Merge pull request #31 from The412Banner/docs/progress-log-0924

Progress log: 2026-09-24

docs/progress-log.md

@@ -7,6 +7,77 @@ the timeline, then lessons and backlog. Companion to the README (what the app *d
 
 ---
 
+## 2026-09-24 (afternoon) - main `94f9935`: PS1, controller focus, own signing key, CI hardening
+
+State: **main = `94f9935`** (PR #41 merge), main build run 36036219740 - the first one signed with
+DroidDeck's own key (`droiddeck-signed-standard`). No tag, no release since 0.1.6. Device-tested on
+the AYANEO Pocket FIT unless marked. **main is now protected** (below).
+
+- **PR #34 → `63d7051`, PR #38 → `c7998a8`** (`feat/duckstation`, `feat/duckstation-play`) - PS1 and the front end:
+  - **DuckStation like ARMSX2**: Player 1 on the controller, BIOS from `ROMs/psx/bios`, `psx` as the game
+    list, Vulkan, guide → pause menu, `-batch -bigpicture -fullscreen` from the rail. Crash Bandicoot and
+    Tekken 3 at 60 fps from the desktop and from the front end.
+  - **One tap to play**: DuckStation's and ARMSX2's first-time setup is answered for the user
+    (`SetupWizardIncomplete = false`); ARMSX2 names its BIOS dump itself (`[Filenames] BIOS`, a US dump
+    first, re-checked before every launch) - PCSX2 needs a named file, DuckStation finds one in its folder.
+    DuckStation no longer warns it cannot inhibit a screensaver (no `org.freedesktop.ScreenSaver` here).
+  - **One tile per disc**: a `.cue`/`.gdi`/`.m3u` hides the files it names (Tekken 3 showed 4×, one per
+    `(Track N).bin`); `bios`/`firmware` folders are skipped (the BIOS showed as a game).
+  - **Controller focus**: the rail item is outlined on open (an app starts in touch mode, where clickables
+    refuse focus - the app now asks for keyboard mode first); Right enters a page on its main button,
+    Left from the page's edge returns to the rail, Right again returns to the tile or button last used
+    (explicit tracking - `FocusRequester.saveFocusedChild` restored into the grid, not the tile); a page
+    opened from a tile takes focus on its main button (focus used to vanish with the tile and the next
+    press landed on Steam); Down from a page's buttons goes to the first tile.
+- **PR #41 → `94f9935`** (`feat/release-signing`) - signing, file access, hardening before going public:
+  - **Own signing key** (RSA 4096, made on device by `tools/release/make-release-key.sh`, digest
+    `b241ea7d…5d3f0` in `keystore/release-signer.sha256`). Every build before it - 0.1.6 included - was
+    signed with the public AOSP testkey, so anyone could sign an "update" that installs over DroidDeck.
+  - **Hand-over** (APK Signature Scheme v3 rotation): v1/v2 by the testkey, v3 by our key with a lineage
+    testkey → ours, testkey rollback off, `--rotation-min-sdk-version 28`. Proven on the FIT with a throwaway
+    key and package: a 0.1.6-style install updates and keeps its data; an apk signed with the testkey alone
+    is refused; so is one with an attacker's own lineage from the testkey; an apk signed with our key alone
+    (what MT Manager / APK Tool M make) installs over a hand-over install and fresh, not over a testkey one.
+  - **CI**: `sign.yml` (reusable, a matrix job per package) runs after every non-pull-request build
+    (environment `signing-main` on main, `signing-branch` elsewhere; the key is an environment secret).
+    `release.yml` (dispatch, version) signs the exact Build APK artifact of a main commit as four packages:
+    `com.droiddeck.launcher`, `com.tencent.ig`, `com.antutu.benchmark.full`, `com.ludashi.benchmark`
+    (`tools/release/variants.txt`; the manifest rename also covers `.documents` and the `.home` task affinity).
+  - **Documents provider** (`files/AppFilesProvider.kt`): the app's data folder in Android's file picker
+    ("Open from" → DroidDeck, per-package title), confined to the data folder (a `../` id is refused, links
+    out of it are hidden), and deleting never follows a link.
+  - **Hardening**: pull requests build with `pull_request`, not `pull_request_target` (a pull request could
+    write the caches main's signed builds restore); a build fails if a private key file is committed;
+    `.gitignore` covers key files; **main is protected** - pull request + passing `build` + one approval,
+    no force-push or deletion, the owner can override for his own pull requests. History scanned before
+    going public: no secrets.
+  - Max and Kurt get the key (jks, p12, pk8 + x509.pem, lineage) with a password and three plain guides
+    (MT Manager / APK Tool M signing, the hand-over, how pull requests / test builds / releases work).
