Add read-only Windows Wireless Adapter doctor (#166 )

Co-authored-by: SAPHID <saphid@users.noreply.github.com>
Add a read-only Linux Wireless Adapter doctor (#165 )
2026-10-24 15:01:37 +02:00 · 2026-10-24 12:44:24 +00:00 · 2026-10-24 12:30:08 +00:00 · 2026-10-24 12:24:04 +00:00 · 2026-10-24 12:18:08 +00:00 · 2026-10-24 12:04:30 +00:00
104 changed files with 7502 additions and 273 deletions
@@ -41,6 +41,10 @@ jobs:
          python -m py_compile $(find frame/devkit-utils -type f ! -name '*.*' ! -name LICENSE) frame/devkit-utils/devkit_utils/*.py
      - name: Server tests
        run: python -m unittest discover -s tests -v
+      - name: Linux Wireless Adapter doctor (read-only PC smoke)
+        run: |
+          python ui/frame_wireless_doctor.py --json > "$RUNNER_TEMP/linux-wireless-doctor.json"
+          python -c 'import json, os; from pathlib import Path; d=json.loads((Path(os.environ["RUNNER_TEMP"]) / "linux-wireless-doctor.json").read_text()); assert d["supported"] and d["selected"] is None and d["schema"] == 1'
      - name: App syntax
        run: node --check app/main.js && node --check app/build/make-icon.js && node --check app/build/fetch-deps.js && node --check app/preload.js && node --check app/install-link.js && node --check app/updater.js
      - name: App tests
@@ -70,6 +74,21 @@ jobs:
      - name: Server tests
        run: python -m unittest discover -s tests -v

+  # Fast, PC-only Windows query validation, without capture libraries or a headset.
+  wireless-windows:
+    runs-on: windows-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+      - name: Wireless doctor fixtures, UI and live read-only Windows inventory
+        run: python -m unittest discover -s tests -p 'test_wireless.py' -v
+
  # The iPhone app: builds for the Simulator and runs its unit tests.
  ios:
    runs-on: macos-latest
@@ -2,6 +2,88 @@

 ## Unreleased

+- Add Windows Tools → Wireless Adapter doctor: an explicit read-only PC snapshot
+  of distinct Wi-Fi Direct PnP instances, presence/link state, PC Wi-Fi and
+  reported channels/bands, with possible 2.4 GHz overlap guidance. Unknowns stay
+  visible; no adapter disable action is offered because an unused instance
+  cannot be identified reliably. No headset access or settings changes.
+  [Sources, verification and limits](docs/windows-wireless-doctor.md).
+
+- Add a Linux PC Wireless Adapter doctor in Settings and Devices, with a source
+  CLI and local JSON report. Select observed hardware without assuming Valve
+  IDs; inspect USB/interface presence, driver/module binding, udev/permissions,
+  rfkill, channel/band and network manager evidence. Missing evidence stays
+  unknown; all checks are read-only and never contact the Frame.
+  [Usage and verification limits](docs/linux-wireless-adapter-doctor.md).
+
+- Add Linux Tools → Steam desktop sharing: request `steam -pipewire` only after
+  checking Steam is not running, or open KDE Application Permissions with
+  instructions to revoke a verified Steam screen-sharing session manually. No
+  automatic permission reset, Steam restart, or headset access. Frame Control
+  Linux capture remains disabled; live portal behavior is unverified.
+  [Usage and limits](docs/steam-pipewire.md).
+
+- Use gamescope's input for the keyboard and trackpad, following the focused
+  headset panel without installing an input service. Start KDE Connect only for
+  accents and emoji, keeping queued text ordered and cancelling it on headset
+  switches. Retain intended-headset checks before starting either control and
+  prevent Unicode helper startup from deadlocking with a headset switch.
+- Keep accepted keyboard text when the Unicode queue is full: reject new batches
+  before sending their clicks or keys, and count in-flight text toward the limit.
+  Retain unsent text after helper failures/timeouts, report the error and resume
+  it with Try again. Clean up failed workers without touching a new headset's queue.
+  [Current verification and device limits](docs/evidence/pad-gamescope-2026-10-24.md).
+
+- Keep media playback running when SteamVR refuses the optional theatre dark
+  surround, including a retry after standby. Log the refusal and play without
+  the surround. Overlay teardown attempts every owned handle and always calls
+  OpenVR shutdown even if a handle fails to close.
+
+- Check the desktop server's single-instance lock before starting background
+  downloads, so a second server exits cleanly with the existing "already
+  running" message.
+
+- Recheck saved spatial layouts on SteamOS 0.5.6 / SteamVR 2.18.2 (issue #31).
+  Read-only probes expose some panel geometry, but safe restoration of
+  Steam/gamescope docking and positions remains unverified. Record exact API
+  results and a reproducible probe; saved layouts remain unavailable.
+
+- Record packaged v0.4.17 Desktop Capture succeeding on a mapped nested KDE
+  compositor on a real Frame with SteamOS 0.5.6. Headset overlay visibility was
+  not established; this is evidence, not a new fix or resolution of issue #73.
+
+- Correct the Return to Game Mode help text: Frame Control selects the switch
+  supported by the headset's SteamOS build, including `steamosctl` on current
+  Frames. The button's behavior is unchanged.
+
+- Distinguish an unreadable gamescope panel list from a confirmed empty list in
+  Desktop Capture and Control (issue #73). Failed discovery now asks users to
+  check SteamVR and report the exact message and SteamOS version, rather than
+  claiming no panel is open. This does not establish a new capture fix.
+
+- Add an opt-in desktop low-battery alert without starting a family session.
+  Existing status reads confirm low charge and drain; recovery hysteresis and a
+  ten-minute cooldown limit repeat alerts. Off on page open/headset switch;
+  pauses with hidden-page status refreshes. No extra polling or headset changes.
+
+- Clarify first-time desktop downloads, installation and opening on the website
+  and README, including CPU choices, unsigned-app warnings, pairing fallback
+  and the source-only iOS build. Keep section navigation available on mobile.
+
+- Treat headset aliases and other CSV metadata as plain text in power and heat
+  exports, so spreadsheet formula prefixes cannot run when a report is opened.
+
+- Add desktop Tools → Power & heat report: bounded read-only one/five-minute
+  observations with progress, stop and HTML/JSON/CSV downloads. Received samples
+  survive stop, disconnect and headset switch, labeled incomplete and tied to the
+  original headset. Shared sampler/report modules ship with the app; no power or
+  thermal controls are added. Download before replacing a report or quitting.
+
+- Fix Return to Game Mode misidentifying full Plasma Desktop Mode when its VR
+  overlay also runs gamescope (issue #142). Session targets now determine the
+  mode; conflicting or incomplete evidence stays unknown. Use SteamOS's
+  `steamosctl` switch when available, with older selector commands retained.
+
 - Export read-only power and heat observations to an offline accessible HTML
  report with JSON/CSV downloads. `--html FILE` limits sessions to ten minutes;
  Ctrl+C saves received samples with an explicit incomplete state. Units,
@@ -7,9 +7,9 @@
 **Manage your Valve Steam Frame from your computer.**<br>
 See what the headset sees, install games and Android apps, move files and text across, and check battery and status, all over SSH.

-[![Latest release](https://img.shields.io/github/v/release/saphid/steam-frame?label=release&color=1a9fff)](https://github.com/saphid/steam-frame/releases/latest)
+[![Latest release](https://img.shields.io/github/v/release/saphid/frame-control?label=release&color=1a9fff)](https://github.com/saphid/frame-control/releases/latest)
 [![Platforms](https://img.shields.io/badge/macOS%20%7C%20Windows%20%7C%20Linux-2a475e?label=runs%20on)](#install)
-[![Checks](https://img.shields.io/github/actions/workflow/status/saphid/steam-frame/checks.yml?branch=main&label=checks)](https://github.com/saphid/steam-frame/actions/workflows/checks.yml)
+[![Checks](https://img.shields.io/github/actions/workflow/status/saphid/frame-control/checks.yml?branch=main&label=checks)](https://github.com/saphid/frame-control/actions/workflows/checks.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-66c0f4)](LICENSE)

 [**Website**](https://frame-control.pages.dev) · [**Download**](#install) · [Trailer](#trailer) · [Features](#features) · [Set up the headset](#set-up-the-headset) · [Feedback](#feedback) · [Docs](#going-further)
@@ -19,7 +19,7 @@ See what the headset sees, install games and Android apps, move files and text a
 <img src="docs/img/frame-control.png" alt="Frame Control's Games tab: installed games, sideloaded titles, and your Steam library with Frame ratings" width="900">

 <a id="trailer"></a>
-<a href="https://github.com/saphid/steam-frame/releases/download/trailer/frame-control-trailer.mp4"><img src="docs/img/trailer.jpg" alt="Watch the Frame Control trailer" width="900"></a>
+<a href="https://github.com/saphid/frame-control/releases/download/trailer/frame-control-trailer.mp4"><img src="docs/img/trailer.jpg" alt="Watch the Frame Control trailer" width="900"></a>

 <sub>The trailer: 66 seconds, with sound. Downloads the MP4 from the trailer release.</sub>

@@ -44,6 +44,9 @@ Live video of what the lenses show, or of the app panel in use, flat and still h
 **🔋 Battery and status**<br>
 Charge, charging watts and time left, storage, memory, temperature, Wi-Fi, and what's running.

+For PC-side USB, driver, radio and network manager evidence, use the
+[Linux Wireless Adapter doctor](docs/linux-wireless-adapter-doctor.md).
+
 For repeatable read-only battery, power-rail, temperature and fan measurements,
 use the [power and heat sampler](docs/power-and-heat.md).

@@ -75,8 +78,8 @@ Drag files onto the window to send them. Drop a game's .zip, folder or .exe to a
 **📸 Screenshots and recordings**<br>
 Browse the shots you take in the headset and save them to your Pictures folder, or have new ones and your Steam clips copied over automatically. Record what the headset shows, with its sound, or export Steam's clips at any length, as .mp4 files in your Videos folder ([not tested on a headset yet](docs/recording.md)).

-**⌨️ Type on the headset**<br>
-Type and point in the Frame's apps from your computer or phone, through KDE Connect, which Frame Control brings along and sets up on the Frame. Copy text to the headset's clipboard and back again. Nothing else to install, anywhere. Press T to open it.
+**⌨️ Keyboard and trackpad**<br>
+Type and point in the headset from your computer or phone, through Valve's own input path, with nothing to install. Accents and emoji use KDE Connect, which Frame Control brings along and sets up the first time you type one. Copy text to the headset's clipboard and back again. Press T to open it.

 </td>
 </tr>
@@ -116,17 +119,30 @@ already ships (sideloading a game copies Valve's own devkit scripts to

 ## Install

+**Install Frame Control on your computer, not on the headset.** The website is
+for downloads and instructions; it does not connect to your Frame in a browser.
+Choose the operating system and processor of the computer you will use.
+
 | | Download | Needs |
 |---|---|---|
-| **macOS** (Apple Silicon) | [Frame-Control-mac-arm64.dmg](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-mac-arm64.dmg) | Nothing extra |
-| **Windows** 10 / 11 (x64) | [Frame-Control-Setup-x64.exe](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-Setup-x64.exe) · [portable .zip](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-win-x64.zip) | Nothing extra |
-| **Linux** (x64) | [AppImage](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-x86_64.AppImage) · [.deb](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-amd64.deb) | `ssh` (most desktops have it) |
-| **Linux** (arm64) | [AppImage](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-arm64.AppImage) · [.deb](https://github.com/saphid/steam-frame/releases/latest/download/Frame-Control-linux-arm64.deb) | `ssh`, and `adb` for Android apps (`sudo apt install adb`) |
+| **macOS** (Apple Silicon) | [Frame-Control-mac-arm64.dmg](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-mac-arm64.dmg) | Nothing extra |
+| **Windows** 10 / 11 (x64) | [Frame-Control-Setup-x64.exe](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-Setup-x64.exe) · [portable .zip](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-win-x64.zip) | OpenSSH Client (normally installed) |
+| **Linux** (x64) | [AppImage](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-x86_64.AppImage) · [.deb](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-amd64.deb) | `ssh` (most desktops have it) |
+| **Linux** (arm64) | [AppImage](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.AppImage) · [.deb](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.deb) | `ssh`, and `adb` for Android apps (`sudo apt install adb`) |

-**iPhone and iPad:** the same features from your phone, with nothing to install on
-a computer. Build it from [`ios/`](ios) in Xcode; see [docs/iphone.md](docs/iphone.md).
+**Which build?** On a Mac, check Apple menu → About This Mac: the download is
+for Apple Silicon (M-series); no Intel Mac build is published. On Windows,
+check Settings → System → About → System type: the release is x64, not a native
+Windows ARM build. On Linux, `uname -m` reports `x86_64` (x64) or `aarch64`
+(arm64). Use `.deb` on Debian/Ubuntu, or AppImage on other distributions.

-The app brings its own Python and `adb`; SSH is built into macOS and Windows.
+**iPhone and iPad:** no App Store, TestFlight or `.ipa` download is provided in
+the current release. It runs from your phone without a computer after setup.
+Build it from [`ios/`](ios) in Xcode on a Mac with your own signing team; see
+[docs/iphone.md](docs/iphone.md).
+
+The app brings its own Python and `adb`. macOS includes SSH; Windows needs the
+OpenSSH Client optional feature (normally installed).
 From 0.4 it updates itself: when a new version is published, a banner offers
 **Update and restart**. It sends anonymous usage statistics, which you can turn
 off. Sharing compatibility results and error details is opt-in. See
@@ -139,7 +155,7 @@ distribution's. If you already have `adb`, the app uses yours.

