73c3b3818fd809c4ec0799df2c0)
feat(windows): Inventory legacy driver trust without changing stores
Add an operator-invoked read-only inventory and advisory planner for the two
legacy display-driver certificate pins. Preserve trust on incomplete, unsafe
or changing catalog evidence; report review leads without applying removals.
Native inventory completeness and cleanup remain unqualified. Dot-sourced
helper inputs are caller-supplied advice, not authenticated inventory.
Partially addresses Nonary/Vibepollo#647.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 7cb3d78dd6e5954fcfb7287c634716df6e83791f)
fix(tests): Pass bootstrap recovery state to reflection dispatch
The legacy dispatch harness omitted the new recovery-payload out argument,
so reflection failed before its assertions ran. Supply the argument slot
and reject unexpected MSI recovery state in the existing legacy cases.
Retain the outcome, elevation and quiet-upgrade directory checks.
Related: Nonary/Vibepollo#650
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit da7a55f7c652ae313dc8a602b19a853c5f9400d7)
fix(tests): Include modular Boost.Asio in power fixture
The generated host power test includes Asio through Simple-Web-Server,
but its compile command only inherited property-tree dependencies. Pass
the combined modular include closure so the test builds without system
Boost headers. Preserve the production code and existing test cases.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 7aa8450c44eff41d122c0bf547f80c5a9ba4e5ff)
fix(tests): Match Playnite fixture to the current pipe API
The identification fixture missed headers and still mocked the old
one-argument pipe factory. Extract the production wait helper and match
its cancellation/deadline signature so the existing security-flag and
connector lifecycle assertions can run again. Production code is unchanged.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit a5e3d7ba9669ba39aadd77cb7461bcd951605d9c)
feat(display): Add opt-in leases for existing monitor targets
Keep an exact physical or shared-virtual target and mode bound through
pending launches, capture, and teardown without creating or reconfiguring
the display. Fence host mutations while borrowed and persist brokered
Linux uncertainty before admission so reconnects cannot clear it.
Keep the prototype opt-in. Portable lifetime proofs and both Linux source
builds pass; native Windows and installed display/service behavior remain
unqualified. Update the affected fixture adapters without weakening their
existing assertions.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 281df6fbbb6ef9c56232735ab71dc7fac00188e0)
feat(pyrowave): Stage optional D3D12 conversion
Add a Windows conversion backend that retains source images, mutex pins,
and queue completion ownership through retirement. Fail abandoned capture
acquisitions, quarantine uncertain experimental work, and retain cache
texture identities when pooled images receive replacement resources.
Keep D3D12 conversion disabled by default. Controlled CPU fixtures and
affected Windows object compilation pass; native ownership, GPU behavior,
full encoder compilation, recovery, and performance remain unqualified.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 1e7867f7d06611d7ca457b62c89f519b9e5820b3)
fix(display): Confirm only requested recovery state
Treat unknown HDR, an omitted primary display, and legacy missing origins
as unrequested fields when confirming a saved recovery snapshot. Continue
to compare every saved mode, canonical topology, and specified field.
Recheck a stable requested state after the quiet period so a quiet but
incorrect display mode cannot be accepted as restored.
Reject a snapshot with no remaining saved modes before applying topology
or settings. Preserve its unconfirmed state and the existing fallback
policy. Add recovery-engine regression cases for partial snapshots,
missing required fields, quiet-window drift, and filtered empty modes.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b8a17b8f597a176374c1480f52e7ca63746c88b6)
test: repair cancel admission regression fixture
Compile the extracted cancel handler with its real host-stream admission
header and threading support. Exercise closed admission with the real
terminal barrier while preserving authentication, ownership and repeated
cancel checks.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 4affb6b91e2df7a07cef4e4c917f820ea095d515)
test(diagnostics): add DMA-BUF layout to RGB import errors
Nonstandard-resolution reports point to a source RGB import failure, but the existing error omits the layout passed to EGL. Include the source surface dimensions, format, modifier, and plane metadata in that failure log, with tests for valid and sparse descriptors. This adds diagnostic context only; it does not change import behavior or establish incident causality.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b3c342614eca1415ab69f14ae4f56b306f12ab73)
test(api): cover existing log export behavior
The bounded log-export correction already landed, but its root fallback and
response assembly had no focused executable regression coverage. Extract those
policies behind injected helpers and test ordering, fallback, duplicate paths,
filename construction, and archive failure while preserving the Windows route.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 0010947cb4cf80fd02849d24ce859d18aad8fd14)
fix(display): keep Exclusive settlement checks through RESET
A disconnected Exclusive apply can lose its bounded verification while rollback, RESET, or a transient repair still owns the worker.
Drain deferred controls before resuming checks and preserve the exact Exclusive target and rollback snapshot across those barriers.
This is a scoped settlement correction; portable regressions pass, while native Windows and runtime behavior remain unverified.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 2bf3a5aeee2f1222ce326ce137b21d620affd796)
fix(diagnostics): label occupied DMA-BUF fd slots
Describe the diagnostic count and index list as occupied FD slots. The formatter counts fd >= 0 entries and does not validate a format plane count; import behavior remains unchanged.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit a5dd2c06dec9e171b1557cb57e829c765bdd92ba)
feat(input): trace ViGEm rumble callback and send results
Game and controller test tools can exercise different portions of the rumble path, so add bounded host observations to separate a matched ViGEm callback from a later local send result.
The log records the first zero and nonzero ENet send result per session and client-relative controller index. A zero means ENet accepted the packet into its outgoing queue; it does not prove delivery or gameplay output.
Refs #480.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 4e5b692d38919c1f4fa2b0d340d6eec6b66989b2)
test(linux): cover Arch installer fence failure
The incoming Arch AbortOnFail guard needs a regression seam for an unsafe private fence path before package replacement.
Exercise the published 2.0.0 selector and incoming hook with temporary paths and command shims; keep the production installer unchanged.
Refs #540.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 700545d732a2c495310d6e48955a11db374f82f1)
feat(linux): label Arch fence failure phases
The private host-upgrade fence preserved fail-closed behavior but exposed only a generic failure step. Fixed phase labels now identify the check that rejected the transaction. The fixture verifies an unsafe symlink still blocks replacement before service freeze or stop and remains unchanged. This is diagnostic only; native ALPM and reporter-host behavior remain unverified.