+- **Also merged today** (Kurt): #20 Back shortcuts (session menu, Steam QAM), #24 build identity on the
+  launcher, #33 per-launch Android display choice, #35 CI build-cleanliness snapshot, #37 the split-D logo,
+  #40 faster held-stick navigation in the session drawer; (The412Banner) #32 stretch games to fill the
+  screen, Quake-engine titles windowed at the session's size.
+
+## 2026-09-24 - main `08a6769`: GPU desktop, emulators like PS3, ARMSX2, game art
+
+State: **main = `08a6769`** (PR #29 merge), main build run 35983098806, staged as `Download/DroidDeck-main-08a6769(-Genshin).apk`. No tag, no release since 0.1.6. **Device-tested on the AYANEO Pocket FIT** (Adreno 750) unless marked.
+
+- **PR #25 → `f6f7470`** (`feat/desktop-gpu`) - the desktop on the GPU:
+  - **Patched wlroots** (`tools/wlroots`, release `wlroots-0.20.2-p1`, staged at `/usr/local/lib/droiddeck-wlroots`): a Vulkan DMA-BUF allocator for the KGSL stand-in node, which is not a DRM device - stock wlroots failed at `drmModeCreateLease` → "unable to create allocator"; linux-dmabuf skips its GEM import check on such a node. labwc's **vulkan** and **gles2** renderers start; **vulkan is the default**.
+  - Compositor: a toplevel's **initial commit is answered with a configure** (labwc on vulkan waited for ever - wlroots moves its toplevel to a private queue after that commit); **`xdg_positioner` / `xdg_popup` / `wl_output` requests no longer abort** the app (NULL implementations; a gamescope beside labwc took the app down); without a Wine desktop a new window takes the keys.
+  - Fallback: labwc that exits or does not answer its socket within 20 s → pixman, remembered per renderer + wlroots md5 + driver (`~/.droiddeck-renderer-failed`, cleared by choosing a renderer). On pixman, Game/Emulator menu entries run through `droiddeck-gpu` (their own gamescope on wayland-0).
+  - Emulators: the pad is a plain Xbox 360 controller outside Steam (SDL ignores Steam's virtual gamepad outside Steam); `bannerlator-pad-defaults` seeds Player 1 per emulator (source-verified formats) and never overwrites a user's profile; big-core pinning (`program_cores`, game cores when chosen); rail programs use the desktop's Linux driver (one shader cache); RPCS3 moved once to `Async Recompiler (multi-threaded)` (no 6650-variant interpreter precompile each boot).
+  - **PC keyboard** (drawer: Keyboard [Hardware] [Android]): Esc, F1-F12, editing block, modifiers (sticky), arrows; real evdev key presses; 47% of the screen.
+  - Proven: Vulkan and gles2 desktops, Firefox on Vulkan, RPCS3 God of War II HD in a window and from the rail (pad bound, no precompile, cores 2-7), pixman fallback path, Steam session.
+- **PR #26 → `6980428`** (`feat/armsx2`) - **PS2 is ARMSX2** (PCSX2 fork with ARM64 recompilers, GPL-3.0). Upstream PCSX2 only has `pcsx2/arm64/RecStubs.cpp`: NFS Underground 2 ran at 17 fps with one core at 100%; ARMSX2 runs it at **59.9 fps / 100%**, all recompilers + fastmem on under proot. PCSX2 left the front end and the catalog.
+- **PR #29 → `08a6769`** (`feat/armsx2-polish`):
+  - ARMSX2 from the rail: `-batch -bigpicture -fullscreen`; guide → pause menu → Close Game returns to the app. First run: PCSX2 settings + memory cards copied once; a new player gets ARMSX2's setup with the BIOS folder in `ROMs/ps2/bios` (or `ps2/firmware`), `ps2` as game list, Vulkan, controller on Player 1. Users bring their own BIOS and games.
+  - Catalog `pages` - a file per memory page size; ARMSX2 4K + 16K.
+  - On-screen controls: Auto for rail games and Steam when no controller, off on the desktop; setting in the drawer everywhere; drawer headed by the emulator for rail games.
+  - Front end: Back/B steps back a level (emulator → Desktop, game → emulator) instead of leaving the app; games found up to 3 folders deep (`ps2/games/<game>/`); **box art** (libretro-thumbnails by name exact/loose, xlenore/ps2-covers by PS2 serial, GameTDB by GC/Wii ID, PS3 discs' own `ICON0.PNG`), kept in `files/covers`; wide art shown whole over a blurred copy; titles without dump tags.
+- **winlator-contents** (the catalog): ARMSX2 `nightly-20260923-92aa2174da` mirrored (`armsx2.AppImage` 4K, `armsx2-16k.AppImage`), PCSX2 dropped from `desktop.json` (PRs #12, #13); the mirror workflow lists only the file being added (a re-run re-fetches and clobbers every listed file, and DuckStation's upstream link moves).
+- **Not yet device-played**: DuckStation, Dolphin, Cemu, melonDS, PPSSPP, RetroArch (profiles + covers written from their sources). Known gap: a keyboard's Esc does not open ARMSX2's pause menu in a rail game (guide does).
+
 ## 2026-09-23 (evening) - renamed SteamDeck → DroidDeck
 