 There's no paid Apple developer account behind it, so macOS says the app is
 damaged or can't be checked. Drag it to Applications, then clear the download
-quarantine once:
+quarantine once, only for a download you trust from the releases linked above:

 ```sh
 xattr -dr com.apple.quarantine "/Applications/Frame Control.app"
@@ -168,26 +184,44 @@ If it complains about FUSE, install `libfuse2` (Ubuntu 24.04+: `libfuse2t64`),
 or run it with `--appimage-extract-and-run`.
 </details>

+## Open the app
+
+- **macOS:** open the `.dmg`, drag **Frame Control** to **Applications**, then
+  open it from Applications. For the unsigned-app warning, use the macOS steps
+  above. Allow local network access and control of Terminal when prompted.
+- **Windows:** run the installer, then open **Frame Control** from Start. For
+  the portable download, extract the entire `.zip` first and run
+  `Frame Control.exe` inside it. See the SmartScreen note above.
+- **Linux:** install the `.deb` with your package installer and launch
+  **Frame Control** from your applications menu; or make the AppImage executable
+  and run it as described above. Install the OpenSSH client if `ssh` is missing.
+
 ## Set up the headset

-You type one password on the headset, once. Everything else happens on your
-computer.
+Keep the Frame awake and connect it and your computer to the same trusted local
+network. Guest Wi-Fi/client isolation can prevent discovery and connections.

 1. **On the Frame:** Steam Settings → System → **Enable Developer Mode**, then
-   in the Developer section, **Set User Password**. Pick something short:
-   you'll type it once more on your computer and then never again.
-2. **On your computer:** open Frame Control. It offers to **Set Up
-   Connection**, which finds the headset, creates an SSH key, and asks for that
-   password once in a terminal window. If it can't find the Frame, type the
-   IP address from the Frame's Quick Settings.
-
-   Before asking for the password it tries Valve's SteamOS devkit pairing: in
-   the headset, open Steam Settings → Developer → **Pair new host** and approve
-   the request, and no password is needed. (The service and the pairing-mode
-   step are verified on a Frame; the approval itself isn't yet. See
-   [SSH](docs/ssh.md#password-free-pairing-steamos-devkit-service).)
-3. That's it. The app now reaches the headset whenever it's awake and on the
-   same network. For anywhere else, see [Tailscale](docs/tailscale.md).
+   Developer → **Set User Password**. Choose a password that isn't easy to guess:
+   it also protects `sudo` and remote desktop, even after SSH keys are set up.
+2. **On your computer:** open Frame Control and choose **Set Up Connection…**.
+   If you dismissed the first-run prompt, use **Frame → Set Up Connection…**.
+   Setup opens a terminal and tries to find the headset. If it can't, use its IP
+   address from Quick Settings or Steam Settings → Internet. Windows/Linux setup
+   prompts for it; macOS exits instead. On macOS, return to the app →
+   **Devices & connection → + Add a headset…**, set SSH alias to `frame` for
+   the default headset, fill in **Address**, then choose **Set Up…**.
+3. **Pair or enter the password:** setup first tries Valve's devkit pairing.
+   Open Steam Settings → Developer → **Pair new host** in the headset and approve
+   only the request you just started. The service and pairing-mode step are
+   verified on a Frame; approval and key installation through that flow remain
+   unverified. If pairing fails or times out, setup falls back to asking for the
+   Developer Mode password in the computer's terminal. Password typing may show
+   no characters; press Enter when done. See [SSH details](docs/ssh.md#password-free-pairing-steamos-devkit-service).
+4. After setup succeeds, return to Frame Control. It uses SSH keys for later
+   connections whenever the Frame is awake and reachable. If it stays offline,
+   check Developer Mode, the address and network isolation, then run setup again.
+   For connections away from home, see [Tailscale](docs/tailscale.md).

 **What it changes:** only what you click. Installs go to your user account on
 the Frame (`--user` Flatpaks, Lepton instances, Steam downloads, sideloaded
@@ -223,12 +257,14 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Frame Control in detail](docs/frame-control.md) | Every feature, how it works, per-platform notes, building |
 | [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels |
 | [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging |
+| [SteamOS October 2026 compatibility](docs/steamos-2026-10-compat.md) | Frame OS 0.5.6 connection changes and SteamOS 3.9.5 PC host notes |
 | [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances |
 | [Import from my Quest](docs/quest-import.md) | Copy games you own off your Quest by USB; what runs, and why licence-checked games may not |
 | [My Meta library](docs/meta-library.md) | Experimental: install and test Quest games your Meta account owns, with your own token |
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
 | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
+| [Steam desktop sharing (Linux)](docs/steam-pipewire.md) | External Steam helper: launch with `-pipewire` after exiting Steam, or open KDE permissions to re-pick a screen manually; no automatic permission reset |
 | [PC in the headset](docs/pc-in-headset.md) | Experimental, Windows only, off until you turn it on: a whole PC screen as a panel in the Frame. Tested in a Windows VM; individual windows need a WGC-enabled build |
 | [Mac in the headset](docs/mac-in-headset.md) | Mac windows and screens as panels in the Frame, with laser and keyboard input |
 | [VR mods and custom songs](docs/mods.md) | UEVR for Unreal games from Frame Control (install, play in VR, remove), the per-game table, Beat Saber blockers |
@@ -252,8 +288,8 @@ Frame's software fits together, all checked against a real headset and labelled
  loopback `127.0.0.1:8080`) only through SSH tunnels. The compatibility
  database key (maintainer-only) is never written to the repo.
 - `steamos` has `sudo`, protected by the same Developer Mode password. Once
-  you've switched to key auth, a short password still protects `sudo` and
-  RDP, so pick one that isn't trivially guessable.
+  you've switched to key auth, that password still protects `sudo` and RDP,
+  so pick one that isn't trivially guessable.
 - Don't port-forward 22, 3389, or 5555–5599 from your router. For remote access,
  use Tailscale: `scripts/tailscale-on-frame.sh` (no sudo). In its userspace mode
  **every** Frame port is reachable from your tailnet, including Steam's DevTools
@@ -13,6 +13,10 @@ const path = require("path");

 const REQUIRED = [
  "ui/server.py",
+  "ui/frame_power.py",
+  "ui/frame_status.py",
+  "scripts/frame_power_sample.py",
+  "scripts/frame_power_report.py",
  "ui/frame_android.py",
  "frame/android/lepton-app.sh",
  "frame/openxr-compat/XrApiLayer_FRAME_compat.json",
@@ -1,12 +1,12 @@
 {
  "name": "frame-control",
-  "version": "0.4.14",
+  "version": "0.4.19",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "frame-control",
-      "version": "0.4.14",
+      "version": "0.4.19",
      "license": "MIT",
      "devDependencies": {
        "electron": "^44.4.5",
@@ -1,7 +1,7 @@
 {
  "name": "frame-control",
  "productName": "Frame Control",
-  "version": "0.4.14",
+  "version": "0.4.19",
  "description": "Desktop app for managing a Valve Steam Frame over SSH",
  "private": true,
  "main": "main.js",
@@ -68,7 +68,9 @@
        "from": "../scripts",
        "to": "scripts",
        "filter": [
-          "*.sh"
+          "*.sh",
+          "frame_power_sample.py",
+          "frame_power_report.py"
        ]
      },
      {
@@ -12,15 +12,41 @@ with no sign-in files or keys in the archives. Restoring one game's saves on top
 of identical files wrote nothing and left nothing behind. The session check
 reported Game Mode, so **Return to Game Mode** changed nothing. Not tested on a
 headset: a restore after a real factory reset, a restore that replaces files,
-Android data restore, and the switch out of a real Desktop Mode session. Unit
-tests and the fake Frame cover those (see [Verification](#verification)).
-On 2026-10-24 a read-only session check on the same build again reported Game
-Mode (`gamescope=true`, `plasma=false`, `nested_desktop=false`) and the
-`steamos-session-select` command was present. Opening the nested desktop for a
-clipboard test did not enter full Desktop Mode. A full session switch was not
-attempted because it restarts the headset session and a reliable return path
-was not established; the **Return to Game Mode** branch for a real full
-Desktop Mode session remains unverified.
+Android data restore. Unit tests and the fake Frame cover those (see
+[Verification](#verification)).
+On 2026-10-24, the real-device reproduction in [issue #142](https://github.com/saphid/frame-control/issues/142)
+confirmed full Plasma Desktop Mode on the same build: the Plasma session target
+was active and the Game Mode target inactive. Desktop Mode also ran gamescope
+for `steamvr-plasma.service`, so the old process check incorrectly reported
+Game Mode. SteamOS's `steamosctl switch-to-game-mode` restored Game Mode and
+reversed the target states; battery stayed at 99%, and the rollback timer and
+shared lock were cleaned up. After #143 passed CI, the corrected code was
+tested in another full Plasma session under a three-minute rollback timer.
+`ui/frame_backup.py session` reported Desktop Mode despite gamescope, and
+`ui/frame_backup.py game-mode` invoked the same guarded Return function used by
+the button. Game Mode became active and a second call made no switch. Battery
+remained at 99%; the timer and lock were removed. That test used the production
+CLI rather than clicking the desktop button.
+
+Later on 2026-10-24, the published **v0.4.17 Linux x86_64 AppImage** passed the
+literal packaged-button check on the same Frame/build. With the shared lock and
+a verified three-minute rollback timer, the headset entered full Plasma Desktop
+Mode. In the packaged Electron window, **Tools → Backup & recovery → Check**
+reported Desktop Mode despite gamescope. A trusted automated pointer click on
+the visible **Return to Game Mode** button, accepting its confirmation, returned
+`switched: true` and `steamosctl switch-to-game-mode`. The systemd targets then
+confirmed Game Mode. A second confirmed button click returned `switched: false`;
+the Game Mode service invocation and SteamVR PID stayed unchanged. **Check**
+then reported Game Mode and disabled Return. The test app/server and virtual
+display were stopped; the timer and shared lock were removed. Steam and SteamVR remained running
+at 99% battery. [Commands, responses, cleanup and limits](evidence/return-game-mode-packaged-2026-10-24.json),
+[before](evidence/return-game-mode-packaged-2026-10-24-before.png) and
+[after](evidence/return-game-mode-packaged-2026-10-24-after.png).
+
+This used the unchanged extracted AppImage payload with its bundled Python on
+Xvfb (`--no-sandbox --disable-gpu`), following the packaged Export test in #156.
+FUSE mounting, desktop integration, hardware rendering and the view inside a
+worn headset were not checked. Older SteamOS builds remain fixture-tested.

 ## Back up

@@ -118,29 +144,28 @@ normally runs *inside* it as one panel (`steamos-nested-desktop`, see
 [how-the-frame-works.md](how-the-frame-works.md#the-layer-cake)). If that panel
 is what you see, you're already in Game Mode: close it from the Steam dashboard.

-Full Desktop Mode is a different session. SteamOS picks the session through
-SDDM's autologin file, `/etc/sddm.conf.d/zz-steamos-autologin.conf` (or the
-default `/etc/sddm.conf.d/steamos.conf`), and switches with
-`steamos-session-select` (`holo-session-select` on newer images). This is what
-Valve's own devkit tools on the Frame read and run
-([`steamos-get-status`](../frame/devkit-utils/steamos-get-status),
-[`steamos-delete`](../frame/devkit-utils/steamos-delete)).
+Full Desktop Mode is a different session. **Check** reads the main user's
+systemd session targets over SSH: `gamescope-session.target` and
+`plasma-workspace-wayland.target`. Game Mode requires the former active and the
+latter inactive; Desktop Mode requires the reverse. This takes precedence over
+process names: full Desktop Mode can run gamescope for its VR overlay, and
+Game Mode can run a nested Plasma panel. Check changes nothing.

-**Check** reads that file and whether gamescope and Plasma are running; it
-changes nothing. On the Frame gamescope's process is `gamescope-wl`, started by
-`start-gamescope-session`, and either counts as Game Mode. Only when Plasma is
-running without gamescope (Desktop Mode) does **Return to Game Mode** run
-exactly `steamos-session-select gamescope` (or `holo-session-select
-gamescope`) over SSH, after asking. It closes the desktop and anything open in
-it. Frame Control never edits the SDDM files itself, and runs nothing when the
-headset is in Game Mode, when it can't tell which mode it's in, or when the
-image has neither command.
+Conflicting, transitional, failed or unreadable targets produce **unknown**.
+On older images where both targets are explicitly absent, the fallback accepts
+only gamescope without Plasma/nested desktop as Game Mode, or Plasma without
+gamescope/nested desktop as Desktop Mode. Mixed processes remain unknown.
+The SDDM autologin file is still reported as a login preference; it cannot
+establish which session is running.

-**Uncertain:** whether the Frame offers a full Desktop Mode session at all
-(only the nested desktop has been seen on BUILD_ID 20260922.6101926 and
-20260925.6191901), and whether `steamos-session-select` there works without
-the Developer Mode password. If the switch is refused, Frame Control says so and
-leaves the headset as it was.
+After confirmation, **Return to Game Mode** runs exactly
+`steamosctl switch-to-game-mode` when available, or the older
+`holo-session-select gamescope` / `steamos-session-select gamescope` command.
+It closes the desktop and anything open in it. Frame Control never edits the
+SDDM files itself, and runs no switch when the headset is in Game Mode, when
+its mode is unknown, or when no supported switch command is installed. A
+refused command reports an error; a request being sent does not verify that
+the new session has started.

 ### Manual fallback

@@ -151,7 +176,9 @@ If the button can't help, or the headset isn't reachable:
   Desktop Mode session, so a restart brings Game Mode back. That the Frame
   behaves the same is **inferred**, not tested.
 2. **Over SSH** (Developer Mode on), run Valve's switch yourself:
-   `ssh frame steamos-session-select gamescope`.
+   `ssh frame steamosctl switch-to-game-mode` (verified on SteamOS 0.5.6).
+   Older images may instead provide `steamos-session-select gamescope` or
+   `holo-session-select gamescope`.
 3. **Boot menu:** hold Power 10 seconds, then power on while holding the AUX
   button on top of Power. Choose `Current`, or `Previous` to start the other
   SteamOS slot; both keep your data. Details and the further options
@@ -172,3 +199,9 @@ restore replaces only its own files and keeps the old ones, unsafe archives
 names that try to leave the backups folder, and the exact Game Mode command.
 `tests/e2e/test_recovery_kit.py` backs up a Proton save from the fake Frame through
 the server, deletes it and restores it. Neither involves a real headset.
+
+Isolated session tests in the same suite reproduce full Plasma plus gamescope,
+Game Mode with and without the nested desktop, conflicting/transitional targets,
+missing targets on older builds, failed/timed-out systemd reads, selector
+compatibility, and the confirmed Return action with SSH mocked. Run them with
+`python3 -m unittest discover -s tests -p test_backup.py -v`.
@@ -0,0 +1,38 @@
+{
+  "date_utc": "2026-10-24T07:54:37Z",
+  "frame_control_tag": "v0.4.16",
+  "steamos_version": "0.5.6",
+  "steamos_build": "20261015.6141207",
+  "host": "lxso2",
+  "interface": "source UI served by a temporary private Frame Control server, opened in T3 Code's desktop browser",
+  "action": "Clicked the visible Export button for Steam's retained real saved clip in Capture & Live",
+  "clip_id": "10230640/clips/clip_13009719723623972864_20261024_072115",
+  "api_observed": {
+    "post_clips_export_http": 200,
+    "get_job_http": 200,
+    "get_clips_http": 200
+  },
+  "ui_result": "Saved clip_13009719723623972864_20261024_072115.mp4 to ~/Videos/SteamFrame; button changed to Export again",
+  "output": {
+    "path": "~/Videos/SteamFrame/clip_13009719723623972864_20261024_072115.mp4",
+    "bytes": 159829,
+    "sha256": "f8a476eefb2bde7ba5cb464632ec9b952eea3ab1610b5bed2098bf1f11d62cf1",
+    "matches_previously_fully_decoded_export": true,
+    "duration_seconds": 10.288532,
+    "video": "H.264 1920x1080",
+    "audio": "AAC stereo"
+  },
+  "cleanup": {
+    "temporary_server_stopped": true,
+    "shared_device_lock_released": true,
+    "battery_percent_after": 99,
+    "desktop_mode_active_after": false,
+    "test_title_created": false,
+    "steam_source_clip_retained": true
+  },
+  "limits": [
+    "The test used the source UI, not a packaged desktop installer.",
+    "The retained source clip was nearly black; visible gameplay capture remains unverified.",
+    "Perceptual audio/video sync, long clips, trims and automatic copying were not tested."
+  ]
+}
@@ -0,0 +1,29 @@
+{
+  "date_utc": "2026-10-24",
+  "version": "v0.4.17",
+  "steam_os_version": "0.5.6",
+  "steam_os_build": "20261015.6141207",
+  "result": "PASS: the real Steam-saved clip exported beyond 60 seconds",
+  "method": "Steam manual recording of a reserved test title, then Frame Control's production frame_clips.export_clip path; no packaged GUI button click",
+  "source": {
+    "kind": "saved Steam clip",
+    "duration_seconds": 100.801,
+    "chunks": 68,
+    "gaps": 0
+  },
+  "export": {
+    "format": "MP4",
+    "bytes": 1377849,
+    "sha256": "82ef31f65e6933d122bc326d664beb2eb2e3ba6969f26c0032552e80fbe8d823",
+    "duration_seconds_ffprobe": 100.833335,
+    "video": "H.264, 1920x1080, 6049 frames",
+    "audio": "AAC, 48000 Hz, stereo",
+    "full_ffmpeg_decode": "passed without errors"
+  },
+  "cleanup": "Restored Steam recording mode to its prior off setting; stopped and removed only the reserved title and its processes; no recording or running Steam apps remained; Game Mode active, battery 100%, shared test lock released",
+  "limits": [
+    "This exercised the production export code path, not a packaged GUI Export click.",
+    "Visible gameplay quality, perceptual audio/video sync, trims and longer recordings were not checked.",
+    "The newly saved Steam source clip was retained; no user recording was deleted."
+  ]
+}
@@ -0,0 +1,94 @@
+{
+  "date_utc": "2026-10-24T09:08:35.523Z",
+  "result": "PASS: packaged Electron visible Export click saved the retained real Steam clip beyond 60 seconds",
+  "frame_control_tag": "v0.4.17",
+  "documentation_base_commit": "4e456480aefbe541e334dbd247328537f535bd94",
+  "host": "lxso2",
+  "steamos_version": "0.5.6",
+  "steamos_build": "20261015.6141207",
+  "package": {
+    "asset": "Frame-Control-linux-x86_64.AppImage",
+    "url": "https://github.com/saphid/frame-control/releases/download/v0.4.17/Frame-Control-linux-x86_64.AppImage",
+    "sha256": "b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d",
+    "launch": "Verified release asset; --appimage-extract, then unmodified squashfs-root/AppRun. Electron used the bundled server and Python, not checkout source.",
+    "display": "Xvfb :137, 1440x1000x24; Electron window 1400x950 including native chrome",
+    "flags": [
+      "--no-sandbox",
+      "--disable-gpu",
+      "--remote-debugging-port=49371",
+      "--remote-debugging-address=127.0.0.1",
+      "--user-data-dir=/tmp/frame-packaged-export-20261024/electron-profile"
+    ],
+    "isolation": "Throwaway XDG_CONFIG_HOME, FRAME_CONTROL_DATA_DIR and Electron profile; telemetry and update checks disabled; existing SSH identity and normal home Videos destination used."
+  },
+  "ui": {
+    "navigation": "Dismissed optional email prompt with No thanks; clicked Tools, then Capture & Live; scrolled Steam clips into view.",
+    "row": "Steam recording \u00b7 Clip; Oct 24, 8:53 AM \u00b7 1:40 \u00b7 2 MB",
+    "action": "Playwright connected to this Electron instance over local CDP; locator.click() clicked its visible button named exactly Export. The test did not directly invoke an export function or API POST.",
+    "button": "button.small[data-clip-export=\"0\"]",
+    "click_is_trusted": true,
+    "button_bounds_css_pixels": {
+      "x": 1300.390625,
+      "y": 701.15625,
+      "width": 61.609375,
+      "height": 28
+    },
+    "post_clips_export_http": 200,
+    "job": "0ab20b1788adce63",
+    "job_poll_http": 200,
+    "saved_message": "Saved clip_15658413054201167872_20261024_085343.mp4 to ~/Videos/SteamFrame",
+    "final_row": "ON PC; Export again",
+    "screenshots": [
+      "clip-packaged-export-2026-10-24-before.png",
+      "clip-packaged-export-2026-10-24-after.png"
+    ],
+    "screenshot_scope": "Cropped to Steam clip rows and saved notification; unrelated screenshot thumbnails and host connection identity excluded."
+  },
+  "source": {
+    "clip_id": "10230640/clips/clip_15658413054201167872_20261024_085343",
+    "duration_seconds": 100.801,
+    "duration_provenance": "Retained real Steam clip from clip-long-2026-10-24.json; current packaged UI displays 1:40."
+  },
+  "output": {
+    "path": "~/Videos/SteamFrame/clip_15658413054201167872_20261024_085343.mp4",
+    "bytes": 1377849,
+    "sha256": "82ef31f65e6933d122bc326d664beb2eb2e3ba6969f26c0032552e80fbe8d823",
+    "matches_prior_production_export_size_and_sha256": true,
+    "duration_seconds_ffprobe": 100.833335,
+    "duration_difference_from_steam_seconds": 0.032335,
+    "video": "H.264, 1920x1080, 6049 decoded frames",
+    "audio": "AAC, 48000 Hz, stereo, 4724 decoded audio frames",
+    "validation": [
+      "ffprobe -v error -count_frames -show_entries format=duration,size:stream=codec_name,codec_type,width,height,sample_rate,channels,nb_read_frames -of json <output>: exit 0",
+      "sha256sum <output>: exact match to prior production export",
+      "ffmpeg -v error -xerror -i <output> -f null -: exit 0, no errors"
+    ]
+  },
+  "cleanup": {
+    "shared_lock": "Acquired with ssh frame mkdir /tmp/frame-test.lock after read-only battery/build/lock checks; released with rmdir after app shutdown; absence read back.",
+    "battery_percent_before": 99,
+    "battery_percent_after": 99,
+    "battery_status": "Not charging; charger Full",
+    "packaged_app_and_server_exited": true,
+    "test_xvfb_stopped": true,
+    "frame_export_cache_directories_remaining": 0,
+    "ffmpeg_processes_after": 0,
+    "game_mode_and_steamvr_running_after": true,
+    "steam_source_clip_retained": true,
+    "user_recordings_deleted": false,
+    "headset_install_or_settings_changes": false,
+    "local_export_retained": true
+  },
+  "limits": [
+    "The unchanged AppImage payload ran after extraction on a virtual X desktop, with Chromium sandbox and GPU disabled. FUSE mounting, desktop integration and hardware rendering were not tested.",
+    "The click was automated trusted pointer input in a visible Electron window on Xvfb, not a human click on a physical monitor. T3 collaborative preview opened successfully but drives separate browser tabs; Electron-native automation was used for this window.",
+    "No new game or Steam recording was started. Visible gameplay quality, audible content and perceptual audio/video sync were not assessed.",
+    "Clips longer than this retained 100-second clip, trims and automatic copying remain unverified.",
+    "No release, tag or application code was changed."
+  ],
+  "validation_local": {
+    "clip_regression_suite": "python3 -m unittest discover -s tests -p test_clips.py -v: 34 tests passed in 20.173s, including real ffmpeg long-recording export",
+    "json": "python3 -m json.tool: passed",
+    "diff": "git diff --check: passed"
+  }
+}
@@ -0,0 +1,95 @@
+{
+  "date": "2026-10-24",
+  "command": "scripts/frame-power-sample.sh --count 2 --interval 1",
+  "exitCode": 0,
+  "stopped": null,
+  "lockPolicy": "Existing sampler checked local and remote /tmp/frame-test.lock before reading; no lock acquired, bypassed or removed. Read-only run only.",
+  "samples": [
+    {
+      "time": 1792828506.4317346,
+      "osBuild": "20261015.6141207",
+      "elapsedSeconds": 0.057539,
+      "battery": {
+        "battery.percent": {
+          "value": 99,
+          "unit": "%",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        },
+        "battery.status": {
+          "value": "Not charging",
+          "unit": "state",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        },
+        "battery.watts": {
+          "value": -0.06,
+          "unit": "W",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        },
+        "battery.tempC": {
+          "value": 24.0,
+          "unit": "C",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        }
+      }
+    },
+    {
+      "time": 1792828507.4357972,
+      "osBuild": "20261015.6141207",
+      "elapsedSeconds": 1.061612,
+      "battery": {
+        "battery.percent": {
+          "value": 99,
+          "unit": "%",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        },
+        "battery.status": {
+          "value": "Not charging",
+          "unit": "state",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        },
+        "battery.watts": {
+          "value": -0.05,
+          "unit": "W",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        },
+        "battery.tempC": {
+          "value": 24.0,
+          "unit": "C",
+          "source": "/sys/class/power_supply/max1720x_bat_7-36",
+          "state": "available"
+        }
+      }
+    }
+  ],
+  "limitations": [
+    "No real low-charge or thermal condition induced.",
+    "No native notification delivery verified.",
+    "No worn-headset or native package tests.",
+    "Read-only parser/transport check; no background monitor or power-saving claim."
+  ],
+  "browserCheck": {
+    "page": "Production ui/index.html served statically; API calls intentionally unavailable",
+    "viewport": {
+      "width": 1280,
+      "height": 800
+    },
+    "bridge": "Synthetic desktop notification bridge; no native OS notification sent",
+    "result": "Initially unchecked and visible only after desktop host/bridge setup. Checkbox enabled through browser. Synthetic 12%, Discharging, -4 W samples at 0/30/60 seconds produced one bridge request, an in-page status and a toast. No horizontal overflow.",
+    "apiLimit": "Static server returned expected 404/501 API errors; not an end-to-end live desktop connection test."
+  },
+  "offlineValidation": [
+    "test_desktop_battery_comfort.py: 2 tests, production JS with monotonic fake clock and notification bridge",
+    "test_comfort*.py: 25 tests",
+    "test_battery.py: 7 tests",
+    "test_power*.py: 36 tests (loopback HTTP test run outside socket-restricted sandbox)",
+    "test_ui_workspace.py: 1 Python wrapper / Node workspace suite",
+    "test_ui_review.py: 1 Python wrapper / 9 Node regression tests, including switch reset and retained cooldown"
+  ]
+}
@@ -0,0 +1,206 @@
+{
+  "date_utc": "2026-10-24",
+  "base_commit": "de931bc",
+  "issue": 73,
+  "result": "Packaged Desktop Capture passed for a mapped nested KDE compositor on the real Frame; wearer-visible overlay condition was not established. Do not close #73 from this test.",
+  "package": {
+    "tag": "v0.4.17",
+    "asset": "Frame-Control-linux-x86_64.AppImage",
+    "sha256": "b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d",
+    "release_digest_matched": true,
+    "panel_helper_matches_base": true,
+    "unmodified_payload": true,
+    "host": "lxso2",
+    "display": "Xvfb :139",
+    "flags": [
+      "--no-sandbox",
+      "--disable-gpu"
+    ],
+    "private_profile_and_data": true,
+    "telemetry_and_update_checks_disabled": true
+  },
+  "preflight": {
+    "steamos_version": "0.5.6",
+    "build_id": "20261015.6141207",
+    "battery_percent": 99,
+    "battery_status": "Not charging",
+    "game_mode": true,
+    "full_plasma_session": false,
+    "nested_desktop_running": false,
+    "nested_runtime_present": false,
+    "lock_present": false,
+    "steam_pid": 297826,
+    "vrserver_pid": 297506,
+    "vrcompositor_pid": 297620,
+    "gamescope_service_invocation": "e8c1085b3bbd4e79a323b3e4a9bc6355",
+    "focusable_windows": [],
+    "focused_windows": []
+  },
+  "session": {
+    "started_utc": "2026-10-24T09:43:48Z",
+    "lock_acquired": true,
+    "launch": [
+      "systemd-run",
+      "--user",
+      "--unit=fc-issue73-desktop-20261024",
+      "--collect",
+      "--property=RuntimeMaxSec=180s",
+      "--property=TimeoutStopSec=15s",
+      "--property=KillMode=control-group",
+      "--setenv=DISPLAY=:0",
+      "--setenv=XDG_RUNTIME_DIR=/run/user/1000",
+      "--setenv=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus",
+      "--setenv=XDG_SESSION_TYPE=x11",
+      "--setenv=XDG_CURRENT_DESKTOP=gamescope",
+      "/usr/bin/steamos-nested-desktop"
+    ],
+    "response": "Running as unit: fc-issue73-desktop-20261024.service; invocation ID: 92cff1e57c794212997d46c0a68877ec\n"
+  },
+  "discovery": {
+    "focus": 62914560,
+    "focus_display": ":0",
+    "panels": [
+      {
+        "window": 62914560,
+        "display": ":0",
+        "name": "KDE Wayland Compositor - Press right control key to grab input",
+        "x": 0,
+        "y": 0,
+        "width": 1920,
+        "height": 1080,
+        "app": 0,
+        "focused": true
+      }
+    ]
+  },
+  "window_evidence": {
+    "xwininfo_map_state": "IsViewable",
+    "width": 1920,
+    "height": 1080,
+    "focused_after_show_request": true,
+    "steamvr_overlay_key": "valve.steam.desktopgame.0",
+    "steamvr_overlay_visibility_after_show_request": "not_visible"
+  },
+  "capture": {
+    "repeat_utc": "2026-10-24T09:44:47.323Z",
+    "route": "/api/screenshot?view=panel&window=62914560&display=%3A0",
+    "http": 200,
+    "content_type": "image/png",
+    "content_length": 1209980,
+    "source_header": "panel",
+    "decoded": {
+      "width": 1920,
+      "height": 1080,
+      "source": "panel",
+      "selected": {
+        "window": 62914560,
+        "display": ":0",
+        "name": "KDE Wayland Compositor - Press right control key to grab input",
+        "x": 0,
+        "y": 0,
+        "width": 1920,
+        "height": 1080,
+        "app": 0,
+        "focused": true
+      },
+      "stamp": "9:44:48 AM",
+      "badge": "Desktop \u00b7 KDE Wayland Compositor - Press right control key to grab input"
+    },
+    "canvas_png_bytes": 2011278,
+    "first_capture_pixel_statistics": {
+      "width": 1920,
+      "height": 1080,
+      "min": 2.3333333333333335,
+      "max": 255,
+      "hidden": false
+    },
+    "first_capture_click_event": {
+      "isTrusted": true,
+      "utc": "2026-10-24T09:44:12.738Z"
+    },
+    "actions": "Two Playwright locator.click() actions on the visible #shotBtn in the actual packaged Electron window; first click recorded isTrusted=true. No direct screenshot API invocation by harness."
+  },
+  "device_cleanup": {
+    "utc": "2026-10-24T09:45:33Z",
+    "before_stop": {
+      "exit": 0,
+      "out": "MainPID=300739\nControlGroup=/user.slice/user-1000.slice/user@1000.service/app.slice/fc-issue73-desktop-20261024.service\nActiveState=active\n",
+      "err": ""
+    },
+    "hide_dashboard": {
+      "exit": 0,
+      "out": "HideDashboard",
+      "err": ""
+    },
+    "stop_owned_unit": {
+      "exit": 0,
+      "out": "",
+      "err": ""
+    },
+    "after_stop": {
+      "exit": 0,
+      "out": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n",
+      "err": ""
+    },
+    "desktop_processes": {
+      "exit": 1,
+      "out": "",
+      "err": ""
+    },
+    "nested_runtime_exists": false,
+    "session": {
+      "exit": 0,
+      "out": "Id=gamescope-session.target\nActiveState=active\nInvocationID=a2fee8ebf55c42c7b546390d14cd985c\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nInvocationID=\n\nId=gamescope-session.service\nActiveState=active\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n",
+      "err": ""
+    },
+    "steam": {
+      "exit": 0,
+      "out": "297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n",
+      "err": ""
+    },
+    "steamvr": {
+      "exit": 0,
+      "out": "297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n297620 /opt/steamvr/bin/linuxarm64/vrcompositor\n",
+      "err": ""
+    },
+    "xprops": {
+      "exit": 0,
+      "out": "GAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = \nGAMESCOPE_FOCUSED_WINDOW(CARDINAL) = \n",
+      "err": ""
+    },
+    "battery": {
+      "capacity": "99",
+      "status": "Not charging"
+    },
+    "owned_lock_released": true
+  },
+  "host_cleanup": {
+    "electron": {
+      "pid": 1578431,
+      "exists_after": false
+    },
+    "xvfb": {
+      "pid": 1578428,
+      "exists_after": false
+    },
+    "x_socket_absent": true
+  },
+  "delayed_final_readback": "2026-10-24T09:46:39Z\nshared-lock-absent\nLoadState=not-found\nActiveState=inactive\nId=gamescope-session.target\nActiveState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n297620 /opt/steamvr/bin/linuxarm64/vrcompositor\nnested-runtime-absent\n100\nFull\nGAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = \nGAMESCOPE_FOCUSED_WINDOW(CARDINAL) = \n",
+  "validation": {
+    "focused_panel_suite": "42 tests passed in 14.805s (test_touch.py), including production-page Node behavior tests",
+    "website": "2 tests passed (node --test site/test/*.test.mjs)",
+    "node_panels": "Passed independently (node tests/page/desk_panels.mjs)",
+    "metadata_and_links": "JSON parsed; result/cleanup assertions and relative evidence/streaming/testing links passed",
+    "diff": "git diff --check passed"
+  },
+  "limits": [
+    "SteamVR continued reporting not_visible after ShowDashboard, despite mapped X window and confirmed focus. No worn-headset visual assessment; does not establish the reporter's visible-overlay condition.",
+    "SteamOS 0.5.6 only; reporter used 0.4.5 with unknown Frame Control version and no reproduction steps.",
+    "Nested desktop launched with SteamOS steamos-nested-desktop from a bounded transient user unit using Steam display/session variables; not launched through a wearer's Steam UI.",
+    "Extracted unchanged AppImage on a virtual X display with Chromium sandbox and GPU disabled; no FUSE, physical monitor or hardware-rendering test.",
+    "No Live video, Control input or full Desktop Mode test.",
+    "Nested-desktop journal included gamescope WSI/Vulkan-hook warnings. No warning was dismissed; captured compositor pixels were nonblank.",
+    "Initial CDP response.body() yielded zero bytes despite successful image decode. Repeat verified Content-Length, fresh decoded image, panel selection and PNG export from canvas; the initial raw-body size is not treated as capture failure or proof.",
+    "No private desktop pixels, issue screenshot or raw desktop journal committed."
+  ]
+}
@@ -0,0 +1,100 @@
+# Packaged Desktop Capture, 2026-10-24
+
+Base: `de931bc`. Package: Linux x86_64 **v0.4.17**. Device: real Frame,
+SteamOS **0.5.6**, BUILD_ID **20261015.6141207**. Host: lxso2.
+[Sanitized state and response evidence](desktop-capture-packaged-2026-10-24.json).
+
+## Result and issue boundary
+
+The packaged app discovered the nested KDE compositor and both automated
+Desktop **Capture** button clicks succeeded. The repeat returned HTTP 200,
+`Content-Type: image/png`, `X-Capture-Source: panel`, and Content-Length
+1,209,980. The app decoded a fresh, nonblank 1920×1080 image and displayed
+the Desktop panel badge. No further product failure was reproduced or fixed.
+
+This does **not** establish the full visible-desktop condition in
+[#73](https://github.com/saphid/frame-control/issues/73). `xwininfo` reported
+the desktop window `IsViewable`, and gamescope confirmed focus after
+`vrcmd --showdashboard valve.steam.desktopgame.0`. However, SteamVR still
+reported that overlay `not_visible`. There was no worn-headset visual check.
+The observation proves capture of a mapped nested compositor, not its visible
+presentation to a wearer. Do not close #73 from this evidence.
+
+The issue screenshot shows a desktop panel in the headset view while Desktop
+Capture logs “no app panel is open in the headset.” The reporter used SteamOS
+0.4.5, gave no Frame Control version or reproduction steps, and has not replied
+to the maintainer's 0.4.3 update request. The duplicate page function was already
+fixed; [PR #152](https://github.com/saphid/frame-control/pull/152) subsequently
+improved unknown-state diagnostics. Its [earlier investigation](panel-discovery-2026-10-24.md)
+was blocked from starting a desktop by another task's lock. This run adds a
+current-package capture observation, without reproducing the older failure.
+
+## Procedure
+
+1. Read-only preflight found Game Mode active, full Plasma inactive, Steam and
+   SteamVR running, battery 99%, no nested desktop/runtime and no test lock.
+2. Compared the retained AppImage's SHA-256 with the live v0.4.17 release asset
+   digest: `b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d`.
+   Extracted an independent copy; `cmp` confirmed its `frame_touch.py` matches
+   the base checkout. No payload was edited.
+3. Started the package's own AppRun, bundled server and Python on Xvfb `:139`
+   with private config/cache/data/profile, telemetry and update checks disabled,
+   and `--no-sandbox --disable-gpu`. Used the existing authorized `ssh frame`
+   identity. T3 preview opened the package server page but does not attach to
+   the existing Electron window. The literal Electron button test used the
+   same Playwright-over-loopback-CDP workflow as the earlier packaged tests.
+4. Acquired `/tmp/frame-test.lock` with atomic `mkdir` and wrote an owner marker.
+   Rechecked no nested runtime or Plasma was present. Started SteamOS's
+   `/usr/bin/steamos-nested-desktop` in the owned transient user unit
+   `fc-issue73-desktop-20261024.service`, using Steam's display/session variables.
+   `RuntimeMaxSec=180s`, `TimeoutStopSec=15s` and `KillMode=control-group` bounded
+   the session. This launches a desktop panel inside Game Mode; no full Desktop
+   Mode switch was sent.
+5. In the actual packaged Electron window, navigated Tools → Capture & Live →
+   Desktop and clicked Capture with `locator.click()`. The first click event
+   recorded `isTrusted=true`. The page selected the KDE compositor on `:0`;
+   the production screenshot path used window `62914560`. Requested the desktop
+   dashboard, read back focus/visibility, and clicked Capture again. Recorded
+   response metadata, fresh decoded image dimensions and canvas pixel range.
+   No direct screenshot API call was substituted for these button clicks.
+6. Ran the packaged `frame_touch.py panels` read-only over SSH to retain its
+   exact discovery result: one focused KDE compositor panel, app ID 0, 1920×1080,
+   display `:0`, with no diagnostic `why` field.
+
+## Cleanup and limits
+
+The owned desktop session ran **09:43:48–09:45:33 UTC** (105 seconds). Hid the
+dashboard to restore its initial hidden state, stopped only the owned unit,
+and verified it was unloaded/inactive with MainPID 0. No Plasma/KWin desktop
+process or nested runtime remained; gamescope's focusable/focused lists were
+empty again. Released only this task's lock, after checking its owner marker.
+
+Delayed readback at **09:46:39 UTC** confirmed the lock absent, Game Mode active,
+full Plasma inactive and the original Steam, vrserver and vrcompositor PIDs
+still running. The Game Mode service invocation was unchanged. Battery was
+99% at cleanup and 100%/Full on the delayed check. Closed both owned preview
+tabs, Electron and Xvfb; their processes and X socket were gone. No test server
+remained. No reboot, installation, security/global setting change or full
+Desktop Mode transition was performed.
+
+The nested desktop journal included gamescope WSI/Vulkan-hook warnings. No
+warning was dismissed. Capture produced nonblank compositor pixels, but this
+run does not assess their usability to a wearer. Private image files stayed
+outside the repository; only state and response metadata are published.
+
+The initial CDP `response.body()` read yielded zero bytes despite successful
+decoding in the page. The repeat verified the PNG Content-Length, fresh image
+dimensions/source/selection and a 2,011,278-byte PNG exported from the canvas.
+The initial raw-body measurement is a harness limitation, not evidence of a
+product capture failure. No Live video, Control input, physical monitor, FUSE
+mounting or hardware rendering was tested. Older SteamOS and other packages
+remain outside this observation.
+
+## Offline verification
+
+`python3 -m unittest discover -s tests -p test_touch.py -v`: **42 tests passed**,
+including the production page's Node panel behavior tests, duplicate-function
+guard, absent versus empty panel diagnostics, alternate displays, capture/input
+target validation and discovery deadlines. JSON parsing and `git diff --check`
+were also checked. No new regression test was added because this is an
+evidence-only change with no reproduced product defect.
@@ -0,0 +1,114 @@
+# Linux PC host feasibility on lxso2, 2026-10-24
+
+**Blocked on this host's current desktop environment. No feature enabled and
+no feature PR opened.** Investigation for [issue #23](https://github.com/saphid/frame-control/issues/23),
+starting at `4e45648` (main after #154). This concerns flat desktop panels,
+not Linux PC VR streaming.
+
+## Decision
+
+The smallest useful candidate is one explicitly selected **whole screen**,
+captured through the ScreenCast portal's restricted PipeWire connection,
+encoded locally with GStreamer/x264, and sent to the existing viewer through
+the shared SSH controller. Input, individual windows and virtual displays
+would remain unsupported until separately verified. This candidate was **not
+implemented**: lxso2 currently cannot exercise the real capture permission path.
+
+Development packages could unblock compilation, but would not create a desktop,
+portal backend or consented screen. Synthetic encoding, an Xvfb screen grab or
+using the Frame as its own host would not verify Linux PC desktop capture.
+No host packages or services were changed.
