DS Netplay adapter: connect native Linux melonDS to GameParty and secure peer transport #165

Parent: #162. Depends on #163 Linux core, #164 safe mirror-state boundary, and the actual implemented capabilities of #106.

Goal

Connect a pinned TrainerOS-managed DS netplay runtime to the existing RuntimeMultiplayer/GameParty flows. A user invites friends the same way as for PPSSPP/Dolphin/RetroArch; do not create a melonDS-specific social lobby, second friends list or manual network setup screen.

Adapter contract

• Add a dedicated DS Local Wireless capability to the current runtime dispatch, not RetroArchNetplay fallback and not WFC/internet-service emulation.
• Expose verified exact game revision/content match, Linux melonDS build/core hash, deterministic-protocol version, BIOS/firmware compatibility status, JIT/profile constraints, usable slot count and actual ready-to-start state.
• Start with 2-player sessions; 3–4 only if runtime/device performance and game-specific multiplayer behavior are explicitly verified (DS Netplay QA: prove two-handheld wireless gameplay, desync recovery and 3–4-player budgets #166). Do not infer support merely from the fork's kMaxPlayers=4.
• Invite → accept → select one intended device endpoint → resolve local content → validate session prerequisites → negotiate peer/relay route → initialize mirrors → report Ready → Start → return on exit.
• Existing people-first invites (Multiplayer UX: replace transport-first invites with one people-first Play Together flow #131) and shared party roster/readiness UI (Multiplayer UX: consolidate roster, readiness, start, access and rejoin into one party surface #132) stay authoritative. The game overlay, optional voice call and independent chat lifecycle remain available as currently supported.

Secure connectivity

• Reuse Shared transport: add authenticated native P2P and relay for system Link or runtime multiplayer #106 authenticated, accepted-session transport route and its real direct/authorized-relay choices. Raw ENet datagrams alone do not provide user authentication, encryption, NAT traversal or a private relay.
• Translate the emulator's bounded control/input traffic into the selected delivery semantics without sending gameplay frames through ordinary Fluxer chat.
• Bind every endpoint to session ID, player index, Trainer, game/content identity and runtime profile; only authenticated invited peers may join. Reject stale/replayed packets and peers after leave.
• Handle ping/jitter estimates, host-selected input delay, input buffer capacity, loss/reorder/disconnect, resync/rejection and network switching as explicit states rather than silent half-speed play.
• Don't tunnel a virtual Ethernet/LAN for DS solely out of habit; DS deterministic mirrored-consoles netplay is distinct from ordinary game IP LAN networking.

Native launch and save integration

• Use registered TrainerOS-managed Linux melonDS executable and narrowly allowlisted argument/control API. Remote invites cannot inject shell commands, arbitrary paths or emulator settings.
• Preserve existing normal DS file paths, Trainer-owned save authority (Trainer saves: isolate ordinary saves across officially supported runtimes #76), launch/return (Launch lifecycle: keep ordinary saves and confirm saving only after explicit Exit game #49), ordinary single-player gameplay and other emulator installations.
• Session teardown stops this party's mirror processes/threads and temporary configs only, not independent user software, a current voice call or an unrelated active game.
• Limit generic runtime/config ownership to Runtimes: deploy a TrainerOS-owned emulator stack on SteamOS and Bazzite #121 and release this integration via TrainerOS Software TrainerOS Software: signed cross-distro updater independent of system image #154 (independent of Linux-image OTA).
• A missing exact ROM may use a distinct Multiplayer: provide temporary guest game content across supported platforms #136 authorized temporary session provision path only when available; never silently copy content as a side effect of the DS netplay handshake.

UX acceptance

• A friend can select a supported DS game in TrainerOS, invite another person, and start an actual local-wireless game using only the standard GameParty user journey.
• No extra manual LAN/VPN/IP address/port/BIOS sharing dialogs appear; unsupported requirements are reported accurately.
• Disconnect/reject/host crash and party closure return to a safe normal game/library state without save collision or ghost Ready.
• Controller Home/voice/notification overlays do not break valid game synchronization solely by focus loss.
• The exact same DS runtime/adapter contract can be installed in a prepared TrainerOS image or via SteamOS/Bazzite with Distribution: independent image and TrainerOS software release manifests and ownership #119/TrainerOS Software: signed cross-distro updater independent of system image #154 ownership.
• Native DS/WFC and existing GB/GBA Link/PPSSPP/Dolphin/RetroArch flows remain unaffected.