Five confirmed findings from the 2026-06-22 adversarial bug sweep:
- S-01: clamp PipeWire capture chunk size to the mapped slice before
indexing, so a bad reported size can't panic (= process abort) from
the RT capture callback. Extracted testable for_each_capture_sample.
- F-04: reserve ring occupancy before publishing a frame on the PipeWire
playback path (mirrors the cpal fix), preventing the RT consumer from
popping an uncounted sample and wrapping fill_gauge to usize::MAX,
which permanently wedged mixer pacing. Extracted publish_frame.
- F-09: GameDetector::spawn now returns io::Result and retains its
JoinHandle (joined on Drop); core fuses a closed watch receiver to
None via next_game_change so a dead detector can't busy-loop select!.
- F-08: collision-free recording paths — Recorder::create and the
multitrack session dir use create_new/create_dir with bounded suffix
retry, so two recordings in the same second no longer truncate the
first.
- S-02: bound the Windows SteamPath registry read (<=4 KiB, even length,
re-checked type/returned length) before allocating/decoding.
403 lib tests pass (+6), clippy --all-targets clean. Implemented by
Codex, reviewed + gates re-run by senior.
Co-Authored-By: Codex <codex@openai.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Field test found Steam games were never detected on Linux. Root cause:
Steam rewrites ~/.steam/registry.vdf only on SHUTDOWN, so its RunningAppID
is stale (often absent) while a game is actually running — polling it can
never see the live game.
Fix: on Linux, read the live appid from the running game's environment
(SteamAppId in /proc/<pid>/environ, the var Steam exports to every game
process — the same signal MangoHud uses; readable for our own processes).
registry.vdf stays as a best-effort fallback. Windows still reads the real
registry's RunningAppID, which IS updated live there. Other Unix keeps the
registry.vdf fallback.
Pure parse_steam_app_id_from_environ() is unit-tested (nonzero filter,
absent, substring-not-fooled, garbage). Also fixes a latent bug in the
first draft where a single non-UTF8 SteamAppId value would abort the whole
scan via ? instead of skipping.
396 lib tests, clippy --all-targets clean.
Step 4 of game detection. One std-thread worker owns the SteamProbe cache
+ Debouncer across ticks, polls the OS adapters every 3s off the async
runtime, and publishes the stable detected game on a tokio watch channel
only when it changes. Manual override + process map are live-updatable via
shared handles; a cancellable sleep honors stop promptly; drop stops it.
The per-tick decision (match + resolve + debounce) is the pure poll_once,
unit-tested with synthetic Steam/process inputs (debounce, process-only
match, immediate manual override). +4 tests (397 lib).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Step 2-3 of game detection (game-presence-plan.md). The OS edges feeding
the pure seams from the previous commit.
- src/game/steam.rs: SteamProbe — reads the live RunningAppID and resolves
it to a name via appmanifest_<id>.acf (no binary appinfo.vdf). Pure parse
fns (parse_running_app_id / parse_library_paths / parse_app_name) over
file contents are unit-tested incl. current+legacy libraryfolders shapes,
escaped Windows paths, empty/missing names, and garbage. Roots discovered
across native/Flatpak/Snap (Linux) and the registry (Windows); libraries
and resolved names cached + mtime-invalidated so the 3s poll doesn't
rescan. File reads byte-capped.
- src/game/scan.rs: native running-process enumeration — /proc (exe symlink,
comm fallback) on Linux, Toolhelp on Windows — feeding the pure
match_processes. No sysinfo dep (D7).
- Cargo.toml: windows-sys as a direct Windows-only dep for the registry +
Toolhelp FFI. No NEW crate — it was already in the lockfile transitively
via cpal/rfd, so the audit surface is unchanged.
391 lib tests (+5). Linux: build + clippy --all-targets clean. Windows FFI
signatures verified against windows-sys 0.61 source (one *const vs *mut
lpReserved fixed) but NOT yet cross-compiled — defer to the post-UI Windows
build cycle.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Step 1 of the game-detection feature (game-presence-plan.md): all the
pure, I/O-free logic, tested first.
- src/game/mod.rs: DetectedGame + stable namespaced ids (steam:730 /
exe:hl2_linux, never the mutable name); ManualOverride; the priority
resolve() matcher (override -> Steam -> mapped process -> none); the
Debouncer (2-on/3-off, immediate bypass for manual override) that
stops a flapping detector re-announcing the ~48KB-avatar PeerState;
match_processes() over explicit user mappings with a launcher denylist
(never guesses a game from an arbitrary process).
- src/game/vdf.rs: a real recursive-descent KeyValues/VDF parser (not a
name-regex) for appmanifest/.acf, libraryfolders.vdf, registry.vdf —
depth-capped, escape-aware, never panics on malformed/truncated input.
- src/sanitize.rs: sanitize_game_label (64-char/256-byte cap, wider than
the 48-char name cap) sharing the bidi/zero-width cleaning.
- src/config.rs: additive game_presence_enabled (opt-in, default OFF),
game_backgrounds + game_process_map (BTreeMap, deterministic);
background_path generalized to hashed per-game files; explicit
legacy-config migration test (load() wipes on any deserialize error).
- src/background.rs: game_background_filename (FNV-1a hashed, fs-safe).
No wire/protocol change yet; no OS reads yet. 386 lib tests (+28).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