+
+## Evidence
+
+Host: `lxso2`, Linux x86-64, kernel `6.8.0-139-generic`.
+
+- `DISPLAY`, `WAYLAND_DISPLAY` and `XDG_SESSION_TYPE` were unset. The user bus
+  was reachable at `/run/user/1000/bus`.
+- `/run/user/1000/pipewire-0` and `/run/user/1000/wayland-0` did not exist.
+  No processes matched Xorg, Xwayland, Xvfb, GNOME Shell, KWin Wayland, Weston,
+  PipeWire, WirePlumber or xdg-desktop-portal at the process check.
+- D-Bus `ListNames` returned D-Bus, systemd and anonymous connections, with no
+  `org.freedesktop.portal.Desktop`. `ListActivatableNames` also had no desktop
+  portal. These calls queried D-Bus itself without activating capture services.
+- `dpkg-query` found no `xdg-desktop-portal*` or `pipewire*` packages.
+  `libgstreamer1.0-0:amd64` was installed at `1.24.2-1ubuntu0.1`, but
+  `gstreamer1.0-tools` was uninstalled. `gst-launch-1.0` and `gst-inspect-1.0`
+  were absent from PATH. Xvfb was installed, but supplies no portal by itself.
+- `pkg-config --modversion` failed for `gstreamer-1.0`,
+  `gstreamer-app-1.0`, `gstreamer-video-1.0` and `libpipewire-0.3`.
+  `gio-unix-2.0` reported `2.80.0`.
+- `desktop/bundle/pc-host.so` did not exist.
+  `python3 desktop/build.py --with-x264 --out /tmp/frame-linux-pc-feasibility`
+  exited **1** before compilation: required GStreamer pkg-config modules were
+  missing. No native build or encoder runtime success is claimed.
+
+Reproduce the non-activating portal checks in the intended desktop user's
+session, using that session's actual runtime directory and bus:
+
+```sh
+gdbus call --session --dest org.freedesktop.DBus \
+  --object-path /org/freedesktop/DBus --method org.freedesktop.DBus.ListNames
+gdbus call --session --dest org.freedesktop.DBus \
+  --object-path /org/freedesktop/DBus --method org.freedesktop.DBus.ListActivatableNames
+pkg-config --modversion gstreamer-1.0 gstreamer-app-1.0 gstreamer-video-1.0 gio-unix-2.0
+```
+
+## Existing implementation reviewed
+
+- `ui/frame_pcview.py` selects PCView only on Windows and rejects Linux even
+  when enabled. Linux installers do not carry its native bundle.
+- `desktop/portal.c` creates a **RemoteDesktop** session, requests pointer and
+  keyboard devices, and selects monitors and windows (`types=3`). It is not
+  ScreenCast-only or screen-only. Its restricted fd/node and fresh-connection
+  handling are reusable.
+- `ui/frame_pc_agent.py` calls the selection a shared window or screen and
+  picks VA-API when the element is present, falling back to x264. A bounded
+  x264 slice needs explicit encoder policy and unsupported-input behavior;
+  exposing the existing Linux path alone would not meet that scope.
+- `app/main.js` starts Python with the inherited environment; it does not
+  supply a compositor, portal backend or capture permission.
+- `.github/workflows/pc-host.yml` installs native dependencies and tests
+  synthetic x264/protocol behavior with fake capture consent/input. This does
+  not establish interactive Linux desktop capture.
+- Issue #23 and its six existing comments distinguish prior synthetic
+  helper/viewer results from untested Linux desktop capture and consent.
+
+## Verification and limits
+
+`python3 -m unittest discover -s tests -p 'test_pc*.py' -v` exited **0**:
+27 tests ran successfully, with one additional native-class setup skip
+(`native PC libraries not built on this host`). Coverage includes the compiled
+C controller trace, Python adapters, grants and default-off/Windows-only gates.
+It does not prove native GStreamer capture or local-client streaming.
+
+No fake/local native stream, consent prompt, real desktop capture, Frame viewer
+run, benchmark, input or window mode was tested in this investigation. No SSH
+connection to the Frame was needed; no lock was acquired and no headset install,
+launch, stop or settings change was attempted. Issue #113 was left alone.
+No issue comments or other public messages were sent.
+
+## Concrete unblock and next slice
+
+1. Supply an interactive Linux desktop, physical or VM, with a working
+   ScreenCast portal/backend, PipeWire and accessible consent dialog. Installing
+   the portal frontend alone is insufficient. A VM can establish software
+   capture/x264 behavior while physical-host behavior remains unverified.
+2. Install the native dependencies listed in `pc-host.yml` in that environment
+   and build a local `--with-x264` bundle. Resolve x264 distribution
+   licensing/source obligations before shipping it: the current build labels
+   that option test-only and the Windows installer omits it.
+3. Implement a ScreenCast-only session with monitor-only selection, no
+   RemoteDesktop/device request, disabled input in protocol and viewer, hidden
+   window/virtual-display modes, and explicit x264 selection. Preserve the
+   default-off gate and existing Mac/Windows paths.
+4. Verify consent acceptance/refusal/cancellation, Stop/reopen, connection loss
+   and portal closure with a local client decoding actual captured content.
+   Run the shared benchmark and record results without inferring hardware or
+   physical laser behavior.
+5. Only after local capture works, acquire the shared Frame lock once and
+   follow [the headset procedure](../testing.md#headset-smoke-test) for a brief
+   viewer test. If occupied, leave the lock alone and defer device testing.
+
+These are prerequisites and proposed scope, not a ready feature. The Linux
+host request in #23 remains open.
@@ -0,0 +1,142 @@
+# Media surround hardening: 2026-10-24
+
+PR [#51](https://github.com/saphid/frame-control/pull/51), branch
+`theatre-media-surround-hardening`, merged main `2ded4c5` without rebasing.
+Both fixes remain necessary on that main: an optional-surround error escapes
+`play()`, and a non-`RuntimeError` during overlay teardown skips the remaining
+handles and OpenVR shutdown.
+
+## Offline checks
+
+- Focused media suite: **23 tests passed** on Linux / Python 3.12.3.
+- Final full suite: **1,381 tests, OK (15 skipped)** in 145.384 s with
+  `PYTHONFAULTHANDLER=1 python3 -m unittest discover -s tests -v`.
+  The service-regression module passed **33 tests**. Player/server compilation
+  and `git diff --check` passed. Current macOS/Windows validation is left to CI.
+- The startup/upload, creation/setup, deferred-surround refusal and teardown
+  regression tests were also run with main's player implementation: they
+  failed as expected (six errors across subtests). The screen-refusal test
+  passed, confirming that actual screen failures still propagate.
+- The historical macOS failure was job
+  [109239733717](https://github.com/saphid/frame-control/actions/runs/36516462623/job/109239733717),
+  on `dac9dbc`, Python 3.12: 619 tests, three failures in artwork resolver
+  tests (`test_resolver_slot_released_when_thread_cannot_start`,
+  `test_timed_out_lookups_are_capped`,
+  `test_url_fetch_refuses_private_hosts_and_honours_deadline`). Media tests
+  passed. Late DNS workers retained semaphore slots; the first failed
+  assertion could also leak acquired slots into later tests.
+- Main already contains `8051687`'s wait-for-idle and unconditional slot
+  cleanup, preserved by `d546568`. The current artwork module passed all
+  **40 tests** locally. No additional artwork changes were needed.
+- The first full run completed **1,380 tests, 15 skipped**, with one failure:
+  `test_a_second_server_is_refused_until_the_first_exits` observed SIGSEGV
+  (`-11`) instead of exit 1. All 41 server tests passed on a focused rerun.
+  Main started daemon index/TLS workers before refusing a second server;
+  its existing shutdown notes document a race with OpenSSL interpreter exit.
+  This crash mechanism is inferred; the first run did not retain a native
+  fault trace. The subprocess assertion now retains stderr for diagnosis.
+  A deterministic regression now checks that rejection starts no listener,
+  cleanup sweep or background workers. It failed before moving the ownership
+  check ahead of startup work and passed afterwards.
+
+The surround retry now logs a refusal before discarding that cosmetic work.
+Creation, setup and first-upload failures also allow the screen to play;
+standby remains retryable, and screen errors remain fatal. Teardown tests
+exercise OpenVR errors, unexpected exceptions and a late `InterruptedError`,
+checking that all handles are attempted and shutdown runs.
+
+## Earlier blocked real Frame attempt
+
+Read-only SSH preflight: SteamOS **0.5.6**, BUILD_ID **20261015.6141207**;
+SteamVR server PID **297506**, compositor PID **297620**; existing media
+service `inactive/dead`, MainPID 0; battery **99%**, fuel gauge `Not charging`,
+charger `Full`. The shared lock was absent at preflight.
+
+The subsequent atomic `mkdir /tmp/frame-test.lock` failed with
+`FileExistsError(17, 'File exists')`: another session acquired it in between.
+The probe stopped before uploading files, launching media, creating overlays,
+or changing any state. The foreign lock was neither modified nor released.
+All generated fixtures remained on the computer and were then removed; no
+headset cleanup was necessary. Steam/SteamVR and the prior player state were
+left alone.
+
+## Follow-up real Frame smoke at the exact PR head
+
+**Passed, 2026-10-24 10:35:02–10:35:23 UTC**, with byte-identical media modules
+from **`5d551a81658d9ff14f49285c28609d506cbc20aa`**. This later run resolves
+the earlier lack of fresh playback evidence. No production code changed.
+The headset was unworn. SteamOS **0.5.6**, BUILD_ID **20261015.6141207**,
+SteamVR **2.18.2**; battery **100%, Full** before and after.
+
+Read-only preflight found Game Mode (`XDG_CURRENT_DESKTOP=gamescope`,
+`start-gamescope` running, no `plasmashell`), Steam/SteamVR running, no media
+overlays, and the installed media service inactive/not loaded. The test then
+acquired `/tmp/frame-test.lock` with atomic `mkdir`; it did not take over a
+foreign lock. Under the lock, those safety conditions were checked again.
+
+Only generated media and the PR's four unchanged modules were uploaded, under
+the test-owned, uid-1000 directory
+`/tmp/pr51-5d551a8-4c0976a52564-utfbk_m0/`. The clip was a **12 s, 30 fps,
+960×540 half-SBS H.264** MP4 with solid red/cyan eye images and **silent AAC**.
+It was generated with FFmpeg's `color`, `hstack` and `anullsrc` sources; no
+personal or external media was used.
+
+The exact `frame_media_remote.run()` Play/status/Stop path was exercised by
+importing its unmodified module and changing only its in-memory `ROOT`,
+`RUNTIME`, `STATUS` and `UNIT` constants to the isolated test locations and
+`frame-control-media-pr51-5d551a8-4c0976a52564.service`. The real
+`frame_media_player.py` ran unchanged with `--layout auto --theatre`, using
+`h264_v4l2m2m` and Pulse output. This checks the player and its systemd lifecycle;
+it does **not** reverify the HTTP/UI upload or runtime installer, nor the
+literal production unit name. The installed media runtime, log, status and
+library were preserved.
+
+- First Play: `starting` → `playing` → **`ended`**, **360 frames**, **160 dropped**,
+  **12.0397 s**, `running=false`. The drops were the normal unworn/standby
+  `SetOverlayRaw` retry path; no fault was forced. At 60 frames, dropped was 0.
+  `vrcmd --overlays` listed `framecontrol.media.surround` as **1×1 visible**
+  and `framecontrol.media.screen` as **visible**. These are SteamVR metadata,
+  not a wearer or eye-capture verification.
+- After EOF: unit **inactive/dead, not-found, MainPID 0**, no test player or
+  decoder, and neither owned overlay remained. Stop after EOF succeeded and
+  retained `ended`.
+- Second Play reached `playing`, 60 frames, 0 dropped. Explicit Stop returned
+  **`stopped`, 72 frames, 0 dropped, `running=false`**. Again the unit was
+  inactive/dead/not-found with MainPID 0, no player/decoder and no owned overlays.
+- The test unit's `ExecStart` and cgroup identified the unique temporary
+  runtime. First-run player/decoder PIDs were **309650/309655**; second-run
+  PIDs were **309805/309810**. Stop controlled only this dedicated test unit.
+  Its player log was empty; no surround refusal or teardown error was logged.
+
+### Uploaded SHA-256 values
+
+```text
+generated_SBS.mp4      1b39cac1d3b092b89657250c817019b68e87a474976ccd44aeb38e8eee44ffca
+frame_media.py         001e3158f4c3931794846b21f1e4cb553349d9326b4db1454a01976d446ad97a
+frame_media_player.py  86b0a140ebff857c2819c74d3ac45d1897735c585d44c7360ad6f18c2ecf2645
+frame_media_remote.py  b60386eb192d32594358246a4e665474c543600f2c564c2efd554ef38d7a631d
+frame_splat.py         f35750926f1149c41b95617a302012406d355c0dfdd4530438b0c42ee6d55daa
+```
+
+### Cleanup and limits
+
+The temporary directory, including its fixture, code, bytecode, status and log,
+was removed only after verifying that its player and decoder had exited. The
+transient unit was collected. The test released only its own lock after cleanup.
+All installed media runtime file hashes, including `player.log` and
+`status.json`, were unchanged. The installed `frame-control-media.service`
+remained inactive/not loaded. Steam **297826**, vrserver **297506**,
+vrcompositor **297620**, vrdashboard **297721**, and start-gamescope **296997**
+kept the same PIDs. The pre-existing overlay key/dimension/visibility/type
+inventory matched the final inventory, and all dashboard main panels remained
+`not_visible`. No dashboard command, wake request, global setting, reboot or
+Steam/SteamVR stop was issued.
+
+Cosmetic surround refusal and exceptional teardown remain **fake-tested**;
+no real refusal or teardown fault was induced. This short unworn-headset
+smoke does not verify appearance, eye isolation, comfort, audible sound/lip
+sync (the AAC was silent), sustained display performance, or the issue #28
+report of laggy 1080p video. It does not cover new H.265, photo or splat cases.
+Historical checks remain in the earlier PR #51 description and
+[media playback notes](../vr-video.md). The PR remains draft and unmerged
+for parent review and CI.
@@ -0,0 +1,178 @@
+# Keyboard and trackpad through gamescope, 2026-10-24
+
+PR: [#66](https://github.com/saphid/frame-control/pull/66), `pad-gamescope`.
+Parent/main: v0.4.18 commit `0da1fe5`. Merge commit: `1737366`, with parents
+`cba23fb` (the existing PR) and `0da1fe5` (main). No history was rewritten.
+
+## Merge and implementation
+
+Both `/api/input` (keyboard/trackpad) and `/api/touch` (live-view Control)
+start and poll the gamescope helper. KDE Connect starts only when Unicode
+typing needs it. The existing ordered, bounded queue and switch cancellation
+remain in place; cross-service typing order is an estimate, not an application
+acknowledgement.
+
+The merge keeps main's intended-device validation and work reservation before
+a GET starts an input helper, immutable SSH routes, launch generations and
+serialized writes. Switching headsets also stops the power report and resets
+both input agents and queued typing before publishing the new route. The page
+keeps main's Tools sections, clipboard controls and single instances of the
+keyboard/trackpad and VR tools, with the PR's gamescope help text.
+
+The start/status regression tests now exercise the gamescope helper for both
+endpoints. An explicit `/api/input` test checks that start and poll use that
+helper without starting KDE Connect. Existing stale/missing-headset and
+route-reservation tests remain active.
+
+## Real Frame: focused click and ASCII keys received
+
+Host: lxso2, `ssh frame`. SteamOS **0.5.6**, BUILD_ID **20261015.6141207**,
+SteamVR **2.18.2**. At **11:05 UTC**, Game Mode was active, full Plasma was
+inactive, Steam and SteamVR were running, battery was **99%**, and gamescope's
+focusable/focused window lists were empty. The shared test lock was absent.
+Existing X11 tools and libX11 were available; Tk could not load its library.
+
+At **11:09:23 UTC**, an initial read-only preflight saw no focused window
+but activity level **0** (idle), rather than the required **3** (standby), and
+aborted before lock acquisition or input. At **11:09:57 UTC**, another task
+held the shared lock with a focused panel; that lock and panel were left alone.
+
+At **11:20:22 UTC**, read-only checks found the lock absent, no focused or
+focusable windows, activity **3** and battery **98%**. The bounded probe ran at
+**11:20:37 UTC** against implementation commit `5641d3c`:
+
+1. Rechecked empty focus and standby, acquired `/tmp/frame-test.lock` with
+   atomic `mkdir`, wrote a unique owner marker and rechecked both conditions.
+2. Created only a disposable 640×400 X11 event-recorder window on `:0`, tagged
+   with test app ID `2000999066`. It had a 45-second alarm and closed on stdin
+   EOF. No existing application, full desktop or dashboard was started.
+3. Waited for gamescope to report that exact window (`62914561`) focused.
+   Started the production server's `TouchAgent` over SSH; it reported ready.
+4. Called production `server.remote_touch` for positioning, then
+   `server.remote_input` with a left click, `Frame66` and the Enter key button.
+   Both responses reported `sent: true`. More importantly, the **window itself
+   recorded ButtonPress/Release (button 1), the ASCII key events in order and
+   Return**. `XLookupString` decoded exactly `Frame66\r`. The events were
+   delivered through gamescope's EIS socket, not fabricated with XSendEvent.
+5. Closed the helper by EOF and waited for exit, closed the recorder, checked
+   empty focus and standby, then removed only the owner-matching test lock.
+
+[State and received events](pad-gamescope-2026-10-24/readback.json) and the
+[probe](pad-gamescope-2026-10-24/probe.py)/[X11 recorder](pad-gamescope-2026-10-24/recorder.py)
+are retained. The archived scripts use checkout-relative source paths; the
+recorded run used the same harness from `/tmp`. Motion records omit an unused
+field that only has meaning for key/button events.
+
+Delayed readback at **11:21:46 UTC** confirmed no test lock or recorder process,
+empty focused/focusable lists, Game Mode active, full Plasma inactive, activity
+3 and battery 98%. The original Steam and vrserver PIDs were unchanged. No
+install, security/global setting change, dashboard/session switch, reset or
+reboot was performed. No headset helper or owned lock remained.
+
+This establishes **focused-panel click and ASCII key delivery on `:0`**.
+It does not establish wearer-visible presentation, Unicode delivery or GUI
+interaction. The absolute-position setup reached the recorder's edge
+(639,399), rather than its centre; pixel-accurate absolute pointing is **not**
+proved by this small-window probe. The trackpad click and typed keys still
+arrived in the owned focused window. The original PR's earlier acceptance-only
+observations remain historical; this observation adds actual window events.
+
+## Offline checks and remaining limits
+
+- `python3 -m unittest discover -s tests -p test_input.py -v`: **58 passed**.
+- `python3 -m unittest discover -s tests -p test_touch.py -v`: **43 passed**.
+- `python3 -m unittest discover -s tests -p test_service_regressions.py -v`:
+  **34 passed**.
+- `python3 -m unittest discover -s tests -v`: **1,403 ran, OK, 15 skipped**
+  (Linux x86_64, Python 3.12; 150.825 seconds).
+- Full fake-Frame e2e in task-specific Docker project `frame-control-pr66`:
+  **47 passed** after the lock fix (192.270 seconds). Both task containers,
+  their network and all three volumes were removed afterward. The run emitted
+  an unclosed test-socket ResourceWarning; the suite returned OK.
+- Node page suites: `ctrl_gestures.mjs`, `pad_queue.mjs`, `desk_panels.mjs`
+  passed, using the production page functions.
+- `node --test app/test/*.test.js`: **3 test files passed**.
+- `node --test site/test/*.test.mjs`: **2 test files passed**.
+- Python compilation, desktop/site JavaScript syntax and `git diff --check`
+  passed. Fake-Frame e2e and exact-head CI results are recorded in the PR after completion.
+
+The first full regression run executed 1,401 tests and found two tests still
+expecting `/api/input` to start the old KDE Connect helper. They were updated
+to the intended gamescope route. The final full run includes the lazy-KDE
+regression above and the lock-order regression below. The initial restricted-sandbox input run could not open
+loopback sockets; the focused rerun with managed network access passed.
+
+Review of the merged code then found a lock inversion: the Unicode worker
+held the pad-send lock while `InputAgent.start()` acquired the route lock,
+whereas a headset switch held the route lock before resetting the pad. A
+bounded subprocess regression reproduced the deadlock with the real
+`InputAgent.send/start` methods and an offline launch stub. Unicode delivery
+and resets now take the route lock before the pad lock; the route lock is
+reentrant so an agent can capture its route inside that reservation. The new
+regression passed after the fix, as did all **58 focused input tests** and
+the **1,403-test full suite** (15 skipped). The local fake-Frame suite also
+passed **47 tests after this fix**. Exact-head CI results are recorded in the PR.
+
+Remaining device work requires an idle, available Frame and the shared lock:
+verify Unicode in a real text field, ordering under real typing load and
+precise absolute pointing for small panels. Worn-headset presentation,
+packaged Electron pointer lock and Windows GUI execution remain separate
+checks. Automated Windows/macOS CI does not establish those interactions.
+
+
+## Review round 2: queue saturation and failure recovery
+
+The coordinator identified silent eviction in both `_queue_for_kde()` and the
+worker's retry path. Both sliced the oldest accepted events off at 200 entries,
+even though the page had already received `sent: true` and discarded its copy.
+
+Admission now serializes concurrent requests, checks capacity before any pointer
+or keyboard send, and returns `sent: false, state: waiting` if the whole batch
+will not fit. Text stays in the bounded queue while in flight, and is removed
+only after the helper accepts it. Rejected mixed batches send no clicks; retrying
+them cannot duplicate clicks already sent by this server. The page polls until
+it can retry. Pointer input stays usable while accepted text is pending.
+
+The old worker also left its worker marker and one-hour timing sentinel behind
+if `send()` raised. Failure/timeout handling now retains unsent text, clears the
+worker/timing state and exposes an error through input status. The page polls
+accepted text without requiring another keypress. **Try again** explicitly
+restarts the retained queue. Thread-start failures follow the same retention
+rule. A stale worker's exception cannot change the new route's state.
+
+The proposed send-to-enqueue headset-switch race was not reachable through the
+normal HTTP switch path: `Handler.do_POST()` reserves `working(meant)` across
+both operations; `devices_post()` shares `_work_lock` and refuses a moving
+operation while work is active. Connector configuration/reconnect paths defer
+changed headsets while work runs. A production-handler regression attempts a
+switch at both send and enqueue and passes even on the previous implementation.
+No separate connector change was needed. Atomic queue admission now uses the
+existing route-before-pad lock order as well, because starting either input
+agent can capture its route synchronously.
+
+Three deterministic saturation regressions fail on `215db7b` and pass with the
+fix: capacity during the typing delay, capacity during an unsuccessful-send
+retry, and two concurrent producers competing for the last slots. They check
+exact accepted event sequences, reject a mixed click/text batch before its
+pointer effects, and verify delivery exactly once after retry. Additional tests
+cover explicit recovery after timeout, helper errors, send exceptions and
+thread-start failure, stale-worker isolation, HTTP status/start behavior, and
+the production page's polling/error behavior.
+
+No new active headset test was performed: this change affects host queue
+admission/recovery and status handling, not Frame event translation or injection.
+The earlier real click/ASCII evidence remains scoped to its recorded commit.
+Real Unicode, packaged Electron pointer lock, Windows GUI, wearer-visible
+presentation and precise small-window absolute positioning remain unverified.
+`sent: true` means accepted by this server, not application delivery. The queue
+is in memory; switching headsets cancels it and server exit loses it. A transport
+failure after a partial write can still make delivery ambiguous; this is not an
+end-to-end exactly-once protocol.
+
+Round 2 local verification: **141 focused input/touch/service tests passed**
+(62 input, 43 touch, 36 service; 20.061 seconds), and **1,409 server tests ran, OK, 15 skipped**
+(Linux x86_64, Python 3.12, 153.198 seconds). All three production-page Node
+suites passed; app tests passed (3 files), site tests passed (2 files), Python
+compilation and `git diff --check` passed. The existing skipped tests require
+zsh, macOS/Swift or built native PC libraries. Current-head CI is tracked in
+PR #66; the previous 47-test local fake-Frame run above is historical.
@@ -0,0 +1,129 @@
+"""Active real-Frame evidence probe: aborts unless idle, then owns the shared lock.
+
+Run manually on an authorised host: python3 docs/evidence/pad-gamescope-2026-10-24/probe.py
+The recorded run used /tmp paths; archived paths are relative to this checkout.
+"""
+import base64
+import datetime
+import json
+import os
+from pathlib import Path
+import queue
+import shlex
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import uuid
+
+ROOT = Path(__file__).resolve().parents[3]
+data = tempfile.TemporaryDirectory(prefix='pr66-live-')
+os.environ.update(FRAME_CONTROL_DATA_DIR=data.name, FRAME_CONTROL_TELEMETRY='0', FRAME_PRIVATE_SSH='1')
+sys.path.insert(0, str(ROOT / 'ui'))
+import server
+
+SSH = ['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', 'frame']
+owner = 'pr66-' + uuid.uuid4().hex
+result = {'time': datetime.datetime.now(datetime.timezone.utc).isoformat(), 'owner': owner,
+          'base': '0da1fe5', 'route': 'production server.remote_input -> TouchAgent SSH -> frame_touch.py -> gamescope EIS',
+          'events': []}
+recorder = None
+locked = False
+rows = queue.Queue()
+
+def ssh(cmd):
+    return subprocess.run([*SSH, cmd], capture_output=True, text=True, timeout=15, check=True).stdout
+
+def focus():
+    return json.loads(server.ssh('python3 - focus', stdin=(ROOT/'ui/frame_touch.py').read_text(), timeout=15))
+
+def activity():
+    return json.loads(ssh('/opt/steamvr/bin/linuxarm64/vrcmd --stats'))[0]['activity_level']
+
+def read_rows():
+    for raw in recorder.stdout:
+        rows.put(json.loads(raw))
+
+def collect(seconds):
+    end = time.monotonic() + seconds
+    while time.monotonic() < end:
+        try:
+            result['events'].append(rows.get(timeout=max(0.01, end-time.monotonic())))
+        except queue.Empty:
+            break
+
+try:
+    result['initial_focus'] = focus()
+    result['initial_activity'] = activity()
+    assert not result['initial_focus'].get('window'), 'existing focused panel; do not interrupt'
+    assert result['initial_activity'] == 3, 'headset is not in standby'
+    ssh('mkdir /tmp/frame-test.lock && printf %s ' + shlex.quote(owner) + ' > /tmp/frame-test.lock/owner')
+    locked = True
+    result['lock_acquired'] = True
+    assert not focus().get('window') and activity() == 3, 'session changed during lock acquisition'
+    code = base64.b64encode(Path(__file__).with_name('recorder.py').read_bytes()).decode()
+    command = 'python3 -u -c ' + shlex.quote("import base64;exec(compile(base64.b64decode('" + code + "'),'pr66-recorder','exec'))")
+    recorder = subprocess.Popen([*SSH, command], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE, text=True)
+    threading.Thread(target=read_rows, daemon=True).start()
+    initial = rows.get(timeout=8)
+    result['recorder'] = initial
+    assert initial.get('ready'), initial
+    window = initial['window']
+    for _ in range(20):
+        current = focus()
+        if current.get('window') == window:
+            break
+        time.sleep(0.2)
+    result['focused_panel'] = current
+    assert current.get('window') == window and current.get('display') == ':0', 'owned panel did not obtain focus; no input sent'
+    server.remote_input({})
+    for _ in range(50):
+        if server._touch.status.get('state') in ('ready', 'error'):
+            break
+        time.sleep(0.1)
+    result['agent_status'] = dict(server._touch.status)
+    assert result['agent_status'].get('state') == 'ready', result['agent_status']
+    target = {'window': window, 'display': ':0'}
+    assert focus().get('window') == window and activity() == 3
+    result['position_response'] = server.remote_touch({'events': [dict(target, fx=0.5, fy=0.5)]})
+    time.sleep(0.2)
+    assert focus().get('window') == window and activity() == 3
+    result['pad_response'] = server.remote_input({'events': [{'singleclick': True}, {'key': 'Frame66'}, {'specialKey': 12}]})
+    collect(2)
+    received = result['events']
+    result['received_text'] = ''.join(e.get('text', '') for e in received if e.get('type') == 2)
+    result['click_received'] = any(e.get('type') == 4 and e.get('code') == 1 and e.get('window') == window for e in received)
+    result['release_received'] = any(e.get('type') == 5 and e.get('code') == 1 and e.get('window') == window for e in received)
+    result['passed'] = result['click_received'] and result['release_received'] and result['received_text'] == 'Frame66\r'
+    assert result['passed'], 'event recorder did not observe expected click and keys'
+except Exception as e:
+    result['error'] = str(e)
+finally:
+    proc = server._touch.proc
+    server.reset_pad_route()
+    if proc:
+        try:
+            proc.wait(timeout=8)
+            result['input_helper_exited'] = True
+        except subprocess.TimeoutExpired:
+            proc.terminate()
+            proc.wait(timeout=5)
+            result['input_helper_terminated'] = True
+    if recorder:
+        recorder.stdin.close()
+        recorder.wait(timeout=8)
+        collect(0.2)
+        result['recorder_exit'] = recorder.returncode
+        result['recorder_stderr'] = recorder.stderr.read()[-1000:]
+    if locked:
+        result['final_focus'] = focus()
+        result['final_activity'] = activity()
+        ssh('test "$(cat /tmp/frame-test.lock/owner)" = ' + shlex.quote(owner)
+            + ' && rm /tmp/frame-test.lock/owner && rmdir /tmp/frame-test.lock')
+        result['owned_lock_released'] = True
+    Path('/tmp/pr66-live.json').write_text(json.dumps(result, indent=2) + '\n')
+    print(json.dumps(result, indent=2))
+    data.cleanup()
+sys.exit(0 if result.get('passed') else 1)
@@ -0,0 +1,280 @@
+{
+  "time": "2026-10-24T11:20:37.392607+00:00",
+  "owner": "pr66-7c2a8e8851f449bcb0bb6a040be94d99",
+  "base": "0da1fe5",
+  "route": "production server.remote_input -> TouchAgent SSH -> frame_touch.py -> gamescope EIS",
+  "events": [
+    {
+      "type": 6,
+      "window": 62914561,
+      "x": 320,
+      "y": 200,
+      "synthetic": false
+    },
+    {
+      "type": 6,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "synthetic": false
+    },
+    {
+      "type": 4,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 1,
+      "synthetic": false
+    },
+    {
+      "type": 5,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 1,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 50,
+      "synthetic": false,
+      "text": "",
+      "keysym": 65505
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 41,
+      "synthetic": false,
+      "text": "F",
+      "keysym": 70
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 41,
+      "synthetic": false
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 50,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 27,
+      "synthetic": false,
+      "text": "r",
+      "keysym": 114
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 27,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 38,
+      "synthetic": false,
+      "text": "a",
+      "keysym": 97
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 38,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 58,
+      "synthetic": false,
+      "text": "m",
+      "keysym": 109
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 58,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 26,
+      "synthetic": false,
+      "text": "e",
+      "keysym": 101
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 26,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false,
+      "text": "6",
+      "keysym": 54
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false,
+      "text": "6",
+      "keysym": 54
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 36,
+      "synthetic": false,
+      "text": "\r",
+      "keysym": 65293
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 36,
+      "synthetic": false
+    },
+    {
+      "cleaned": true
+    }
+  ],
+  "initial_focus": {
+    "window": null
+  },
+  "initial_activity": 3,
+  "lock_acquired": true,
+  "recorder": {
+    "ready": true,
+    "window": 62914561,
+    "pid": 317210,
+    "display": ":0",
+    "appid": 2000999066
+  },
+  "focused_panel": {
+    "window": 62914561,
+    "display": ":0",
+    "name": "Frame Control PR66 disposable input probe",
+    "x": 0,
+    "y": 0,
+    "width": 640,
+    "height": 400,
+    "root": [
+      1920,
+      1080
+    ],
+    "app": 2000999066
+  },
+  "agent_status": {
+    "state": "ready",
+    "focus": 62914561
+  },
+  "position_response": {
+    "state": "ready",
+    "focus": 62914561,
+    "sent": true
+  },
+  "pad_response": {
+    "state": "ready",
+    "focus": 62914561,
+    "sent": true
+  },
+  "received_text": "Frame66\r",
+  "click_received": true,
+  "release_received": true,
+  "passed": true,
+  "input_helper_exited": true,
+  "recorder_exit": 0,
+  "recorder_stderr": "",
+  "final_focus": {
+    "window": null
+  },
+  "final_activity": 3,
+  "owned_lock_released": true,
+  "implementation_commit": "5641d3c316dfe225321f7233840cc83ff8c3f527",
+  "device": {
+    "steamos": "0.5.6",
+    "build_id": "20261015.6141207",
+    "steamvr": "2.18.2",
+    "battery_before": 98,
+    "battery_after": 98
+  },
+  "delayed_cleanup": {
+    "time": "2026-10-24T11:21:46Z",
+    "shared_lock_absent": true,
+    "owned_recorder_absent": true,
+    "game_mode": "active",
+    "full_plasma": "inactive",
+    "steam_pid": 297826,
+    "vrserver_pid": 297506,
+    "focusable_windows": [],
+    "focused_windows": [],
+    "activity_level": 3
+  },
+  "limits": [
+    "No wearer or packaged Electron/GUI interaction",
+    "ASCII only; Unicode and cross-service ordering not tested on device",
+    "The positioning setup reached the recorder edge (639,399); pixel-accurate absolute targeting is not established by this probe"
+  ]
+}
@@ -0,0 +1,82 @@
+"""Disposable X11 event recorder used for the PR #66 focused-input observation."""
+import ctypes as C
+import json
+import os
+import select
+import signal
+import time
+
+X = C.CDLL('libX11.so.6')
+P, U = C.c_void_p, C.c_ulong
+for name, restype, args in [
+    ('XOpenDisplay', P, [C.c_char_p]), ('XDefaultRootWindow', U, [P]),
+    ('XCreateSimpleWindow', U, [P, U, C.c_int, C.c_int, C.c_uint, C.c_uint, C.c_uint, U, U]),
+    ('XInternAtom', U, [P, C.c_char_p, C.c_int]),
+    ('XChangeProperty', C.c_int, [P, U, U, U, C.c_int, C.c_int, P, C.c_int]),
+    ('XStoreName', C.c_int, [P, U, C.c_char_p]),
+    ('XSelectInput', C.c_int, [P, U, C.c_long]), ('XMapWindow', C.c_int, [P, U]),
+    ('XFlush', C.c_int, [P]), ('XPending', C.c_int, [P]),
+    ('XConnectionNumber', C.c_int, [P]), ('XNextEvent', C.c_int, [P, P]),
+    ('XLookupString', C.c_int, [P, P, C.c_int, P, P]),
+    ('XDestroyWindow', C.c_int, [P, U]), ('XCloseDisplay', C.c_int, [P]),
+]:
+    fn = getattr(X, name)
+    fn.restype, fn.argtypes = restype, args
+
+class InputEvent(C.Structure):
+    _fields_ = [('type', C.c_int), ('serial', U), ('send_event', C.c_int),
+               ('display', P), ('window', U), ('root', U), ('subwindow', U),
+               ('time', U), ('x', C.c_int), ('y', C.c_int), ('x_root', C.c_int),
+               ('y_root', C.c_int), ('state', C.c_uint), ('code', C.c_uint),
+               ('same_screen', C.c_int)]
+
+class Event(C.Union):
+    _fields_ = [('type', C.c_int), ('input', InputEvent), ('pad', C.c_long * 24)]
+
+def say(**row):
+    print(json.dumps(row), flush=True)
+
+def end(*_):
+    raise TimeoutError('probe ended')
+
+signal.signal(signal.SIGTERM, end)
+signal.signal(signal.SIGALRM, end)
+signal.alarm(45)
+d = X.XOpenDisplay(b':0')
+assert d, 'X display unavailable'
+w = 0
+try:
+    w = X.XCreateSimpleWindow(d, X.XDefaultRootWindow(d), 0, 0, 640, 400, 0, 0, 0x224466)
+    for name, value in [(b'STEAM_GAME', 2000999066), (b'_NET_WM_PID', os.getpid())]:
+        val = U(value)
+        X.XChangeProperty(d, w, X.XInternAtom(d, name, 0), 6, 32, 0, C.byref(val), 1)
+    X.XStoreName(d, w, b'Frame Control PR66 disposable input probe')
+    X.XSelectInput(d, w, 1 | 2 | 4 | 8 | 64 | 32768 | 2097152)
+    X.XMapWindow(d, w)
+    X.XFlush(d)
+    say(ready=True, window=w, pid=os.getpid(), display=':0', appid=2000999066)
+    while True:
+        while X.XPending(d):
+            event = Event()
+            X.XNextEvent(d, C.byref(event))
+            if event.type in (2, 3, 4, 5, 6):
+                e = event.input
+                row = dict(type=event.type, window=e.window, x=e.x, y=e.y,
+                           synthetic=bool(e.send_event))
+                if event.type != 6:
+                    row['code'] = e.code
+                if event.type == 2:
+                    buf, keysym = C.create_string_buffer(32), U()
+                    n = X.XLookupString(C.byref(e), buf, 32, C.byref(keysym), None)
+                    row.update(text=buf.raw[:n].decode('utf-8', 'replace'), keysym=keysym.value)
+                say(**row)
+        ready, _, _ = select.select([0, X.XConnectionNumber(d)], [], [], 0.2)
+        if 0 in ready and not os.read(0, 1024):
+            break
+except TimeoutError:
+    pass
+finally:
+    if w:
+        X.XDestroyWindow(d, w)
+    X.XCloseDisplay(d)
+    say(cleaned=True)
@@ -0,0 +1,65 @@
+# Panel discovery investigation, 2026-10-24
+
+Base: v0.4.16 (`040581a`). Scope: issue #73, Desktop Capture and Control.
+
+## Evidence and change
+
+Issue #73 reports SteamOS 0.4.5 with its desktop visibly running, without a
+Frame Control version or steps. The maintainer's 2026-10-12 comment identifies
+the duplicate `loadPanels` UI function fixed in 0.4.3 and requests the exact
+remaining message and SteamOS build if it persists. There is no reporter
+follow-up. At this base, the functions are distinct and the existing Node
+regression checks their uniqueness and the Desktop GET request.
+
+Read-only source inspection found a remaining diagnostic ambiguity:
+`read_props()` returns `{}` for failed/timed-out X queries and missing root
+properties. `panels()` treated that like a confirmed empty focusable-window
+list. With no detected Plasma process it claimed no panel was open; with Plasma
+it claimed SteamOS was not listing the desktop. Neither claim follows from an
+unreadable list.
+
+The change checks for the presence of `GAMESCOPE_FOCUSABLE_WINDOWS` before
+those claims. An absent list now reports unknown panel state, suggests checking
+SteamVR and retrying/Headset view, and asks for the exact message and SteamOS
+version if persistent. Missing-tool and whole-run deadline explanations retain
+precedence. No new probes, retries, timeouts, input or capture routes are added.
+
+## Real-device boundary
+
+A preliminary read-only SSH inspection returned SteamOS 0.5.6, BUILD_ID
+`20261015.6141207`, battery 99%, discharging, and X0/X1 socket names. It made
+no headset changes. The shared lock was absent at that moment.
+
+The subsequent atomic `mkdir /tmp/frame-test.lock` failed with `File exists`.
+The guarded command exited with status 3 before the session, X-property or
+panel-helper probes ran. The other task's lock was left alone. No application
+was installed, started, stopped or focused; no headset settings changed.
+
+That implementation probe was blocked by the occupied shared device. The
+coordinator later supplied a separate narrow read-only observation on SteamOS
+0.5.6, BUILD_ID `20261015.6141207`, at battery 99%, with the shared lock absent
+and both `xprop` and `xwininfo` installed:
+
+- In **Game Mode**, `DISPLAY=:0 xprop -root GAMESCOPE_FOCUSABLE_WINDOWS
+  GAMESCOPE_FOCUSED_WINDOW` returned both properties **present but empty**.
+- On `DISPLAY=:1`, both properties were reported **not found**.
+
+This observation distinguishes a confirmed empty list on `:0` from absent
+properties on `:1`. It does **not** reproduce #73's Desktop Mode report on
+SteamOS 0.4.5, and it does **not** test this PR's code on the headset. It is a
+coordinator-supplied observation, separate from the blocked implementation probe
+above; no new headset probe was run for this follow-up.
+
+Remaining limit: there is no reproduction establishing a further
+capture/discovery fix for the reported Desktop Mode/build combination. This PR
+improves a demonstrated diagnostic error; it must not close #73 as a verified
+new capture fix.
+
+## Offline verification
+
+Focused Python regressions distinguish absent, focus-only, failed/timed-out X
+queries, confirmed empty and desktop-running lists. Existing tests cover
+missing tools, alternate displays, successful discovery and the 12-second
+deadline. The production page's Node behavior test verifies that both Capture
+and Control preserve the unreadable-list advice. These use fake X/HTTP/DOM
+boundaries and do not prove real SteamOS 0.4.5 capture or physical input.
@@ -0,0 +1,168 @@
+# Saved panel layouts: feasibility recheck, 2026-10-24
+
+Issue: [#31](https://github.com/saphid/frame-control/issues/31). Base: main
+`5b47cd3`. This investigation covers spatial save/restore for existing
+Steam/gamescope panels without another overlay application.
+
+## Decision and user behavior
+
+Keep saved layouts unavailable. The current Frame exposes some geometry,
+including a standing-space coordinate transform, but this investigation did
+not establish a complete dock-state snapshot or a controlled restore path for
+these panels. The existing companion/headset switcher still lists panels and
+requests focus; users arrange them with SteamVR's dashboard controls. No layout
+file, new control, overlay application or background service is added.
+
+This is a limit of the investigated route, not proof that every native