Refs #540
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit bf07c9f4cd66055cc9ca166c281e02a74c3000c4)
fix(display): preserve unknown physical enumeration status
Failed or partially mapped display enumeration can look like a
successful empty device list, which can incorrectly become absence or
reappearance evidence during saved-baseline recovery.
Keep unavailable observations distinct in the physical-baseline paths.
The legacy recovery executor stays list-shaped; successful-empty Windows
enumeration completeness and the reported incident cause remain unproven.
Related-to: Nonary/Vibepollo#653
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 4ca91fd33739fbf42518383a786b1b5fe9504f3e)
test(input): keep the Guide handoff fixture current
New exact-display target fields broke compilation of the extracted RTSP path fixture at the current source head.
Stub those external display boundaries so the regression still exercises the real Guide snapshot, stream allocation, and input path.
This is test-only; the Guide behavior is already present in source commit 0619cd51.
Related: Nonary/Vibepollo#444
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit d79066714358a684f6a337907a1b169c32e1bd64)
feat(display): pin requested mode catalogs
Vibeshine master already contains the capability-gated caller, but its
producer pin still points at the older protocol. Advance only the driver
pin so new builds can use the opt-in protocol 3.8 catalog while clients
without the flag keep the full mode list. Reapply the one-line pin from
6c881157c080f9304a5bba7c3d90b5a595dee7af onto current master.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit c3dc8958d4d9fd2686c4d6433f41d62c680ed174)
fix(capture): reset present latency on process changes
Swap-chain pointer values are only unique within a process, so a foreground PID switch can reuse the old numeric value and retain unrelated latency samples. Track the PID with the selected chain and reset refinement state when either part of that source identity changes.
This corrects the conditional timestamp-state defect; available issue logs do not prove it explains the reported choppiness.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 97ed562e39cef571b816c592985abea0d9b1eaca)
(cherry picked from commit fb1537630be8d8ca1678f2d83a7fc6c00578b425)
fix(pyrowave): fall back for linear capture imports
Some explicitly linear captures remain CPU-readable when Vulkan rejects their DMA-BUF. Upload bounded 32-bit RGB surfaces after producer readiness, validating allocation size and row layout while retrying required sync calls. Keep external ownership barriers only for imported images; tiled, implicit, and unsupported formats stay on the diagnostic path.
Refs: #293
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 68284d546af46e12c26e3c0026a08f277c5acd47)
(cherry picked from commit 6e7d7759f888a9954f3673be88e38879611d792c)
fix(creds): return after displaying CLI help
Missing operands or a help operand currently print usage and then continue into credential saving, risking invalid inputs or persisting the help token.
Return the help status before saving those inputs while preserving valid operand forwarding and saver errors. Focused callback tests avoid real credential-store writes.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 6a9a7ee60c7f86446df842b702572e2ebe5b240b)
(cherry picked from commit 15923c6774669f775f89c13f387ccdf5494425db)
fix(display): reject snapshots missing monitor origins
Windows captures active topology and monitor positions through separate queries. A transient mismatch can leave a retained output without an origin, which the save filter previously persisted and restore later skipped.
Reject incomplete post-filter captures before storage so retries preserve the existing baseline. The guard applies to new captures; older sparse snapshots and explicit exclusions remain compatible.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit a463a58698cb9cff48eb1f691585e92612872884)
(cherry picked from commit b6b4205479219527fd87f2f76a031136881879e2)
fix(installer): bound display-driver inventory waits
Move blocking Driver Store and PnP inventory reads out of the installer host and run them through each driver installer’s existing timed PowerShell process helper. Fail closed when a bounded query fails so install decisions do not proceed on unknown inventory. Add behavioral fixtures for successful, failed, timed-out child processes and result decoding.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b80a2adfada8686733a584e552e6e9da3e283967)
(cherry picked from commit ffeea0724a82d03e0cef0f033a2f4b5e8c810416)
test(stream): guard delayed bitrate requests after teardown
Port the issue #326 delayed paired-bitrate regression and count broadcast
construction in the fixture. The counter catches a transient restart that
a final idle-state assertion would miss.
Refs: Nonary/Vibepollo#326
Test-Basis: 6ae755e7de714b9f03fef6f44c833275ad1efd07
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 84678f6f3f31f8bc45d1cef030144dad7aedb551)
fix(input): refresh WGC geometry without capture restart
Adapt the verified desktop geometry and input lifetime update to Vibepollo's current master. Install each complete per-session port event before reapplying the accepted versioned geometry map, preserve the last known map while invalid, reject touch/pen starts until the mapping is usable, and keep Vibepollo's permission-aware queue and teardown behavior with cancellation before publishing a new capture generation. Target identity, capture, and observation failures remain on the existing reinitialization path.
This corrects input mapping and state transport only; it does not establish that geometry-only capture continuation resolves the reported WGC freeze.
Publish terminal geometry on every capture return, but raise the existing reinit signal only for an effective reinit status so ordinary error exits keep Vibepollo's asynchronous encoder teardown behavior.
Ref: Nonary/Vibeshine#301
Adapted-from: Nonary/Vibeshine@4a99508ac694178055f9cd51c4b960d378f305dc
Target-base: Nonary/Vibepollo@0883672ffb75478f9f444d447ed55de6ecd309cf
Co-authored-by: Codex <noreply@openai.com>
fix(vhf): bound feedback poll diagnostics
Aggregate decoded feedback observations and driver poll errors into a per-slot debug summary emitted immediately, then at most every five seconds. Keep ordinary rumble queue dispatch unchanged; the counters describe local poll outcomes and do not prove client delivery or physical actuation.
Issue: #303
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 004eadaf795b575c3d1ee1532adf378747d08165)
(cherry picked from commit f725c40e80bf0bcb393d998e953ead4cf96f5e7b)
fix(shutdown): carry phase diagnostics into Vibepollo
Reapply the accepted shutdown-phase tracker to the current Vibepollo base so the ordinary watchdog log can name the last marked teardown operation.
Preserve the supervised machine-host immediate _Exit before logging; that path still emits no phase, and this patch does not resolve the reported incident.
Reapplied from private target candidate 048aec4ce32512356842bb8d6802a1dd9e0cead2.