 - **App name, app ID and code package**: DroidDeck, `com.droiddeck.launcher` (was `com.steamdeck.launcher`), sources under `app/src/main/java/com/droiddeck/launcher`, the 68 JNI functions renamed with them. A new app ID means DroidDeck installs **beside** SteamDeck, not over it: the runtime, the Steam sign-in and the settings start fresh.
@@ -191,8 +262,36 @@ State: **main = `90c7574`** (PR #14 merge), main build run 35895701784. No tag,
 - Bannerlator's File Manager ports mechanically (`port_fm.py` anchors) once the container hooks
   are cut; do not hand-edit 2,500 lines.
 - Deleting a release asset on GitHub can drop a sibling asset - re-list and restore.
+- A resource without an implementation makes libwayland abort on its first request - every
+  interface the compositor hands out needs one, even as no-ops (positioner, popup, output).
+- The KGSL stand-in answers no DRM ioctl: `drmIsMaster()` reads that as "master"; check
+  `drmGetVersion()` before treating a GPU fd as DRM.
+- Verify an emulator's config values from its source: RPCS3's GUI says "Async Shader Recompiler",
+  the config value is "Async Recompiler (multi-threaded)".
+- Upstream PCSX2 has no ARM64 recompiler; a correct ARM64 build of it is still interpreter-slow.
+- An Android app starts in touch mode, where Compose clickables refuse focus: `requestFocus()` on open
+  does nothing until the app asks for keyboard input mode.
+- `grep -q` (or `head`) at the end of a pipe exits early; under `pipefail` that fails the whole line at
+  random. Capture the output first, then search it.
+- A reusable workflow gets no more permission than its caller gives, and sees environment secrets only
+  with `secrets: inherit`. A workflow naming an environment that does not exist creates it unprotected.
+- `pull_request_target` shares main's caches with the pull request's code - never with signed builds.
+- apksigner prints signers as "Signer #1", "Signer (minSdkVersion=…)" or "V3.0 Signer:" by version.
 
 ## Backlog / next
+- Play-test the other emulators one by one on the FIT: Dolphin, Cemu, melonDS, PPSSPP, RetroArch
+  (pad profiles and covers exist; nothing played yet). DuckStation done 2026-09-24.
+- **Kurt's PR #39 (Non-Launcher flavor) breaks signing as written**: it replaces the `droiddeck-apk`
+  artifact with `droiddeck-home-apk` / `droiddeck-non-launcher-apk`, which `sign.yml` and `release.yml`
+  read, and it conflicts with today's `build.yml`. Adapt before merging: sign both editions (a release
+  would then be editions × packages).
+- After the repo is public: add a required reviewer to the `release` environment (not allowed on a
+  private repo on the Pro plan).
+- First release with the new key (0.1.7): run `release.yml`, publish; 0.1.6 users move over by the
+  hand-over.
+- Keyboard Esc in a rail game does not reach ARMSX2's pause menu (guide does).
+- 0.1.7 pre-release when ready (everything above is on main only).
+- Pin a newer ARMSX2 nightly only after testing it (it changes daily).
 - Device-prove 0.1.4 on the FIT (list above).
 - Thor Pro: trackpad tap; the 1–2 min in-game crash once a `crash.log` arrives.
 - Xfce as a second desktop shell (Max's branch runs XFCE 4.20 on labwc) - a catalog package + a
@@ -202,4 +301,4 @@ State: **main = `90c7574`** (PR #14 merge), main build run 35895701784. No tag,
   actions. Device confirmation is still needed.
 - FlatOut shrink: try `vk_wsi_force_swapchain_to_current_extent=false` via `steamdeck-env`.
 - Max's stricter `winnative-directaudio` guards; `winnative-epic-launch` (a feature).
-- Rename before anything truly public: "SteamDeck" is Valve's mark.
+- Rename before anything truly public: "SteamDeck" is Valve's mark. (Done 2026-09-23: DroidDeck.)