+implementation is impossible. In particular, failure of
+`GetOverlayTransformAbsolute` does **not** mean all pose readback is denied.
+
+## Device and read-only results
+
+SteamOS **0.5.6**, BUILD_ID **20261015.6141207**; `vrcmd --version`:
+**2.18.2**. `gamescope-session.service` was active and
+`plasma-workspace.target` inactive: Game Mode. gamescope used the OpenVR backend
+and `--virtual-connector-strategy PerAppId`. Battery was 99%, Not charging,
+before the probe and 100%, Full, afterwards.
+
+The [exact probe](panel-layout-2026-10-24/probe.py) loads only
+`FnTable:IVROverlay_028` from the shipped
+`/opt/steamvr/bin/linuxarm64/libopenvr_api.so`. It uses application type 3
+(`VRApplication_Background`, avoiding runtime startup) and shuts down its own
+OpenVR connection in `finally`. Initialization and interface acquisition both
+returned 0. It calls getters only, with no image capture or input injection.
+
+[Raw result](panel-layout-2026-10-24/readback.json):
+
+| Getter | `valve.steam.desktopgame.0` | `valve.steam.gamepadui.main` |
+|---|---|---|
+| FindOverlay | 0, Success | 0, Success |
+| Rendering process | `gamescope-wl` | `gamescope-wl` |
+| Width | 0; 2.6700000763 m | 0; 2.6670000553 m |
+| Curvature | 0; 0 | 0; 0 |
+| Transform type | 0; 5, DashboardTab | 0; 5, DashboardTab |
+| Absolute transform | 18, WrongTransformType | 18, WrongTransformType |
+| Tracked-device-relative transform | 18, WrongTransformType | 18, WrongTransformType |
+| Coordinate transform, center, standing origin | 0; identity matrix | 0; scaled/translated matrix |
+| Coordinate transform, center, seated origin | 23, RequestFailed | 23, RequestFailed |
+| Coordinate transform, center, raw origin | 23, RequestFailed | 23, RequestFailed |
+
+The dashboard and both panels were reported hidden; neither panel was active.
+The standing-space matrix is the transform for the overlay point `(0.5, 0.5)`;
+it does not identify World/Dashboard/Theater/controller docking or recreate a
+dashboard frame. The Steam panel's basis has scale about 0.369. Treat neither
+that scaled matrix nor the hidden Gamescope panel's identity as a validated
+physical placement to feed to an absolute-transform setter. Visible placement,
+matrix freshness and correspondence to dashboard size were not checked by a
+wearer.
+
+## API and dashboard boundary
+
+The ABI and result names were checked against Valve's
+[OpenVR v2.12.14 C header](https://github.com/ValveSoftware/openvr/blob/v2.12.14/headers/openvr_capi.h)
+and [C++ interface comments](https://github.com/ValveSoftware/openvr/blob/v2.12.14/headers/openvr.h).
+That header declares `IVROverlay_028`; its SHA-256 is
+`d58a2b149e434b2b8ee25cb4253ca6157feed8092f621e78ecfed6846d35d3e4`.
+The absolute getter is explicitly limited to absolute transforms. The
+coordinate getter returns the 3D transform for a 2D overlay point. Public
+`IVROverlay_028` has no getter/setter pair for dashboard dock location or frame
+scene-graph state. The probe fails closed if that exact interface is absent.
+
+Read-only inspection of the shipped dashboard
+`/opt/steamvr/resources/webinterface/dashboard/chunk~8012d0c89.js`
+(SHA-256 `937ec62c67a481f030a416099ceb98b0fe2a702aea5a0705601c6c40d4969f6d`)
+found:
+
+- `dockLocation` reads an internal `_getDockLocation(frameID)` store;
+  `SetDockLocation` updates that store or sends a VRLink request.
+- `m_mapLastRelativeTransformForDockLocation` keeps per-location transforms.
+  World initialization requests a dashboard scene-graph transform through
+  `requestSGTransform`, then updates the component's `xfTransform`.
+- The `vrcmd_dock_overlay` handler accepts `dashboard`, `lefthand`, `righthand`,
+  `theater` and `world`. It selects the frame associated with the supplied key,
+  **falls back to the active frame if no match exists**, sets dock location and
+  may switch frame. This is not an exact pose restore or a readback response.
+
+Those are observations of shipped internal code, not proof that Frame Control
+can safely access its state through a supported external API. No dashboard
+JavaScript was injected, private store edited or VRLink command sent. The
+active-frame fallback is an additional reason not to experiment with docking
+commands on a stale key.
+
+The [2026-09-28 probe](../panels.md#saved-spatial-layouts-blocked-on-the-current-panel-route)
+on SteamOS 0.4.1 / SteamVR 2.18.1 recorded an absolute setter returning
+12 (`PermissionDenied`) on a temporary, test-owned gamescope panel. That setter
+result is **historical**, not a new test on 2.18.2. The newer read-only results
+above neither overturn nor reverify it.
+
+## Commands, safety and cleanup
+
+Read-only inspection used `ssh frame` with `BatchMode=yes` and
+`ConnectTimeout=10`, `cat /etc/os-release`, battery sysfs reads,
+`systemctl --user is-active gamescope-session.service plasma-workspace.target`,
+process inspection, and `vrcmd --version`, `--help`, `--overlays`. An initial
+`--listoverlays` attempt returned `Unknown command`; `--overlays` is the actual
+enumeration command. Dashboard sources were read/copied to local `/tmp` for
+inspection. No files were installed on the Frame.
+
+Run the retained probe from the repository root, following
+[the shared-device rules](../testing.md#headset-smoke-test). Stop if the lock is
+occupied or battery is at/below 20%; never remove another task's lock:
+
+```sh
+ssh -o BatchMode=yes -o ConnectTimeout=10 frame \
+  'set -eu; mkdir /tmp/frame-test.lock || exit 3; trap "rmdir /tmp/frame-test.lock" EXIT; timeout 25 python3 -' \
+  < docs/evidence/panel-layout-2026-10-24/probe.py
+```
+
+This command acquired the lock, completed with exit 0 and released it. A
+subsequent check confirmed the lock absent, Game Mode active, and Steam,
+`vrserver` and `vrcompositor` running. The probe's only headset filesystem
+change was creating/removing that shared lock. Its Python source ran from
+stdin. There were no test panels, installs, profiles or services to remove.
+
+No mutation test was essential: without verified dock/relative-frame readback,
+there was no exact original layout and bounded rollback to justify changing a
+panel. Existing user panels were never focused, shown, hidden, resized, moved
+or docked. No global settings, security, passwords, runtime processes or modes
+were changed; no reboot or reset occurred.
+
+## Validation and remaining gaps
+
+Existing `tests/test_panels.py` covers main-panel enumeration, hidden panels,
+focus revalidation, unavailable-runtime errors and HTTP authentication/Host/
+Origin guards. `tests/test_page_scripts.py` checks the production page's shared
+JavaScript scope. These offline checks do not prove spatial placement. The
+retained probe is evidence tooling, not a new product API; no fake layout
+backend or layout tests claiming device support were added.
+
+Validation passed:
+
+```sh
+python3 -m unittest discover -s tests -p test_panels.py -v       # 8 passed
+python3 -m unittest discover -s tests -p test_page_scripts.py -v # 5 passed
+python3 -m py_compile docs/evidence/panel-layout-2026-10-24/probe.py
+python3 -m json.tool docs/evidence/panel-layout-2026-10-24/readback.json
+git diff --check
+```
+
+The initial panel-suite attempt hit sandbox socket restrictions in four HTTP
+tests; rerunning with loopback sockets permitted passed all eight. No real
+headset connection is used by those tests. The full suite and fake Frame were
+not run for this evidence-only change.
+
+Before shipping layouts, a native route still needs proof of dock state and
+relative-frame readback, authorized restore on an owned test panel with exact
+rollback, and correspondence between saved size/pose and visible placement.
+It also needs stable source identity and a fresh capture-permission/ticket
+flow when reopening viewers. Reconnect, panel recreation, reboot recovery,
+Steam-launched gameplay, controller docking and worn-headset input were not
+tested here. The existing Frame Control-owned media renderer is not proof that
+Steam/gamescope panels can be restored. No third-party overlay app was used.
+
+## Announcement
+
+We rechecked saved panel layouts on SteamOS 0.5.6. SteamVR exposes some panel
+geometry, but we have not verified safe restoration of Steam's panel positions
+and docking. Saved layouts remain unavailable; use SteamVR's dashboard to
+arrange panels. The panel switcher continues to list and show open panels.
@@ -0,0 +1,89 @@
+"""Read-only issue #31 probe; pipe to `ssh frame 'timeout 25 python3 -'`.
+
+Acquire /tmp/frame-test.lock first per docs/testing.md. No overlay is created,
+focused, docked or changed. Background init (3) does not start SteamVR.
+ABI: ValveSoftware/openvr v2.12.14 headers/openvr_capi.h, IVROverlay_028.
+"""
+import ctypes as C
+import json
+from pathlib import Path
+
+H = C.c_uint64
+Matrix = C.c_float * 12
+
+
+class Vector2(C.Structure):
+    _fields_ = [('v', C.c_float * 2)]
+
+
+def probe():
+    vr = C.CDLL('/opt/steamvr/bin/linuxarm64/libopenvr_api.so')
+    vr.VR_InitInternal2.argtypes = [C.POINTER(C.c_int), C.c_int, C.c_char_p]
+    vr.VR_InitInternal2.restype = C.c_uint32
+    vr.VR_GetGenericInterface.argtypes = [C.c_char_p, C.POINTER(C.c_int)]
+    vr.VR_GetGenericInterface.restype = C.c_void_p
+    vr.VR_ShutdownInternal.argtypes = []
+    vr.VR_ShutdownInternal.restype = None
+    err = C.c_int()
+    vr.VR_InitInternal2(C.byref(err), 3, None)
+    report = {'init_error': err.value, 'interface': 'IVROverlay_028', 'panels': []}
+    if err.value:
+        return report
+    try:
+        ptr = vr.VR_GetGenericInterface(b'FnTable:IVROverlay_028', C.byref(err))
+        report['interface_error'] = err.value
+        if err.value or not ptr:
+            return report
+        table = C.cast(ptr, C.POINTER(C.c_void_p))
+
+        def function(slot, result, *args):
+            return C.CFUNCTYPE(result, *args)(table[slot])
+
+        def read(slot, handle, output_type):
+            output = output_type()
+            rc = function(slot, C.c_int, H, C.POINTER(output_type))(handle, C.byref(output))
+            return {'rc': rc, 'value': output.value if rc == 0 else None}
+
+        report['dashboard_visible'] = function(68, C.c_bool)()
+        for key in ('valve.steam.desktopgame.0', 'valve.steam.gamepadui.main'):
+            row = {'key': key}
+            report['panels'].append(row)
+            handle = H()
+            row['find_rc'] = function(0, C.c_int, C.c_char_p, C.POINTER(H))(
+                key.encode(), C.byref(handle))
+            if row['find_rc']:
+                continue
+            pid = function(10, C.c_uint32, H)(handle)
+            row['rendering_pid'] = pid
+            try:
+                row['rendering_comm'] = Path('/proc/%d/comm' % pid).read_text().strip()
+            except OSError:
+                row['rendering_comm'] = None
+            row['visible'] = function(45, C.c_bool, H)(handle)
+            row['active_dashboard'] = function(69, C.c_bool, H)(handle)
+            row['width_m'] = read(23, handle, C.c_float)
+            row['curvature'] = read(25, handle, C.c_float)
+            row['transform_type'] = read(32, handle, C.c_int)
+            for name, slot, scalar in (('absolute', 34, C.c_int),
+                                       ('tracked_device_relative', 36, C.c_uint32)):
+                origin = scalar()
+                matrix = Matrix()
+                rc = function(slot, C.c_int, H, C.POINTER(scalar), C.POINTER(Matrix))(
+                    handle, C.byref(origin), C.byref(matrix))
+                row[name] = {'rc': rc, 'origin_or_device': origin.value if rc == 0 else None,
+                             'matrix': list(matrix) if rc == 0 else None}
+            row['coordinate_transforms'] = []
+            for origin in (0, 1, 2):  # seated, standing, raw/uncalibrated
+                matrix = Matrix()
+                rc = function(46, C.c_int, H, C.c_int, Vector2, C.POINTER(Matrix))(
+                    handle, origin, Vector2((.5, .5)), C.byref(matrix))
+                row['coordinate_transforms'].append({
+                    'tracking_origin': origin, 'coordinates': [.5, .5], 'rc': rc,
+                    'matrix': list(matrix) if rc == 0 else None})
+        return report
+    finally:
+        vr.VR_ShutdownInternal()
+
+
+if __name__ == '__main__':
+    print(json.dumps(probe(), indent=2, allow_nan=False))
@@ -0,0 +1,152 @@
+{
+  "init_error": 0,
+  "interface": "IVROverlay_028",
+  "panels": [
+    {
+      "key": "valve.steam.desktopgame.0",
+      "find_rc": 0,
+      "rendering_pid": 297037,
+      "rendering_comm": "gamescope-wl",
+      "visible": false,
+      "active_dashboard": false,
+      "width_m": {
+        "rc": 0,
+        "value": 2.6700000762939453
+      },
+      "curvature": {
+        "rc": 0,
+        "value": 0.0
+      },
+      "transform_type": {
+        "rc": 0,
+        "value": 5
+      },
+      "absolute": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "tracked_device_relative": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "coordinate_transforms": [
+        {
+          "tracking_origin": 0,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        },
+        {
+          "tracking_origin": 1,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 0,
+          "matrix": [
+            1.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            1.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            1.0,
+            0.0
+          ]
+        },
+        {
+          "tracking_origin": 2,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        }
+      ]
+    },
+    {
+      "key": "valve.steam.gamepadui.main",
+      "find_rc": 0,
+      "rendering_pid": 297037,
+      "rendering_comm": "gamescope-wl",
+      "visible": false,
+      "active_dashboard": false,
+      "width_m": {
+        "rc": 0,
+        "value": 2.6670000553131104
+      },
+      "curvature": {
+        "rc": 0,
+        "value": 0.0
+      },
+      "transform_type": {
+        "rc": 0,
+        "value": 5
+      },
+      "absolute": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "tracked_device_relative": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "coordinate_transforms": [
+        {
+          "tracking_origin": 0,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        },
+        {
+          "tracking_origin": 1,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 0,
+          "matrix": [
+            0.3689989447593689,
+            0.0,
+            0.0008894503116607666,
+            -0.5048462152481079,
+            0.0,
+            0.36899998784065247,
+            0.0,
+            1.2510287761688232,
+            -0.0008894503116607666,
+            0.0,
+            0.3689989447593689,
+            -1.1726053953170776
+          ]
+        },
+        {
+          "tracking_origin": 2,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        }
+      ]
+    }
+  ],
+  "interface_error": 0,
+  "dashboard_visible": false
+}
@@ -0,0 +1,36 @@
+{
+  "date": "2026-10-24",
+  "base": "c7489a8 (v0.4.14)",
+  "feature": "Desktop Tools power and heat observations",
+  "automated": {
+    "targeted": "python3 -m unittest discover -s tests -p 'test_power*.py': 35 passed",
+    "uiAndResourceGuard": "node --test tests/power_desktop.cjs: 7 passed",
+    "desktopApp": "node --test app/test/*.test.js: 37 passed",
+    "packaging": "Materialized ui/scripts resources selected by app/package.json; isolated Python -I imported frame_power, constructed remote payload including frame_status, and read idle status. Missing resource detection tested. Shared phone bundle import passed.",
+    "syntax": "Python compilation, sampler shell syntax and git diff --check passed",
+    "fullSuite": "python3 -m unittest discover -s tests -v: 1363 tests, OK (skipped=15), 153.274 seconds",
+    "transientFailure": "An earlier full run had one nested sandbox-test failure: the existing OneServer second-server child exited -11 (SIGSEGV), expected 1. Isolated sandbox rerun passed (6 tests), then the complete suite passed. No unrelated server-lifecycle code was changed."
+  },
+  "browser": {
+    "environment": "T3 collaborative Chromium preview, Linux, local Python Handler server; synthetic observation subprocess at accelerated one-second intervals; normal headset SSH disabled during start/stop/download verification",
+    "observations": [
+      "Opened #powerReport and verified labeled duration selector, disabled Stop/downloads before start and accessible sample progress.",
+      "Started a synthetic observation and observed 11 of 12 samples in progress; completion allowed another start.",
+      "Started again, observed progress, stopped, and saw 7 of 12 samples retained with explicit incomplete state and original frame alias.",
+      "Clicked HTML download and saw the UI acknowledge the request; T3's download list did not record the blob download, so filesystem save was not verified.",
+      "Fetched all three authenticated export endpoints in the browser: HTML 200 (7599 characters), JSON 200 (2618 characters, 7 samples), CSV 200 (977 characters); each retained the stop reason."
+    ]
+  },
+  "realFrame": {
+    "lock": "ssh frame 'mkdir /tmp/frame-test.lock' succeeded before real-device probe; this task removed only that owned empty lock with rmdir after verification",
+    "probe": "Ran the production desktop Observation using strict, batch SSH to frame. The first attempt exposed a missing structured reason on early remote lock refusal; fixed and reran successfully.",
+    "result": "0 of 12 samples; running=false; stopped='Smoke session active (/tmp/frame-test.lock); no sensors read'. Exported HTML included the same incomplete reason.",
+    "scope": "Lock refusal only. No successful real sensor session, installation, app launch/stop, power control or thermal control was performed for this feature."
+  },
+  "limitations": [
+    "Native Electron installers were not built or launched; resource staging and build-hook contracts were tested.",
+    "One latest report is retained only in server memory. Starting again, restarting the server or quitting discards it; the UI warns users to download first.",
+    "Stopping ends only the owned local SSH process. The bounded remote reader discovers closure on its next write; immediate remote cancellation is not guaranteed.",
+    "Phone-hosted observation starts are unsupported; the shared server bundle still imports without desktop sampler resources."
+  ]
+}
@@ -0,0 +1,226 @@
+{
+  "date_utc": "2026-10-24T09:27:25.354Z",
+  "result": "PASS: literal packaged desktop Return to Game Mode button switched the real Frame from full Plasma; a repeat visible click made no second switch",
+  "documentation_base_commit": "71288d8980040c14f777f0e417f41f7105eaaac4",
+  "host": "lxso2",
+  "steamos_version": "0.5.6",
+  "steamos_build": "20261015.6141207",
+  "prior_evidence": [
+    "https://github.com/saphid/frame-control/issues/142",
+    "https://github.com/saphid/frame-control/pull/143",
+    "https://github.com/saphid/frame-control/pull/156"
+  ],
+  "package": {
+    "tag": "v0.4.17",
+    "asset": "Frame-Control-linux-x86_64.AppImage",
+    "url": "https://github.com/saphid/frame-control/releases/download/v0.4.17/Frame-Control-linux-x86_64.AppImage",
+    "sha256": "b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d",
+    "verification": "sha256sum matched the live release asset digest. Independently extracted the retained asset into a new private test directory. cmp confirmed bundled frame_backup.py and frame_backup_remote.py equal the checkout versions. No source or payload was changed.",
+    "launch": "--appimage-extract, then squashfs-root/AppRun --no-sandbox --disable-gpu --remote-debugging-port=49372 --remote-debugging-address=127.0.0.1 --user-data-dir=/tmp/frame-return-button-20261024/electron-profile --window-size=1400,950",
+    "display": "Xvfb :138 -screen 0 1440x1000x24 -nolisten tcp; Electron content screenshot 1400x923",
+    "isolation": "Private XDG_CONFIG_HOME, XDG_CACHE_HOME, FRAME_CONTROL_DATA_DIR and Electron profile; FRAME_CONTROL_TELEMETRY=0 and FRAME_CONTROL_NO_UPDATE_CHECK=1. Existing authorized ssh frame identity retained; bundled server and Python used."
+  },
+  "preflight": {
+    "read_only_first": true,
+    "initial_mode": "gamescope-session.target=active; plasma-workspace-wayland.target=inactive",
+    "initial_battery_percent": 99,
+    "initial_battery_status": "Not charging; charger Full",
+    "steam_and_steamvr_running": true,
+    "running_steam_apps": [],
+    "default_login_mode": "game",
+    "lock": "mkdir /tmp/frame-test.lock succeeded atomically; no foreign lock was removed. Initial harmless probe attempt released its own lock, then a fresh atomic acquisition covered both full-session attempts."
+  },
+  "rollback": {
+    "unit": "fc-return-button-rollback-20261024",
+    "probe": "systemd-run --user --unit=fc-return-button-probe-20261024 --on-active=2s --timer-property=AccuracySec=1s --property=Type=oneshot --property=RemainAfterExit=yes /usr/bin/true",
+    "probe_execution": "Result=success\nExecMainStartTimestamp=Sat 2026-10-24 20:27:07 AEDT\nExecMainExitTimestamp=Sat 2026-10-24 20:27:07 AEDT\nExecMainCode=1\nExecMainStatus=0\n",
+    "arm": "systemd-run --user --unit=fc-return-button-rollback-20261024 --on-active=180s --timer-property=AccuracySec=1s /bin/sh -c <guarded command>",
+    "guarded_command": "if [ \"$(systemctl --user is-active gamescope-session.target)\" != active ]; then exec /usr/bin/steamosctl switch-to-game-mode; fi",
+    "verified_before_desktop": "TimersMonotonic={ OnActiveUSec=3min ; next_elapse=1d 21h 53min 49.130174s }\nNextElapseUSecMonotonic=1d 21h 53min 49.130174s\nBindsTo=\nPartOf=\nActiveState=active\nExecStart={ path=/bin/sh ; argv[]=/bin/sh -c if [ \"$(systemctl --user is-active gamescope-session.target)\" != active ]; then exec /usr/bin/steamosctl switch-to-game-mode; fi ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }\nBindsTo=\nPartOf=\n",
+    "user_manager_linger": "yes",
+    "desktop_entry": "ssh frame steamosctl switch-to-desktop-mode",
+    "first_click_utc": "2026-10-24T09:27:27.037Z",
+    "cancelled_before_deadline": true,
+    "fired": false,
+    "limit": "The benign transient timer was observed executing. The actual rollback timer configuration was read back, then cancelled after the UI restored Game Mode; its recovery action was not deliberately allowed to fire."
+  },
+  "ui": {
+    "navigation": "Clicked nav Tools, Backup & recovery, and Check in the actual packaged Electron window. Initial Game Mode disabled Return. After full Plasma entry, Check enabled it.",
+    "automation": "Playwright connected to the packaged Electron instance over local CDP and used locator.click() on the visible button; accepted the native JavaScript confirm dialog. No Return API/CLI or production handler was directly invoked by the test. T3 preview was inspected separately and closed; it cannot control this Electron window.",
+    "clicks": [
+      {
+        "isTrusted": true,
+        "utc": "2026-10-24T09:27:27.037Z"
+      },
+      {
+        "isTrusted": true,
+        "utc": "2026-10-24T09:27:32.942Z"
+      }
+    ],
+    "button_bounds_css_pixels": {
+      "x": 47,
+      "y": 709.59375,
+      "width": 156.203125,
+      "height": 44
+    },
+    "confirmation_dialogs": [
+      {
+        "type": "confirm",
+        "message": "Return the headset to Game Mode?\n\nThis closes the desktop and any apps open in it, then starts Steam's Game Mode.",
+        "utc": "2026-10-24T09:27:27.042Z"
+      },
+      {
+        "type": "confirm",
+        "message": "Return the headset to Game Mode?\n\nThis closes the desktop and any apps open in it, then starts Steam's Game Mode.",
+        "utc": "2026-10-24T09:27:32.943Z"
+      }
+    ],
+    "desktop_check": {
+      "http": 200,
+      "body": {
+        "mode": "desktop",
+        "gamescope": true,
+        "plasma": true,
+        "nested_desktop": false,
+        "configured": "gamescope-wayland.desktop",
+        "config_file": "/etc/sddm.conf.d/steamos.conf",
+        "selector": "steamosctl",
+        "session_targets": {
+          "gamescope-session.target": "inactive",
+          "plasma-workspace-wayland.target": "active"
+        },
+        "mode_source": "session-targets"
+      }
+    },
+    "return_responses": [
+      {
+        "http": 200,
+        "body": {
+          "message": "Asked the headset to return to Game Mode; it restarts its session in a few seconds",
+          "state": {
+            "mode": "desktop",
+            "gamescope": true,
+            "plasma": true,
+            "nested_desktop": false,
+            "configured": "gamescope-wayland.desktop",
+            "config_file": "/etc/sddm.conf.d/steamos.conf",
+            "selector": "steamosctl",
+            "session_targets": {
+              "gamescope-session.target": "inactive",
+              "plasma-workspace-wayland.target": "active"
+            },
+            "mode_source": "session-targets"
+          },
+          "switched": true,
+          "command": "steamosctl switch-to-game-mode"
+        },
+        "utc": "2026-10-24T09:27:27.316Z"
+      },
+      {
+        "http": 200,
+        "body": {
+          "message": "The headset is already in Game Mode. The desktop you see is a panel: close it from the Steam dashboard.",
+          "state": {
+            "mode": "game",
+            "gamescope": true,
+            "plasma": false,
+            "nested_desktop": false,
+            "configured": "gamescope-wayland.desktop",
+            "config_file": "/etc/sddm.conf.d/steamos.conf",
+            "selector": "steamosctl",
+            "session_targets": {
+              "gamescope-session.target": "active",
+              "plasma-workspace-wayland.target": "inactive"
+            },
+            "mode_source": "session-targets"
+          },
+          "switched": false
+        },
+        "utc": "2026-10-24T09:27:33.126Z"
+      }
+    ],
+    "final_check": {
+      "http": 200,
+      "body": {
+        "mode": "game",
+        "gamescope": true,
+        "plasma": false,
+        "nested_desktop": false,
+        "configured": "gamescope-wayland.desktop",
+        "config_file": "/etc/sddm.conf.d/steamos.conf",
+        "selector": "steamosctl",
+        "session_targets": {
+          "gamescope-session.target": "active",
+          "plasma-workspace-wayland.target": "inactive"
+        },
+        "mode_source": "session-targets"
+      }
+    },
+    "final_return_disabled": true,
+    "final_text": "Game Mode: the headset is running normally. A desktop you see is a panel; close it from the Steam dashboard.",
+    "screenshots": [
+      "return-game-mode-packaged-2026-10-24-before.png",
+      "return-game-mode-packaged-2026-10-24-after.png"
+    ],
+    "screenshot_scope": "Cropped to the session controls and repeat-action notification; host identity, connection address and backup folder excluded."
+  },
+  "systemd_verification": {
+    "command": "ssh frame systemctl --user show gamescope-session.target plasma-workspace-wayland.target -p Id -p ActiveState -p SubState; ssh frame systemctl --user show gamescope-session.service -p InvocationID",
+    "before": "Id=gamescope-session.target\nActiveState=inactive\nSubState=dead\n\nId=plasma-workspace-wayland.target\nActiveState=active\nSubState=active\nInvocationID=892b843dbe1a4d2ba91b93057bd38463\n295589 /home/steamos/.local/share/Steam/steamrtarm64/steam -silent -vrdisable -deckard\n295066 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-294978\n",
+    "after_first_click": "Id=gamescope-session.target\nActiveState=active\nSubState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nSubState=dead\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n",
+    "after_repeat_click": "Id=gamescope-session.target\nActiveState=active\nSubState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nSubState=dead\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297942 /home/steamos/.local/share/Steam/steamrtarm64/steam -child-update-ui -child-update-ui-socket 8 -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n",
+    "repeat_did_not_restart_game_mode": true,
+    "unchanged_game_service_invocation": "e8c1085b3bbd4e79a323b3e4a9bc6355",
+    "unchanged_steamvr_pid": 297506,
+    "delayed_final_readback_utc": "2026-10-24T09:28:05Z"
+  },
+  "cleanup": {
+    "complete": true,
+    "final_readback": "2026-10-24T09:28:05Z\nId=gamescope-session.target\nActiveState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\nNEXT LEFT LAST PASSED UNIT ACTIVATES\n\n0 timers listed.\nId=fc-return-button-rollback-20261024.timer\nLoadState=not-found\nActiveState=inactive\n\nId=fc-return-button-rollback-20261024.service\nLoadState=not-found\nActiveState=inactive\n\nId=fc-return-button-probe-20261024.timer\nLoadState=not-found\nActiveState=inactive\n\nId=fc-return-button-probe-20261024.service\nLoadState=not-found\nActiveState=inactive\n297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n99\nCharging\ngame\n",
+    "owned_lock_release_exit": 0,
+    "owned_lock_absent": true,
+    "host_processes": {
+      "xvfb": {
+        "pid": 1562020,
+        "exists": false,
+        "cmd": null,
+        "state": null
+      },
+      "electron": {
+        "pid": 1562023,
+        "exists": false,
+        "cmd": null,
+        "state": null
+      },
+      "x_socket_absent": true
+    },
+    "remaining_test_servers": [],
+    "battery_final_percent": 99,
+    "battery_final_status": "Charging",
+    "battery_range_observed_percent": [
+      99,
+      100
+    ],
+    "game_mode_steam_steamvr_running": true,
+    "default_login_mode_after": "game",
+    "headset_installs_or_global_settings_changed": false,
+    "rebooted": false,
+    "notes": "Stopping the timer succeeded. systemctl stop also named its never-started, unloaded service and returned 5; explicit readback confirms both rollback and probe timer/service units are not-found/inactive. No further switch was sent."
+  },
+  "attempts_and_harness_limits": [
+    "Initial harmless timer probe was garbage-collected before its exit metadata could be read. No Desktop Mode switch was attempted. Repeated with RemainAfterExit=yes and verified successful execution.",
+    "First full Plasma attempt clicked the visible packaged Return button and got HTTP 200 / switched=true. The harness then treated absent pgrep matches during the expected session restart as a fatal error. Independent readback confirmed Game Mode and SteamVR had returned. Rollback remained armed until that readback, then was cancelled. This incomplete attempt was not counted as the final pass.",
+    "Final full Plasma attempt tolerated transiently absent Steam/SteamVR while polling systemd targets, passed both trusted visible clicks, and completed the final Check. Stopping the unused rollback service returned unit-not-loaded; explicit subsequent readback verified all four owned probe/rollback units not-found/inactive and zero timers. Cleanup was completed before releasing our lock."
+  ],
+  "limits": [
+    "Unchanged AppImage payload ran after extraction on a virtual X desktop with Chromium sandbox and GPU disabled. FUSE mounting, desktop integration and hardware rendering were not tested.",
+    "Automated trusted pointer clicks in a visible Electron window; no physical-monitor human click or worn-headset visual/interaction assessment.",
+    "Verified only SteamOS 0.5.6 build 20261015.6141207 and the Linux x86_64 v0.4.17 package; older selectors/builds and other desktop platforms remain covered only by their existing tests.",
+    "No release, tag, application code, passwords or security/global settings changed."
+  ],
+  "validation": {
+    "focused_suite": "python3 -m unittest discover -s tests -p test_backup.py -v: 28 tests passed in 2.479s",
+    "json": "python3 -m json.tool: passed",
+    "diff": "git diff --check: passed"
+  }
+}
@@ -0,0 +1,74 @@
+# Windows Wireless Adapter doctor verification, 24 October 2026
+
+PC-only implementation and verification. No Frame was contacted, before or
+after 13:00 UTC. No adapters or security settings were changed. This evidence
+does not establish a physical Steam wireless adapter fix or RF interference.
+
+## Windows VM
+
+An existing local Windows 11 VM (build 26200), Python 3.12.14 from the installed
+Frame Control bundle, ran the isolated suite from a task-specific Downloads
+folder:
+
+```powershell
+& 'C:\Users\frame\AppData\Local\Programs\Frame Control\resources\python\python.exe' -m unittest discover -s tests -p test_wireless.py -v
+```
+
+Result: **15 tests, OK, one skipped** (Node absent). This includes the real
+read-only PowerShell inventory and authenticated HTTP handler tests. The app's
+connector was never started. Existing test SSH credentials were used only for
+the Windows VM; no credentials were copied into the repository.
+
+- [Exact test output](windows-wireless-tests-2026-10-24.txt).
+- [Sanitized live inventory](windows-wireless-summary-2026-10-24.json): two
+  virtual-machine network devices, with PnP/presence/adapter/route sources
+  available. WLAN unavailable; channels/bands remained null. All PnP IDs,
+  device names and interface names were removed from this artifact.
+- The guest clock was approximately seven hours ahead of the host. `observedAt`
+  is retained as returned by Windows, not used to establish test timing.
+
+The first probe used a list of requested default prefixes. A missing IPv6
+route caused PowerShell to throw away available IPv4 data. The final query
+filters `Get-NetRoute` results instead, and the rerun above confirms routes
+are available. No network configuration was changed to make the query work.
+
+## Browser UI and local tests
+
+Production `ui/index.html` ran against a loopback-only synthetic API fixture,
+with no connector and no headset transport. Opening/revisiting the tool caused
+no wireless query; an explicit click rendered two distinct Wi-Fi Direct PnP
+instances and a 2.4 GHz PC interface while the headset state was offline.
+Unknown virtual-adapter channels, non-present/disabled status, and unconfirmed
+interference remained visible. Checked at 1280 and 640 CSS pixels without
+horizontal overflow.
+
+![Production browser UI with explicitly labelled synthetic Windows readings](windows-wireless-synthetic-2026-10-24.png)
+
+The screenshot uses synthetic readings, not the VM's two Ethernet interfaces.
+The yellow synthetic-data label was added by the browser fixture for this
+capture; it is not product UI.
+
+Local commands:
+
+```sh
+python3 -m unittest discover -s tests -p 'test_wireless.py' -v
+node tests/wireless.cjs
+python3 -m unittest discover -s tests -v
+python3 -m py_compile ui/*.py
+node --check /tmp/wireless-index-scripts.js
+```
+
+The targeted suite passed 15 tests with the live Windows-only test skipped;
+the direct Node run passed all four UI tests. The complete server suite passed
+1,423 tests with 16 skips before the additional missing-metadata test; a final
+complete run and Windows CI results are recorded in the PR. The syntax check
+used inline scripts extracted from the production HTML.
+
+## What remains unverified
+
+No physical Steam dongle, Razer headset, live Wi-Fi Direct session, channel
+reading from real wireless hardware, dropout reproduction or recovery action.
+The English netsh parser is fixture-tested; localised or denied readings remain
+unknown. Windows CI validates query execution on hosted virtual hardware.
+There is no adapter disable action because the available evidence cannot
+reliably identify a safe extra instance.
@@ -0,0 +1,40 @@
+{
+  "platform": "Windows-11-10.0.26200-SP0",
+  "python": "3.12.14",
+  "state": "partial",
+  "sources": {
+    "pnp": "ok",
+    "present": "ok",
+    "adapters": "ok",
+    "routes": "ok",
+    "wlan": "unavailable"
+  },
+  "observedAt": "2026-10-24T19:15:45.946191+00:00",
+  "deviceCount": 2,
+  "devicesWithoutIdentifiers": [
+    {
+      "present": true,
+      "pnpStatus": "OK",
+      "problemCode": 0,
+      "operational": 6,
+      "media": 0,
+      "defaultRoute": false,
+      "wifi": false,
+      "hardware": false,
+      "channel": null,
+      "band": null
+    },
+    {
+      "present": true,
+      "pnpStatus": "OK",
+      "problemCode": 0,
+      "operational": 1,
+      "media": 1,
+      "defaultRoute": true,
+      "wifi": false,
+      "hardware": true,
+      "channel": null,
+      "band": null
+    }
+  ]
+}
@@ -0,0 +1,24 @@
+test_ambiguous_adapter_join_never_selects_the_first_match (test_wireless.Inventory.test_ambiguous_adapter_join_never_selects_the_first_match) ... ok
+test_channels_require_exact_guid_and_band_is_never_guessed (test_wireless.Inventory.test_channels_require_exact_guid_and_band_is_never_guessed) ... ok
+test_counts_unique_pnp_ids_not_rows_or_suffix_order (test_wireless.Inventory.test_counts_unique_pnp_ids_not_rows_or_suffix_order) ... ok
+test_distinct_instances_presence_disabled_and_activity_are_separate (test_wireless.Inventory.test_distinct_instances_presence_disabled_and_activity_are_separate) ... ok
+test_friendly_name_is_only_a_candidate_and_other_duplicate_names_are_not_direct (test_wireless.Inventory.test_friendly_name_is_only_a_candidate_and_other_duplicate_names_are_not_direct) ... ok
+test_missing_interface_metadata_and_invalid_guids_stay_unknown (test_wireless.Inventory.test_missing_interface_metadata_and_invalid_guids_stay_unknown) ... ok
+test_missing_sources_are_unknown_and_adapter_fallback_is_retained (test_wireless.Inventory.test_missing_sources_are_unknown_and_adapter_fallback_is_retained) ... ok
+test_raw_ssid_mac_and_errors_are_not_returned (test_wireless.Inventory.test_raw_ssid_mac_and_errors_are_not_returned) ... ok
+test_concurrent_requests_do_not_spawn_more_probes (test_wireless.Probe.test_concurrent_requests_do_not_spawn_more_probes) ... ok
+test_failure_timeout_and_invalid_output_are_explicit_and_release_lock (test_wireless.Probe.test_failure_timeout_and_invalid_output_are_explicit_and_release_lock) ... ok
+test_http_is_authenticated_pc_only_and_never_calls_ssh (test_wireless.Probe.test_http_is_authenticated_pc_only_and_never_calls_ssh) ... GET "GET /api/host/wireless HTTP/1.1" 403 -
+GET "GET /api/host/wireless HTTP/1.1" 400 -
+GET "GET /api/host/wireless HTTP/1.1" 200 -
+ok
+test_live_windows_inventory (test_wireless.Probe.test_live_windows_inventory) ... ok
+test_non_windows_starts_nothing (test_wireless.Probe.test_non_windows_starts_nothing) ... ok
+test_static_noninteractive_local_command_and_timeout (test_wireless.Probe.test_static_noninteractive_local_command_and_timeout) ... ok
+test_ui_behavior (test_wireless.Probe.test_ui_behavior) ... skipped 'Node required'
+
+----------------------------------------------------------------------
+Ran 15 tests in 8.139s
+
+OK (skipped=1)
+Windows wireless smoke: partial {'pnp': 'ok', 'present': 'ok', 'adapters': 'ok', 'routes': 'ok', 'wlan': 'unavailable'} devices= 2
@@ -6,6 +6,45 @@ This is Frame Control code using Python, Steam and SteamVR already on the Frame.

 ![Family and comfort controls in the desktop app](img/comfort-desktop.png)

+## Desktop low-battery alert without a session
+
+In the desktop app, open **Tools → Family & comfort** and check **Alert on this
+computer at 15% or less**. This separate option does not start a session, install
+a worker or change the headset. It starts off whenever the page opens and turns
+off when you switch headsets. The choice is only for the current open page.
+
+It consumes the battery parser already used by normal status refreshes (also
+shared by the read-only power sampler). It adds no SSH calls, timers, sensor
+reads, third-party push or heat thresholds. Normal automatic status refreshes
+pause while the page is hidden, so this is **not a background or safety monitor**.
+Keep the app visible and connected. Use **Enable / test notifications** to check
+system delivery; operating-system settings may block notifications.
+
+Two fresh readings, at least 20 seconds and at most 90 seconds apart, must show
+15% or less, driver state `Discharging`, and signed battery power below −0.5 W.
+This avoids alerting on plugged-in idle readings, which can report discharging.
+Missing, invalid, stale or interrupted readings break confirmation. Disconnect,
+a failed status request, hiding the page or toggling the option also breaks
+confirmation. Unknown readings never mean zero charge.
+
+An alert appears in the page and requests a native desktop notification once
+per low-charge episode. Two readings at 20% or more rearm it, and at least ten
+minutes must pass between alerts (including across headset switches). A single
+recovery spike cannot rearm it. Toggling off/on does not clear the episode latch.
+Notification failure stays visible in the page and does not retry on every
+refresh. While an active family session has battery alerts enabled, that session
+handles battery alerts instead. Multiple app windows have independent state;
+this does not coordinate notifications between computers or windows.
+
+A read-only check on 2026-10-24, build **20261015.6141207**, received two samples
+at 99%, `Not charging`, approximately −0.06 W and 24 °C. No low-battery condition
+was induced, no notification was sent to the real headset, and no headset state
+was changed. The sampler's local and remote smoke-lock checks allowed the run;
+no lock was acquired or removed. Deterministic tests exercise low charge,
+recovery, missing readings, idle drain, timing and notification denial. See
+[recorded evidence](evidence/desktop-battery-comfort-2026-10-24.json). Native OS
+notification display, worn use and macOS/Windows packaging were not verified.
+
 ## Sessions

 Set a limit of 1–240 minutes, optional break and check-in intervals, then
@@ -58,6 +58,11 @@ counts them while they run.
  restore chosen parts after a factory reset, and **Return to Game Mode** when
  the headset is stuck in Desktop Mode. Sign-in files and keys are never copied.
  Not tested on a headset yet. See [backup-and-recovery.md](backup-and-recovery.md).
+- **Wireless Adapter doctor** (Windows, Tools → This PC): explicitly read local
+  PnP instances, presence/link states and available channel/band readings;
+  explain possible Wi-Fi Direct duplicates and 2.4 GHz audio overlap. No headset
+  access, automatic changes or disable button. See
+  [Windows wireless diagnosis](windows-wireless-doctor.md).
 - **Battery** with charging state: charge rate in watts, time to full or empty,
  charger type and wattage (for example USB-C PD 20 W), and battery temperature.
 - **Status**: storage, memory, temperature, Wi-Fi, uptime, and whether SteamVR,
@@ -8,13 +8,15 @@ installed; the desktop app does not bundle this command.

