M2 (#38): wire the controller proxy — seamless reconnect build

[aradanmn]

Turns the reconnect design (docs/DESIGN-38-RECONNECT-WIRING.md, decisions locked) into a buildable sequence. Lights up the DARK controller_proxy module so a dropped wireless pad re-attaches to its running instance.

Why this is the right approach (settled this session)

• Node-stability tested on-Deck (docs(#38): record node-stability test result (Steam's virtual isn't usable) #141): Steam's own virtual is destroyed when the pad dies → binding it is dead on reconnect, same as raw-binding (Instance sandboxes leak other players' input nodes and go stale on re-enumeration — isolation is app-layer only (probable #61 mechanism) #62). A virtual we hold open (evsieve) is genuinely required, not reinvention.
• Identity = MAC — device-agnostic, unique per BT pad (DS4 + Xbox); the "shared-MAC" worry was a UHID misread. No Steam dependency for identity.
• #38 D2 blocker: evsieve dies ~2min after BT battery-death reopen — 'capabilities of the reconnected device are different than expected' #112 root cause known — evsieve was grabbing the touchpad after the node-number shuffle; fix = target the js-owner node.
• Decisions locked — grace 180s; identity follows the pad on ADOPT; proxy-off = no-op; REJECT-when-full logs only (README documents the 4p cap, done in docs(readme): note the 4-player limit is a hard cap #140).

Build sequence (each PR gated; raw-binding never regresses)

PR-a — slot_manager.sh (behavior-neutral, flag off)

• New module: slot record schema (phys_uniq/vendor/product/event_node, disconnected, disconnected_at)
• GET: slot_by_uniq, slot_by_event_node, free_slot, most_recent_abandoned_within, slot_is_active/disconnected
• SET: slot_claim → SPAWN|RESUME|ADOPT|REJECT (full policy, but only SPAWN reachable while flag off)
• RELEASE: slot_release (CONTROLLER_REMOVE → mark abandoned+ts), slot_free (SLOT_DIED)
• Consolidate the scattered helpers (_find_free_slot, update_slot_state, slot_is_active, _find_slot_by_event_node)
• Unit-test decision matrix (design §12) — hardware-free
• Register in CI baseline
• Gate: CI green; existing behavior identical (flag off)

PR-b — proxy launch wiring (behind MCSS_PROXY_ENABLE, default off)

• On SPAWN + flag on: proxy_start_slot → bind the virt node into bwrap instead of the raw js
• Record identity fields via slot_reserve
• js-owner re-verify (design §7 belt-and-suspenders)
• Gate: flag-off raw binding unchanged; flag-on launches + binds virt (on-Deck smoke)

PR-c — reconnect policy live

• CONTROLLER_ADD → slot_claim → execute outcome
• RESUME = proxy_repoint_slot; ADOPT = proxy_restart (device-id changes); grace 180s
• REJECT = log only
• Gate: handler unit tests; on-Deck single-pad drop→reconnect rejoins same slot (flag on)

PR-d — watchdog supervision + on-Deck verify → flip default

• Fold evsieve liveness supervision into watchdog.sh (restart on death of a present-controller slot)
• On-Deck #38 D2 blocker: evsieve dies ~2min after BT battery-death reopen — 'capabilities of the reconnected device are different than expected' #112 verify: does evsieve persist=reopen honor a moved symlink (seamless) or need restart (sub-second blip)? (design §9)
• Confirm js-node targeting eliminates the #38 D2 blocker: evsieve dies ~2min after BT battery-death reopen — 'capabilities of the reconnected device are different than expected' #112 caps-death
• Q4 verify: evsieve grab vs Steam guide button/overlay
• Flip MCSS_PROXY_ENABLE default ON
• Gate: full HW validation — 4-pad drop/reconnect ×N, no evsieve death, guide button works, isolation intact

Tracking

Design: docs/DESIGN-38-RECONNECT-WIRING.md · Blocks/absorbs: #112 · Milestone headline: #38