(cherry picked from commit 51d8544bdf9bdab37ebe40b65002493da92b142e)
Co-authored-by: Codex <noreply@openai.com>
chore(windows): log stream scheduling outcomes
Issue #385 needs fresh logs that distinguish successful scheduling cleanup from failures. Add info records for timer and process-priority lifecycle outcomes, and assert the extracted production callbacks emit representative records.
This improves diagnosis only; it does not change scheduling behavior or establish a physical mouse report rate.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 29d283fc996ee3d7709edd54e322494aed1771e0)
(cherry picked from commit c037e0cb8741d8ab32a4ab365bc086b106220ac3)
fix(tests): restore standalone Vibepollo configuration
Vibepollo already requests Boost.Process and its latest test list adds test_component_shutdown_phase. Preserve those target-specific changes while adapting standalone nlohmann discovery, optional peercred registration, and the fast-only locale-property fix.
Keep the nested Linux component fatal check so full-project peercred coverage remains required when the helper target is absent.
Target-base: Nonary/Vibepollo@08c904a65459644a59b3212e81bcb317e2ef6ccb
Adapted-from: Nonary/Vibeshine@72d71d2379f8f213a3c933fb87d63e32d51fef93
Reapplies-reviewed: Nonary/Vibepollo@ab5bd62ee08b890d70a83fa14697595186ef849a
Co-authored-by: Codex <noreply@openai.com>
Add Linux private display mode diagnostics
Record the requested and observed KScreen facts around existing display work so the 4:3 black-screen report can be investigated.
Keep Vibepollo's exact-refresh guard and use-current-output fallback intact; this adds diagnostics without claiming the incident is resolved.
Adapted from Vibepollo commit d47e33861ea3089dd9d866050596ae97d87e0a0f, originally based on source commit 757d63860a7a92c5bcd354c97d18879e240e8a40.
(cherry picked from commit 2875e432ca79ddbd609e47cbee6845d1406a1227)
Co-authored-by: Codex <noreply@openai.com>
fix(display): report effective rate and guard readback parsing
The first Linux display trace could report the requested encoding rate even when the encoder later used its fallback, and malformed KScreen mode data could throw during diagnostic extraction.
Report the effective rate with the same normalization used by the encoder, and treat invalid optional mode facts as unobserved. Add behavioral coverage for framerate normalization and malformed readback fields.
These diagnostics remain observational; existing mode selection and capture fallback decisions are unchanged.
Adapted from Vibepollo commit 16193ead0cee22d5b830d22388a1143743e3c0ac, originally based on source commit 2bf1520b3390f33e801ac85c5f6a2ad4ee892c36.
(cherry picked from commit 5a77c3ed895b9f5c5fc7f1e0c9055d2c2065ae57)
Co-authored-by: Codex <noreply@openai.com>
fix(stream): bound Vibepollo video batches by demand
Port the reviewed Vibeshine per-call batch-demand bound while preserving Vibepollo's operator ceiling and cumulative deadline behavior.
This bounds individual ordinary-stream send calls; it is not aggregate pacing and does not establish that the bound resolves issue #543.
(cherry picked from commit e01f7f027c76180207b9b41ae76b1e8eab7b414e)
(cherry picked from commit ccc1f4a9aefbbd47740f54a5b2b60426a1c76273)
(cherry picked from commit a2153d9883d65984cdd0d22b49fa415b96ccdd91)
Vibeshine-source-commit: b3b5a0434447645d2364a03a6e8692e91f00de47
feat(stream): opt in to demand batch sizing
The source-side demand policy has no demonstrated #543 causal effect or wire-burst guarantee, so preserve the published Vibepollo default behavior. Expose per-call demand sizing only when explicitly enabled, while retaining the pacing_max_bitrate_kbps ceiling and cumulative frame-deadline path. The new quantum limits one send call, not aggregate sends before a wait.
Downstream adaptation of Vibeshine commit 98873de1
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 27df0406a5430b68c71bf7366524cbf3dd6c26b8)
(cherry picked from commit 470c0be149d0ead48eeb727e611cd575750cae58)
Vibeshine-source-commit: 866a2e6f5b29c04e319353976bce78e6cec107cb
docs(config): clarify per-call video batch limits
(cherry picked from commit 4e55e1b9aa0dd9a073d06be23a36dc458a1561b4)
Require proof before fixed issue follow-up
Treat the fixed label as a candidate awaiting reporter confirmation, and request testing only after trusted metadata matches the tagged source and dependency locks. Remove both publication-time issue closure paths.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit d499f4b3ba50afca3c39d9de8f8e4a14cf9a0f4b)
fix(linux): preserve greeter baseline across handoff
Keep one process-owned Vulkan instance alive until PyroWave streams and probes unwind, then release it under the machine-host shutdown deadline.
Carry pending greeter layout through desktop startup by validating same-boot generation, physical monitor identity, and mode even when the compositor has retired its virtual connector.
Exercise handoff recovery and the target-specific machine-host contract with behavioral tests.
Co-authored-by: Codex <noreply@openai.com>
Adapt launch and resume traces for Vibepollo
Manually adapt the paired diagnostic change from published Vibeshine commit bfeeb1e823e985bde7aeb669818a41151d0781fa to Vibepollo, retaining launch_request_mutex then lifecycle-gate ordering and run_start cancellation behavior.
This diagnostic/privacy change does not claim an incident root-cause fix.
(cherry picked from commit bfeeb1e823e985bde7aeb669818a41151d0781fa)
Co-authored-by: Codex <noreply@openai.com>
test(input): preserve host IDs across controller mask removal
The regression needs to run on live Vibepollo master, whose packet enqueue
uses geometry policy. Verify host-ID mapping, exact platform release,
allocator-mask reuse, and preservation of the still-active slot.
Reapplied from: 446114fcdda3da51f47bf96f01fbe0cf3747b9b1
Source-commit: 110ca9a34d1f71bd86ad4b8e2d212d18b34efbcc
Co-authored-by: Codex <noreply@openai.com>
fix(display): Reactivate owned inactive virtual targets in place
Fullscreen transitions can leave a driver-owned target inactive while generic recovery waits through its longer grace and rebuilds display state.
Use a bounded, lease- and adapter-verified helper operation to restore the exact target while preserving peer modes. Require a fresh frame for the output before further display mutation, and route missing or unavailable targets through generic recovery.
The reported OS request and fullscreen transition have not been reproduced.