 ```sh
 scripts/frame-doctor.sh
-scripts/frame-doctor.sh --alias bedroom --lan frame.local
+scripts/frame-doctor.sh --alias bedroom --lan 192.168.1.40
 scripts/frame-doctor.sh --alias frame --lan 192.168.1.40
 ```

 Use only addresses belonging to your intended headset. The command tries the
 existing `frame` SSH alias first (Tailscale if setup configured it that way),
-then `frame.local`, then USB-C at `10.86.200.233`. `--alias`, `--lan` and `--usb`
+then an optional `--lan` address, then USB-C at `10.86.200.233`. SteamOS 0.5.6
+stopped publishing mDNS names, so use a known IP for `--lan` if `.local` no longer
+resolves. `--alias`, `--lan` and `--usb`
 override those defaults. It reports the successful path without printing its
 address. It neither discovers other devices nor enables Tailscale.

@@ -0,0 +1,118 @@
+# Linux Wireless Adapter doctor
+
+![Linux PC doctor before any checks run, with explicit hardware selection and read-only limits](img/linux-wireless-doctor.png)
+
+On the **Linux PC**, open **Settings → Linux Wireless Adapter doctor**, or
+**Devices & connection → Linux Wireless Adapter doctor**. It works without a
+connected headset. Choose **Read PC device inventory**, select the intended
+USB device or wireless interface, then **Check selected device**. Nothing runs
+until requested. Re-read the inventory after reconnecting a device.
+
+From a source checkout, the same collector is available without starting the
+app or its headset connection workers:
+
+```sh
+python3 ui/frame_wireless_doctor.py
+python3 ui/frame_wireless_doctor.py --device net:wlan0
+python3 ui/frame_wireless_doctor.py --device usb:1-2 --json > adapter-report.json
+```
+
+Use a selector actually listed on your PC. No device is selected automatically.
+All USB devices are included, including hubs and devices without a network
+interface. A product label, observed VID/PID, or a single available interface
+**does not identify Valve's adapter**. There is no trusted adapter ID table in
+this feature. Compare inventory before and after reconnecting the intended
+adapter when safe. For a USB device exposing multiple wireless interfaces,
+select the specific interface for radio/manager evidence.
+
+## Evidence and limits
+
+- **Presence and binding:** `/sys/bus/usb/devices` and `/sys/class/net` correlate
+  USB ancestry, wireless interfaces, driver links and module links. An absent
+  interface does not establish which driver should be installed. A missing
+  module link may mean a built-in driver. A bound driver does not prove Steam
+  streaming support.
+- **Permissions and udev:** `udevadm info --query=property` supplies a small
+  allowlist of driver, ID and tag fields. If available, the report includes USB
+  node mode, owner/group IDs and the current user's read/write access. Direct
+  USB access is not necessarily required by kernel networking; a restrictive
+  node alone is not diagnosed as the cause. No udev rules are installed or run.
+- **Radio blocks:** read-only WLAN rfkill sysfs entries are matched to the
+  selected interface's PHY name. An unrelated block cannot establish that
+  this adapter is blocked. Unavailable or unmatched entries remain unknown.
+- **Channel/band:** `iw dev IFACE info` provides the current channel and
+  frequency where reported; `iw phy PHY info` supplies enabled frequencies.
+  An idle interface may have no current channel. These observations do not
+  establish the channel used by a Steam streaming session, supported regions,
+  or the correct regulatory setting.
+- **Network managers:** visible `/proc/*/comm` process names show
+  NetworkManager, iwd and wpa_supplicant. `nmcli` reads only the selected
+  interface's general state, managed flag and driver. NetworkManager can use
+  iwd or wpa_supplicant as its backend, so coexistence is not itself a conflict.
+  If both backends are visible, the report suggests checking who owns this
+  exact interface. It does not claim a confirmed conflict or stop services.
+  Restricted process visibility and unverified backend ownership are explicit.
+
+Every command uses fixed read-only arguments, no shell, closed stdin and a
+three-second timeout. Optional tools are not installed automatically. Missing
+tools, denied reads, disappearing devices, and restricted VM/container hardware
+visibility remain unknown. A successful report is a snapshot, not a hardware
+health certificate. CLI exit 0 means collection is supported, not that the
+adapter works; unsupported platforms/headset-local mode return 2, as does an
+invalid/stale selector. JSON has schema version 1.
+
+The doctor never uses SSH, scans nearby Wi-Fi networks, opens a connection to
+the Frame, escalates privileges, loads drivers, changes security settings,
+changes channels, unblocks radios, changes network settings, or restarts
+services. Run it as your ordinary user, never with sudo. The app hides the
+entry on macOS, Windows and phone sessions; its API refuses collection in
+headset-local (`FRAME_LOCAL=1`) mode. The source CLI is intended only for the PC.
+
+Reports stay local unless you explicitly save, copy or share them. Exported
+fields include observed USB IDs/product labels, interface names, driver names
+and permission metadata. USB serials, Wi-Fi names, MAC/IP address fields,
+credentials, process arguments and raw command output are not exported. Review
+the report before posting it: hardware labels and local paths can identify
+parts of your setup.
+
+## Motivation and shipped comparison
+
+[The 23 October 2026 complaint](https://x.com/ExpressGinga81/status/2113457683143741720)
+says the Wi-Fi dongle does not work on Ubuntu/Kubuntu 26.04 while SteamVR works
+under Wayland. It supplies **no adapter VID/PID, driver, logs or established
+cause**. This feature helps gather that missing evidence; it does not claim to
+fix that complaint or certify Ubuntu/Kubuntu 26.04 support.
+
+Shipped **v0.4.18** has local network/gateway discovery in `frame_network.py`
+and headset connection management, but no local USB/driver/rfkill adapter
+report or adapter diagnostic UI. The existing `frame-doctor.sh` diagnoses the
+headset through SSH and is a different tool. This doctor never calls it.
+General SteamOS 3.9.5 / Frame OS 0.5.6 compatibility and OS backend transition
+notes are covered separately in
+[`docs/steamos-2026-10-compat.md`](https://github.com/saphid/frame-control/blob/9c7110c1f48d160b0fb3c3b9f658d4937bd2032d/docs/steamos-2026-10-compat.md)
+([PR #164](https://github.com/saphid/frame-control/pull/164)). Existing PC
+route/SSID diagnostics use NetworkManager's `nmcli` with an `iwgetid` SSID
+fallback, independently of whether NetworkManager uses wpa_supplicant (SteamOS
+3.9.5 new installs) or iwd (upgrades). This doctor reads actual PC evidence and
+does not infer a conflict, hardware identity or fix from those OS defaults.
+There is no adapter-specific device observation in that compatibility work.
+
+## Verification
+
+```sh
+python3 -m unittest discover -s tests -p test_wireless_doctor.py -v
+python3 -m unittest discover -s tests
+```
+
+Tests use an explicitly synthetic USB `1234:5678`, sysfs trees, command replies
+and loopback HTTP. They cover an unbound USB device, module binding, multiple
+interfaces, PHY-matched and unrelated rfkill entries, channel parsing, manager
+coexistence, missing/denied commands, stale/injected selectors, export field
+filtering, authentication and refusal to probe in headset-local mode. The
+HTTP tests instantiate the handler without starting headset workers.
+
+Linux host collection was exercised on kernel `6.8.0-139-generic`: an existing
+PC interface was visible with its `iwlwifi` binding and unblocked PHY; `iw` and
+`nmcli` were absent and reported as unavailable. This is **not a physical Steam
+Frame Wireless Adapter test**, an Ubuntu/Kubuntu 26.04 test, or a headset test.
+No Frame access is part of this work.
@@ -190,7 +190,24 @@ HTTP focus is not evidence of worn-headset laser input. Follow the

 ## Saved spatial layouts: blocked on the current panel route

-**Verified 2026-09-28**, same build, using a temporary xterm panel with
+**Rechecked 2026-10-24**, SteamOS 0.5.6, BUILD_ID `20261015.6141207`,
+SteamVR 2.18.2: a read-only probe of the existing Gamescope and Steam main
+panels still reports type 5 (`DashboardTab`), and both the absolute and
+tracked-device-relative getters return 18 (`WrongTransformType`). Width and
+curvature read successfully. **Some pose readback is available:**
+`GetTransformForOverlayCoordinates` at the panel center succeeds in standing
+space; seated and raw origins return 23 (`RequestFailed`). Both panels and the
+dashboard were hidden. That matrix snapshot does not identify docking, prove
+visible placement, or establish a restore operation. The shipped dashboard
+stores dock location and relative transforms internally; no supported external
+snapshot/restore pair was established. No setters or docking commands were run
+in this recheck. See the [exact probe, results, cleanup and remaining
+gaps](evidence/panel-layout-2026-10-24.md). Saved layouts remain unavailable.
+
+### Earlier mutation evidence (2026-09-28)
+
+**Verified 2026-09-28**, SteamOS 0.4.1, BUILD_ID `20260925.6191901`,
+SteamVR 2.18.1, using a temporary xterm panel with
 `STEAM_GAME=2000999031` and `FnTable:IVROverlay_028` from
 `/opt/steamvr/bin/linuxarm64/libopenvr_api.so`:

@@ -1,5 +1,9 @@
 # PC in the headset (Experimental)

+For Steam's own Linux Wayland desktop-sharing flow, see the separate
+[Steam desktop sharing helper](steam-pipewire.md). It does not enable this
+feature on Linux.
+
 **Tools → PC in the headset**, on Windows only. It's the Windows version of
 [Mac in the headset](mac-in-headset.md): a whole screen on your PC
 becomes its own SteamVR panel in the Frame. Individual windows are available only
@@ -107,6 +111,12 @@ The Linux adapter from #38 (desktop portal, PipeWire, VA-API) is in the tree,
 because it shares `capture.c` and the controller, and CI still builds and tests
 it. The app never offers it and the Linux installers don't include it.

+The [2026-10-24 lxso2 feasibility check](evidence/linux-pc-host-lxso2-2026-10-24.md)
+found no running or activatable desktop portal, no PipeWire socket and missing
+native build dependencies. Linux support remains disabled. The evidence records
+the build failure and prerequisites for a screen-only, view-only x264 slice;
+Linux capture, input and window modes have not been verified there.
+
 ## Measuring

 The Mac benchmark accepts the PC host:
@@ -46,11 +46,10 @@ raw measurements. The HTML also embeds those measurements; review it before
 sharing. No automatic browser launch occurs.

 HTML sessions are limited to `count × interval <= 600` seconds, with a 30-second
-transport allowance and at most nine seconds of local child/reader cleanup. The default
+transport allowance and at most twelve seconds of local child/pipe cleanup. The default
 12 samples at five-second intervals take about 55 seconds. Existing output files
 are never overwritten; choose a new filename for each run. `--html` cannot be
-combined with `--csv`. This source-checkout flow is not a desktop Tools panel
-and is not added to the packaged app.
+combined with `--csv`. The desktop flow below uses the same sampler and renderer.

 Stop, timeout, SSH failure or a smoke-test lock marks the report incomplete;
 earlier received samples remain downloadable. Exit status is 75 for incomplete
@@ -67,6 +66,47 @@ not an immediate headset-side cancellation guarantee. The reader still checks
 the smoke-test lock before every sample. No lock is acquired or removed by this
 flow, and no power, thermal, service, password or security controls are exposed.

+## Desktop Tools → Power & heat report
+
+In the packaged desktop app, connect to an already paired Frame, open **Tools →
+Power & heat report**, choose **1 minute** (12 samples) or **5 minutes** (60 samples),
+and select **Start observation**. Samples arrive every five seconds, starting at
+zero (about 55 or 295 seconds total). Progress shows received samples and the
+original headset alias. There is at most one observation per local app server;
+viewing progress never starts another SSH connection. No terminal, checkout,
+extra dependency or password is needed.
+
+Use **Stop and keep samples** to end local collection. Disconnect, timeout,
+app shutdown or switching to another headset also ends collection. Switching
+network addresses for the same headset does not retarget an existing observation:
+it keeps its captured SSH route and may finish incomplete if that route fails.
+As with the CLI, only the owned local SSH child is terminated. The remote reader
+is bounded and discovers a closed connection on its next write. Desktop sessions
+have a 30-second transport allowance and bounded child cleanup. Stream lines are
+limited to 262,144 characters, sample events to the requested count, and the receive queue
+to count + 2 events; desktop SSH stderr is discarded rather than stored unbounded.
+The existing smoke lock is checked locally before start and remotely before each
+sample; this feature never creates, bypasses or removes that lock.
+
+**Download HTML report**, **Download JSON** and **Download CSV** save local
+snapshots through the browser/app download mechanism. Open the downloaded HTML
+in your browser to view the offline table and its embedded JSON/CSV downloads.
+Snapshots taken before completion explicitly say incomplete. Desktop CSV includes
+`collection.state`, `collection.requestedSamples` and `collection.receivedSamples`
+metadata rows with the original headset alias in the source column, even when no
+sensor sample arrived. CSV text fields, including the alias, are escaped if they
+begin with a spreadsheet formula prefix. JSON records the alias and device ID;
+HTML names the alias.
+
+Only the latest observation is retained in server memory, including partial
+samples after stop or disconnect. **Download before starting another observation,
+restarting the server or quitting the app**: those discard the previous report.
+Page reloads retain server state. Download requests include an observation ID, so
+an old page cannot silently download or stop a replacement observation. Reports
+are not uploaded or automatically opened, and may contain device identifiers,
+OS builds and sensor paths. Review before sharing. The phone-hosted UI does not
+support starting observations.
+
 ## What it reads

 - Battery percentage, driver charging state, signed battery watts and battery
@@ -175,3 +215,10 @@ summary counts, CSV quoting, strict SSH transport and smoke-lock interruption.
 Export fixtures also cover HTML escaping, download round trips, zero versus unknown,
 stream completion/failure, smoke-lock stop, timeout, Ctrl+C retention, local child
 cleanup, duration bounds and refusing to overwrite reports.
+
+Desktop validation on **2026-10-24** covered API start/stop, a synthetic browser
+observation with partial exports, shared-module resource staging under isolated
+Python and missing-resource build guards. A real Frame probe under this task's
+owned smoke lock correctly returned zero samples with an explicit incomplete
+reason; no successful live sensor baseline or native installer run was performed.
+See [desktop evidence and limitations](evidence/power-desktop-2026-10-24.json).
@@ -8,13 +8,13 @@ Both are on **Tools → Capture & Live**. Everything is saved to
 Nothing needs installing on the computer or on the Frame: the work is done by
 the `ffmpeg` that SteamOS ships.

-**Recording is tested on a headset; Steam clip export isn't yet.** On a Frame
+**Recording and Steam clip export have each been tested on a headset.** On a Frame
 running SteamOS 0.5.6 (build 20261015.6141207), Record and Stop saved an
 8-second 1080p H.264 recording with AAC sound to the computer, Stop took about a
-second, and nothing was left running or stored on the Frame. That Frame had no
-Steam recordings, so the clip list came back empty and export has only been
-tested with files in Steam's format made by `ffmpeg`. The parts we're least sure
-of are listed under [What hasn't been checked](#what-hasnt-been-checked).
+second, and nothing was left running or stored on the Frame. A later test on
+that build created a saved clip with Steam's own recorder and exported it with
+Frame Control's production export function. The parts we're least sure of are
+listed under [What hasn't been checked](#what-hasnt-been-checked).

 ## Record

@@ -147,19 +147,65 @@ stand-in `ffmpeg`, so Stop, the time limit and the clean-up are tested as they
 run on the Frame. Where `ffmpeg` is installed, they also make a 65-second DASH
 recording with Steam's file names and export it with the real `ffmpeg`.

-## What hasn't been checked
+## Real Steam clip verification and remaining checks

-The 2026-10-24 read-only clip list on build `20261015.6141207` again returned
-zero clips: its `gamerecordings` directory held only `gamerecording.pb`. No
-Steam recording was created during that check, so a real Steam clip export is
-still unverified. The recording and Stop path were verified earlier on that
-build, as described above. Remaining checks:
+On 2026-10-24, v0.4.15 on build `20261015.6141207` recorded a ten-second
+reserved test session through Steam's own game recorder, saved it as a clip,
+then exported it with `frame_clips.export_clip`, the same implementation used
+by the desktop API. The 159,829-byte MP4 decoded completely: 10.29 seconds,
+1920×1080 H.264 video and stereo AAC audio (SHA-256
+`f8a476eefb2bde7ba5cb464632ec9b952eea3ab1610b5bed2098bf1f11d62cf1`).
+All 616 decoded video frames and the decoded audio matched Steam's source
+segments. Recording mode was restored
+to off; the reserved title and its processes were removed, the shared test lock
+was released, and the battery remained at 99%. The Steam source clip was kept.

- Audio and video sync. Both inputs are stamped with the wall clock, because
-  the camera device and the audio server otherwise count from different clocks.
- The exact layout of `gamerecordings` on the Frame's SteamOS build, and
-  whether a clip's segments start mid-recording. The parser is deliberately
-  loose about the layout.
+The inspected frame is nearly black in both Steam's source and the export, so
+this establishes file creation and faithful export, **not visible gameplay
+capture**. On v0.4.16, the literal desktop **Export** button was also clicked
+against that retained real Steam clip in the source UI on lxso2. The job
+completed and saved `~/Videos/SteamFrame/clip_13009719723623972864_20261024_072115.mp4`;
+its 159,829 bytes and SHA-256 matched the previously decoded export exactly.
+The temporary server stopped, the shared device lock was released, and the
+headset remained in Game Mode at 99% battery. See
+[`docs/evidence/clip-gui-export-2026-10-24.json`](evidence/clip-gui-export-2026-10-24.json)
+for the narrow proof. This did not exercise the packaged desktop installer.
+
+On 2026-10-24, the exact v0.4.17 tag exported a second real Steam-saved clip
+through `frame_clips.export_clip`, the same production path used by **Export**.
+Steam listed the clip at **100.801 seconds**, with 68 chunks and no gaps. The
+copied MP4 was **100.833 seconds** by `ffprobe` and decoded completely with
+`ffmpeg`; it was not cut at 60 seconds. The test restored Steam's recording
+mode, removed its reserved title and processes, and left Game Mode active at
+100% battery. See [the long-clip evidence](evidence/clip-long-2026-10-24.json).
+That code-path test did not click **Export** in the packaged desktop app or
+verify visible gameplay quality or perceptual audio/video sync.
+
+Later that day, the published v0.4.17 x86_64 Linux AppImage also passed the
+packaged desktop **Export** check against the retained 100.801-second clip.
+The asset SHA-256 was verified before launching its unchanged extracted payload
+in an isolated Electron profile on a virtual X desktop. An automated pointer
+click on the visible **Tools → Capture & Live → Steam clips → Export** button
+saved the MP4 and changed the row to **ON PC / Export again**. The saved file
+was 100.833335 seconds, decoded completely, and matched the prior production
+export by size and SHA-256. The app and test display were closed,
+the Frame export cache was empty, the source clip was retained, and the shared
+lock was released at 99% battery with Game Mode and SteamVR still running.
+See [the packaged export evidence](evidence/clip-packaged-export-2026-10-24.json)
+and its cropped before/after screenshots. This verifies the packaged Electron
+button and bundled export path; AppImage FUSE mounting, desktop integration,
+physical display/GPU rendering, gameplay quality and perceptual sync remain
+unverified. The virtual-display launch used `--no-sandbox --disable-gpu`.
+
+Remaining checks include:
+
+- Perceptual audio/video sync and audible content. Frame Control's separate
+  **Record** path stamps camera and audio inputs with the wall clock because
+  they otherwise count from different clocks.
+- Clips longer than the 100-second test and trims starting partway through a
+  Steam recording. Two real saved clips' directory layouts were checked; the
+  parser remains deliberately loose
+  for other layouts.
 - How much x264 at 1080p30 costs the Frame while a game is running.
 - Automatic copying: that 30 seconds without a write is a safe sign Steam has
  finished saving a clip, and how a once-a-minute listing feels on the Frame.
@@ -46,14 +46,14 @@ unless your router's DNS registers DHCP client names.

