Retire stale session callbacks and require usable input before ready - #8
Merged
jmonster merged 1 commit intoSep 10, 2026
Conversation
…ut for readiness Guard late notifications, queued commands and timers after session retirement. Clear notify completion before invocation to preserve reentrant replacement. Require isNotifying on essential channels and one existing-decoder input report before readiness, retaining the established keep-alive and handshake bytes. Eleven synthetic production-session tests pass locally; five new targeted cases fail against the prior session source. Full Apple-framework build and regressions remain the hosted gate. No new connection deadline or protocol.
jmonster
marked this pull request as ready for review
September 9, 2026 23:47
jmonster
merged commit Sep 10, 2026
5b9ccaf
into
fix/session-command-and-model-guards
1 check passed
jmonster
added a commit
that referenced
this pull request
Sep 10, 2026
…ting (#3) * fix(session): preserve command correlation and respect model capabilities * fix(session): retire callbacks before teardown and require usable input for readiness (#8) Guard late notifications, queued commands and timers after session retirement. Clear notify completion before invocation to preserve reentrant replacement. Require isNotifying on essential channels and one existing-decoder input report before readiness, retaining the established keep-alive and handshake bytes. Eleven synthetic production-session tests pass locally; five new targeted cases fail against the prior session source. Full Apple-framework build and regressions remain the hosted gate. No new connection deadline or protocol.
jmonster
added a commit
that referenced
this pull request
Sep 10, 2026
* test: add protocol fixtures and read-only macOS app build checks * test: run isolated regression groups alongside protocol fixtures * Adopt the browser bridge with replay, lifecycle, and access guards (#5) * feat(browser): stage attributed browser bridge for guarded integration Adapted from Andrei-Kondrykau/switch2mac browser-bridge at 24b0cd3 (upstream PR #2). Keep the output sink unregistered until access and lifecycle guards are added. Retain the contributor's source and documentation, with our read-only checks. * fix(browser): guard replay, rumble ownership, and opt-in WebSocket access Preserve complete connection/state replay after rename and reject obsolete socket callbacks. Keep long effects alive only for their requested lifetime, settle cancelled effects, and reject retired actuators. Eight deterministic Node regressions cover these behaviors (seven fail on the imported source). Add an opt-in settings window, exact extension-Origin checks, bounded clients and messages, and per-client rumble ownership. GameCube HD rumble is withheld using the existing model capability. Origin checks are not native-process authentication. Exercise the actual Network.framework listener in macOS CI. Adapted browser feature retains attribution to Andrei-Kondrykau's upstream browser-bridge at 24b0cd3. * fix(browser): distinguish validated rumble values from clamped magnitudes * docs(browser): document fork opt-in setup and actual compatibility limits * fix(browser): preserve bridged controllers when native gamepads hotplug Move only a conflicting virtual index and announce the old/new indices, without mutating prior snapshots or hiding the native device. A regression fails against the previous shim and all nine Node cases pass after repair. * Adopt optional RetroArch network output with input-delivery regressions (#6) * feat(retroarch): import the optional network gamepad sink for regression validation Adapted from vialoh/switch2mac retroarch-network-gamepad at 2c7a396 (upstream PR #1). Retain the contributor's opt-in default and attribution; validate actual Swift builds and repair edge/lifecycle behavior before marking ready. * fix(retroarch): preserve edges, refresh releases and retire old destinations Retain the attributed optional fork output and existing remote_message bytes. Replace latest-only button state with a bounded edge queue; overflow explicitly neutralizes this output until disable/re-enable. Include zeros in periodic refreshes and clear the old port before switching destinations. Reject nonfinite axes and remove the imported Array safe-subscript compile failure. Eight synthetic/real-loopback cases pass locally; the tap, release refresh, destination, overflow and finite-axis cases fail against the imported source. UDP acceptance is not acknowledgement; no physical-gameplay claim is made. * fix(retroarch): resume ordered input after cancelling a destination change A partially completed reset left switchIndex active when the user changed back to the original port. Subsequent button edges were never queued. Reassert the desired state and retire that reset; the new real-loopback regression fails against the previous head and the nine-case suite passes. * fix(fork): isolate app identity and disable upstream automatic updates (#9) Use io.github.jmonster.switch2mac and a distinct bundle name/defaults domain. Keep upstream credits but reject default or saved update feeds and updater entry points until a fork-specific signing/update trust path is established. Require explicit signing identities, notary credentials and fork-matching entitlements instead of silently consuming upstream signing configuration. No certificate, profile, notarization request or release is created here. Add metadata, actual feed-resolver and early signing-refusal regressions and build the actual ad-hoc fork app in the existing read-only macOS check. * Neutralize disconnected UDP controllers and bound subscriber processing (#4) * fix(udp): neutralize disconnected slots and bound subscriber handling * test(udp): synchronize real datagram arrival before subscriber assertions * Fix session response matching, fallback sticks, and GameCube motor gating (#3) * fix(session): preserve command correlation and respect model capabilities * fix(session): retire callbacks before teardown and require usable input for readiness (#8) Guard late notifications, queued commands and timers after session retirement. Clear notify completion before invocation to preserve reentrant replacement. Require isNotifying on essential channels and one existing-decoder input report before readiness, retaining the established keep-alive and handshake bytes. Eleven synthetic production-session tests pass locally; five new targeted cases fail against the prior session source. Full Apple-framework build and regressions remain the hosted gate. No new connection deadline or protocol.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ready for review — session-local retirement and readiness, depends on #3
Head
dbe8b154797b84afd9533e78279d20aab48efb4f. Exact-head macOS tests and actual app build passed.Teardown becomes terminal before pending notification completions, handshake work, callbacks and timers are cleared. Late session input and queued commands/rumble/audio work cannot revive that retired session. Essential notifications require isNotifying, and notification completions are cleared before invocation so reentrant replacement work is not erased.
Readiness requires both the existing handshake and an input report accepted by the unchanged decoder. Keep-alives still start at handshake completion. Early valid input is retained/delivered when readiness is announced, exactly once and before usable input is routed to sinks.
Eleven production-session cases pass with fake CoreBluetooth boundaries; the new failure cases were checked against the preceding #3 source. The full app is separately built with real Apple frameworks and its ad-hoc bundle verified. The same production file and tests passed again in the combined nine-PR macOS run.
No new timeout, report-length requirement, GATT identifier, pairing/encryption setting or controller command byte is introduced. False-ready behavior deliberately changes. This is session-local protection: engine-level slot/replacement ownership is a distinct boundary and is not represented as fully resolved here. Physical firmware/keep-alive acceptance remains unperformed.
Merge #1, then #3; retarget here to main and recheck. No merge or release performed.