Upstream issue: https://github.com/Nonary/Vibepollo/issues/617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 5b4080dce96eaaaad1585f48941ae13c0d471db7)
(cherry picked from commit 4ee05a3b8d63c9d079ea8ec04f93b58d457aef52)
Guard virtual display fullscreen reactivation
Keep the target reactivation lane from asking Windows to rewrite supplied peer timings, and require stable device identity before trusting a refreshed display-name capture alias.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 41c7b0a480e91bf23e07664e3e1d344efb7c50ee)
(cherry picked from commit 784c05ecf779d1ce40537d14ac3ef8e14e8a1bb0)
fix(display): bind recovery capture aliases to lease
A unique friendly-name fallback can seed an identifier that later appears to be a strong match. That lets a frame from another output acknowledge recovery of the owned virtual display.
Resolve presence and verified capture aliases from the exact driver lease, and observe display-name or monitor-path aliases only after that identity check.
Add executable positive and negative controls for weak-name promotion and exact-lease capture confirmation.
Issue #617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 63c35400a0b471c0bb1ba5356ace9ffc617f9b56)
fix(display): bind recovery frames to current lease identity
Friendly-name matches could classify unrelated virtual targets as present, and GDI aliases could be reassigned before a new frame arrived. Require exact driver lease identity for owned-target presence, and resolve each fresh capture output to its current device ID before confirmation. Retry failed lookups on the same capture instance with a bounded delay.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 68b2d54612a522e9a1282f3df5d59f014c4406f0)
fix(display): keep owned recovery bound to its exact output
Do not accept a friendly-name candidate when reusing a securely reclaimed driver lease; resolve the target by stable display ID. Revalidate the captured lease identity before reactivation and retry mismatched frame identity lookups on the same capture instance after a short delay.
Add executable controls for conflicting names, identity refresh and same-instance topology remap.
Upstream issue: https://github.com/Nonary/Vibepollo/issues/617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 3e93ec6cca5577973d51b405e7370b2a6528ce7d)
fix(display): reject stale capture confirmation after lease identity changes
Record the device ID captured by the reactivation watcher and require the live lease to retain that identity before polling confirmation. A same lease/display pair can otherwise refresh its tracked device ID while a stale watcher remains pending.
Add executable controls for matching and changed identities before and after watcher installation.
Upstream issue: https://github.com/Nonary/Vibepollo/issues/617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit bc77716ad60cc6c2e1202981dbcb93de5b860576)
Fix reclaimed display name resolution by exact ID
A securely reclaimed target can be enumerated without a usable GDI name while a peer has the same friendly name. Falling back to that peer can store its monitor path alongside the reclaimed lease.
Resolve reclaimed names only from the owned device ID and fail closed when it has no GDI mapping. Keep the existing client-name and no-client fallback behavior for ordinary reuse, with executable positive and negative controls.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 413e6fa865d5590e2a502200742eb628f7745c11)
Keep monitor path resolution bound to device ID
A known device ID can lose its enumerated path while Windows reassigns the same GDI name to another monitor. Falling back to that mutable name can bind scaling or profile work to a peer.
Resolve monitor paths by exact device ID whenever one is supplied; use DisplayConfig name matching only when no device ID is available. Keep exact-path lookup generic for physical and virtual devices, and add executable peer-alias and fallback controls.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit f77df4ea2e9eaf3416bb00a9185c9807c9e88031)
Require stable identity during display readiness
When DisplayConfig has not published a target identity, selecting a device by client friendly name can promote a same-name peer into the exact device-ID check. A peer can then satisfy readiness before the created display appears.
Wait for the requested stable display ID or a target-specific DisplayConfig identity instead of seeding readiness from friendly-name or arbitrary-device fallbacks. Count the stable ID as a strong hint so weak-name and resolution candidates cannot satisfy it, with executable policy controls.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 8cea7d4b6a12098adb419b7fc02c7bc041b1d936)
Bind display readiness to stable identity
Require the requested EDID identity for exact readiness when creating a display, so reassigned GDI names and monitor paths cannot make a same-name peer look like the new target. Derive the published name and monitor path from the selected exact device ID, and do not seed its ID from the mutable GDI alias.
Add executable policy controls for the mutable-alias case and readiness fallback behavior.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 9c225553c86c1b4b9edb906f4201a0e9a9a22984)
Require identity for virtual display persistence
A readiness candidate may match the requested EDID while device enumeration leaves its device ID empty. Persistence confirmation must then fail closed instead of treating any remaining virtual display as the created target. When an ID is known, it must also remain authoritative over a mutable display-name alias.
Extend the live-recovery harness to compile and execute the production presence check with empty-identity, wrong-ID/same-name, exact-ID, and name-only controls.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit f53c9fe0e94fdd30daeebb357d8b7bd096d988ea)
fix(display): rebind reuse aliases to the selected target
A reused client-name match can seed a GDI alias from a peer whose device ID is empty, even when readiness later selects the requested EDID target. Rebind the published name to the selected stable device ID after readiness and suppress client-name fallback whenever a stable display identity is known. Keep the alias unset when Windows cannot provide the selected ID, so persistence cannot confirm a peer by name alone. Add executable controls for exact rebinding, unresolved identity, and legacy behavior.
Fixes #617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 4022bb8bbbec6647b358bd5179572564ce88941f)
fix(display): drop peer ID hints for stable target reuse
Ordinary reuse can begin with a client-name device ID that belongs to a peer. When readiness is bound to the requested stable display identity, do not carry that unverified ID through an EDID match that exposes no device ID. Preserve the exact ID for a securely reclaimed lease and keep the legacy name candidate only when no stable target identity is available. Use the numeric display ID as the stable-identity gate and extend the executable policy controls.
Fixes #617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 9dfbe4cf50379c3769445fc3d905c61207ec33b1)
fix(display): reject ambiguous stable EDID matches
Count every virtual display with the requested EDID projection before readiness can adopt one. If the projection matches more than one enumerated candidate, fail closed instead of taking the first peer.
Fixes #617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 3eed6eddc981ed88db5b0f924dda6a6f7471d59c)
fix(display): verify stable targets with ContainerID
The EDID product and serial fields are a lossy projection of the 64-bit display ID. Require the monitor devnode ContainerID before a stable identity can select a readiness target, and reject duplicate complete matches.