 ```sh
 ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_frame -N '' -C "mac->steam-frame"
-ssh-copy-id -i ~/.ssh/id_ed25519_frame.pub steamos@frame.local
+ssh-copy-id -i ~/.ssh/id_ed25519_frame.pub steamos@192.168.1.40
 ```

 `~/.ssh/config` block (managed between marker lines by the script):

 ```
 Host frame
-  HostName frame.local
+  HostName 192.168.1.40
  User steamos
  IdentityFile ~/.ssh/id_ed25519_frame
  IdentityFile ~/.ssh/id_rsa_frame_devkit
@@ -62,6 +62,10 @@ Host frame
 ```

 The script only asks for the password if the pairing below doesn't work.
+Replace the example IP with the one in the Frame's Quick Settings. SteamOS
+0.5.6 stopped publishing `.local` names; an existing SSH alias or the headset's
+current IP is more reliable. Frame Control remembers authenticated IPs per
+network and checks the saved SSH identity on reconnect.

 ## Password-free pairing (SteamOS devkit service)

@@ -0,0 +1,92 @@
+# Steam desktop sharing on a Linux PC
+
+**Tools → Steam desktop sharing** helps with Steam's own `steam -pipewire`
+desktop-in-headset flow on a local Wayland PC. It needs no Frame connection.
+It is separate from Frame Control's [PC in the headset](pc-in-headset.md),
+which remains disabled on Linux. Steam and the desktop portal own the capture,
+screen picker and headset flow; this helper does not provide a stream.
+
+## Launch Steam with PipeWire
+
+Save your game and use **Steam → Exit** first. Then click **Launch Steam with
+PipeWire**. Frame Control checks this user's local processes, finds `steam` on
+PATH, and requests `steam -pipewire`. This flag applies to that launch only.
+No Steam settings, login files or startup entries are changed. An existing
+Steam session is never stopped, signalled or silently switched.
+
+If Steam or a Steam launcher/helper is running, the button explains that Steam
+must be exited first. If the process inventory cannot be read, it refuses to
+launch. It also refuses root, SSH, headless, X11 and Flatpak-sandboxed Frame
+Control sessions. Run Frame Control as your normal user in the local Wayland
+desktop with its session bus.
+
+For a Flatpak-only Steam install without a `steam` command on PATH, the helper
+provides a manual command instead of choosing an installation for you. After
+exiting Steam, run `flatpak run com.valvesoftware.Steam -pipewire` in a local
+terminal. Flatpak Steam processes are included in the existing-session check.
+
+A successful request is **not confirmation of a picker or stream**. Steam may
+exit or fail after the initial check, and another launcher can race the local
+process check. Do not start Steam elsewhere at the same time. If nothing opens,
+run the command yourself in a terminal to see Steam's error.
+
+## Reset screen-share choice
+
+Click **Reset screen-share choice…** to request KDE's **Application Permissions**
+page. This button does **not** revoke anything or report a completed reset.
+Frame Control cannot reliably map a Steam runtime display name to a
+Steam-specific portal grant or restore token across backends. It never reads,
+edits or clears the portal permission store or Steam tokens.
+
+On KDE:
+
+1. Open **System Settings → Applications → Application Permissions** if the
+   button cannot open it.
+2. Find the entry for Steam. The Ubuntu 26.04 KDE report showed **Steam Linux
+   Runtime 3.0**. That display name alone is not proof that every session there
+   is safe to remove; verify the session belongs to your Steam desktop share.
+3. Under **Screen sharing**, choose **Manage 1 Session** (the count may differ).
+4. Choose **Revoke** for that verified session only. **Do not use Revoke All**
+   or change another application's grants. If ownership is ambiguous, stop.
+5. Retry Steam's desktop sharing flow. The reporter saw the portal picker again
+   after revoking that session. Results can differ by Steam and portal version.
+
+The reported entry sometimes appeared intermittently. If it is missing, do not
+clear other entries or the whole portal store. Check again when Steam's sharing
+session is present. If **Application Permissions** itself is missing on
+Ubuntu/Kubuntu, check your distribution's `kde-config-flatpak` package: the
+reporter needed that package and a reboot before the page appeared. Frame
+Control does not install packages, reboot, request root or change security
+settings. Older KDE modules may lack this page; other desktops receive guidance
+only, with no automatic reset or guessed permission target.
+
+The launcher uses `kcmshell6 --list` to verify the exact module, then
+`kcmshell6 kcm_app-permissions`. It does not substitute the older Flatpak-only
+page. A request to open the page does not prove that a window became visible.
+
+## Evidence and limits
+
+- User-supplied report and screenshot description:
+  [ExpressGinga81's thread and replies](https://x.com/ExpressGinga81/status/2113242533530911058).
+  The report describes Ubuntu 26.04 KDE, the initial picker appearing once,
+  the Steam Linux Runtime 3.0 entry, and Revoke making the picker reappear.
+  This is reported behavior, not a live test performed for this feature.
+- KDE upstream [`flatpak-kcm`](https://github.com/KDE/flatpak-kcm):
+  `CMakeLists.txt` and `kcm_app-permissions.json` identify Application
+  Permissions; `ui/SessionList.qml` distinguishes Revoke from Revoke All.
+- Automated tests mock Steam, processes and KDE commands. HTTP tests verify
+  request guards, no actions on GET, and no headset work. Existing CI discovers
+  these tests on Linux, macOS and Windows; they do not need a desktop portal.
+- lxso2 has no interactive Wayland/PipeWire portal for a chooser test.
+  **No live chooser, revoke, Steam launch or headset display is verified here.**
+  No Frame access was performed for this task, including during the hold before
+  2026-10-24 13:00 UTC. The helper never invokes SSH or Frame controls.
+
+## Announcement
+
+Linux Wayland users can now find **Steam desktop sharing** under Tools to
+request Steam with `-pipewire` after exiting Steam, or open KDE's Application
+Permissions to revoke only a verified Steam screen-sharing session and try the
+picker again. Frame Control does not clear permissions automatically. This is
+help for Steam's own desktop-sharing flow; Frame Control's Linux capture
+feature remains disabled. Live picker behavior still needs desktop validation.
@@ -0,0 +1,62 @@
+# SteamOS October 2026 compatibility
+
+SteamOS 3.9.5 is the **PC host / Steam Machine** update. It is not the Frame
+headset OS. The headset release discussed here is **SteamOS 0.5.6 beta**.
+
+## Finding and connecting to the headset
+
+SteamOS 0.5.6 stopped publishing mDNS names, including `frame.local`. Existing
+addresses in Frame Control still work if they resolve, and the app tries all
+saved addresses. After an authenticated connection through a `.local` name,
+Frame Control also remembers the numeric IP on that network. If the name stops
+resolving, it tries that IP and checks the same pinned SSH identity before using
+it. The IP is never reused automatically on a different network.
+
+In **Devices**, **Find on this network** checks the SteamOS devkit advertisement,
+known IPs and the local IPv4 `/24`. It offers scan results only when their SSH
+key matches the headset's saved key. The scan is bounded to a private subnet;
+it cannot find a headset across a router or on another subnet. Enter the IP
+shown in the headset's Quick Settings in the address field in those cases.
+For initial pairing, **Set Up Connection** accepts a manual IP and reuses an
+existing `~/.ssh/config` `HostName` before trying mDNS. A configured SSH alias
+continues to work. Frame doctor no longer assumes `frame.local`: supply
+`--lan <IP>` when a separate LAN route is needed.
+
+## SteamOS script names
+
+Session switching already prefers `holo-session-select` over
+`steamos-session-select`, after the Frame's `steamosctl` control. Desktop
+process detection accepts `holo-nested-desktop` and its old name. The sideload
+helper prefers `holo-prepare-upload` and `holo-delete` if a future devkit
+provides them, falling back to the vendored `steamos-*` scripts. The devkit
+service name `_steamos-devkit._tcp` is a protocol identifier, so it is not
+renamed.
+
+## SteamOS 3.9.5 Linux PC hosts
+
+NetworkManager's `nmcli` supplies the active SSID and route diagnostics; the
+SSID reader falls back to `iwgetid`. Neither depends on whether NetworkManager
+uses wpa_supplicant (new installs) or iwd (upgraded installs). The current code
+does not manage either backend or the Steam Frame Wireless Adapter. An adapter
+doctor belongs in its own PC host feature.
+
+## Android APKs and telemetry
+
+The 0.5.6 Desktop Mode **Add to Steam** action for `.apk` files is another way
+to make a Steam library entry. Frame Control already creates a non-Steam
+shortcut for every installed APK through the running Steam client's API, with
+its own persistent Lepton instance and artwork. It does not edit
+`shortcuts.vdf` or require a Steam restart, so no extra shortcut option is
+needed in its install flow.
+
+The battery reader selects a system battery by power-supply `type` and `scope`
+and reads standard sysfs fields. The memory reader uses `/proc/meminfo`.
+Neither relies on the performance overlay's labels or hard-coded SteamOS
+paths. SteamOS 0.5.6's improved overlay reporting does not establish a sysfs
+path change. The dominant-eye setting is not read yet; recording metadata
+must not claim an eye until its source and effect on `/dev/video99` are verified.
+
+Sources: [SteamOS 3.9 news](https://store.steampowered.com/news/app/1675200),
+[Frame OS news](https://steamcommunity.com/app/4165890/allnews/), and the
+Frame Control implementation in `ui/frame_network.py`, `ui/frame_status.py`,
+`ui/frame_android.py`, `ui/frame_link.py` and `frame/android/steam_shortcuts.py`.
@@ -7,6 +7,9 @@ This covers three directions, plus input:
 - **C. iPhone → Frame**: mirror the phone inside the headset.
 - **PC VR from Linux**: [feasibility and options](linux-vr-streaming.md),
  including Valve's streaming and USB support. No Linux host tested yet.
+- **Linux desktop → Frame panels**: [PC-host feasibility on lxso2](evidence/linux-pc-host-lxso2-2026-10-24.md).
+  Blocked on missing desktop portal/PipeWire and native build dependencies;
+  Linux desktop capture remains disabled and unverified.
 - **Input**: type and point in the Frame from the Mac or iPhone.
 - **Live view and Control**: watch a panel flat and tap on it to use it.

@@ -151,10 +154,31 @@ two fingers to scroll, two-finger tap to right-click) plus a text field that
 types on the Frame. On a computer, clicking the pad passes your mouse and
 keyboard through to the Frame until you press Esc (⌘ is sent as Ctrl on a Mac).

-It goes through **KDE Connect**, the first-party route (KDE makes the Frame's
-desktop): Frame Control's server runs [`ui/frame_input_agent.py`](../ui/frame_input_agent.py)
-on the Frame, which talks KDE Connect's own LAN protocol to the Frame's
-`kdeconnectd` as if it were a phone. KDE Connect does the typing and clicking.
+Since Control (below), the pad goes through **gamescope's own input socket**
+([`ui/frame_touch.py`](../ui/frame_touch.py)), so it reaches whichever panel has
+focus, Steam's own menus included, and needs nothing installed on the Frame.
+Only characters that aren't on a US keyboard (accents, emoji) go through
+**KDE Connect** as below; it starts the first time you type one. (Before
+Control, everything went through KDE Connect, which is why the notes below
+describe it in detail.)
+
+The server keyboard queue holds at most 200 events, including text being sent.
+A batch with an accent sends its whole keyboard part through KDE Connect, and
+later keys follow it there while typing is pending. If the batch will not fit,
+the server rejects it before sending any clicks or keys; the page keeps it and
+retries after polling. Accepted events are never evicted to make room. A timeout
+or helper failure retains unsent text and shows **Try again**; that button resumes
+the retained queue. The queue lives in memory and is lost if the server exits.
+Switching headsets cancels queued text and stops both input helpers before the
+new route is published. Both controls validate the intended headset before they
+start. Ordering between the two input services uses a typing-time estimate;
+neither service acknowledges when characters reach the application.
+
+[PR #66 verification on 2026-10-24](evidence/pad-gamescope-2026-10-24.md)
+records an owned focused X11 panel receiving a click and `Frame66` plus Enter
+on a real Frame with SteamOS 0.5.6, after the shared headset became available.
+The helper, window and owner-marked lock were cleaned up. This is ASCII input
+proof, not wearer-visible, Unicode or packaged Electron GUI verification.

 **Verified 2026-09-28** (SteamOS 0.4.1, build 20260925.6191901):

@@ -285,6 +309,17 @@ How (**verified 2026-09-29**, SteamOS 0.4.1, build 20260925.6191901):
  [#73](https://github.com/saphid/frame-control/issues/73) (SteamOS 0.4.5, desktop
  open but not found). The likely cause there was the page itself: a second
  `loadPanels` (the panel switcher's) replaced the Desktop view's, fixed in #84.
+  If the `GAMESCOPE_FOCUSABLE_WINDOWS` property cannot be read, discovery now
+  reports that the panel list is unreadable and whether a panel is open is
+  unknown. A failed X connection or missing property is not evidence that the
+  desktop is closed. Check that SteamVR is running, retry or use Headset view;
+  if it persists, report the exact message and SteamOS version. The confirmed
+  empty-list advice is retained when the property is present but empty.
+  [2026-10-24 investigation and verification limits](evidence/panel-discovery-2026-10-24.md).
+  A later [packaged v0.4.17 test on the real Frame](evidence/desktop-capture-packaged-2026-10-24.md)
+  captured a mapped, focused nested KDE compositor on SteamOS 0.5.6. SteamVR
+  still reported its overlay hidden, so that test does not establish the
+  wearer's visible-desktop condition in #73 or justify closing it.
 - Tested from the iPhone app (Simulator): a tap on the Desktop view focused a
  text box in the panel and the text field typed into it; a trackpad move went
  exactly (+40, +25).
@@ -12,6 +12,16 @@ A fourth, a SteamOS VM, may come later ([issue #6](https://github.com/saphid/ste

 ## Unit tests

+The gamescope keyboard/trackpad route has focused suites in `test_input.py`,
+`test_touch.py` and `test_service_regressions.py`. They cover pad translation,
+ASCII/modifier keys, Unicode queuing/retries, stale panel targets, release
+handling, route cancellation, and intended-headset start/status guards.
+`tests/page/pad_queue.mjs` and `tests/page/ctrl_gestures.mjs` execute the page's
+real queue and gesture functions in Node. These are offline tests; their
+acknowledgements do not prove that a real application received input.
+See [the 2026-10-24 PR #66 evidence](evidence/pad-gamescope-2026-10-24.md)
+for the real focused-panel click/key observation, cleanup and remaining limits.
+
 The read-only power/heat sampler has fixture and transport tests in
 `tests/test_power_sample.py`. Run
 `python3 -m unittest discover -s tests -p test_power_sample.py -v`.
@@ -165,6 +175,14 @@ Record the build, actual interaction results, cleanup and any unworn-headset
 limits alongside screenshots or logs. These are caller responsibilities; the
 smoke script below does not acquire this shared lock itself.

+[Packaged Desktop Capture evidence, 2026-10-24](evidence/desktop-capture-packaged-2026-10-24.md)
+records v0.4.17 GUI button captures of a real mapped nested desktop on SteamOS
+0.5.6, a bounded owned user unit, and cleanup back to the original Game Mode
+state. Check X window mapping/focus and SteamVR overlay visibility separately:
+successful capture of a mapped window does not prove the desktop is visible
+to a wearer. That run's overlay stayed `not_visible`; #73 remains unverified
+for its reported visible-desktop/0.4.5 condition. Only state/log metadata is public.
+
 ```sh
 scripts/frame-smoke.sh           # needs `ssh frame` to work without a password
 scripts/frame-smoke.sh --pair    # also pairs a throwaway key: approve it in the headset
@@ -374,7 +392,11 @@ trees on the fake Frame. None of it has run on a headset.

 `tests/test_media.py` covers layout evidence and overrides, OU eye ordering,
 hardware-decoder command construction, malformed splats, stereo parallax and
-fake-Frame library/process ownership. `tests/e2e/test_media_transfer.py` checks the real
+fake-Frame library/process ownership. It also covers optional-surround refusal
+at creation, setup, first upload and retry after standby, fatal screen refusal,
+and best-effort overlay teardown with shutdown.
+Run `python3 -m unittest discover -s tests -p test_media.py -v`.
+`tests/e2e/test_media_transfer.py` checks the real
 HTTP/SSH upload and library listing without pretending the fake renders VR.
 Real decode timings and captured stereo output are recorded in
 [vr-video.md](vr-video.md). Generated media only; no external player required.
@@ -461,3 +483,19 @@ rule, which the original source-only assertion missed. Check computed wrapping,
 the complete explanation, tooltip punctuation, Refresh bounds and selection
 after **Use this headset** when changing these styles. This fixture does not
 exercise Electron integration or a real SSH identity change.
+
+
+## PC-only Windows wireless diagnosis
+
+```sh
+python3 -m unittest discover -s tests -p 'test_wireless.py' -v
+node --test tests/wireless.cjs
+```
+
+The checks workflow runs this targeted suite on Windows, including the real
+read-only PowerShell query, and the normal server suite includes it on all
+platforms. HTTP tests instantiate only a handler, never the app connector.
+Fixtures cover duplicate instance identity, unknown states, GUID matching,
+localised/denied channel data and 6 GHz ambiguity. No tests contact a real Frame.
+A Windows CI runner/VM cannot prove physical Steam dongle behaviour or audio RF
+interference. See [sources and limits](windows-wireless-doctor.md).
@@ -101,6 +101,14 @@ Stills and the theatre surround are re-sent after waking. Five minutes
 without an accepted frame is reported as an error. Headset-view captures
 taken during standby show a flat dark frame, not our screen.

+**Optional surround:** if SteamVR refuses the theatre dark surround at startup
+or on a retry after standby, playback continues without it and the player log
+records `Theatre surround unavailable`. Screen errors still fail playback.
+On exit, the player attempts to destroy every owned overlay and calls OpenVR
+shutdown even if an overlay's teardown raises an exception. Refusal and
+teardown errors are covered by fake-OpenVR tests; a real surround refusal has
+not been induced safely. See the [current hardening checks](evidence/media-surround-2026-10-24.md).
+
 ![Media panel in Frame Control while a photo plays on the Frame](img/media-ui-panel.png)

 **Verified failed route:** GStreamer 1.24.2's `playbin` selected
@@ -0,0 +1,101 @@
+# Windows Wireless Adapter doctor
+
+Open **Tools → This PC → Wireless Adapter doctor**, then choose **Read PC
+adapters**. It works without a headset connection. It only queries this Windows
+PC, with no automatic polling, changes, elevation or UAC prompt. It never
+contacts the Frame. A direct `#wireless` link on another platform explains that
+Windows is required.
+
+The snapshot shows:
+
+- Exact network PnP instance IDs, including non-present devices, with separate
+  presence, PnP status/problem code, operational state and media connection state.
+- Microsoft Wi-Fi Direct Virtual Adapter candidates and their distinct instance
+  count. `SWD\WIFIDIRECT\` is enumerator evidence; an English device-name match
+  is explicitly labelled **Name only**. A repeated row for one ID is counted once.
+- PC Wi-Fi interfaces, hardware-interface status and whether Windows has a
+  default route configured on an interface. Neither a route nor **Up** proves
+  that Steam uses that adapter. Multiple configured defaults are possible.
+- Reported channel and band, when `netsh wlan show interfaces` supplies recognised
+  English fields and an exact matching interface GUID. Missing, localised,
+  disconnected or denied readings remain **Unknown**. There is no name-based
+  channel association. A PC's router channel is not the Steam dongle's channel.
+- Possible spectrum overlap when an interface reports **2.4 GHz**, without
+  claiming interference. With no such reading, overlap stays **Unknown**:
+  unreported virtual/proprietary radios and audio dongles may still use 2.4 GHz.
+  Channel 1–14 alone does not identify a band: 6 GHz reuses low channel numbers.
+
+## Why there is no disable button
+
+[夕凪's report](https://x.com/Oo_yuunagi_oO/status/2113904070352343135)
+(24 October 2026) says extra Microsoft Wi-Fi Direct Virtual Adapter instances
+appear when their wireless adapter becomes unavailable, and disabling the newly
+appeared one *seems* to stop recurrence. This is useful owner evidence, but does
+not establish which instance would be safe to disable on another PC.
+
+Windows can legitimately create several Wi-Fi Direct virtual interfaces.
+A `#2` suffix is not a creation timestamp; non-present, down, or disconnected
+status is not proof of an unused instance. The inventory does not reliably map
+Steam's active radio/session to an expendable PnP instance. Disabling the wrong
+one could interrupt streaming, PC Wi-Fi, Mobile Hotspot or wireless displays.
+Frame Control therefore supplies evidence and guidance, with no disable,
+re-enable, driver removal or other write endpoint. It never changes security or
+location settings, requests administrator access, or bypasses execution policy.
+
+Before any manual changes, retain the exact instance IDs and compare snapshots
+before/after a drop with Steam Support. Do not disable a device based only on
+this report. A future disable feature needs a verified Steam adapter/session
+mapping, fresh protection for primary/active instances, explicit confirmation
+for one exact instance, and a tested recovery path that re-enables that same ID.
+
+## Checking a 2.4 GHz audio conflict
+
+[Deko's report](https://x.com/DekoDrak/status/2113412044644897023)
+(22 October 2026) describes Razer wireless-headset interference and temporarily
+disabling the Steam Frame dongle. It also mentions a PC/Wi-Fi shutdown during
+Windows Update and asks whether the dongle caused it. The post does not prove
+that connection or specify a measured audio radio channel. Treat the suggested
+2.4 GHz conflict as a hypothesis, not a diagnosis of the shutdown.
+
+Try wired audio briefly, separate radio dongles with a USB extension lead, or
+compare PC Ethernet / an existing 5 or 6 GHz network. Change one thing at a time
+and record whether symptoms recur. The doctor cannot measure RF congestion,
+read an audio dongle's channel, identify a faulty driver, or prove a dropout fix.
+
+## Sources, privacy and limits
+
+The single local PowerShell process uses `Get-PnpDevice -Class Net`, its
+`-PresentOnly` variant, `Get-NetAdapter -IncludeHidden`, `Get-NetRoute` for
+IPv4/IPv6 defaults, and `netsh wlan show interfaces`. Each source reports
+availability separately. Access denial, unavailable cmdlets/services and
+unsupported features produce partial/unknown results; there is no permission
+workaround. Queries run sequentially, so even one snapshot can span a state
+change. One probe runs at a time, with a 20-second process timeout.
+
+SSIDs, MAC addresses and raw command/error output are omitted from the API/UI.
+PnP IDs and adapter/interface names can identify this PC; review before sharing.
+The tool does not send or save reports, and does not add these readings to
+telemetry or problem-report diagnostics. Copy relevant text manually if needed.
+
+The shipped basic network-identity probe (`frame_network.py`) finds a gateway,
+network name and Tailscale state. It does not inventory virtual adapters or
+check channel overlap. The new doctor is a separate, explicit PC query.
+
+## Verification
+
+`tests/test_wireless.py` checks duplicate identity, presence/disabled/link
+separation, ambiguous joins, partial sources, privacy filtering, 6 GHz/channel
+ambiguity, localisation, missing band and denied output. HTTP tests require the
+UI key, reject headset-local mode, and assert no SSH call. `tests/wireless.cjs`
+executes the production UI with boundary fixtures: navigation starts no query,
+clicks query once, unknown values and failure/retry remain visible, and PnP IDs
+and names are escaped as text.
+
+Windows CI also executes the real read-only PowerShell probe against the
+runner's network devices. That proves Windows query execution, not a physical
+Steam dongle, Wi-Fi Direct session or Razer headset. See the PR for exact CI
+results. An existing local Windows 11 VM passed 15 targeted tests (one UI test skipped
+because Node is absent), including the live query. PnP, presence, adapters and
+routes were available; WLAN was unavailable in this VM. See
+[VM evidence](evidence/windows-wireless-2026-10-24.md). No Frame was accessed; no physical
+adapter/dropout fix or RF measurements are claimed.
@@ -73,7 +73,11 @@ discover_devkit() {
 pick_host() {
  local candidates=()
  [[ -n "$host_arg" ]] && candidates+=("$host_arg")
-  [[ -z "$host_arg" ]] && candidates+=("$FRAME_ALIAS.local" "$FRAME_ALIAS")
+  if [[ -z "$host_arg" ]]; then
+    local saved=$(ssh -G "$FRAME_ALIAS" 2>/dev/null | awk '$1 == "hostname" {print $2; exit}')
+    [[ -n "$saved" && "$saved" != "$FRAME_ALIAS" && "$saved" =~ $HOST_RE ]] && candidates+=("$saved")
+    candidates+=("$FRAME_ALIAS.local" "$FRAME_ALIAS")
+  fi
  local h
  for h in "${candidates[@]}"; do
    if reachable "$h"; then
@@ -224,6 +228,7 @@ pair_with_devkit() {
 print "==> Looking for the Steam Frame"
 if ! HOST=$(pick_host); then
  print -u2 "Could not reach the Frame on port 22 or $DEVKIT_PORT."
+  print -u2 "SteamOS 0.5.6 stopped publishing .local names; use its IP from Quick Settings."
  print -u2 "Check: Developer Mode on + user password set; same Wi-Fi; no client isolation."
  print -u2 "Then re-run with the IP from Quick Settings: scripts/connect.sh 192.168.x.y"
  exit 1
@@ -293,7 +293,7 @@ def load_baseline(path):
 def main(argv=None):
    parser = argparse.ArgumentParser(description='Read-only Frame setup diagnostics. Never pairs, repairs or asks for a password.')
    parser.add_argument('--alias', default='frame', help='Existing trusted SSH alias (default: frame)')
-    parser.add_argument('--lan', default='frame.local', help='LAN fallback host/IP')
+    parser.add_argument('--lan', help='Optional LAN IP or host name; SteamOS 0.5.6 no longer publishes .local names')
    parser.add_argument('--usb', default='10.86.200.233', help='USB fallback IP; use only with the intended headset connected')
    parser.add_argument('--plan', action='store_true', help='Print a read-only repair plan from recognized evidence')
    parser.add_argument('--save-report', metavar='FILE', help='Create a local JSON baseline (never overwrite an existing file)')
@@ -307,6 +307,8 @@ def main(argv=None):
            print('UNKNOWN Baseline: Cannot read a valid doctor report; no comparison performed.')
            return 2
    for value in (args.alias, args.lan, args.usb):
+        if value is None:
+            continue
        if not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._:-]{0,252}', value):
            parser.error('Use a plain alias, hostname or IP address.')
    print('Frame doctor: read-only; no passwords, pairing, repairs or raw logs. Reports are saved only with --save-report.')
@@ -327,7 +329,11 @@ def main(argv=None):
        print('UNKNOWN Baseline: SSH target configuration differs; comparison refused.')
        return 2
    source = Path(__file__).read_text()
-    for label, host in (('configured alias (Tailscale if configured)', None), ('LAN', args.lan), ('USB-C', args.usb)):
+    routes = [('configured alias (Tailscale if configured)', None)]
+    if args.lan:
+        routes.append(('LAN', args.lan))
+    routes.append(('USB-C', args.usb))
+    for label, host in routes:
        result = run(ssh_args(args.alias, host, identity) + ['python3 -B - --probe'], timeout=90, input=source)
        if result is not None and result.returncode == 0:
            try:
@@ -36,6 +36,7 @@ thead th,td{{white-space:nowrap}}th[scope=row]{{min-width:240px;max-width:300px;
 td:last-child{{min-width:220px;max-width:300px;white-space:normal;overflow-wrap:anywhere}}
 thead{{background:#edf1f5}}.scroll{{overflow:auto}}h1{{line-height:1.2}}</style>
 <main><h1>Frame power and heat report</h1>
+<p>Headset: {esc(report.get("headset", {}).get("alias", "frame"))}</p>
 <p>{len(report['samples'])} of {report['requestedSamples']} requested samples received; target interval {esc(report['intervalSeconds'])} seconds.</p>
 <p>Collection: {esc(report['stopped'] or 'Completed')}. Results describe only the samples received.</p>
 <p>{links}</p>
@@ -141,18 +141,28 @@ def collect(status, count, interval, emit=None):


 def csv_samples(report):
+    # CSV quoting alone does not prevent spreadsheet formulas in text fields.
+    def cell(value):
+        if isinstance(value, str) and (value.startswith(('\t', '\r', '\n')) or
+                                       value.lstrip(' \t\r\n').startswith(('=', '+', '-', '@'))):
+            return "'" + value
+        return value
+
    output = io.StringIO(newline='')
    writer = csv.writer(output)
    writer.writerow(('time', 'elapsedSeconds', 'metric', 'value', 'unit', 'source', 'state'))
+    if 'headset' in report:
+        for key, value in (('collection.state', report['stopped'] or 'Completed'),
+                           ('collection.requestedSamples', report['requestedSamples']),
+                           ('collection.receivedSamples', len(report['samples']))):
+            writer.writerow([cell(v) for v in ('', '', key, value, '', report['headset']['alias'],
+                                              'incomplete' if report['stopped'] else 'completed')])
    for sample in report['samples']:
        for key, row in sample['readings'].items():
-            # csv quoting does not prevent spreadsheet formulas in labels.
-            def cell(value):
-                return "'" + value if isinstance(value, str) and value.startswith(('=', '+', '-', '@')) else value
            writer.writerow([cell(v) for v in (sample['time'], sample['elapsedSeconds'], key,
                                               row['value'], row['unit'], row['source'], row['state'])])
        for group in sample['unavailableGroups']:
-            writer.writerow((sample['time'], sample['elapsedSeconds'], group, '', '', '', UNAVAILABLE))
+            writer.writerow([cell(v) for v in (sample['time'], sample['elapsedSeconds'], group, '', '', '', UNAVAILABLE)])
    return output.getvalue()


@@ -178,31 +188,61 @@ def remote_payload():
            'sys.modules["frame_status"] = status\n' + Path(__file__).read_text())


-def stream_report(command, payload, count, interval):
+def stream_report(command, payload, count, interval, stop_event=None, on_sample=None, discard_errors=False):
    """Receive each sample before the next wait; stop only our local SSH child.

    The remote bounded reader exits on its next write to the closed connection.
    No remote process-control command is sent. Keep already received samples on
    interrupt, transport failure or deadline, clearly marked as incomplete.
    """
+    if stop_event is not None and stop_event.is_set():
+        return {'schemaVersion': 1, 'requestedSamples': count, 'intervalSeconds': interval,
+                'stopped': 'Stopped before collection; no SSH started', 'samples': [], 'summary': {}}
    samples, final, stopped = [], None, None
-    events = queue.Queue()
+    events = queue.Queue(maxsize=count + 2)
+    reader_stop = threading.Event()
    deadline = time.monotonic() + count * interval + 30
    with tempfile.TemporaryFile(mode='w+') as errors:
        proc = subprocess.Popen(command + ['--stream'], stdin=subprocess.PIPE,
-                                stdout=subprocess.PIPE, stderr=errors, text=True)
+                                stdout=subprocess.PIPE, stderr=subprocess.DEVNULL if discard_errors else errors, text=True)
        def receive():
            try:
-                for line in proc.stdout:
-                    events.put(line)
+                for _ in range(count + 2):
+                    line = proc.stdout.readline(262145)
+                    if not line:
+                        break
+                    if len(line) > 262144 or not line.endswith('\n'):
+                        line = 'invalid or oversized sample'
+                    while not reader_stop.is_set():
+                        try:
+                            events.put(line, timeout=0.2)
+                            break
+                        except queue.Full:
+                            continue
+                    if reader_stop.is_set():
+                        return
            finally:
-                events.put(None)
+                while not reader_stop.is_set():
+                    try:
+                        events.put(None, timeout=0.2)
+                        break
+                    except queue.Full:
+                        continue
        reader = threading.Thread(target=receive, daemon=True)
        reader.start()
+        def feed():
+            try:
+                proc.stdin.write(payload)
+                proc.stdin.close()
+            except OSError:
+                pass  # transport exit/EOF below marks the observation incomplete
+        writer = threading.Thread(target=feed, daemon=True)
+        writer.start()
        try:
-            proc.stdin.write(payload)
-            proc.stdin.close()
            while True:
+                if stop_event is not None and stop_event.is_set() and events.empty():
+                    stopped = 'Stopped; received samples retained'
+                    break
                remaining = deadline - time.monotonic()
                if remaining <= 0:
                    stopped = 'Timed out; received samples retained'
@@ -218,6 +258,8 @@ def stream_report(command, payload, count, interval):
                    if len(samples) >= count:
                        raise ValueError('Too many samples received')
                    samples.append(event['sample'])
+                    if on_sample:
+                        on_sample(event['sample'])
                    print(f'Received {len(samples)}/{count} samples; Ctrl+C to stop and save.', file=sys.stderr)
                elif 'finished' in event:
                    final = event['finished']
@@ -228,6 +270,7 @@ def stream_report(command, payload, count, interval):
        except (OSError, ValueError, subprocess.TimeoutExpired) as exc:
            stopped = f'Collection interrupted: {exc}'
        finally:
+            reader_stop.set()
            if proc.poll() is None:
                proc.terminate()
                try:
@@ -235,6 +278,7 @@ def stream_report(command, payload, count, interval):
                except subprocess.TimeoutExpired:
                    proc.kill()
                    proc.wait(timeout=3)
+            writer.join(timeout=3)
            if not proc.stdin.closed:
                try:
                    proc.stdin.close()
@@ -263,6 +307,8 @@ def main(argv=None):
        ap.error('--html output already exists; choose a new file')
    # Also honor a coordinator lock on the computer before opening SSH.
    if LOCK.exists():
+        if args.probe and args.stream:
+            print(json.dumps({'finished': {'stopped': 'Smoke session active (/tmp/frame-test.lock); no sensors read'}}), flush=True)
        print('Smoke session active (/tmp/frame-test.lock); no SSH or sensors accessed.', file=sys.stderr)
        return 75
    if args.probe:
@@ -5,7 +5,8 @@ The Frame Control website, <https://frame-control.pages.dev>, on Cloudflare Page
 - `public/`: static pages. `/` is the landing page, `/feedback/` the feedback form, `/privacy/` the privacy note.
 - `functions/api/feedback.js`: `POST /api/feedback`, which turns the form into a GitHub issue labelled `feedback`.
 - `lib/feedback.js`: validation and issue formatting, tested by `test/feedback.test.mjs`.
- `public/js/site.js`: settings, including the Ko-fi page name for the donate buttons.
+- `public/js/site.js`: settings, including the Ko-fi page name for the donate buttons, OS hints and opening-help deep links. OS hints lead to instructions, never directly to an architecture-specific installer.
+- `test/onboarding.test.mjs`: desktop/mobile browser hints and opening-help deep links.