Add executable controls for a lone colliding peer and duplicate full identities. Native Windows SetupAPI behavior remains a qualification gap.
Fixes #617
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 68f4fc760bf183426d92458bd9d2965c381b8922)
test(pyrowave): repair D3D12 retention harness
(cherry picked from commit 256a4219fed91fda8b127d99d35097f86c397721)
test(pairing-recovery): cover divergent backup isolation
Duplicate pairing certificates fail closed, so recovery needs an explicit offline survivor choice. Exercise a valid divergent backup to ensure candidate preparation uses only primary state and preserves both snapshots. This adds regression coverage; it does not repair an affected host state.
Refs #308
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 4207315c34f38f6bfe591eac268ed193c0bd2e1a)
(cherry picked from commit 91a9dac5081a7763654d72db24ba5d1f4e47482c)
fix(tests): gate Boost.Process on component tests
Fast-only standalone configuration skips component targets, but unconditional
dependency discovery still requires Boost.Process on systems that do not have it.
Request the library only when component tests are enabled, retaining it for the
targets that use it.
Vibeshine-source-commit: 72d71d2379f8f213a3c933fb87d63e32d51fef93
Co-authored-by: Codex <noreply@openai.com>
feat(display): add opt-in IddCx frame-push capture
Add a D3D11 four-slot consumer and owner-authenticated target lookup to the Windows capture selector. Require explicit build opt-in and a validated first frame before activation, while retaining WGC fallback for unsupported or unavailable targets.
Refs: #626
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 34d294432c765a07b8f190f251b067585704a73f)
build(display): pair frame-push host with driver protocol
The default driver pin lacks the protocol header and producer used by the opt-in capture path. Point the host at the reviewed current-master driver candidate so their interfaces match when explicitly enabled.
Keep this host pin behind the driver commit; do not publish it before that revision is publicly reachable.
Refs: #626
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 61bb43522ce622256c0df3c6dff3ddbb0667cba9)
build(display): keep frame producer paired with host opt-in
(cherry picked from commit 9ad495c6f78d6f8db0cc26a5fe4a1042cde9ec90)
build(display): pin DXGI importer include fix
(cherry picked from commit 7fc7b0f05b2539fb38a4490ea6b67790aec446a9)
fix: preserve frame-push capture across input geometry updates
(cherry picked from commit 8eb97c33fe46e40b05d9eea29d47d808a1c546fd)
fix: repair Arch builds and diagnose Windows probe
The Shine policy test omitted its header-only JSON target, and Pollo's
shared header used a geometry include path absent from its test target.
Scope the JSON dependency to that test and use the repository-root path.
Keep the Windows rollback probe's assertion unchanged while reporting
captured length and UTF-16 output on failure; native rerun is required
to identify the process-capture mismatch.
Vibeshine-source-commit: 66f457a5002cad32384f8a8fa0840f628471e5b2
(cherry picked from commit 66f457a5002cad32384f8a8fa0840f628471e5b2)
Co-authored-by: Codex <noreply@openai.com>
fix(nightly): isolate query output and link Boost.UUID
PowerShell first-use progress polluted Sunshine's merged inventory-query output, and the Arch recovery target lacked Boost.UUID's include usage requirement.
Set progress preference only inside the bounded Sunshine child process and link Boost::uuid to the test target, keeping fail-closed controls intact.
Vibeshine-source-commit: 17d2450b4e8d34e6ed888ba46a4ffce917dd1d27
(cherry picked from commit 17d2450b4e8d34e6ed888ba46a4ffce917dd1d27)
Co-authored-by: Codex <noreply@openai.com>
fix(build): qualify Linux display recovery and MinGW dispatcher
Port the Boost.UUID test dependency closure and Winsock header ordering required by the nightly native validations.
Keep the recovery assertions, Windows-only include guard, and non-Windows test dependency scope intact.
Vibeshine-source-commit: cc075db9811261d7d34bed977c47cef6dfbf4ea1
(cherry picked from commit cc075db9811261d7d34bed977c47cef6dfbf4ea1)
Co-authored-by: Codex <noreply@openai.com>
fix(display): complete Vibepollo nightly test dependencies
Port the reviewed borrow-gate and MinGW link repair from Vibeshine. Keep the regression test truly multi-translation-unit and preserve the same nested, concurrent, and moved-scope checks.
Vibepollo's shared utility header includes nlohmann JSON, so the input-geometry, VHF, and extracted PyroWave test compilers must receive that usage requirement. The VHF test also compiles Boost.Process through common.h.
Vibeshine-source-commit: 7332902b12d391db4fbc17a2758e814eae5ed565
(cherry picked from commit 7332902b12d391db4fbc17a2758e814eae5ed565)
Co-authored-by: Codex <noreply@openai.com>
fix(logging): inline the shared archive filename helper
confighttp.cpp includes this shared header without calling the archive filename helper, so the per-translation-unit static definition fails warnings-as-errors builds. Give the header-defined helper inline external linkage while keeping its body and generated filename unchanged.
Vibeshine-source-commit: 94b4d9b951e451f79fbed46f19190d62d3dfb349
(cherry picked from commit 94b4d9b951e451f79fbed46f19190d62d3dfb349)
Co-authored-by: Codex <noreply@openai.com>
fix(linux): fix Arch warning-as-error header builds
Arch compiles these shared helpers in translation units that do not call every function, and GCC treats the unused static definitions as errors. Mark the Vibepollo helper definitions static inline while retaining internal linkage and their bodies.
Clarify the lease liveness conditional so the unconditional return does not trigger misleading-indentation warnings; runtime behavior is unchanged.
Vibeshine-source-commit: c1ac3a44c0ad2f6fe5cc5fe8c06fb61df3a88cba
(cherry picked from commit c1ac3a44c0ad2f6fe5cc5fe8c06fb61df3a88cba)
Co-authored-by: Codex <noreply@openai.com>
fix(windows): qualify display borrow protocol types
The integration translation unit declares platf::display_helper before including this client header, which shadows the global display_helper protocol namespace.
Qualify the three API types globally so every translation unit resolves the same protocol types regardless of include order; this changes lookup only, not behavior or signatures.
Vibeshine-source-commit: 86d7b79d1a71f534eb59379b98d971005da4981e
(cherry picked from commit 86d7b79d1a71f534eb59379b98d971005da4981e)
Co-authored-by: Codex <noreply@openai.com>
fix(nightly): stabilize native regression build and recovery
Recent nightly validation exposed stale extracted test bodies, incomplete component declarations, and recovery paths that could verify against a retired display identity. Align the fixtures with current production APIs while preserving their behavioral checks, serialize Linux display-power lease admission, and keep Exclusive rollback verification on the restored topology through the final probe. Correct the confirmed Windows duplicate definition, missing declaration include, and BOM parse failure without weakening compiler or safety checks.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 4c3782fd031e3e666f2d3cc7fe93ba7da1d95264)
fix(display): preserve exclusive settlement through final probe
After bounded disconnect repairs, resetting settlement before the final Exclusive check caused its callback to be discarded, preventing recovery when the exact topology still failed.
Keep the captured topology and settlement ownership through that final probe. Record direct verification as zero-delay in the fake dispatcher so delayed timings cannot leak into later assertions.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 757274d5c5801ebe16d4c2e982c9dc6f9879e31d)
fix(linux): Use commit-specific DRM presentation timestamps
Keep capture source timing tied to the completed flip rather than worker scheduling. Update the DRM driver and cover delayed publication, timeout and independent CRTC behavior.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 615ac1097346a1e507ef1f61c599fa5e42f61f20)
fix(linux): Hold screen state while private topology is retained
Prevent idle screen-off transactions while only a retained private output remains lit after streaming. Use a separate screen-only inhibitor that allows suspend and releases after physical topology restoration.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 5c25b3eff9aac17d5d3c0ebd451551eadaed1e6e)
feat(linux): Preserve GPU fault evidence through late shutdown
Keep incident recording alive through ordinary service shutdown and send late kernel and systemd messages to an independent netconsole receiver. Repair the broker socket ordering cycle while preserving shutdown cleanup.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 0c6b9d5489057d45f2906ed55b594775c15835e8)
fix(installer): Identify local builds and accept native companions
Distinguish local builds from clean release tags with a commit-based version suffix while retaining existing artifact versions when skipping builds. Include the native tray and package preflight artifacts in installation validation.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit e7cddc5e0b520063a879c7356699f8ac01d09789)
fix(hdr): Preserve PQ transfer in eight-bit Linux capture
Framebuffer precision does not identify whether captured pixels already contain HDR. Carry the capture color state into PyroWave conversion so native PQ is not expanded as SDR a second time.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 3ab869f0fd3b550bf49f3e9d286d2e9af54a1394)
fix(web): Apply display actions to virtual application layouts
Expose display actions for virtual outputs in both interfaces and select an activating action when choosing a layout. Explain inherited settings that prevent layout application and cover the application display flow.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 91fff06aeb7d5a276acc81d6adcdcdfbe3c9d17d)
feat(tools): Add native Linux TrueHDR reference harness
Provide pinned runtime extraction, raw-frame conversion and resident GPU benchmarks for investigating NVIDIA TrueHDR on Linux. Include a Windows reference capture and explicit pixel comparison without claiming unverified Windows parity.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 947db3c00a34b58d3c9d38c97d7bb22036291fb7)
fix(tests): Link frame transport validation into catalog tests
The updated virtual-display control client depends on frame transport validation. Include its implementation in the standalone catalog test target so the complete native build links successfully.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit dc65ac6b4f972e73b1383ad1a7c0111205e7a079)
test(gpu): Retire the shared instance before loader teardown
The encode/decode fixture left its shared Vulkan instance for static destruction after the codec released the loader. Match the host shutdown order on both normal return and exceptions so successful GPU cases also exit cleanly.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b6eb11e9433255091cde6140223b4522747b106f)
fix(tests): Preserve Apollo host and fixture contracts after migration
The migrated retained screen lease must use Apollo’s machine-host marker or it silently skips its inhibitor. Align the production-extracted startup and shutdown fixtures with current Apollo signatures, and keep the display UI test on Apollo labels.
Co-authored-by: Codex <noreply@openai.com>
fix(windows): Pin driver import library correction for nightly links
The hosted UCRT build links the frame importer into the final executable. Advance the driver pin to the toolchain-specific OneCore linkage fix so the Windows nightly can link while MSVC retains Kernelbase.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit e2eb8ff93b4edb166b59739a543ba3dfd67d6340)
fix(release): Name nightly builds with their source revision
Use the base version, UTC date, and built commit SHA as the immutable nightly tag, displayed title, and application version. Keep legacy daily releases recognizable while preserving installer safety, update notifications, provenance, and reporter follow-up across the new identity.
Limit normal publication to one successful new-style nightly per day because SHA order cannot safely drive upgrades. Failed reserved builds may retry only at their exact source commit.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 38054e1cb3f42a56650535aa7bac93ca74da00d4)
fix(pairing): Collapse 1.x duplicate client records instead of refusing startup
Vibeshine 1.x appended a new named record whenever an already-paired client
paired again, and re-imported legacy root.devices certificates on every start.
It looked clients up by certificate and stopped at the first match, so later
copies were never used for authorization, identity or settings. 2.x treated
those copies as ambiguous, stopped the HTTP interface and raised shutdown, and
the service restarted the host in a loop. Every 1.x upgrader with a re-paired
client hit it.
Collapse each duplicate group into its first record, the one 1.x used. Keep it
disabled if any copy was disabled, so no access is granted that 1.x denied.
Repeated legacy certificates carry no settings and collapse the same way. Log
each removed UUID and save the original state once as
sunshine_state.json.before-dedupe.bak.
If pairing state still cannot be loaded, keep the host and Web UI running
without exposing a new identity, and retry with backoff instead of exiting
into a service restart loop.
Addresses Nonary/vibeshine#308 and Nonary/vibeshine#298
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 3390096d01ab197c8a100e946bb466f96974aff5)
fix(windows): Define the device container property key for MinGW
The hosted nightly reached sunshine.exe linking and found an unresolved DEVPKEY_Device_ContainerId. Include initguid.h before devpkey.h in the one translation unit that uses this property so DEFINE_DEVPROPKEY emits its definition. Keep the existing SetupDiGetDevicePropertyW lookup and driver selection behavior.