 ## Feedback → GitHub issues

@@ -33,3 +34,30 @@ npx wrangler pages deploy --branch main      # production
 ```

 Point `GITHUB_REPO` in `.dev.vars` at a scratch repo when testing locally so test issues don't land on the real tracker.
+
+## First-run verification
+
+Before changing download or setup instructions:
+
+- Compare every linked filename with `gh release view --repo saphid/frame-control --json tagName,assets`.
+  Browser OS hints cannot establish CPU architecture; keep every platform choice visible.
+- Run `node --test site/test/*.test.mjs` from the repo root, plus
+  `node --check site/public/js/site.js` and `node --check site/public/js/feedback.js`.
+- Serve `public/` locally (for example `python3 -m http.server 8793 --directory site/public`
+  from the repo root). Check 320px, 390px, 768px and desktop widths: section navigation,
+  the hero link, download cards, opening-help links, feedback and privacy pages. Check
+  horizontal overflow and that anchor targets clear the sticky header. Repeat with
+  JavaScript disabled: downloads and navigation must remain available.
+- Check setup labels against `app/main.js`, `scripts/connect.sh`, `ui/frame_connect.py`
+  and the Devices page. macOS discovery failure exits; Windows/Linux prompt for an IP.
+  The app's Devices → Add a headset dialog can pass an explicit address on all platforms.
+- Separate website checks from native installation and real-headset pairing evidence.
+  A successful page/link check does not verify an installer or headset approval flow.
+
+On 2026-10-24, the first-run update was checked against published v0.4.16 assets:
+all seven linked desktop installers returned HTTP 200 after redirects, as did the
+linked GitHub documentation and trailer. Local page/resource links and section
+fragments were checked; navigation stayed visible without horizontal overflow at
+320, 390, 768 and 1280 CSS pixels. Native macOS/Windows installs and real-headset
+pairing were not exercised for this documentation change. No site deployment was
+performed.
@@ -38,8 +38,13 @@ code { font: 14px ui-monospace, SFMono-Regular, Menlo, monospace; background: rg
 .top nav a { color: var(--muted); font-size: 14.5px; font-weight: 500; }
 .top nav a:hover, .top nav a[aria-current] { color: var(--bright); }
 .top .end { margin-left: auto; display: flex; gap: 10px; align-items: center; }
-@media (max-width: 880px) { .top nav { display: none; } }
-@media (max-width: 480px) { .top .end .ghost { display: none; } }
+@media (max-width: 1050px) {
+  html { scroll-padding-top: 150px; }
+  .top .wrap { height: auto; min-height: 64px; flex-wrap: wrap; gap: 8px 16px; padding-top: 12px; padding-bottom: 8px; }
+  .top nav { order: 3; width: 100%; margin-left: 0; flex-wrap: wrap; gap: 0 18px; }
+  .top nav a { padding: 8px 0; }
+}
+@media (max-width: 480px) { .top .end { display: none; } }

 /* ---- buttons ---- */
 .btn { display: inline-flex; align-items: center; justify-content: center; gap: 9px; height: 46px; padding: 0 22px; border-radius: 10px;
@@ -199,3 +204,11 @@ textarea { min-height: 180px; resize: vertical; }
 .done p { color: var(--muted); margin: 10px auto 24px; max-width: 460px; }
 .done .cta { margin-top: 0; }
 .page h1 { font-size: clamp(34px, 5vw, 48px); }
+
+/* Opening instructions remain readable on narrow screens. */
+.dl p, .setup-note { color: var(--muted); font-size: 15px; margin-top: 16px; }
+.dl { min-width: 0; }
+code { overflow-wrap: anywhere; }
+pre { white-space: pre-wrap; overflow-wrap: anywhere; }
+pre code { background: none; padding: 0; }
+@media (prefers-reduced-motion: reduce) { html { scroll-behavior: auto; } }
@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Frame Control: manage your Steam Frame from your computer</title>
-<meta name="description" content="Free, open-source app for the Valve Steam Frame. See what the headset sees, install Steam games and Android apps, move files and text across, and check battery and status. macOS, Windows, Linux and iPhone.">
+<meta name="description" content="Free, open-source app for the Valve Steam Frame. See what the headset sees, install Steam games and Android apps, move files and text across, and check battery and status. Desktop downloads for macOS, Windows and Linux; iPhone build instructions.">
 <meta name="theme-color" content="#0e141b">
 <link rel="icon" href="/favicon.png">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
@@ -41,13 +41,13 @@
 <main>
 <section class="hero">
  <div class="wrap">
-    <span class="eyebrow"><b>Free and open source</b><span class="sep"> · </span><span class="plats">macOS · Windows · Linux · iPhone</span></span>
+    <span class="eyebrow"><b>Free and open source</b><span class="sep"> · </span><span class="plats">macOS · Windows · Linux</span></span>
    <h1>Your Steam Frame, <span>managed from your desk.</span></h1>
-    <p class="lede">See what the headset sees, install games and Android apps, move files and text across, and keep an eye on battery and status. All over SSH, with nothing to install on the Frame.</p>
+    <p class="lede">See what the headset sees, install games and Android apps, move files and text across, and keep an eye on battery and status. Install Frame Control on your computer, then connect to your headset over SSH. This website provides downloads and instructions; it does not control the headset in your browser.</p>
    <div class="cta">
      <a class="btn primary" id="hero-download" href="#download">
        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 3v12m0 0-5-5m5 5 5-5M4 20h16"/></svg>
-        <span data-label>Download Frame Control</span>
+        <span data-label>Choose your computer’s download</span>
      </a>
      <a class="btn ghost" href="#trailer">
        <svg viewBox="0 0 24 24" fill="currentColor" aria-hidden="true"><path d="M8 5.5v13a1 1 0 0 0 1.5.86l10.5-6.5a1 1 0 0 0 0-1.72L9.5 4.64A1 1 0 0 0 8 5.5z"/></svg>
@@ -173,7 +173,7 @@
    <div class="head">
      <span class="kicker">iPhone and iPad</span>
      <h2>Also in your pocket</h2>
-      <p>The same features on iPhone and iPad, served from the Frame itself, so there's nothing to run on a computer. Build it from the repo in Xcode.</p>
+      <p>The same features on iPhone and iPad, served from the Frame itself, so there's nothing to run on a computer. There is no App Store, TestFlight or iOS download in the current release. Building it requires a Mac, Xcode and your own signing team. <a href="https://github.com/saphid/frame-control/blob/main/docs/iphone.md">iPhone build and pairing instructions</a>.</p>
    </div>
    <div class="phones">
      <img src="/img/phone-home.jpg" width="600" height="1304" loading="lazy" alt="Frame Control on iPhone: headset view and device status.">
@@ -186,23 +186,24 @@
  <div class="wrap">
    <div class="head">
      <span class="kicker">Setup</span>
-      <h2>One password, typed once</h2>
-      <p>Everything else happens on your computer.</p>
+      <h2>Connect your computer to the Frame</h2>
+      <p>First <a href="#download">install and open the desktop app</a>. Keep the headset awake, on the same trusted network as your computer. Guest Wi-Fi or client isolation can block the connection.</p>
    </div>
    <div class="steps">
      <div class="card">
-        <h3>Turn on Developer Mode</h3>
-        <p>On the Frame: Steam Settings → System → <b>Enable Developer Mode</b>, then <b>Set User Password</b> in the Developer section.</p>
+        <h3>Prepare the headset</h3>
+        <p>On the Frame: Steam Settings → System → <b>Enable Developer Mode</b>, then Developer → <b>Set User Password</b>. Choose a password that isn't easy to guess; it also protects remote desktop and <code>sudo</code>.</p>
      </div>
      <div class="card">
-        <h3>Set up the connection</h3>
-        <p>Open Frame Control and choose <b>Set Up Connection</b>. It finds the headset, makes an SSH key, and asks for that password once.</p>
+        <h3>Run connection setup</h3>
+        <p>In the desktop app, choose <b>Set Up Connection…</b>. If you skipped the first prompt, use <b>Frame → Set Up Connection…</b>. A terminal opens. If discovery fails, find the Frame's IP in Quick Settings or Steam Settings → Internet. Windows/Linux setup prompts for it. On macOS, return to the app → <b>Devices &amp; connection → + Add a headset…</b>, use SSH alias <code>frame</code> for the default headset, enter the IP in <b>Address</b> and choose <b>Set Up…</b>.</p>
      </div>
      <div class="card">
-        <h3>That's it</h3>
-        <p>The app reaches the headset whenever it's awake and on the same network. For anywhere else, use <a href="https://github.com/saphid/frame-control/blob/main/docs/tailscale.md">Tailscale</a>.</p>
+        <h3>Pair, with a password fallback</h3>
+        <p>Setup tries Valve's pairing first: open Developer → <b>Pair new host</b> in the headset and approve only your request. If it fails or times out, enter the Developer Mode password in the computer's terminal (typing may be invisible), then press Enter.</p>
      </div>
    </div>
+    <p class="setup-note">The devkit service and pairing-mode step were checked on a Frame; approval and key installation through that flow remain unverified. <a href="https://github.com/saphid/frame-control/blob/main/docs/ssh.md#password-free-pairing-steamos-devkit-service">Pairing details</a>. After setup succeeds, return to the app; future connections use SSH keys. Still offline? Check Developer Mode, the IP and network isolation, then rerun setup. For use away from home, see <a href="https://github.com/saphid/frame-control/blob/main/docs/tailscale.md">Tailscale</a>.</p>
  </div>
 </section>

@@ -211,32 +212,39 @@
    <div class="head">
      <span class="kicker">Download</span>
      <h2>Get Frame Control</h2>
-      <p>Free, with Python and adb built in. <span hidden>Version <span data-version></span>.</span> <a href="https://github.com/saphid/frame-control/releases">Release notes</a></p>
+      <p>Choose your computer’s OS and processor, not the headset’s. Python is bundled; Linux needs <code>ssh</code>, and arm64 Linux also needs your distribution’s <code>adb</code> for Android apps. <span hidden>Version <span data-version></span>.</span> <a href="https://github.com/saphid/frame-control/releases">Release notes</a></p>
    </div>
    <div class="downloads">
-      <div class="dl" data-os="mac">
-        <div class="os"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M16.37 12.6c-.02-2.2 1.8-3.26 1.88-3.31-1.02-1.5-2.62-1.7-3.19-1.72-1.36-.14-2.65.8-3.34.8-.69 0-1.75-.78-2.88-.76a4.27 4.27 0 0 0-3.6 2.19c-1.53 2.66-.39 6.6 1.1 8.76.73 1.06 1.6 2.24 2.74 2.2 1.1-.04 1.51-.71 2.84-.71 1.32 0 1.7.71 2.86.69 1.18-.02 1.93-1.08 2.65-2.14.83-1.23 1.18-2.41 1.2-2.47-.03-.01-2.3-.88-2.32-3.5zM14.2 6.13c.6-.73 1.01-1.75.9-2.76-.87.04-1.92.58-2.54 1.3-.56.64-1.05 1.67-.92 2.66.97.08 1.96-.49 2.56-1.2z"/></svg><h3>macOS</h3><span class="tag" hidden>Your system</span></div>
-        <span class="need">Apple Silicon</span>
+      <div class="dl" id="download-mac" data-os="mac">
+        <div class="os"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M16.37 12.6c-.02-2.2 1.8-3.26 1.88-3.31-1.02-1.5-2.62-1.7-3.19-1.72-1.36-.14-2.65.8-3.34.8-.69 0-1.75-.78-2.88-.76a4.27 4.27 0 0 0-3.6 2.19c-1.53 2.66-.39 6.6 1.1 8.76.73 1.06 1.6 2.24 2.74 2.2 1.1-.04 1.51-.71 2.84-.71 1.32 0 1.7.71 2.86.69 1.18-.02 1.93-1.08 2.65-2.14.83-1.23 1.18-2.41 1.2-2.47-.03-.01-2.3-.88-2.32-3.5zM14.2 6.13c.6-.73 1.01-1.75.9-2.76-.87.04-1.92.58-2.54 1.3-.56.64-1.05 1.67-.92 2.66.97.08 1.96-.49 2.56-1.2z"/></svg><h3>macOS</h3><span class="tag" hidden>OS detected</span></div>
+        <span class="need">Apple Silicon (M-series) only · no Intel Mac build</span>
        <div class="links">
          <a class="btn primary" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-mac-arm64.dmg">Download .dmg</a>
        </div>
+        <p>Check Apple menu → About This Mac for your chip. Open the DMG, drag Frame Control to Applications, then open it there. Allow local network access and Terminal control when asked.</p>
+        <p>The app isn't notarized. <a href="#mac-opening">macOS opening instructions</a>.</p>
      </div>
-      <div class="dl" data-os="windows">
-        <div class="os"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M3 5.5 10 4.5v7H3zM11 4.35 21 3v8.5H11zM3 12.5h7v7L3 18.5zM11 12.5h10V21l-10-1.4z"/></svg><h3>Windows</h3><span class="tag" hidden>Your system</span></div>
+      <div class="dl" id="download-windows" data-os="windows">
+        <div class="os"><svg viewBox="0 0 24 24" fill="currentColor"><path d="M3 5.5 10 4.5v7H3zM11 4.35 21 3v8.5H11zM3 12.5h7v7L3 18.5zM11 12.5h10V21l-10-1.4z"/></svg><h3>Windows</h3><span class="tag" hidden>OS detected</span></div>
        <span class="need">Windows 10 or 11, x64</span>
        <div class="links">
          <a class="btn primary" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-Setup-x64.exe">Download installer</a>
          <a class="btn ghost" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-win-x64.zip">Portable .zip</a>
        </div>
+        <p>Check Settings → System → About → System type. No native Windows ARM build is published. Run the installer, then open Frame Control from Start. The OpenSSH Client optional feature must be installed (it normally is). For portable use, extract the entire ZIP and run <code>Frame Control.exe</code>.</p>
+        <p>The installer isn't code-signed. <a href="#windows-opening">SmartScreen instructions</a>.</p>
      </div>
-      <div class="dl" data-os="linux">
-        <div class="os"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="4" width="18" height="16" rx="2"/><path d="m7 9 3 3-3 3M13 15h4"/></svg><h3>Linux</h3><span class="tag" hidden>Your system</span></div>
+      <div class="dl" id="download-linux" data-os="linux">
+        <div class="os"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="4" width="18" height="16" rx="2"/><path d="m7 9 3 3-3 3M13 15h4"/></svg><h3>Linux</h3><span class="tag" hidden>OS detected</span></div>
        <span class="need">x64 or arm64 · needs <code>ssh</code></span>
        <div class="links">
          <a class="btn primary" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-x86_64.AppImage">AppImage (x64)</a>
          <a class="btn ghost" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-amd64.deb">.deb (x64)</a>
          <a class="btn ghost" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.AppImage">AppImage (arm64)</a>
+          <a class="btn ghost" href="https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.deb">.deb (arm64)</a>
        </div>
+        <p>Run <code>uname -m</code>: <code>x86_64</code> means x64; <code>aarch64</code> means arm64. Install the matching .deb on Debian/Ubuntu and open Frame Control from your applications menu, or use AppImage on other distributions.</p>
+        <p><a href="#linux-opening">AppImage permissions and FUSE help</a>. On arm64 Debian/Ubuntu, install <code>adb</code> with <code>sudo apt install adb</code> for Android apps.</p>
      </div>
    </div>
  </div>
@@ -249,15 +257,22 @@
      <h2>Good questions</h2>
    </div>
    <div class="faq">
-      <details>
+      <details id="mac-opening">
        <summary>macOS says the app is damaged or can't be checked</summary>
-        <div><p>The app isn't notarized, because there's no paid Apple developer account behind it. Drag it to Applications, then clear the download quarantine once in Terminal:</p>
+        <div><p>The app isn't notarized, because there's no paid Apple developer account behind it. Only for a download you trust from the releases linked above: drag it to Applications, then clear the download quarantine once in Terminal:</p>
        <p><code>xattr -dr com.apple.quarantine "/Applications/Frame Control.app"</code></p></div>
      </details>
-      <details>
+      <details id="windows-opening">
        <summary>Windows SmartScreen says it protected my PC</summary>
        <div><p>The installer isn't code-signed. Choose <b>More info → Run anyway</b>, or use the portable .zip: unzip it anywhere and run <code>Frame Control.exe</code>.</p></div>
      </details>
+      <details id="linux-opening">
+        <summary>How do I open the Linux AppImage?</summary>
+        <div><p>In a terminal in your download folder, use the exact filename for your architecture. For x64:</p>
+        <pre><code>chmod +x Frame-Control-linux-x86_64.AppImage
+./Frame-Control-linux-x86_64.AppImage</code></pre>
+        <p>If FUSE is missing, install <code>libfuse2</code> (Ubuntu 24.04+: <code>libfuse2t64</code>), or run the same AppImage with <code>--appimage-extract-and-run</code>. Install your distribution’s OpenSSH client if <code>ssh</code> is missing.</p></div>
+      </details>
      <details>
        <summary>What does it change on my headset?</summary>
        <div><p>Only what you click. Installs go to your user account on the Frame, and nothing needs <code>sudo</code> except the power buttons. On your computer it adds a <code>Host frame</code> entry to <code>~/.ssh/config</code> and two SSH keys.</p></div>
@@ -5,8 +5,6 @@ const SITE = {
  kofi: "alexsouthwell",
 };

-const RELEASE = `https://github.com/${SITE.repo}/releases/latest/download/`;
-
 // Donate buttons.
 for (const el of document.querySelectorAll("[data-kofi]")) {
  if (SITE.kofi) el.href = `https://ko-fi.com/${SITE.kofi}`;
@@ -15,37 +13,39 @@ for (const el of document.querySelectorAll("[data-kofi]")) {
 for (const el of document.querySelectorAll("[data-needs-kofi]")) el.hidden = !SITE.kofi;
 for (const el of document.querySelectorAll("[data-no-kofi]")) el.hidden = !!SITE.kofi;

-// Best guess at the visitor's platform, for the hero button and the download cards.
+// Browser hints identify an OS, not a reliable CPU architecture. Always show
+// the install instructions and all choices before starting a download.
 function detectPlatform() {
  const ua = navigator.userAgent;
  const hint = navigator.userAgentData?.platform || navigator.platform || "";
-  if (/iPhone|iPad|iPod/.test(ua) || (/Mac/.test(hint) && navigator.maxTouchPoints > 1)) return "ios";
-  if (/Android/.test(ua)) return null;
+  if (/iPhone|iPad|iPod|Android/.test(ua) || (/Mac/.test(hint) && navigator.maxTouchPoints > 1)) return null;
  if (/Mac/.test(hint) || /Macintosh/.test(ua)) return "mac";
  if (/Win/.test(hint) || /Windows/.test(ua)) return "windows";
-  if (/Linux/.test(hint) || /Linux/.test(ua)) return /aarch64|arm64/i.test(ua + hint) ? "linux-arm" : "linux";
+  if (/Linux/.test(hint) || /Linux/.test(ua)) return "linux";
  return null;
 }

-const PLATFORMS = {
-  mac: { name: "macOS", file: "Frame-Control-mac-arm64.dmg" },
-  windows: { name: "Windows", file: "Frame-Control-Setup-x64.exe" },
-  linux: { name: "Linux", file: "Frame-Control-linux-x86_64.AppImage" },
-  "linux-arm": { name: "Linux (arm64)", file: "Frame-Control-linux-arm64.AppImage" },
-};
-
 const platform = detectPlatform();
 const hero = document.getElementById("hero-download");
-if (hero && PLATFORMS[platform]) {
-  hero.href = RELEASE + PLATFORMS[platform].file;
-  hero.querySelector("[data-label]").textContent = `Download for ${PLATFORMS[platform].name}`;
+if (hero && platform) {
+  hero.href = `#download-${platform}`;
+  const name = { mac: "macOS", windows: "Windows", linux: "Linux" }[platform];
+  hero.querySelector("[data-label]").textContent = `Choose a ${name} download`;
 }
-const card = platform && document.querySelector(`.dl[data-os="${platform.replace("-arm", "")}"]`);
+const card = platform && document.querySelector(`.dl[data-os="${platform}"]`);
 if (card) {
  card.classList.add("mine");
  card.querySelector(".tag").hidden = false;
 }

+// Keep linked opening instructions visible, including direct FAQ deep links.
+function revealInstructions() {
+  const target = document.getElementById(location.hash.slice(1));
+  if (target?.tagName === "DETAILS") target.open = true;
+}
+window.addEventListener("hashchange", revealInstructions);
+revealInstructions();
+
 // Latest version number, so the page never goes stale. Fails quietly.
 const versionEls = document.querySelectorAll("[data-version]");
 if (versionEls.length) {
@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { runInNewContext } from 'node:vm';
+
+const script = readFileSync(new URL('../public/js/site.js', import.meta.url), 'utf8');
+const html = readFileSync(new URL('../public/index.html', import.meta.url), 'utf8');
+
+function visit(navigator, hash = '') {
+  const label = { textContent: 'Choose your computer’s download' };
+  const hero = { href: '#download', querySelector: () => label };
+  const cards = Object.fromEntries(['mac', 'windows', 'linux'].map(os => [os, {
+    classes: [], classList: { add(name) { cards[os].classes.push(name); } },
+    tag: { hidden: true }, querySelector() { return this.tag; },
+  }]));
+  const details = { tagName: 'DETAILS', open: false };
+  const listeners = {};
+  const context = {
+    navigator, location: { hash }, window: { addEventListener: (name, fn) => { listeners[name] = fn; } },
+    document: {
+      querySelectorAll: () => [],
+      getElementById: id => id === 'hero-download' ? hero : id === 'mac-opening' ? details : null,
+      querySelector: selector => cards[selector.match(/data-os="([^"]+)"/)[1]],
+    },
+  };
+  runInNewContext(script, context);
+  return { hero, cards, details, listeners, context };
+}
+
+for (const [name, navigator, expected] of [
+  ['Intel Mac', { platform: 'MacIntel', userAgent: 'Macintosh' }, 'mac'],
+  ['Apple Silicon browser with Intel hint', { platform: 'MacIntel', userAgent: 'Macintosh', userAgentData: { platform: 'macOS' } }, 'mac'],
+  ['Windows', { platform: 'Win32', userAgent: 'Windows NT 10.0' }, 'windows'],
+  ['Linux x64', { platform: 'Linux x86_64', userAgent: 'Linux x86_64' }, 'linux'],
+  ['Linux ARM', { platform: 'Linux aarch64', userAgent: 'Linux aarch64' }, 'linux'],
+  ['iPhone', { platform: 'iPhone', userAgent: 'iPhone' }, null],
+  ['iPad desktop mode', { platform: 'MacIntel', userAgent: 'Macintosh', maxTouchPoints: 5 }, null],
+  ['Android', { platform: 'Linux armv8l', userAgent: 'Linux Android' }, null],
+  ['unknown', { userAgent: '' }, null],
+]) {
+  test(`${name} opens choices instead of guessing an installer architecture`, () => {
+    const { hero, cards } = visit(navigator);
+    assert.equal(hero.href, expected ? `#download-${expected}` : '#download');
+    assert.ok(html.includes(`id="${hero.href.slice(1)}"`));
+    assert.deepEqual(Object.keys(cards).filter(os => !cards[os].tag.hidden), expected ? [expected] : []);
+  });
+}
+
+test('opening help expands for direct and in-page links; unknown fragments are safe', () => {
+  const result = visit({ userAgent: '' }, '#mac-opening');
+  assert.equal(result.details.open, true);
+  result.details.open = false;
+  result.context.location.hash = '#unknown';
+  result.listeners.hashchange();
+  assert.equal(result.details.open, false);
+  result.context.location.hash = '#mac-opening';
+  result.listeners.hashchange();
+  assert.equal(result.details.open, true);
+});
@@ -23,7 +23,8 @@ function fixture() {
  const page = element('controlCenter');
  page.querySelectorAll = selector => selector === '[data-cc-category]' ? buttons : selector === '[data-cc-metric]' ? metrics : selector === '[data-cc-mac-link]' ? [element('macLink')] : [];
  page.querySelector = selector => selector === '[href="#connection"]' ? element('connectionLink') : cards.find(e=>selector === `[data-cc-card="${e.dataset.ccCard}"]`);
-  return {document:{getElementById:element},element,cards,buttons};
+  const listeners = {};
+  return {document:{hidden:false,getElementById:element,addEventListener(name,callback){listeners[name]=callback;}},listeners,element,cards,buttons};
 }
 function mounted(options = {}) {
  const f = fixture(), calls = [];
@@ -39,8 +40,10 @@ const flush = async () => { for(let i=0;i<12;i++)await Promise.resolve(); };
 // bootstrap, including the real Home-to-Control status handoff. Only unrelated
 // rendering helpers, timers and transport are stubbed.
 function sharedPage({productionApi=false} = {}) {
-  const f=fixture(), requests=[], writes=[], host=deferred(), job=deferred();
-  const context={document:f.document,FrameControlCenter:cc,window:{frameApp:{setUpConnection(){}}},
+  const f=fixture(), requests=[], writes=[], notifications=[], host=deferred(), job=deferred();
+  let now=0;
+  const context={document:f.document,FrameControlCenter:cc,performance:{now:()=>now},
+    window:{frameApp:{setUpConnection(){},notify:async(message,request)=>{notifications.push({message,request});}}},
    Date,setInterval,clearInterval,setTimeout:()=>1,clearTimeout(){},$:f.element,QUICK:[],installing:new Set(),
    battery(){},setVolume(){},renderHome(){},gb:String,dur:String,esc:String,meter(){},toast(){},
    runJob(title,id){context.installing.add(id);return job.promise;},
@@ -52,7 +55,11 @@ function sharedPage({productionApi=false} = {}) {
    watchConnection(){context.watched=true;}};
  vm.createContext(context);
  const stateDeclaration=pageSource.match(/let state = null[^\n]*/)[0];
-  vm.runInContext(stateDeclaration+'\nlet online = true, devGen = 1; const HOST = {computer:"computer"}; window.connDevice="frame-a";',context);
+  vm.runInContext(stateDeclaration+'\nlet online = true, devGen = 1, comfortActive = false; const HOST = {computer:"computer"}; window.connDevice="frame-a";',context);
+  // Load the real alert state machine and DOM wiring used by render, refresh,
+  // setOnline and onConnection; do not stub away their lifecycle behavior.
+  const batteryStart=pageSource.indexOf('class DesktopBatteryAlert'),batteryEnd=pageSource.indexOf('// ---- battery ----',batteryStart);
+  vm.runInContext(pageSource.slice(batteryStart,batteryEnd),context);
  const refreshStart=pageSource.indexOf('let refreshing = null'),refreshEnd=pageSource.indexOf('// ---- our VR HUD',refreshStart);
  const renderStart=pageSource.indexOf('function render(s) {'),renderEnd=pageSource.indexOf('// ---- view ----',renderStart);
  vm.runInContext(pageSource.slice(renderStart,renderEnd)+pageSource.slice(refreshStart,refreshEnd),context);
@@ -80,12 +87,48 @@ function sharedPage({productionApi=false} = {}) {
  const hostStart=pageSource.lastIndexOf('api("/api/host").then(h =>'),hostEnd=pageSource.indexOf('</script>',hostStart);
  vm.runInContext(pageSource.slice(hostStart,hostEnd),context);
  const bootstrapStart=pageSource.indexOf('window.frameControlCenter = FrameControlCenter.mount('),bootstrapEnd=pageSource.indexOf('</script>',bootstrapStart);
-  return {...f,context,requests,writes,host,refresh:()=>vm.runInContext('refresh()',context),
+  return {...f,context,requests,writes,notifications,host,setNow(value){now=value;},refresh:()=>vm.runInContext('refresh()',context),
    switchHeadset:()=>vm.runInContext('onConnection({now:Date.now()/1000,phase:"connected",devices_rev:0,device:{id:"frame-b",name:"Second Frame"}})',context),
    installFlatpak:()=>vm.runInContext('installFlatpak("test.app")',context),
    mount(){vm.runInContext(pageSource.slice(bootstrapStart,bootstrapEnd),context);return context.window.frameControlCenter;}};
 }
 const response = data => ({ok:true,status:200,json:async()=>data});
+test('production refresh confirms desktop alerts and failures interrupt confirmation', async () => {
+  const f=sharedPage({productionApi:true});
+  const low=sample();low.battery={percent:15,status:'Discharging',watts:-4};
+  const read=async(now,data=low)=>{
+    f.setNow(now);const pending=f.refresh();
+    f.requests.at(-1).resolve(response(data));await pending;
+  };
+  await read(0);await read(30000);
+  assert.equal(f.notifications.length,0,'desktop alert starts off');
+  f.element('desktopBatteryAlert').checked=true;
+  f.element('desktopBatteryAlert').onchange();
+  await read(60000);
+  const failed=f.refresh();f.requests.at(-1).reject(Error('Status transport failed'));await failed;
+  await read(90000);
+  assert.equal(f.notifications.length,0,'failed status interrupts low-battery confirmation');
+  await read(120000);
+  assert.equal(f.notifications.length,1);
+  assert.match(f.notifications[0].message,/15%.*draining/);
+  assert.equal(f.notifications[0].request,false,'refresh never requests notification permission');
+  await read(150000);
+  assert.equal(f.notifications.length,1,'same episode stays latched');
+  assert.equal(f.requests.length,7,'only explicit existing status reads are used');
+});
+test('production headset switch clears desktop opt-in and pending confirmation', async () => {
+  const f=sharedPage({productionApi:true});
+  f.element('desktopBatteryAlert').checked=true;
+  const low=sample();low.battery={percent:10,status:'Discharging',watts:-3};
+  const pending=f.refresh();f.requests[0].resolve(response(low));await pending;
+  assert.equal(vm.runInContext('desktopBattery.pending.condition',f.context),'low');
+  f.setNow(30000);f.switchHeadset();
+  assert.equal(f.element('desktopBatteryAlert').checked,false);
+  assert.equal(vm.runInContext('desktopBattery.pending',f.context),null);
+  assert.match(f.element('desktopBatteryStatus').textContent,/Headset changed/);
+  f.requests[1].resolve(response(low));await flush();
+  assert.equal(f.notifications.length,0,'new headset cannot inherit the prior opt-in');
+});
 for(const rejection of ['transport','body'])for(const delayedMount of [false,true]) {
  test(`production ${rejection} rejection from A preserves B ${delayedMount ? 'before delayed mount' : 'after mount'}`, async t => {
    const f=sharedPage({productionApi:true});
@@ -40,6 +40,15 @@ function page(answer) {
  if (!p.noPanelWhy().startsWith("The headset's desktop is running")) fail("why for capture: " + p.noPanelWhy());
  if (!p.ctrlTarget().why.startsWith("The headset's desktop is running")) fail("why for control: " + p.ctrlTarget().why);
 }
+// An unreadable list is unknown: both Capture and Control retain that distinction.
+{
+  const why = "Frame Control couldn't read gamescope's panel list, so it can't tell whether an app panel is open. " +
+    "Check that SteamVR is running in the headset, then try again or use the Headset view. " +
+    "If this persists, report your SteamOS version and this exact message.";
+  const p = page(() => ({ panels: [], focus: null, why }));
+  await p.loadPanels();
+  if (p.noPanelWhy() !== why || p.ctrlTarget().why !== why) fail("unreadable list reason lost");
+}
 // An older headset script without "why": the generic advice.
 {
  const p = page(() => ({ panels: [], focus: null }));
@@ -31,7 +31,8 @@ function page(api) {

 // A request that fails, or reaches a link that had dropped, keeps its keys and releases.
 for (const [label, api] of [["request failed", async () => { throw new Error("offline"); }],
-                            ["not sent", async () => ({ state: "starting", sent: false })]]) {
+                            ["not sent", async () => ({ state: "starting", sent: false })],
+                            ["queue full", async () => ({ state: "waiting", sent: false })]]) {
  const { pad, padSend, shown } = page(api);
  padSend({ dx: 5 });  // sent and lost: a move, fine to drop
  await new Promise(r => setTimeout(r, 0));
@@ -45,4 +46,29 @@ for (const [label, api] of [["request failed", async () => { throw new Error("of
    fail(label + ": " + JSON.stringify(q));
  if (!shown.length || shown.at(-1).state === "ready") fail(label + ": state not shown");
 }
+// Acknowledged text is removed locally, but its pending status must reach padShow
+// so failures reported after acceptance are polled without another keypress.
+{
+  const { pad, padSend, shown } = page(async () => ({ state: "ready", sent: true, queued: 1 }));
+  padSend({ key: "é" });
+  await new Promise(r => setTimeout(r, 0));
+  if (pad.queue.length || shown.at(-1)?.queued !== 1) fail("accepted text is not polled");
+}
+
+// Exercise the real status/poll function: queued text leaves pointer controls
+// usable, still polls, shows an eventual error, and does not silently retry it.
+{
+  const pad = { state: "ready", queue: [] }, elements = {};
+  let poll = null;
+  const show = new Function("pad", "$", "PAD_STATES", "TOUCH", "padFlush", "devGen", "api",
+    "setTimeout", "clearTimeout", grab("padShow") + "; return padShow;")(
+    pad, id => elements[id] ||= { classList: { toggle() {} } }, {}, false, () => {}, 0,
+    async () => ({ state: "error", message: "Text is retained; try again." }),
+    fn => { poll = fn; return 1; }, () => { poll = null; });
+  show({ state: "ready", queued: 1 });
+  if (pad.state !== "ready" || !poll) fail("pending text disabled pointer or skipped poll");
+  await poll();
+  if (pad.state !== "error" || poll || !elements.padHint.textContent.includes("retained"))
+    fail("asynchronous error not surfaced");
+}
 console.log("queue rules ok");
@@ -0,0 +1,70 @@
+// Run the real doctor page script with a minimal DOM; no browser or hardware I/O.
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import vm from 'node:vm';
+class Element {
+  constructor(tag) { this.tagName = tag.toUpperCase(); this.children = []; this.value = ''; this.hidden = false; this.disabled = false; this.textContent = ''; }
+  append(...nodes) { this.children.push(...nodes); }
+  prepend(...nodes) { this.children.unshift(...nodes); }
+  replaceChildren(...nodes) { this.children = nodes; }
+  get firstChild() { return this.children[0]; }
+  get options() { return this.children; }
+}
+const ids = ['back','inventory','diagnose','device','message','results','json','reportSection','selection','download','copy'];
+const elements = Object.fromEntries(ids.map(id => [id,new Element(id === 'device' ? 'select' : 'div')]));
+const requests = [];
+let pending;
+const context = vm.createContext({
+  document:{getElementById:id=>elements[id],createElement:tag=>new Element(tag)},
+  URLSearchParams,location:{search:'?key=test-key'},
+  fetch:(path,options)=>{ requests.push({path,options}); return new Promise(resolve=>{pending=resolve;}); },
+  navigator:{clipboard:{writeText:async()=>{throw Error('clipboard denied');}}},
+});
+const source = readFileSync(new URL('../../ui/wireless-doctor.html',import.meta.url),'utf8');
+vm.runInContext(source.match(/<script>([\s\S]*)<\/script>/)[1],context);
+assert.equal(requests.length,0,'opening the page must not probe');
+assert.equal(elements.back.href,'/?key=test-key#devices');
+const fixture = {
+  schema:1,supported:true,selected:null,
+  usb:[{id:'usb:1-2',vid:'1234',pid:'5678',product:'<img src=x onerror=alert(1)>'}],
+  interfaces:[{id:'net:wlan0',name:'wlan0',usb:'usb:1-2',driver:'synthetic'}],
+  checks:[{id:'presence',title:'Presence',status:'ok',suggestion:'Select hardware',evidence:['Synthetic evidence']}]
+};
+let promise=elements.inventory.onclick();
+assert.equal(elements.device.disabled,true,'selection must stay fixed during a read');
+assert.equal(requests[0].path,'/api/wireless-doctor');
+assert.equal(requests[0].options.headers['X-Frame-UI'],'test-key');
+pending({ok:true,json:async()=>fixture}); await promise;
+assert.equal(elements.device.value,'','no automatic hardware choice');
+assert.equal(elements.diagnose.disabled,true);
+assert.equal(elements.device.options.length,3);
+assert.match(elements.device.options[2].textContent,/<img src=x/,'hardware labels must stay plain text');
+assert.equal(elements.device.options[2].children.length,0);
+assert.equal(elements.reportSection.hidden,false);
+assert.equal(elements.results.children.length,1);
+elements.device.value='net:wlan0'; elements.device.onchange();
+assert.equal(elements.diagnose.disabled,false);
+assert.equal(elements.results.children.length,0,'changing hardware clears the previous result');
+assert.equal(elements.reportSection.hidden,true,'cannot export an old report for a new selection');
+promise=elements.diagnose.onclick();
+assert.equal(requests[1].path,'/api/wireless-doctor?device=net%3Awlan0');
+assert.equal(elements.device.disabled,true);
+pending({ok:true,json:async()=>({...fixture,selected:'net:wlan0'})}); await promise;
+assert.equal(elements.device.value,'net:wlan0');
+assert.equal(elements.device.disabled,false);
+await elements.copy.onclick();
+assert.match(elements.message.textContent,/Clipboard unavailable/);
+promise=elements.diagnose.onclick();
+assert.equal(elements.results.children.length,0,'clear a healthy snapshot before retrying');
+assert.equal(elements.reportSection.hidden,true);
+pending({ok:false,json:async()=>({error:'Device is no longer present. Refresh and select an observed device.'})}); await promise;
+assert.match(elements.message.textContent,/no longer present/);
+assert.equal(elements.results.children.length,0);
+assert.equal(elements.reportSection.hidden,true,'failed requests cannot export stale success');
+assert.equal(elements.inventory.disabled,false,'can refresh after failure');
+promise=elements.inventory.onclick();
+pending({ok:true,json:async()=>({...fixture,supported:false,usb:[],interfaces:[]})}); await promise;
+assert.equal(elements.selection.hidden,true);
+assert.equal(elements.diagnose.disabled,true);
+assert.match(elements.message.textContent,/only on a Linux PC/);
+console.log('doctor UI: on-demand reads, explicit selection, safe labels, stale report clearing and failure recovery passed');
@@ -0,0 +1,77 @@
+const {test}=require('node:test');
+const assert=require('node:assert/strict');
+const {workspaceFixture,html}=require('./workspace_fixture.cjs');
+function fixture() {
+  const f=workspaceFixture();
+  Object.assign(f.context, {clearTimeout(){},setTimeout(){},UI_KEY:'1',encodeURIComponent});
+  const formats=['html','json','csv'].map(format=>Object.assign(f.el('download-'+format),{dataset:{powerFormat:format}}));
+  const query=f.context.document.querySelectorAll;
+  f.context.document.querySelectorAll=s=>s==='[data-power-format]'?formats:query(s);
+  f.formats=formats;
+  f.run(html.slice(html.indexOf('// ---- Read-only power observation ----'),html.indexOf('// ---- Read-only game storage ----')));
+  return f;
+}
+const state={id:'abc',headset:{alias:'old-frame'},requested:12,received:3,running:true,stopped:null};
+test('Tools navigation loads the report and renders accessible progress',async()=>{
+  const f=fixture();let calls=0;f.context.api=async()=>{calls++;return state;};
+  f.navigate('#powerReport');await new Promise(setImmediate);
+  assert.equal(f.activePage,'tools');assert.equal(f.el('powerReport').hidden,false);
+  assert.equal(f.el('powerReport').parentNode,f.el('toolWorkspace'));
+  assert.equal(calls,1);assert.equal(f.el('powerProgress').value,3);
+  assert.equal(f.el('powerStart').disabled,true);assert.equal(f.el('powerStop').disabled,false);
+  assert.match(f.el('powerStatus').textContent,/Headset: old-frame.*3 of 12.*Observing/);
+});
+test('incomplete result preserves original identity and start becomes available',()=>{
+  const f=fixture();f.context.sample={...state,running:false,stopped:'Headset switched; samples retained'};
+  f.run('renderPower(sample)');
+  assert.match(f.el('powerStatus').textContent,/old-frame.*Incomplete: Headset switched/);
+  assert.equal(f.el('powerStart').disabled,false);assert.equal(f.el('powerStop').disabled,true);
+});
+test('stop submits observation identity and keeps progress visible',async()=>{
+  const f=fixture(),calls=[];f.context.sample=state;f.run('renderPower(sample)');
+  f.context.api=async(path,body)=>{calls.push([path,body]);return {...state,running:false,stopped:'Stopped by user'};};
+  await f.el('powerStop').onclick();
+  assert.equal(calls[0][0],'/api/power');assert.equal(calls[0][1].action,'stop');assert.equal(calls[0][1].id,'abc');
+  assert.equal(f.el('powerProgress').value,3);assert.match(f.el('powerStatus').textContent,/Incomplete/);
+});
+test('old polls cannot overwrite newer report and retry explains retained samples',async()=>{
+  const f=fixture(),pending=[];f.context.api=()=>new Promise((resolve,reject)=>pending.push({resolve,reject}));
+  const first=f.run('loadPower()'),second=f.run('loadPower()');
+  pending[1].resolve({...state,running:false,stopped:'Disconnected'});await second;
+  const current=f.el('powerStatus').textContent;pending[0].resolve(state);await first;
+  assert.equal(f.el('powerStatus').textContent,current);
+  const next=f.run('loadPower()');pending[2].reject(new Error('Offline'));await next;
+  assert.match(f.el('powerStatus').textContent,/Offline.*Received samples remain/);
+});
+test('start failure remains actionable and does not imply success',async()=>{
+  const f=fixture();f.context.api=async()=>{throw new Error('Smoke session active');};
+  await f.el('powerStart').onclick();assert.match(f.el('powerStatus').textContent,/Smoke session/);
+  assert.equal(f.el('powerStart').disabled,false);
+});
+test('download captures observation ID, fetches an authenticated blob and names the file',async()=>{
+  const f=fixture(),requests=[],saved=[];
+  f.context.sample={...state,running:false,stopped:'Disconnected'};f.run('renderPower(sample)');
+  f.context.fetch=async(url,opts)=>{requests.push([url,opts]);return {ok:true,blob:async()=>({report:true})};};
+  f.context.URL={createObjectURL:()=> 'blob:report',revokeObjectURL(){}};
+  f.context.document.createElement=()=>({click(){saved.push({href:this.href,name:this.download});}});
+  await f.formats[0].onclick();
+  assert.equal(requests[0][0],'/api/power/report?id=abc&format=html');
+  assert.equal(requests[0][1].headers['X-Frame-UI'],'1');
+  assert.deepEqual(saved,[{href:'blob:report',name:'frame-power-abc.html'}]);
+  assert.match(f.el('powerSaveStatus').textContent,/Download requested/);
+  f.context.fetch=async()=>({ok:false,json:async()=>({error:'Report replaced'})});
+  await f.formats[0].onclick();
+  assert.match(f.el('powerSaveStatus').textContent,/Download failed: Report replaced/);
+  assert.equal(f.formats[0].disabled,false);
+});
+test('packaging guard requires shared modules and detects missing resources',()=>{
+  const fs=require('node:fs'),os=require('node:os'),path=require('node:path');
+  const guard=require('../app/build/check-resources');const tmp=fs.mkdtempSync(path.join(os.tmpdir(),'power-resources-'));
+  try {
+    for(const rel of guard.REQUIRED) {const file=path.join(tmp,rel);fs.mkdirSync(path.dirname(file),{recursive:true});fs.writeFileSync(file,'test');}
+    assert.deepEqual(guard.missing(tmp),[]);
+    for(const rel of ['ui/frame_power.py','ui/frame_status.py','scripts/frame_power_sample.py','scripts/frame_power_report.py']) {
+      assert.ok(guard.REQUIRED.includes(rel));fs.unlinkSync(path.join(tmp,rel));assert.ok(guard.missing(tmp).includes(rel));
+    }
+  } finally {fs.rmSync(tmp,{recursive:true,force:true});}
+});
@@ -230,8 +230,9 @@ def cleanup(smoke):
        # It logs a failed sync and exits 0, so read its log; a second run lists
        # what Steam still has registered, which must not include ours.
        try:
-            first = ssh('python3 ~/devkit-utils/steamos-delete 2>&1', timeout=120)
-            second = ssh('python3 ~/devkit-utils/steamos-delete 2>&1', timeout=120)
+            command = frame_titles.devkit_script('delete') + ' 2>&1'
+            first = ssh(command, timeout=120)
+            second = ssh(command, timeout=120)
            for out in (first, second):
                if 'sync of devkit games failed' in out:
                    raise AssertionError(out.strip().splitlines()[-1])
@@ -0,0 +1,82 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const path = require('node:path');
+const html = fs.readFileSync(path.join(__dirname, '../ui/index.html'), 'utf8');
+const code = html.split('// Local Steam helper: never start')[1].split('// ---- shared destinations')[0];
+
+function fixture() {
+  const elements = new Map(), requests = [];
+  const $ = id => {
+    if (!elements.has(id)) elements.set(id, {disabled:true, textContent:''});
+    return elements.get(id);
+  };
+  const ctx = {$, api:(url, body) => new Promise((resolve, reject) => requests.push({url, body, resolve, reject}))};
+  vm.createContext(ctx);
+  vm.runInContext('// never start' + code, ctx);
+  return {ctx, $, requests};
+}
+
+test('navigation reads status; only clicks request launch or permission UI', async () => {
+  const {ctx, $, requests} = fixture();
+  assert.equal(requests.length, 0);
+  const load = ctx.loadSteamPipewire();
+  assert.equal(requests[0].url, '/api/steam-pipewire');
+  assert.equal(requests[0].body, undefined);
+  requests[0].resolve({available:true, guidance:'Verify the Steam session'});
+  await load;
+  assert.equal($('steamPipewireLaunch').disabled, false);
+  assert.equal($('steamPipewireGuidance').textContent, 'Verify the Steam session');
+  const launch = $('steamPipewireLaunch').onclick();
+  assert.deepEqual(JSON.parse(JSON.stringify(requests[1].body)), {action:'launch', confirmed:true});
+  assert.equal($('steamPipewireReset').disabled, true);
+  await $('steamPipewireReset').onclick(); // repeated action suppressed
+  assert.equal(requests.length, 2);
+  requests[1].reject(new Error('Exit Steam first'));
+  await launch;
+  assert.equal($('steamPipewireStatus').textContent, 'Exit Steam first');
+  const reset = $('steamPipewireReset').onclick();
+  assert.deepEqual(JSON.parse(JSON.stringify(requests[2].body)), {action:'permissions', confirmed:true});
+  requests[2].resolve({reset:false, opened:true, message:'No permission was changed'});
+  await reset;
+  assert.equal($('steamPipewireStatus').textContent, 'No permission was changed');
+});
+
+test('unsupported status and read failure keep actions disabled', async () => {
+  const {ctx, $, requests} = fixture();
+  const load = ctx.loadSteamPipewire();
+  requests[0].resolve({available:false, reason:'Local Wayland required'});
+  await load;
+  assert.equal($('steamPipewireLaunch').disabled, true);
+  assert.equal($('steamPipewireReset').disabled, true);
+  assert.equal($('steamPipewireStatus').textContent, 'Local Wayland required');
+  const retry = ctx.loadSteamPipewire();
+  requests[1].reject(new Error('Unavailable'));
+  await retry;
+  assert.equal($('steamPipewireLaunch').disabled, true);
+});
+
+test('stale status cannot overwrite an action result', async () => {
+  const {ctx, $, requests} = fixture();
+  const load = ctx.loadSteamPipewire();
+  const reset = ctx.steamPipewireAction('permissions');
+  requests[1].resolve({message:'No permission was changed'});
+  await reset;
+  requests[0].resolve({available:true});
+  await load;
+  assert.equal($('steamPipewireStatus').textContent, 'No permission was changed');
+});
+
+
+test('Tools navigation opens the separate Steam panel without starting PC capture', () => {
+  const {workspaceFixture} = require('./workspace_fixture.cjs');
+  const f = workspaceFixture();
+  f.navigate('#steamPipewire');
+  assert.equal(f.activePage, 'tools');
+  assert.equal(f.el('steamPipewire').hidden, false);
+  assert.equal(f.el('macview').hidden, true);
+  assert.ok(f.calls.some(call => call[0] === 'steam-pipewire'));
+  assert.ok(!f.calls.some(call => call[0] === 'macview'));
+  assert.match(html, /\$\("steamPipewireLink"\)\.hidden = h.mobile \|\| h.os !== "Linux"/);
+});
@@ -5,6 +5,7 @@ import io
 import json
 import os
 from pathlib import Path
+import re
 import shlex
 import subprocess
 import sys
@@ -203,23 +204,113 @@ class Remote(unittest.TestCase):
        self.assertEqual(result['written'], 0)
        self.assertEqual(result['held'], {'refused': 1, 'reference': 1})

-    def test_session_reads_the_mode(self):
-        conf = write(self.home, 'zz-steamos-autologin.conf', '[Autologin]\nSession=plasma-steamos-wayland-oneshot.desktop\n')
-        running = set()
-        with patch.object(remote, 'SDDM_CONFS', (str(conf),)), \
-                patch.object(remote, '_running', side_effect=lambda n, full=False: n in running), \
-                patch.object(remote.shutil, 'which', side_effect=lambda n: '/usr/bin/' + n if n == 'steamos-session-select' else None):
-            state = remote.session()
-            self.assertEqual((state['mode'], state['selector']), ('desktop', 'steamos-session-select'))
-            self.assertEqual(state['configured'], 'plasma-steamos-wayland-oneshot.desktop')
-            running.update({'gamescope', 'plasmashell'})  # the nested desktop panel
-            self.assertEqual(remote.session()['mode'], 'game')
-            running.clear()
-            running.add('gamescope-wl')  # gamescope's process name on the Frame, with no desktop panel open
-            self.assertEqual(remote.session()['mode'], 'game')
-            running.clear()
-            running.add('start-gamescope-session')
-            self.assertEqual(remote.session()['mode'], 'game')
+
+class Session(unittest.TestCase):
+    def state(self, targets, running=(), configured=None):
+        with tempfile.TemporaryDirectory() as folder:
+            conf = write(folder, 'sddm.conf', 'Session=%s\n' % (configured or 'gamescope.desktop'))
+            with patch.object(remote, 'SDDM_CONFS', (str(conf),)), \
+                    patch.object(remote, '_session_target', side_effect=targets), \
+                    patch.object(remote, '_running', side_effect=lambda n, full=False: n in running), \
+                    patch.object(remote.shutil, 'which', return_value='/usr/bin/steamosctl'):
+                return remote.session()
+
+    def test_full_plasma_with_vr_gamescope_is_desktop(self):
+        # Issue #142, SteamOS 0.5.6: steamvr-plasma also starts nested scripts.
+        state = self.state(['inactive', 'active'],
+                           {'gamescope-wl', 'plasmashell', 'steamos-nested-desktop'},
+                           configured='gamescope.desktop')
+        self.assertEqual(state['mode'], 'desktop')
+        self.assertTrue(state['gamescope'])
+        self.assertTrue(state['nested_desktop'])
+        self.assertEqual(state['selector'], 'steamosctl')
+        self.assertEqual(state['session_targets']['plasma-workspace-wayland.target'], 'active')
+        with patch.object(backup, 'session_status', return_value=state), patch.object(backup, '_ssh') as ssh:
+            self.assertTrue(backup.return_to_game_mode(confirmed=True)['switched'])
+            ssh.assert_called_once_with('steamosctl switch-to-game-mode', timeout=60)
+
+    def test_game_target_wins_with_or_without_nested_desktop(self):
+        for running in ((), {'gamescope-wl'}, {'gamescope', 'plasmashell', 'steamos-nested-desktop'}):
+            state = self.state(['active', 'inactive'], running, configured='plasma.desktop')
+            self.assertEqual(state['mode'], 'game')
+            with patch.object(backup, 'session_status', return_value=state), patch.object(backup, '_ssh') as ssh:
+                self.assertFalse(backup.return_to_game_mode(confirmed=True)['switched'])
+                ssh.assert_not_called()
+
+    def test_conflicting_incomplete_and_transitional_targets_block_return(self):
+        for targets in (['active', 'active'], ['inactive', 'inactive'], ['active', 'unknown'],
+                        ['not-found', 'active'], ['unknown', 'unknown'], ['inactive', 'activating'],
+                        ['deactivating', 'active'], ['failed', 'active']):
+            with self.subTest(targets=targets):
+                state = self.state(targets, {'gamescope', 'plasmashell'}, 'plasma.desktop')
+                self.assertEqual(state['mode'], 'unknown')
+                with patch.object(backup, 'session_status', return_value=state), patch.object(backup, '_ssh') as ssh:
+                    with self.assertRaisesRegex(backup.BackupError, 'nothing was changed'):
+                        backup.return_to_game_mode(confirmed=True)
+                    ssh.assert_not_called()
+
+    def test_older_builds_use_only_unambiguous_running_processes(self):
+        cases = [((), 'unknown'), ({'plasmashell'}, 'desktop'),
+                 ({'gamescope'}, 'game'), ({'gamescope-wl'}, 'game'),
+                 ({'start-gamescope-session'}, 'game'),
+                 ({'gamescope', 'plasmashell'}, 'unknown'),
+                 ({'gamescope', 'steamos-nested-desktop'}, 'unknown')]
+        for running, expected in cases:
+            with self.subTest(running=running):
+                state = self.state(['not-found', 'not-found'], running, 'plasma.desktop')
+                self.assertEqual(state['mode'], expected)
+                self.assertEqual(state['mode_source'], 'legacy-processes')
+
+    def test_target_probe_parses_systemd_and_uses_main_user_bus(self):
+        cases = [('LoadState=loaded\nActiveState=active\n', 0, 'active'),
+                 ('ActiveState=inactive\nLoadState=loaded\n', 0, 'inactive'),
+                 ('LoadState=not-found\nActiveState=inactive\n', 0, 'not-found'),
+                 ('LoadState=error\nActiveState=active\n', 0, 'unknown'),
+                 ('garbage', 0, 'unknown'), ('LoadState=loaded\nActiveState=active', 1, 'unknown')]
+        for stdout, code, expected in cases:
+            with self.subTest(stdout=stdout, code=code), \
+                    patch.object(remote.os, 'getuid', return_value=1000, create=True), \
+                    patch.object(remote.subprocess, 'run', return_value=subprocess.CompletedProcess([], code, stdout)) as run:
+                self.assertEqual(remote._session_target('gamescope-session.target'), expected)
+                self.assertEqual(run.call_args.args[0], ['systemctl', '--user', 'show',
+                                 'gamescope-session.target', '--property=LoadState', '--property=ActiveState'])
+                self.assertEqual(run.call_args.kwargs['timeout'], 5)
+                self.assertEqual(run.call_args.kwargs['env']['DBUS_SESSION_BUS_ADDRESS'], 'unix:path=/run/user/1000/bus')
+                self.assertEqual(run.call_args.kwargs['env']['XDG_RUNTIME_DIR'], '/run/user/1000')
+        for error in (OSError('no systemctl'), subprocess.TimeoutExpired('systemctl', 5)):
+            with patch.object(remote.os, 'getuid', return_value=1000, create=True), \
+                    patch.object(remote.subprocess, 'run', side_effect=error):
+                self.assertEqual(remote._session_target('gamescope-session.target'), 'unknown')
+
+    def test_selector_preference_and_older_builds(self):
+        for available, expected in [({'steamosctl', 'steamos-session-select'}, 'steamosctl'),
+                                    ({'holo-session-select', 'steamos-session-select'}, 'holo-session-select'),
+                                    ({'steamos-session-select'}, 'steamos-session-select'), (set(), None)]:
+            with patch.object(remote, 'SDDM_CONFS', ()), \
+                    patch.object(remote, '_session_target', return_value='unknown'), \
+                    patch.object(remote, '_running', return_value=False), \
+                    patch.object(remote.shutil, 'which', side_effect=lambda n: '/usr/bin/' + n if n in available else None):
+                self.assertEqual(remote.session()['selector'], expected)
+
+    def test_holo_nested_desktop_is_recognized(self):
+        with patch.object(remote, 'SDDM_CONFS', ()), \
+                patch.object(remote, '_session_target', return_value='not-found'), \
+                patch.object(remote, '_running', side_effect=lambda name, full=False: name == 'holo-nested-desktop'), \
+                patch.object(remote.shutil, 'which', return_value=None):
+            self.assertTrue(remote.session()['nested_desktop'])
+
+    def test_script_probe_does_not_match_names_in_transmitted_python_source(self):
+        with patch.object(remote.subprocess, 'call', return_value=1) as call:
+            self.assertFalse(remote._running('steamos-nested-desktop', full=True))
+            pattern = call.call_args.args[0][-1]
+        for command in ('/usr/bin/steamos-nested-desktop',
+                        '/bin/sh /usr/bin/steamos-nested-desktop',
+                        'bash steamos-nested-desktop --flag'):
+            self.assertIsNotNone(re.search(pattern, command), command)
+        for command in ('python3 -c ' + backup.REMOTE.read_text(),
+                        '/bin/sh -c pgrep -f steamos-nested-desktop',
+                        '/usr/bin/steamos-nested-desktop-other'):
+            self.assertIsNone(re.search(pattern, command), command)


 def fake_ssh(home, os_release):
@@ -393,9 +484,11 @@ class Ssh(unittest.TestCase):

 class GameMode(unittest.TestCase):
    def test_command_is_only_ever_the_session_switch(self):
+        self.assertEqual(backup.session_command('steamosctl'), 'steamosctl switch-to-game-mode')
        self.assertEqual(backup.session_command('steamos-session-select'), 'steamos-session-select gamescope')
        self.assertEqual(backup.session_command('holo-session-select'), 'holo-session-select gamescope')
-        for bad in (None, '', 'rm -rf ~', '/tmp/steamos-session-select', 'steamos-session-select; reboot'):
+        for bad in (None, '', 'rm -rf ~', '/tmp/steamos-session-select', 'steamos-session-select; reboot',
+                    'steamosctl switch-to-desktop-mode', 'steamosctl; reboot'):
            with self.assertRaises(backup.BackupError):
                backup.session_command(bad)

@@ -185,6 +185,7 @@ class ConfigBlock(unittest.TestCase):
                fc.write_config("10.0.0.5", 22, "deck")
                text = fc.CONFIG.read_text(encoding="utf-8")
                self.assertEqual(fc.configured_user(), "deck")  # not "me" from Host other
+                self.assertEqual(fc.configured_host(), "10.0.0.5")
            finally:
                fc.SSH_DIR, fc.CONFIG = saved
        self.assertEqual(text.count(fc.BEGIN), 1)
@@ -0,0 +1,105 @@
+"""Exercise the shipped desktop alert and its UI with a monotonic fake clock."""
+import pathlib
+import shutil
+import subprocess
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+
+
+@unittest.skipUnless(shutil.which('node'), 'Node exercises production page JavaScript')
+class DesktopBatteryComfort(unittest.TestCase):
+    def test_alert_confirmation_and_lifecycle(self):
+        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
+        code = page.split('// ---- Desktop-only low-battery comfort:')[1].split('// ---- battery ----')[0]
+        code = code[code.index('class DesktopBatteryAlert'):]
+        js = r'''
+const assert = require('node:assert/strict');