Co-authored-by: Codex <codex@openai.com>
(cherry picked from commit 2a49414c00171c3fa276101ed053e57e88dbc709)
(cherry picked from commit b4e88bf7278e4d7f5944e4a87008e17a1cf97dce)
fix(nightly): Retain exact-build Windows symbols in Actions
Nightly stripped binaries lacked a matching debug archive. Enable the reusable Windows symbols pack, keep it separate from the installer provenance and public release assets, and retain the exact-build archive for 90 days in the publish run. The strict installer asset and checksum gates remain in place.
Co-authored-by: Codex <codex@openai.com>
(cherry picked from commit d4832b726a9023aa192a188b650093b9da1fcd68)
fix(nightly): Match Vibepollo symbol archive name
Use the target package prefix when verifying the exact-build Windows symbol archive so the daily workflow can retain it without relaxing the installer contract.
Co-authored-by: Codex <codex@openai.com>
test(windows): Compare refresh rational fields in isolated target
The standalone display helper state-machine test links the display-device headers but not the implementation of Rational equality. Check the exact numerator and denominator so the test keeps its assertions without adding an unrelated library dependency.
Co-authored-by: Codex <codex@openai.com>
(cherry picked from commit 78c8dd847f2d6bc3e57b817eb3ef3ee141f24a4e)
fix(steam): Honor working directories for direct game launches
Direct desktop-session launches inherited the home directory, leaving
Metaphor stuck during startup when it could not find relative assets.
Enter the discovered game directory before evaluating Steam launch options
and abort if it is unavailable. Cover relative assets and quoted paths.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit aa6b8a936f7b689c8d7c7a2e88522dde650082e2)
test(windows): keep downstream harnesses compiling on MinGW
The generated tests placed src ahead of MinGW system headers and redefined an imported CRT symbol, so the daily Windows job stopped before executing these policies. Use quoted-header search paths and the real Windows CRT symbol while retaining the Linux fixture.
Co-authored-by: Codex <noreply@openai.com>
fix(portable): Permit host NVIDIA driver import
The portable PE closure ran on a GPU-less Windows host and rejected nvcuda.dll, which the installed NVIDIA driver supplies. Exempt only that unresolved driver name after the existing PE and path checks; retain failure for all other missing imports and add real CPack fixture coverage.
Co-authored-by: Codex <codex@openai.com>
(cherry picked from commit 2c7b047dd5b5b6f501558679f37bdb45ff531e31)
fix(portable): confine NVIDIA driver import to optional NGX
The pinned TrueHDR runtime eagerly imports nvcuda.dll, but the host loads that runtime only for RTX HDR. Permit the driver DLL only from the root NGX image, reject an eager import from any other staged PE, and smoke the extracted host on a GPU-less Windows runner before accepting the ZIP.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit d1be90ec62490cfa1528d67dc43c69ed4363aa22)
fix(portable): inspect NVIDIA imports on every Windows runner
An NVIDIA-equipped builder can resolve nvcuda.dll, so conditioning the optional runtime guard on an unresolved import misses eager host dependencies. Scan staged PE imports on every package build and cover both resolved and unresolved driver cases.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit c2183215122d944d490bfa8fbe95bb08f563a0b6)
feat(linux): Add native RTX HDR to NVENC and PyroWave
Convert opted-in SDR applications with NVIDIA TrueHDR while keeping capture
SDR and publishing HDR10 metadata. Preserve live tuning and neutral desktop
fallback, and observe foreground ownership through the desktop user service
so the broker sandbox cannot silently disable enhancement.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 6bfa666db01a2f0b72d72713dfc0c18fa36687b4)
fix(display): preserve physical origins and skip idle shutdown reapply
Adapt donny110's contribution from Nonary/Vibepollo#616 at
2d9cb289cdafa8366cb9debd2f0737ba87fa85b5 to the implementation source.
Retain physical inventory origins and avoid idle topology mutations.
Recheck managed ownership atomically when committing an inventory refresh.
Co-authored-by: donny110 <63401186+donny110@users.noreply.github.com>
(cherry picked from commit 04216f38d8256f82fca7ab7175cc4109416ec4bc)
fix(display): retain failed physical restore after terminal removal
Address R2-C1: track restore intent independently of display ownership,
protect its baseline from idle inventory refresh, and retry on shutdown
without reconnecting removed monitors. Preserve clean idle no-op.
Add chained failure/removal/repeated retry regression; format added lines
with clang-format 23.1.3.
(cherry picked from commit 2e74625ad5134c76c0699190705e079534952f0d)
feat(recovery): Prepare explicit zero-filled auxiliary state reset candidates
Refs Nonary/Vibepollo#643. Preserve originals, bind both snapshots,
require explicit token/metadata-loss acceptance, and emit private candidates
without modifying live state or claiming lost contents were recovered.
(cherry picked from commit 937273c55a1904d8089a8b8d1e955e2feb341886)
fix(recovery): Preserve Windows Unicode command-line paths
Address PR330-R1-001: read recovery arguments through the wide Windows
command line, strictly convert to UTF-8, and leave unrelated CLI argv
semantics unchanged. Add Unicode path and Windows boundary tests.
(cherry picked from commit 98bb22a063fa215787171ebe95c1526325cabc49)
fix(video): release idle probe resources and scope GPU scheduling boosts
(cherry picked from commit a57ecaeb1509afa830f99010c8e86295a82a4ffb)
style(video): conform GPU lifetime tests to lint policy
(cherry picked from commit 13f12b6597b01a5917f614f4e450dfc791072075)
fix(linux): request SDR displays for synthesized HDR sessions
Vibepollo normal and Remote Monitor topology requests used the encoded HDR flag as a source-display setting. TrueHDR needs SDR capture, so pass the source HDR requirement to those display coordinators while leaving the stream colorspace request intact.
Co-authored-by: Codex <noreply@openai.com>
fix(linux): allow synthesized HDR from Hyprland SDR capture
Hyprland KMS rejected every HDR stream before distinguishing a native HDR capture request from RTX HDR conversion. Gate on the required source format so opted-in TrueHDR sessions can use a physical SDR output; retain the virtual-display and native HDR restrictions.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit b6fbf7e8c213cdc87e89d2340bd10a32fbbdf19c)
fix(release): preserve Linux display restores and gate RTX HDR controls
Keep inventory reads from replacing a pending physical restore baseline. Show Linux RTX HDR controls only when the built host reports TrueHDR support, including global settings and both UI generations.
Require an explicit separate-state attestation before preparing auxiliary reset candidates, because zero-filled offline copies cannot prove their configured origin. Record that assertion in the manifest and update the operator guide and coverage.
Co-authored-by: Codex <codex@openai.com>
(cherry picked from commit 03584a61882f78ca7dc2bd44cfded7f5f760b6f2)
fix(input): recreate owned VHF controllers after device removal
(cherry picked from commit c47af5089f90e627874f108734b75624b1cf1a8d)
fix(input): replay latest held state during VHF recovery
(cherry picked from commit 0714538f9c3e060a71eab77d40af1d12f50e97c8)
fix(input): retain battery state across VHF reconstruction
(cherry picked from commit 7246ef9d690c2918ca041721e34177bd735a9de9)
fix(input): preserve partial battery semantics across VHF recovery
(cherry picked from commit 688ce26d1872125a1ebadf966b6defb996b3947e)
fix(release): pin reviewed upstream snapshot for manual Pollo nightly
A source master advance after exact migration must not silently change the candidate or block a reviewed pair whose source nightly tag is already reserved. Let manual runs name that immutable upstream tag, verify its full SHA against the exact source/target confirmation, and retain live-master validation for schedules.
Co-authored-by: Codex <codex@openai.com>
ci: Build nightly prereleases from the canary branch
Allow contributors to share changes through canary while master remains the stable review lane. Resolve and pin the confirmed remote canary tip, retain workflow parity and qualification checks, and include canary pull requests in CI.
Vibepollo adaptation: use its 06:32 UTC schedule and accept independent
canary contributions without a primary migration pin. Preserve the reviewed
master migration gate and its exact reserved-upstream-tag support.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 1318b146a89f3450ac31ef1ba663314b26fe172e)
feat(windows): Enable RTX HDR for PyroWave streams
Run the existing NGX TrueHDR converter before PyroWave colour conversion,
with live tuning, peak compensation and neutral fallback during initialization.
Copy capture into a private texture before releasing its keyed mutex so NGX
cannot hold up capture. Cover shader variants and native GPU conversion paths.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit cae5f2b7fc9b30eb13563d8052b5a947e840b258)
test(display): Cover pending restore after terminal removal
Align the terminal composition fixture with the merged idle shutdown policy.
Require clean idle shutdown to avoid topology reapply, and retain the failure
check for a removed display that still has pending physical restore work.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit bd5e9c61964670dd255434c5f5e691f1233e67aa)
perf(pyrowave): Keep Linux TrueHDR synchronization on the GPU
Replace intermediate CPU fence and CUDA stream waits with an external
timeline semaphore, retaining the synchronous compatibility path and explicit
GPU ownership transfers. Reuse unchanged cursor and gamma textures.
Add a complete 4K HDR 4:4:4 benchmark and exercise both synchronization paths
against independent native TrueHDR output.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit fc979c3a8c9c604c469656c6fb2a27d2ce90b2a8)
fix(linux): Keep TrueHDR CUDA dispatch layouts consistent
FFmpeg bundled headers overrode the pinned SDK in the TrueHDR library,
so native HEVC HDR initialization called unrelated CUDA entry points and
could segfault during cleanup. Apply pinned-header precedence after the
bulk include paths and verify layouts using production compiler commands.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 00846208e8f55c3c00442a5e5383ea7fd870e019)
fix(ci): Validate portable ZIP with Windows host Python
MSYS2 did not expose Python after package_portable completed. Run the existing ZIP validator in PowerShell so package checks remain required before artifact upload.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 3df296b95811b05e2f5a308ea00634e8f77e61f4)
fix(release): Verify downstream migration against source canary
Vibeshine nightly development now advances on canary while Vibepollo remains on master. Require the scheduled downstream release to match the exact reviewed canary SHA, retaining the immutable-tag override for an explicit manual run.
Co-authored-by: Codex <noreply@openai.com>
fix(vaapi): fall back to CPU upload for safe linear DMA-BUF imports
Keep direct GPU import first and preserve exporter dimensions, pitch and offsets.
Use the existing CPU upload only when its layout policy allows it, as other
Linux capture paths already do. Exercise success/failure and layout guards in
behavioral component tests. AMD GPU runtime and odd-height encoding remain
unverified; this does not replace the existing driver row-alignment fix.
(cherry picked from commit 94d790459af0a3bdfe0aa7615a4a010bcb6abcf9)
fix(ci): Give PR package builds a valid version
PR checks previously passed 0.0.0 into CMake, so native validation failed before compiling even though production rightly rejects that version. Derive a commit-bound validation prerelease from the latest merged stable tag and keep the zero-version safety gate intact.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit be41524b0c4a91a2fa9241b2bec4ac3d5dc36049)
fix(linux): Pass explicit empty environment to HDR focus broker
The RTX HDR foreground call still used the old exec_user_service signature, stopping Arch packaging at compilation. Supply the same empty stream environment used by the other focus operations while preserving supervised execution.
Co-authored-by: Codex <noreply@openai.com>
fix(ci): Keep PR validation installers below stable
Use the current stable numeric base for commit-bound PR prereleases so validation packages cannot supersede the corresponding stable MSI. Keep candidate versions inside the supported WiX patch range.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit a6ae1ad9b1978334cb14c783e24da405cc0993e6)
Revert "fix(ci): Keep PR validation installers below stable"
This reverts commit c9a9727f3bd7ba3bab72a2f59bc82b7ba582a1f2.
Revert "fix(ci): Give PR package builds a valid version"
This reverts commit 5dadb6b51ed4bf65c4c27f87e81072f291d564a9.
fix(windows): load Winsock headers before Windows SDK
MinGW rejects pyrowave_encode.cpp when D3D headers include windows.h before winsock2.h. Put winsock2.h first so the native release build can compile with warnings treated as errors.
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 08027aed9a694669dded35ef890fe5c087b46884)
docs: explain HTTPS-only Web UI access on LAN
(cherry picked from commit 895c392930783fab11e5c8a9256ff8b1663b4848)
test(linux): match supervised focus execution signature
The production session broker now passes an explicit empty stream environment to exec_user_service. Keep the extracted RTX HDR foreground test aligned with that call and assert it does not add environment entries.
Co-authored-by: Codex <noreply@openai.com>