+const elements = new Map();
+const $ = id => {
+  if (!elements.has(id)) elements.set(id, {checked:false, textContent:''});
+  return elements.get(id);
+};
+let now = 0, calls = [], toasts = [], devGen = 1, comfortActive = false;
+const performance = {now:()=>now};
+const listeners = {};
+const document = {hidden:false, addEventListener:(name,fn)=>listeners[name]=fn};
+const HOST = {mobile:false};
+const window = {frameApp:{notify:(message,request)=>{calls.push({message,request});return Promise.resolve();}}};
+const toast = message => toasts.push(message);
+''' + code + r'''
+(async () => {
+  const low = {percent:15,status:'Discharging',watts:-4};
+  const high = {...low,percent:20};
+  const a = new DesktopBatteryAlert();
+  assert.equal(a.sample(low,0),false);
+  assert.equal(a.sample(low,1000),false); // rapid manual refreshes cannot confirm
+  assert.equal(a.sample(low,30000),true);
+  for (let t=60000;t<=900000;t+=30000) assert.equal(a.sample(low,t),false);
+  assert.equal(a.sample(high,930000),false);
+  assert.equal(a.sample(low,960000),false); // a recovery spike did not rearm
+  assert.equal(a.sample(low,990000),false);
+  a.sample(high,1020000); a.sample(high,1050000);
+  assert.equal(a.sample(low,1080000),false);
+  assert.equal(a.sample(low,1110000),true);
+  const c = new DesktopBatteryAlert();
+  c.sample(low,0); assert.equal(c.sample(low,30000),true);
+  c.sample(high,60000); c.sample(high,90000);
+  c.sample(low,120000); assert.equal(c.sample(low,150000),false); // ten minute cap
+  assert.equal(c.sample(low,631000),false); // long gap requires fresh confirmation
+  assert.equal(c.sample(low,661000),true);
+  for (const bad of [null,{}, {...low,percent:null}, {...low,percent:NaN}, {...low,percent:-1},
+      {...low,percent:101},{...low,percent:'10'}, {...low,status:'Unknown'},
+      {...low,status:'Charging'}, {...low,status:'Full'}, {...low,status:'Not charging'},
+      {...low,watts:0},{...low,watts:-0.5},{...low,watts:null},{...low,watts:NaN}]) {
+    const b = new DesktopBatteryAlert();
+    b.sample(low,0); assert.equal(b.sample(bad,30000),false);
+    assert.equal(b.sample(low,60000),false); // unknown interrupts confirmation
+  }
+  const b = new DesktopBatteryAlert();
+  b.sample(low,0); b.invalidate(); assert.equal(b.sample(low,30000),false);
+  assert.equal(b.sample(low,121000),false); // stale gap
+  assert.equal(b.sample(low,120000),false); // clock rollback
+  desktopBatterySample(low); now=30000; desktopBatterySample(low);
+  assert.equal(calls.length,0); // opt-in starts unchecked
+  $('desktopBatteryAlert').checked=true; $('desktopBatteryAlert').onchange();
+  now=60000;desktopBatterySample(low);now=90000;desktopBatterySample(low);
+  assert.equal(calls.length,1); assert.equal(calls[0].request,false);
+  assert.match(calls[0].message,/15%.*draining/);
+  $('desktopBatteryAlert').checked=false;$('desktopBatteryAlert').onchange();
+  $('desktopBatteryAlert').checked=true;$('desktopBatteryAlert').onchange();
+  now=120000;desktopBatterySample(low);now=150000;desktopBatterySample(low);
+  assert.equal(calls.length,1); // toggling does not clear episode latch
+  desktopBattery.latched=false;desktopBattery.lastAlert=-Infinity;desktopBattery.invalidate();
+  now=180000;desktopBatterySample(low);document.hidden=true;listeners.visibilitychange();
+  document.hidden=false;now=210000;desktopBatterySample(low);assert.equal(calls.length,1);
+  now=240000;desktopBatterySample(low);assert.equal(calls.length,2);
+  desktopBattery.latched=false;desktopBattery.lastAlert=-Infinity;desktopBattery.invalidate();
+  comfortActive=true;$('batteryAlert').checked=true;
+  now=270000;desktopBatterySample(low);now=300000;desktopBatterySample(low);
+  assert.equal(calls.length,2); // existing session owns battery alerts
+  comfortActive=false;HOST.mobile=true;
+  now=330000;desktopBatterySample(low);now=360000;desktopBatterySample(low);
+  assert.equal(calls.length,2);
+  HOST.mobile=false;
+  window.frameApp.notify=()=>Promise.reject(Error('denied'));
+  now=390000;desktopBatterySample(low);now=420000;desktopBatterySample(low);
+  await new Promise(setImmediate);
+  assert.match($('desktopBatteryStatus').textContent,/not confirmed/);
+  now=450000;desktopBatterySample(low);
+  assert.equal(toasts.length,3); // delivery failure does not retry on refresh
+})().catch(e=>{console.error(e);process.exitCode=1;});
+'''
+        result = subprocess.run(['node', '-e', js], capture_output=True, text=True)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_existing_status_path_and_switch_reset(self):
+        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
+        self.assertIn('desktopBatterySample(s.battery);', page)
+        switch = page.split('if (link.device !== null && devId !== link.device)')[1].split('devGen++;')[0]
+        self.assertIn('$("desktopBatteryAlert").checked = false;', switch)
+        refresh = page.split('function refresh()')[1].split('async function refreshAfterAudio')[0]
+        self.assertIn('desktopBattery.invalidate();', refresh)
+        block = page.split('// ---- Desktop-only low-battery comfort:')[1].split('// ---- battery ----')[0]
+        self.assertNotIn('setTimeout', block)
+        self.assertNotIn('api(', block)
@@ -323,6 +323,16 @@ class Pins(Base):


 class Registry(Base):
+    def test_mdns_result_remembers_numeric_ip_only_on_its_network(self):
+        d = self.reg.add_device("frame-cache", hosts=["frame-cache.local"])
+        self.reg.record_success(d["id"], "frame-cache.local", "n-home", 2.0, ip="192.168.1.40")
+        a = fd.Registry(self.reg.path).get(d["id"])["addresses"][0]
+        self.assertEqual((a["last_ip"], a["last_ip_network"]), ("192.168.1.40", "n-home"))
+        self.reg.record_success(d["id"], "frame-cache.local", "n-home", 2.0, ip="host;bad")
+        self.assertEqual(self.reg.get(d["id"])["addresses"][0]["last_ip"], "192.168.1.40")
+        self.reg.update_address(d["id"], "frame-cache.local", new_host="frame-next.local")
+        self.assertNotIn("last_ip", self.reg.get(d["id"])["addresses"][0])
+
    def test_replaced_registry_is_read_even_when_timestamp_and_size_match(self):
        d = self.reg.add_device('frame', name='First')
        before = self.reg.path.stat()
@@ -46,7 +46,8 @@ class FrameDoctor(unittest.TestCase):
        self.assertFalse(any('/register' in str(c.args[0]) for c in run.call_args_list))

    def test_fallback_preserves_identity_and_disables_mutating_ssh_options(self):
-        _, text, run = self.main([result(code=255), result(json.dumps({'guard': 'loop', 'checks': []}))])
+        _, text, run = self.main([result(code=255), result(json.dumps({'guard': 'loop', 'checks': []}))],
+                                 argv=['--lan', 'frame.local'])
        args = run.call_args_list[2].args[0]
        for flag in ('HostKeyAlias=pinned-frame', 'HostName=frame.local', 'BatchMode=yes',
                     'StrictHostKeyChecking=yes', 'UpdateHostKeys=no', 'PermitLocalCommand=no',
@@ -55,6 +56,10 @@ class FrameDoctor(unittest.TestCase):
        self.assertIn('OK Connection: LAN', text)
        self.assertIn('Counters are rising', text)

+    def test_no_implicit_mdns_fallback(self):
+        _, _, run = self.main([result(code=255), result(code=255)])
+        self.assertFalse(any('HostName=frame.local' in str(c.args[0]) for c in run.call_args_list))
+
    def test_hostkey_failure_does_not_suggest_deleting_identity(self):
        _, text, _ = self.main([result(code=255, err='REMOTE HOST IDENTIFICATION HAS CHANGED')] * 3)
        self.assertIn('Do not delete known_hosts', text)
@@ -14,6 +14,15 @@ import frame_titles  # noqa: E402
 from frame_titles import FrameError  # noqa: E402


+class DevkitNames(unittest.TestCase):
+    def test_holo_script_is_preferred_with_vendored_steamos_fallback(self):
+        command = frame_titles.devkit_script('prepare-upload', '--gameid MyGame')
+        self.assertLess(command.index('holo-prepare-upload'), command.index('steamos-prepare-upload'))
+        self.assertIn('[ -f ~/devkit-utils/holo-prepare-upload ]', command)
+        with self.assertRaises(ValueError):
+            frame_titles.devkit_script('unknown')
+
+
 def elf(machine, e_type=3, interp=True, pad=0):
    """A 64-bit little-endian ELF header plus one program header (PT_INTERP or PT_LOAD)."""
    ident = b'\x7fELF' + bytes([2, 1, 1]) + b'\0' * 9
@@ -18,6 +18,7 @@ import tempfile
 import threading
 import time
 import unittest
+from unittest import mock
 from pathlib import Path

 ROOT = Path(__file__).resolve().parent.parent
@@ -631,3 +632,428 @@ class PageQueue(unittest.TestCase):

 if __name__ == "__main__":
    unittest.main()
+
+
+class PadEvents(unittest.TestCase):
+    """The trackpad and key row go through gamescope; accents and emoji go the KDE Connect way."""
+
+    @classmethod
+    def setUpClass(cls):
+        import server
+        cls.pad = staticmethod(server.pad_events)
+
+    def test_moves_clicks_and_scroll(self):
+        out, extra = self.pad([{"dx": 3, "dy": -2}, {"singleclick": True}, {"singlehold": True},
+                               {"singlerelease": True}, {"scroll": True, "dy": 1}, {"rightclick": True}])
+        self.assertEqual(out[0], {"dx": 3, "dy": -2})
+        self.assertEqual(out[1:3], [{"button": "left", "down": True}, {"button": "left", "down": False}])
+        self.assertEqual(out[3:5], [{"button": "left", "down": True}, {"button": "left", "down": False}])
+        self.assertEqual(out[5], {"scroll": [0, -15]})  # up = content follows the finger
+        self.assertEqual(out[6:], [{"button": "right", "down": True}, {"button": "right", "down": False}])
+        self.assertEqual(extra, [])
+
+    def test_keys_and_modifiers(self):
+        out, _ = self.pad([{"specialKey": 12}, {"specialKey": 1, "ctrl": True}, {"key": "c", "ctrl": True}])
+        self.assertEqual(out[:2], [{"key": 28, "down": True}, {"key": 28, "down": False}])
+        self.assertEqual([e["key"] for e in out[2:6]], [29, 14, 14, 29])  # Ctrl+Backspace
+        self.assertEqual([(e["key"], e["down"]) for e in out[6:]],
+                         [(29, True), (46, True), (46, False), (29, False)])  # Ctrl+C
+
+    def test_text_stays_ascii_through_gamescope(self):
+        out, slow = self.pad([{"key": "Hi "}, {"key": "there"}])
+        self.assertEqual(out, [{"text": "Hi there"}])
+        self.assertEqual(slow, [])
+
+    def test_keyboard_goes_to_kde_whole_and_in_order(self):
+        events = [{"key": "a"}, {"key": "é"}, {"specialKey": 12}, {"key": "c", "ctrl": True}, {"dx": 2, "dy": 1}]
+        out, slow = self.pad(events, kde=True)
+        self.assertEqual(out, [{"dx": 2, "dy": 1}])  # the pointer still goes through gamescope
+        self.assertEqual(slow, events[:4])  # the keyboard as sent, in order
+
+    def test_shifted_key_with_modifier(self):
+        out, _ = self.pad([{"key": "A", "ctrl": True}])
+        self.assertEqual([e["key"] for e in out], [29, 42, 30, 30, 42, 29])
+
+
+class PadDelivery(unittest.TestCase):
+    """remote_input's promises: "sent" means the whole batch is taken; accents go once, in order."""
+
+    class Agent:
+        def __init__(self, sent=True, state="ready"):
+            self.sent, self.state, self.got = sent, state, []
+
+        def send(self, events):
+            if events and self.sent:
+                self.got.append(events)
+            return {"state": self.state, "sent": self.sent and bool(events)}
+
+    def setUp(self):
+        import server
+        self.s = server
+        self.saved = (server._touch, server._input, server.KDE_WAIT)
+        server._touch, server._input = self.Agent(), self.Agent()
+        self.reset()
+
+    def tearDown(self):
+        self.s._touch, self.s._input, self.s.KDE_WAIT = self.saved
+        self.settle()
+        self.reset()
+
+    def reset(self):
+        self.s._kde_queue.clear()
+        self.s._kde_error = None
+        self.s._kde_until = self.s._typed_until = 0.0
+        self.s._kde_worker[0] = None
+
+    def settle(self):
+        worker = self.s._kde_worker[0]
+        if worker:
+            worker.join(5)
+
+    def typed(self):
+        return [e for batch in self.s._input.got for e in batch]
+
+    def test_accent_only_batch_is_acknowledged_and_typed_once(self):
+        status = self.s.remote_input({"events": [{"key": "é"}]})
+        self.assertTrue(status["sent"])  # so the page doesn't send it again
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "é"}])
+
+    def test_mixed_text_stays_in_one_ordered_stream(self):
+        self.s.remote_input({"events": [{"key": "aéb"}, {"specialKey": 12}]})
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "aéb"}, {"specialKey": 12}])
+        self.assertEqual(self.s._touch.got, [])  # none of it split off through gamescope
+
+    def test_batch_gamescope_didnt_take_is_not_queued(self):
+        self.s._touch = self.Agent(sent=False, state="starting")
+        status = self.s.remote_input({"events": [{"dx": 1, "dy": 1}, {"key": "é"}]})
+        self.assertFalse(status["sent"])  # the page tries the whole batch again...
+        self.assertEqual(self.s._kde_queue, [])  # ...so the accent isn't queued twice
+
+    def test_waits_for_kde_connect_then_sends_without_more_input(self):
+        self.s._input = self.Agent(sent=False, state="starting")
+        self.s.remote_input({"events": [{"key": "é"}]})
+        time.sleep(0.2)
+        self.assertEqual(self.s._kde_queue, [{"key": "é"}])
+        self.s._input.sent = True
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "é"}])
+        self.assertEqual(self.s._kde_queue, [])
+
+    def test_later_ascii_waits_behind_a_pending_accent(self):
+        self.s._input = self.Agent(sent=False, state="starting")
+        self.s.remote_input({"events": [{"key": "é"}]})
+        self.s.remote_input({"events": [{"key": "x"}]})
+        self.assertEqual(self.s._touch.got, [])  # "x" can't overtake the "é"
+        self.assertEqual(self.s._kde_queue, [{"key": "é"}, {"key": "x"}])
+        self.s._input.sent = True
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "é"}, {"key": "x"}])
+
+    def test_errors_and_timeout_retain_accepted_text_for_explicit_retry(self):
+        events = [{"key": "é"}] * 150
+        for state in ("error", "starting"):
+            with self.subTest(state=state):
+                self.reset()
+                self.s._input = self.Agent(sent=False, state=state)
+                self.s.KDE_WAIT = 0
+                self.assertTrue(self.s.remote_input({"events": events})["sent"])
+                self.settle()
+                self.assertEqual(self.s._kde_queue, events)
+                self.assertIsNone(self.s._kde_worker[0])
+                self.assertEqual(self.s._kde_until, 0)
+                status = self.s.pad_status({"state": "ready"})
+                self.assertEqual(status["state"], "error")
+                self.assertIn("retained", status["message"])
+                self.assertFalse(self.s.remote_input({"events": [{"key": "x"}]})["sent"])
+                self.s._input = self.Agent()
+                self.s.start_pad()
+                self.settle()
+                self.assertEqual(self.typed(), events)
+                self.assertEqual(self.s._kde_queue, [])
+                self.assertIsNone(self.s._kde_error)
+
+    def test_worker_exception_and_start_failure_are_visible_and_retryable(self):
+        for start_failure in (False, True):
+            with self.subTest(start_failure=start_failure):
+                self.reset()
+                events = [{"key": "é"}]
+                if start_failure:
+                    with mock.patch.object(threading.Thread, "start", side_effect=RuntimeError("no thread")):
+                        self.assertTrue(self.s.remote_input({"events": events})["sent"])
+                else:
+                    with mock.patch.object(self.s._input, "send", side_effect=OSError("send failed")):
+                        self.assertTrue(self.s.remote_input({"events": events})["sent"])
+                        self.settle()
+                self.assertEqual(self.s._kde_queue, events)
+                self.assertIsNone(self.s._kde_worker[0])
+                self.assertEqual(self.s._kde_until, 0)
+                self.assertEqual(self.s.pad_status({"state": "ready"})["state"], "error")
+                self.s._input = self.Agent()
+                self.s.start_pad()
+                self.settle()
+                self.assertEqual(self.typed(), events)
+
+    def test_ascii_just_after_an_accent_stays_behind_it(self):
+        self.s.remote_input({"events": [{"key": "é"}]})
+        self.settle()
+        self.s.remote_input({"events": [{"key": "x"}]})  # KDE Connect may still be typing the é
+        self.settle()
+        self.assertEqual(self.s._touch.got, [])
+        self.assertEqual(self.typed(), [{"key": "é"}, {"key": "x"}])
+
+    def test_accent_just_after_gamescope_text_waits_for_it(self):
+        self.s.remote_input({"events": [{"key": "x" * 50}]})
+        self.assertEqual(self.s._touch.got, [[{"text": "x" * 50}]])
+        start = time.time()
+        self.s.remote_input({"events": [{"key": "é"}]})
+        self.settle()
+        self.assertGreater(time.time() - start, 0.6)  # 50 keys at 16 ms, plus the margin
+        self.assertEqual(self.typed(), [{"key": "é"}])
+
+    def test_typing_time_counts_every_key_transition(self):
+        t = self.s.typing_seconds
+        self.assertAlmostEqual(t([{"text": "ab"}]), 4 * 0.008)
+        self.assertAlmostEqual(t([{"text": "A"}]), 4 * 0.008)  # shift down, key down, key up, shift up
+        self.assertAlmostEqual(t([{"text": "x" * 500}]), 8.0)  # a long paste
+        self.assertAlmostEqual(t([{"key": 29, "down": True}, {"dx": 3, "dy": 0}]), 0.008)
+
+    def test_the_margin_is_added_once_not_per_request(self):
+        for _ in range(10):
+            self.s.remote_input({"events": [{"key": "ab"}]})
+        # ten requests of 4 transitions each: the work queues up, with no margin added per request
+        self.assertLess(self.s._typed_until - time.time(), 10 * 4 * 0.008 + 0.05)
+
+    def hold_worker(self):
+        entered, release = threading.Event(), threading.Event()
+        class Gate:
+            def wait(self, timeout):
+                entered.set()
+                if not release.wait(3):
+                    raise RuntimeError("test did not release worker")
+                return False
+        patch = mock.patch.object(self.s, "_kde_cancel", Gate())
+        patch.start()
+        self.addCleanup(patch.stop)
+        self.addCleanup(release.set)
+        return entered, release
+
+    def test_saturation_rejects_whole_batch_and_retry_delivers_every_accepted_event_once(self):
+        entered, release = self.hold_worker()
+        self.s._typed_until = time.time() + 60
+        first = [{"key": "é"}] * 150
+        remainder = [{"key": "ü"}] * 50
+        overflow = [{"singleclick": True}, {"key": "ß"}] * 75
+        self.assertTrue(self.s.remote_input({"events": first})["sent"])
+        self.assertTrue(entered.wait(1))  # batch is in flight, waiting for prior ASCII
+        try:
+            self.assertTrue(self.s.remote_input({"events": remainder})["sent"])
+            status = self.s.remote_input({"events": overflow})
+            self.assertFalse(status["sent"])
+            self.assertEqual(status["state"], "waiting")
+            self.assertEqual(self.s._kde_queue, first + remainder)
+            self.assertEqual(len(self.s._kde_queue), self.s.KDE_QUEUE_LIMIT)
+            self.assertEqual(self.s._touch.got, [])  # rejected clicks cannot be duplicated
+        finally:
+            self.s._typed_until = 0
+            release.set()
+            self.settle()
+        self.assertEqual(self.typed(), first + remainder)
+        self.assertTrue(self.s.remote_input({"events": overflow})["sent"])
+        self.settle()
+        self.assertEqual(self.typed(), first + remainder + [{"key": "ß"}] * 75)
+        self.assertEqual(self.s._touch.got, [[e for _ in range(75) for e in (
+            {"button": "left", "down": True}, {"button": "left", "down": False})]])
+
+    def test_retrying_batch_keeps_its_capacity_and_order(self):
+        entered, release = self.hold_worker()
+        self.s._input = self.Agent(sent=False, state="starting")
+        first, second = [{"key": "é"}] * 150, [{"key": "ü"}] * 150
+        self.assertTrue(self.s.remote_input({"events": first})["sent"])
+        self.assertTrue(entered.wait(1))  # first send failed; worker is in retry delay
+        try:
+            self.assertFalse(self.s.remote_input({"events": second})["sent"])
+            self.assertEqual(self.s._kde_queue, first)
+        finally:
+            self.s._input.sent = True
+            release.set()
+            self.settle()
+        self.assertTrue(self.s.remote_input({"events": second})["sent"])
+        self.settle()
+        self.assertEqual(self.typed(), first + second)
+
+    def test_concurrent_requests_cannot_both_claim_the_last_capacity(self):
+        entered, release = self.hold_worker()
+        self.s._typed_until = time.time() + 60
+        first = [{"key": "é"}]
+        self.s.remote_input({"events": first})
+        self.assertTrue(entered.wait(1))
+        barrier, results = threading.Barrier(3), []
+        def request(key):
+            barrier.wait(2)
+            batch = [{"key": key}] * 150
+            results.append((batch, self.s.remote_input({"events": batch})["sent"]))
+        threads = [threading.Thread(target=request, args=(key,)) for key in ("ü", "ß")]
+        try:
+            for thread in threads:
+                thread.start()
+            barrier.wait(2)
+            for thread in threads:
+                thread.join(2)
+                self.assertFalse(thread.is_alive())
+            self.assertEqual(sorted(sent for _, sent in results), [False, True])
+        finally:
+            self.s._typed_until = 0
+            release.set()
+            self.settle()
+        accepted = next(batch for batch, sent in results if sent)
+        rejected = next(batch for batch, sent in results if not sent)
+        self.assertEqual(self.typed(), first + accepted)
+        self.assertTrue(self.s.remote_input({"events": rejected})["sent"])
+        self.settle()
+        self.assertEqual(self.typed(), first + accepted + rejected)
+
+    def test_input_queued_as_the_worker_finishes_is_still_sent(self):
+        for _ in range(40):
+            self.reset()
+            self.s._input.got.clear()
+            self.s.remote_input({"events": [{"key": "é"}]})
+            time.sleep(0.002)
+            self.s.remote_input({"events": [{"key": "ü"}]})
+            self.settle()
+            self.assertEqual(self.s._kde_queue, [])
+            self.assertEqual(self.typed(), [{"key": "é"}, {"key": "ü"}])
+
+
+class PadRoute(unittest.TestCase):
+    def test_unicode_start_and_headset_switch_do_not_deadlock(self):
+        # Real InputAgent.send/start takes the route lock. Race it with route(),
+        # which cancels the pad worker; mocks of send() hide this lock inversion.
+        # A child keeps a regression's blocked daemon threads out of this suite.
+        code = r'''
+import sandbox
+import server as s
+import threading
+from unittest import mock
+
+entered, release, switching = threading.Event(), threading.Event(), threading.Event()
+s._input = s.InputAgent(packages=[])
+s._input._launch = lambda *args: None  # exercise real start, without any SSH
+s._touch = mock.Mock()
+send = s._input.send
+def held(events):
+    entered.set()
+    assert release.wait(2)
+    return send(events)
+s._input.send = held
+s._power.stop = lambda *args: switching.set()
+s._queue_for_kde([{'key': 'é'}])
+worker = s._kde_worker[0]
+assert entered.wait(2), 'Unicode worker never reached send'
+switch = threading.Thread(target=s.route, args=('frame-pr66-new', []), daemon=True)
+switch.start()
+switching.wait(0.2)
+release.set()
+worker.join(2)
+switch.join(2)
+assert not worker.is_alive(), 'Unicode worker deadlocked starting input during headset switch'
+assert not switch.is_alive(), 'headset switch deadlocked cancelling Unicode input'
+assert not s._kde_queue
+'''
+        env = {**os.environ, "PYTHONPATH": os.pathsep.join([str(ROOT / 'tests'), str(ROOT / 'ui')])}
+        result = subprocess.run([sys.executable, '-c', code], env=env, capture_output=True,
+                                text=True, timeout=8)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def setUp(self):
+        import server
+        self.s = server
+        self.agents = mock.patch.multiple(server, _touch=mock.Mock(), _input=mock.Mock())
+        self.agents.start()
+        self.addCleanup(self.agents.stop)
+        self.s._touch.send.return_value = {"state": "ready", "sent": True}
+        self.s._input.send.return_value = {"state": "ready", "sent": True}
+        self.s.reset_pad_route()
+        self.s._touch.reset_mock(); self.s._input.reset_mock()
+        self.addCleanup(self.s.reset_pad_route)
+
+    def switch(self):
+        with mock.patch.multiple(self.s, FRAME="frame-a", HOST_OPTS=[], MUX=[], SSH=[], macview=None), \
+             mock.patch.multiple(self.s.frame_android, FRAME="frame-a", SSH_OPTS=[]):
+            self.s.route("frame-b", [])
+
+    def test_stale_worker_exception_cannot_damage_new_route(self):
+        entered, release = threading.Event(), threading.Event()
+        class BrokenWait:
+            def wait(self, timeout):
+                entered.set()
+                if not release.wait(2):
+                    raise RuntimeError("test did not release old worker")
+                raise OSError("old route wait failed")
+            def set(self):
+                pass  # hold its exception until the new route has been published
+        self.s._kde_cancel = BrokenWait()
+        self.s._typed_until = time.time() + 60
+        self.s.remote_input({"events": [{"key": "é"}]})
+        worker = self.s._kde_worker[0]
+        try:
+            self.assertTrue(entered.wait(1))
+            self.switch()
+            marker = object()
+            with self.s._kde_lock:
+                self.s._kde_queue.append({"key": "new"})
+                self.s._kde_worker[0] = marker
+                self.s._kde_until = 42
+        finally:
+            release.set()
+            worker.join(2)
+        self.assertFalse(worker.is_alive())
+        self.assertEqual(self.s._kde_queue, [{"key": "new"}])
+        self.assertIs(self.s._kde_worker[0], marker)
+        self.assertEqual(self.s._kde_until, 42)
+        self.assertIsNone(self.s._kde_error)
+
+    def test_switch_stops_both_input_agents_and_discards_old_queue(self):
+        self.s._kde_queue.append({"key": "old"})
+        self.s._kde_until = self.s._typed_until = time.time() + 60
+        cancel = self.s._kde_cancel
+        self.switch()
+        self.s._input.stop.assert_called_once()
+        self.s._touch.stop.assert_called_once()
+        self.assertEqual(self.s._kde_queue, [])
+        self.assertEqual((self.s._kde_until, self.s._typed_until), (0, 0))
+        self.assertTrue(cancel.is_set())
+
+    def test_switch_cancels_delayed_and_retrying_text_before_new_input(self):
+        for delaying in (True, False):
+            with self.subTest(delaying=delaying):
+                waiting, cancel = threading.Event(), threading.Event()
+                class ObservedCancel:
+                    def wait(self, timeout):
+                        waiting.set()
+                        return cancel.wait(timeout)
+                    def set(self):
+                        cancel.set()
+                self.s.reset_pad_route()
+                self.s._kde_cancel = ObservedCancel()
+                self.s._typed_until = time.time() + 60 if delaying else 0
+                self.s._input.reset_mock()
+                self.s._input.send.return_value = {"state": "starting", "sent": False}
+                self.s.remote_input({"events": [{"key": "é"}]})
+                worker = self.s._kde_worker[0]
+                self.assertTrue(waiting.wait(1), "worker never reached its cancellable delay")
+                self.switch()
+                worker.join(1)
+                self.assertFalse(worker.is_alive())
+                attempts = self.s._input.send.call_count
+                self.assertEqual(attempts, 0 if delaying else 1)
+                self.s._input.send.return_value = {"state": "ready", "sent": True}
+                self.s.remote_input({"events": [{"key": "ü"}]})
+                next_worker = self.s._kde_worker[0]
+                if next_worker:
+                    next_worker.join(1)
+                    self.assertFalse(next_worker.is_alive())
+                self.assertEqual(self.s._input.send.call_count, attempts + 1)
+                self.assertEqual(self.s._input.send.call_args.args[0], [{"key": "ü"}])
+                self.assertEqual(self.s._kde_queue, [])
@@ -58,6 +58,50 @@ class FailureDetail(unittest.TestCase):


 class Probe(unittest.TestCase):
+    def test_mdns_falls_back_only_to_ip_authenticated_on_this_network(self):
+        address = {"host": "frame.local", "kind": "mdns", "last_ip": "192.168.1.40",
+                   "last_ip_network": "n-home"}
+        def result(host, port, **kwargs):
+            return {"state": "answered", "ip": host, "rtt_ms": 1} if host == "192.168.1.40" else \
+                   {"state": "unresolved", "detail": "Can't find name"}
+        with mock.patch.object(fl, "probe", side_effect=result) as probe:
+            self.assertEqual(fl.probe_address(address, 22, "n-home")["ip"], "192.168.1.40")
+            self.assertEqual([c.args[0] for c in probe.call_args_list], ["frame.local", "192.168.1.40"])
+            probe.reset_mock()
+            self.assertEqual(fl.probe_address(address, 22, "n-cafe")["state"], "unresolved")
+            probe.assert_called_once()
+
+    def test_find_uses_cached_ip_and_neighbours_without_trusting_them(self):
+        device = {"id": "d1", "alias": "frame", "port": 22, "addresses": [{"host": "frame.local", "kind": "mdns",
+                  "last_ip": "192.168.1.40", "last_ip_network": "n-test"}]}
+        link = mock.Mock()
+        link.active_device.return_value = device
+        link.state = {"network": NET}
+        def answer(host, port, timeout=3):
+            return {"state": "answered" if host in ("192.168.1.40", "192.168.1.41") else "unresolved",
+                    "detail": "test", "ip": host if host.startswith("192.") else None, "rtt_ms": 1}
+        with mock.patch.object(fl, "probe", side_effect=answer), \
+             mock.patch.object(fl.frame_network, "local_scan_candidates", return_value=["192.168.1.40", "192.168.1.41"]), \
+             mock.patch.object(fl.frame_network, "neighbour_cache", return_value=""), \
+             mock.patch.object(fl.frame_devices, "pinned_keys", return_value=[("ssh-ed25519", "SHA256:test")]), \
+             mock.patch.object(fl, "matches_pinned_key", return_value=True), \
+             mock.patch.object(fl.frame_host, "which", return_value=None), \
+             mock.patch("frame_connect.discover_devkit", return_value=[]):
+            found = fl.mdns_find(link)
+        self.assertEqual(found["scanned"], 1)  # cached IP is tried once
+        self.assertEqual({h["host"] for h in found["hosts"]}, {"192.168.1.40", "192.168.1.41"})
+        self.assertTrue(found["hosts"][0]["added"] is False)
+
+    def test_scan_requires_saved_matching_ssh_key(self):
+        key = ("ssh-ed25519", fd.fingerprint("a2V5"))
+        response = subprocess.CompletedProcess([], 0, "192.168.1.41 ssh-ed25519 a2V5\n", "")
+        with mock.patch.object(fl.frame_host, "which", return_value="ssh-keyscan"), \
+             mock.patch.object(fl.frame_host, "run_ssh", return_value=response):
+            self.assertTrue(fl.matches_pinned_key("192.168.1.41", 22, [key]))
+            self.assertFalse(fl.matches_pinned_key("192.168.1.41", 22, [("ssh-ed25519", "SHA256:other")]))
+            self.assertFalse(fl.matches_pinned_key("name;bad", 22, [key]))
+            self.assertFalse(fl.matches_pinned_key("192.168.1.41", 22, []))
+
    def test_answers_refusals_and_unknown_names(self):
        with socket.socket() as srv:
            srv.bind(("127.0.0.1", 0))
@@ -68,7 +68,7 @@ class Media(unittest.TestCase):
        self.assertIn('-frames:v', cmd)

    def play_with(self, name, busy=0, on_pixels=None, sleeps=None, info=None,
-                  fail=None, layout='auto'):
+                  fail=None, layout='auto', on_create=None, on_call=None):
        """Run the player against a fake OpenVR; returns (status, pixels calls).

        Handle 0 is the theatre surround and 1 the screen. `fail(handle, n)` makes
@@ -82,11 +82,18 @@ class Media(unittest.TestCase):
            write_status(path, **values)

        class FakeOverlay:
+            created = 0
+
            def create(self, *a, **k):
-                return len(calls)
+                # Handles in creation order: surround 0, then screen 1 (theatre).
+                FakeOverlay.created += 1
+                if on_create:
+                    on_create(*a, **k)
+                return FakeOverlay.created - 1

            def call(self, *a):
-                pass
+                if on_call:
+                    on_call(*a)

            def pixels(self, handle, data, w, h):
                calls.append((handle, w, h))
@@ -132,6 +139,58 @@ class Media(unittest.TestCase):
        self.assertEqual(result['dropped'], 2)
        self.assertIn((0, 1, 1), calls[3:])

+    def test_theatre_surround_failure_does_not_stop_playback(self):
+        def fail_surround(n):
+            if n == 1:  # the surround's upload is the first pixels call
+                raise RuntimeError('OpenVR SetOverlayRaw failed: 11')
+        result, _ = self.play_with('clip_SBS.mp4', on_pixels=fail_surround)
+        self.assertEqual((result['state'], result['frames']), ('ended', 4))
+
+    def test_theatre_surround_creation_and_setup_failures_are_cosmetic(self):
+        def fail_create(key, *a, **k):
+            if key.endswith('.surround'):
+                raise RuntimeError('OpenVR CreateOverlay failed: 11')
+        def fail_alpha(name, *a):
+            if name == 'SetOverlayAlpha':
+                raise RuntimeError('OpenVR SetOverlayAlpha failed: 11')
+        for hooks in ({'on_create': fail_create}, {'on_call': fail_alpha}):
+            with self.subTest(hooks=hooks), patch('builtins.print') as log:
+                result, calls = self.play_with('clip_SBS.mp4', **hooks)
+            self.assertEqual((result['state'], result['frames']), ('ended', 4))
+            self.assertEqual(sum(h == 1 for h, w, hgt in calls), 4)
+            self.assertIn('Theatre surround unavailable:', log.call_args.args[0])
+
+    def test_theatre_surround_refusal_after_standby_is_not_retried(self):
+        def refuse_retry(n):
+            if n == 3:  # surround busy, screen accepted, surround retry refused
+                raise RuntimeError('OpenVR SetOverlayRaw failed: 11')
+        with patch('builtins.print') as log:
+            result, calls = self.play_with('clip_SBS.mp4', busy=1, on_pixels=refuse_retry)
+        self.assertEqual((result['state'], result['frames'], result['dropped']), ('ended', 4, 0))
+        self.assertEqual(sum(h == 0 for h, w, hgt in calls), 2)
+        self.assertIn('Theatre surround unavailable:', log.call_args.args[0])
+
+    def test_screen_refusal_still_fails_playback(self):
+        def refuse_screen(n):
+            if n == 2:
+                raise RuntimeError('OpenVR SetOverlayRaw failed: 11')
+        with self.assertRaisesRegex(RuntimeError, 'SetOverlayRaw failed: 11'):
+            self.play_with('clip_SBS.mp4', on_pixels=refuse_screen)
+
+    def test_close_attempts_every_overlay_and_shuts_down_after_teardown_errors(self):
+        for error in (RuntimeError('OpenVR error'), ValueError('bad handle'),
+                      InterruptedError('late Stop')):
+            with self.subTest(error=type(error).__name__):
+                overlay = player.Overlay.__new__(player.Overlay)
+                overlay.handles = [10, 20]
+                overlay.vr = unittest.mock.Mock()
+                overlay.call = unittest.mock.Mock(side_effect=[error, None])
+                overlay.close()
+                self.assertEqual(overlay.call.call_args_list, [
+                    unittest.mock.call('DestroyOverlay', 20),
+                    unittest.mock.call('DestroyOverlay', 10)])
+                overlay.vr.VR_ShutdownInternal.assert_called_once_with()
+
    def test_stop_mid_video_reports_stopped(self):
        result, _ = self.play_with('clip_SBS.mp4', on_pixels=lambda n: n == 3 and stop_now())
        self.assertEqual(result['state'], 'stopped')
@@ -102,6 +102,17 @@ class Parsers(unittest.TestCase):
        self.assertEqual(fn.parse_nmcli(NMCLI), "Cafe: upstairs")
        self.assertIsNone(fn.parse_nmcli("no:Neighbour\n"))

+    def test_neighbour_scan_stays_on_local_subnet(self):
+        nearby = ("192.168.50.31 dev wlan0 lladdr 00:11:22:33:44:55 REACHABLE\n"
+                  "192.168.51.31 dev wlan0 lladdr 00:11:22:33:44:66 STALE\n"
+                  "192.168.50.1 dev wlan0 lladdr 00:11:22:33:44:77 STALE\n")
+        self.assertEqual(fn.parse_neighbours(nearby, "192.168.50.9", "192.168.50.1"), ["192.168.50.31"])
+        candidates = fn.local_scan_candidates("192.168.50.9", "192.168.50.1", nearby)
+        self.assertEqual(candidates[0], "192.168.50.31")
+        self.assertEqual(len(candidates), 252)
+        self.assertNotIn("192.168.51.31", candidates)
+        self.assertEqual(fn.local_scan_candidates("100.101.1.4", "100.101.1.1"), [])
+
    def test_windows(self):
        self.assertEqual(fn.parse_route_windows(WIN_ROUTE), ("192.168.1.1", "192.168.1.50"))
        self.assertEqual(fn.parse_arp_windows(WIN_ARP, "192.168.1.1"), "b4:fb:e4:b5:67:55")
@@ -9,7 +9,7 @@ import subprocess
 import unittest

 ROOT = pathlib.Path(__file__).resolve().parents[1]
-STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadPanels', 'loadPanelSwitcher', 'loadBackups', 'loadStorage', 'loadTitles', 'showAndroidTab',
+STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadSteamPipewire', 'loadPanels', 'loadPanelSwitcher', 'loadBackups', 'loadStorage', 'loadPower', 'loadTitles', 'showAndroidTab',
         'loadAndroid', 'loadDisplays', 'setGameSource', 'requestAnimationFrame']

 RUN = r'''
@@ -0,0 +1,256 @@
+"""Desktop observation lifecycle, guarded HTTP API and packaged resource contract."""
+import sandbox  # noqa: F401
+import contextlib
+import io
+import http.client
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'ui'))
+import frame_power
+import server
+
+STREAM = frame_power.sampler.stream_report
+
+SAMPLE = {'time': 1, 'elapsedSeconds': 0, 'osBuild': 'test', 'readings': {
+    'battery.watts': {'value': 0, 'unit': 'W', 'source': '/sys/test', 'state': 'available'}},
+    'unavailableGroups': ['fan']}
+
+
+class DesktopPower(unittest.TestCase):
+    def setUp(self):
+        self.observation = frame_power.Observation()
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.lock = Path(self.temp.name) / 'frame-test.lock'
+        self.patches = [patch.object(frame_power.sampler, 'LOCK', self.lock)]
+        for p in self.patches:
+            p.start()
+            self.addCleanup(p.stop)
+        self.addCleanup(self.observation.shutdown)
+
+    def wait(self):
+        self.observation.thread.join(4)
+        self.assertFalse(self.observation.thread.is_alive())
+
+    def stream(self, program, preset='minute'):
+        real = STREAM
+        def collect(command, payload, count, interval, stop, received, **kw):
+            return real([sys.executable, '-u', '-c', program], '', count, interval, stop, received, **kw)
+        mocked_stream = patch.object(frame_power.sampler, 'stream_report', side_effect=collect)
+        mocked_stream.start()
+        self.addCleanup(mocked_stream.stop)
+        return self.observation.start(preset, ('ssh', '-o', 'HostName=old', 'frame-old'),
+                                      {'alias': 'frame-old', 'deviceId': 'old'})
+
+    def test_complete_exports_match_and_no_background_collection_on_status(self):
+        def collect(command, payload, count, interval, stop, received, **kw):
+            self.assertEqual(count, 12)
+            self.assertEqual(interval, 5)
+            self.assertIn('HostName=old', command)
+            self.assertIn('StrictHostKeyChecking=yes', command)
+            self.assertIn('frame-old', command)
+            self.assertNotIn('pkill', ' '.join(command))
+            for _ in range(count):
+                received(SAMPLE.copy())
+            return {'schemaVersion': 1, 'requestedSamples': count, 'intervalSeconds': interval,
+                    'stopped': None, 'samples': [SAMPLE.copy() for _ in range(count)], 'summary': {}}
+        with patch.object(frame_power.sampler, 'stream_report', side_effect=collect) as run:
+            self.observation.start('minute', ('ssh', '-o', 'HostName=old', 'frame-old'), {'alias': 'frame-old'})
+            self.wait()
+            state = self.observation.status()
+            self.assertEqual((state['received'], state['running'], state['stopped']), (12, False, None))
+            for _ in range(3):
+                self.observation.status()
+            self.assertEqual(run.call_count, 1)
+        report, _ = self.observation.export(state['id'], 'json')
+        self.assertEqual(json.loads(report)['summary']['battery.watts']['mean'], 0)
+        html, _ = self.observation.export(state['id'], 'html')
+        csv, _ = self.observation.export(state['id'], 'csv')
+        self.assertIn('Headset: frame-old', html)
+        self.assertIn('collection.state,Completed', csv)
+        self.assertIn('collection.receivedSamples,12', csv)
+        self.assertIn('battery.watts,0,W', csv)
+
+    def test_stop_keeps_received_sample_and_reaps_only_owned_child(self):
+        real_popen = subprocess.Popen
+        children = []
+        def spawn(*a, **kw):
+            proc = real_popen(*a, **kw)
+            children.append(proc)
+            return proc
+        event = json.dumps({'sample': SAMPLE})
+        with patch.object(frame_power.sampler.subprocess, 'Popen', side_effect=spawn):
+            state = self.stream(f'import sys,time; sys.stdin.read(); print({event!r}, flush=True); time.sleep(30)')
+            deadline = time.monotonic() + 3
+            while self.observation.status()['received'] < 1 and time.monotonic() < deadline:
+                time.sleep(.01)
+            self.assertEqual(self.observation.status()['received'], 1)
+            with self.assertRaisesRegex(ValueError, 'already running'):
+                self.observation.start('minute', ('ssh', 'frame'), {'alias': 'other'})
+            active, _ = self.observation.export(state['id'], 'json')
+            self.assertIn('in progress', json.loads(active)['stopped'])
+            self.observation.stop()
+            self.wait()
+        self.assertIsNotNone(children[0].poll())
+        data, _ = self.observation.export(state['id'], 'json')
+        self.assertEqual(json.loads(data)['samples'], [SAMPLE])
+        self.assertIn('Stopped by user', json.loads(data)['stopped'])
+        csv, _ = self.observation.export(state['id'], 'csv')
+        self.assertIn('incomplete', csv)
+
+    def test_disconnect_and_oversize_keep_partial_and_incomplete(self):
+        for ending in ('sys.exit(255)', 'print("x"*262145, flush=True)'):
+            with self.subTest(ending=ending):
+                event = json.dumps({'sample': SAMPLE})
+                state = self.stream(f'import sys; sys.stdin.read(); print({event!r}, flush=True); {ending}')
+                self.wait()
+                data, _ = self.observation.export(state['id'], 'json')
+                report = json.loads(data)
+                self.assertEqual(report['samples'], [SAMPLE])
+                self.assertTrue(report['stopped'])
+
+    def test_local_lock_preserves_previous_report_and_invalid_inputs_do_not_spawn(self):
+        with patch.object(frame_power.sampler, 'stream_report') as run:
+            self.lock.mkdir()
+            with self.assertRaisesRegex(ValueError, 'Smoke session'):
+                self.observation.start('minute', ('ssh', 'frame'), {'alias': 'frame'})
+            for preset in ('hour', 1000, None):
+                with self.assertRaises(ValueError):
+                    self.observation.start(preset, ('ssh', 'frame'), {'alias': 'frame'})
+            run.assert_not_called()
+        self.assertIsNone(self.observation.status()['id'])
+
+    def test_headset_switch_preserves_original_identity_and_requests_cancel(self):
+        done = threading.Event()
+        def collect(command, payload, count, interval, cancel, received, **kw):
+            received(SAMPLE)
+            done.set()
+            cancel.wait(3)
+            return {'requestedSamples': count, 'intervalSeconds': interval, 'samples': [SAMPLE], 'stopped': None}
+        with patch.object(frame_power.sampler, 'stream_report', side_effect=collect), \
+             patch.object(server, '_power', self.observation):
+            original = server.FRAME, list(server.HOST_OPTS)
+            try:
+                state = self.observation.start('five-minutes', ('ssh', 'old'), {'alias': 'old'})
+                self.assertTrue(done.wait(2))
+                server.route('different-headset', [])
+                self.wait()
+                current = self.observation.status()
+                self.assertEqual(current['headset']['alias'], 'old')
+                self.assertEqual(current['requested'], 60)
+                self.assertIn('Headset switched', current['stopped'])
+                with self.assertRaises(ValueError):
+                    self.observation.export('stale-id', 'html')
+                with self.assertRaises(ValueError):
+                    self.observation.export(state['id'], '../file')
+            finally:
+                server.route(*original)
+
+    def test_http_guards_stale_target_stop_id_and_download_headers(self):
+        httpd = server.ThreadingHTTPServer(('127.0.0.1', 0), server.Handler)
+        thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+        thread.start()
+        conn = http.client.HTTPConnection(*httpd.server_address)
+        def request(method, path, body=None, device=None, key=True):
+            headers = {'X-Frame-UI': server.UI_KEY} if key else {}
+            if device:
+                headers['X-Frame-Device'] = device
+            conn.request(method, path, json.dumps(body) if body is not None else None, headers)
+            r = conn.getresponse()
+            return r.status, dict(r.getheaders()), r.read()
+        try:
+            with patch.object(server, '_power', self.observation), \
+                 patch.object(server, 'LINK', SimpleNamespace(active_device=lambda: {'id': 'new'})), \
+                 patch.object(frame_power.sampler, 'stream_report') as run:
+                for path in ('/api/power', '/api/power/report?id=x&format=html'):
+                    self.assertEqual(request('GET', path, key=False)[0], 403)
+                self.assertEqual(request('POST', '/api/power', {'action': 'start', 'preset': 'minute'}, key=False)[0], 403)
+                for device, expected in ((None, 400), ('old', 409)):
+                    self.assertEqual(request('POST', '/api/power', {'action': 'start', 'preset': 'minute'}, device)[0], expected)
+                run.assert_not_called()
+                self.observation.id = 'test-id'
+                self.observation.report = {'schemaVersion': 1, 'requestedSamples': 12, 'intervalSeconds': 5,
+                                           'headset': {'alias': 'old'}, 'stopped': 'Disconnected', 'samples': [SAMPLE]}
+                status, headers, data = request('GET', '/api/power/report?id=test-id&format=html')
+                self.assertEqual(status, 200)
+                self.assertIn('attachment;', headers['Content-Disposition'])
+                self.assertIn('no-store', headers['Cache-Control'])
+                self.assertIn(b'Disconnected', data)
+                self.assertEqual(request('POST', '/api/power', {'action': 'stop', 'id': 'stale'}, 'new')[0], 409)
+                self.assertEqual(request('POST', '/api/power', {'action': 'stop', 'id': 'test-id'}, 'new')[0], 200)
+                received = threading.Event()
+                def collect(command, payload, count, interval, cancel, emit, **kw):
+                    emit(SAMPLE)
+                    received.set()
+                    cancel.wait(3)
+                    return {'schemaVersion': 1, 'requestedSamples': count, 'intervalSeconds': interval,
+                            'samples': [SAMPLE], 'stopped': 'Stopped'}
+                run.side_effect = collect
+                code, _, data = request('POST', '/api/power', {'action': 'start', 'preset': 'minute'}, 'new')
+                self.assertEqual(code, 200)
+                new_id = json.loads(data)['id']
+                self.assertNotEqual(new_id, 'test-id')
+                self.assertTrue(received.wait(2))
+                self.assertEqual(request('GET', '/api/power/report?id=test-id&format=json')[0], 409)
+                self.assertEqual(request('POST', '/api/power', {'action': 'stop', 'id': new_id}, 'new')[0], 200)
+                self.wait()
+                self.assertEqual(self.observation.status()['received'], 1)
+                self.assertEqual(self.observation.status()['headset']['deviceId'], 'new')
+        finally:
+            conn.close()
+            httpd.shutdown()
+            httpd.server_close()
+            thread.join()
+
+    def test_early_remote_smoke_lock_has_structured_reason_without_sensor_reads(self):
+        self.lock.mkdir()
+        output = io.StringIO()
+        with patch.object(frame_power.sampler, 'snapshot') as sensor, contextlib.redirect_stdout(output), contextlib.redirect_stderr(io.StringIO()):
+            self.assertEqual(frame_power.sampler.main(['--probe', '--stream']), 75)
+        sensor.assert_not_called()
+        self.assertIn('Smoke session active', json.loads(output.getvalue())['finished']['stopped'])
+
+    def test_phone_can_import_without_desktop_sampler_resources(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            import os
+            import shutil
+            shutil.copyfile(ROOT / 'ui/frame_power.py', Path(tmp) / 'frame_power.py')
+            program = 'import sys; sys.path.insert(0, sys.argv[1]); import frame_power; assert frame_power.Observation().status()["id"] is None'
+            result = subprocess.run([sys.executable, '-I', '-B', '-c', program, tmp],
+                                    env={**os.environ, 'FRAME_LOCAL': '1'}, capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_packaged_resources_under_isolated_python(self):
+        config = json.loads((ROOT / 'app/package.json').read_text())
+        # Materialize exactly the Python resources selected by electron-builder.
+        with tempfile.TemporaryDirectory() as tmp:
+            resources = Path(tmp)
+            import shutil
+            for spec in config['build']['extraResources']:
+                if spec.get('to') not in ('ui', 'scripts'):
+                    continue
+                source = ROOT / 'app' / spec['from']
+                for pattern in spec['filter']:
+                    for file in source.glob(pattern):
+                        if file.is_file():
+                            dest = resources / spec['to'] / file.name
+                            dest.parent.mkdir(parents=True, exist_ok=True)
+                            shutil.copyfile(file, dest)
+            program = ('import sys; sys.path.insert(0, sys.argv[1]); import frame_power; '
+                       'p=frame_power.sampler.remote_payload(); '
+                       'assert "def snapshot" in p and "def battery" in p; '
+                       'o=frame_power.Observation(); assert not o.status()["running"]')
+            run = subprocess.run([sys.executable, '-I', '-B', '-c', program, str(resources / 'ui')], capture_output=True, text=True)
+            self.assertEqual(run.returncode, 0, run.stderr)
+        run = subprocess.run(['node', '--test', str(ROOT / 'tests/power_desktop.cjs')], capture_output=True, text=True)
+        self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
@@ -2,6 +2,7 @@
 import sandbox  # noqa: F401
 import base64
 import contextlib
+import csv
 from html.parser import HTMLParser
 import io
 import json
@@ -43,6 +44,19 @@ class Report(unittest.TestCase):
        with contextlib.redirect_stderr(io.StringIO()):
            return power.stream_report([sys.executable, '-c', program], '', count, 1)

+    def test_csv_metadata_headset_alias_is_plain_text_in_spreadsheets(self):
+        for prefix in ('=', '+', '-', '@', ' =', '\t='):
+            with self.subTest(prefix=prefix):
+                alias = prefix + 'HYPERLINK("https://example.invalid")'
+                report = {'headset': {'alias': alias}, 'requestedSamples': 12,
+                          'stopped': 'Stopped', 'samples': []}
+                rows = list(csv.reader(io.StringIO(power.csv_samples(report))))
+                self.assertEqual(len(rows), 4)
+                self.assertEqual([row[5] for row in rows[1:]], ["'" + alias] * 3)
+        report['headset']['alias'] = 'living-room-frame'
+        rows = list(csv.reader(io.StringIO(power.csv_samples(report))))
+        self.assertEqual([row[5] for row in rows[1:]], ['living-room-frame'] * 3)
+
    def test_completed_stream_preserves_zero_unknown_units_and_downloads(self):
        event = json.dumps({'sample': SAMPLE})
        program = f'import sys; sys.stdin.read(); print({event!r}); print(\'{{"finished": {{"stopped": null}}}}\')'
@@ -89,6 +103,28 @@ class Report(unittest.TestCase):
        self.assertIn('Stopped by user', report['stopped'])
        self.assertIsNotNone(children[0].poll())

+    def test_canceled_launch_does_not_open_ssh(self):
+        import threading
+        stop = threading.Event()
+        stop.set()
+        with mock.patch.object(power.subprocess, 'Popen') as spawn:
+            report = power.stream_report(['ssh', 'frame'], '', 12, 5, stop_event=stop)
+        spawn.assert_not_called()
+        self.assertIn('Stopped before collection', report['stopped'])
+
+    def test_stop_interrupts_child_that_never_reads_payload(self):
+        import threading
+        stop = threading.Event()
+        timer = threading.Timer(0.1, stop.set)
+        timer.start()
+        try:
+            report = power.stream_report([sys.executable, '-c', 'import time; time.sleep(30)'],
+                                         'x' * 1048576, 1, 1, stop_event=stop)
+        finally:
+            timer.cancel()
+        self.assertIn('Stopped', report['stopped'])
+        self.assertEqual(report['samples'], [])
+
    def test_invalid_stream_is_not_completed(self):
        report = self.collect('import sys; sys.stdin.read(); print("not json")')
        self.assertIn('interrupted', report['stopped'])
@@ -296,7 +296,7 @@ class OneServer(unittest.TestCase):
        self.assertIn("Frame Control on", first.stdout.readline())
        second = subprocess.run([sys.executable, str(ROOT / "ui" / "server.py"), "--port", "0"], env=env,
                                capture_output=True, text=True, timeout=60)
-        self.assertEqual(second.returncode, 1)
+        self.assertEqual(second.returncode, 1, second.stderr)
        self.assertIn("already running", second.stderr)
        first.terminate()
        first.wait(10)
@@ -2,6 +2,7 @@
 import sandbox  # noqa: F401
 import contextlib
 import hashlib
+import io
 import json
 import os
 from pathlib import Path
@@ -19,6 +20,28 @@ import frame_agent as agent
 import frame_android as android


+class StartupTests(unittest.TestCase):
+    def test_rejected_server_starts_no_background_work(self):
+        # A losing process exits through Python teardown. Background TLS/index
+        # workers there can crash it, and it must not sweep the owner's files.
+        with mock.patch.object(server, 'LOCAL', False), \
+                mock.patch.object(server, 'PRIVATE', False), \
+                mock.patch.object(sys, 'argv', ['server.py', '--port', '0']), \
+                mock.patch.object(server, 'one_server', side_effect=SystemExit('already running')), \
+                mock.patch.object(server, 'LoopbackServer') as listener, \
+                mock.patch.object(server, 'sweep_tmp') as sweep, \
+                mock.patch.object(server.threading, 'Thread') as worker, \
+                mock.patch.object(server.frame_telemetry, 'start') as telemetry, \
+                mock.patch.object(server.frame_contact, 'start') as contact:
+            with self.assertRaisesRegex(SystemExit, 'already running'):
+                server.main()
+            listener.assert_not_called()
+            sweep.assert_not_called()
+            worker.assert_not_called()
+            telemetry.assert_not_called()
+            contact.assert_not_called()
+
+
 class TargetTests(unittest.TestCase):
    def setUp(self):
        self.active = {'id': 'a', 'name': 'Headset A'}
@@ -32,6 +55,7 @@ class TargetTests(unittest.TestCase):
        self.stack.enter_context(mock.patch.object(server, '_backfill', {'running': False, 'last': 0.0}))
        self.stack.enter_context(mock.patch.object(server.macview, 'retarget'))
        self.stack.enter_context(mock.patch.object(server._input, 'stop'))
+        self.real_devices_action = server.frame_link.devices_action
        self.stack.enter_context(mock.patch.object(server.frame_link, 'devices_action', self.switch))

    def switch(self, link, body, setup, busy):
@@ -90,6 +114,39 @@ class TargetTests(unittest.TestCase):
                server._live_tunnels.discard(proc)
                server.route(*before)

+    def test_input_post_reserves_headset_through_send_and_enqueue(self):
+        body = json.dumps({'events': [{'singleclick': True}, {'key': 'é'}]}).encode()
+        handler = server.Handler.__new__(server.Handler)
+        handler.path = '/api/input'
+        handler.local_request = lambda: True
+        handler.headers = {'Content-Length': str(len(body)), 'X-Frame-Device': 'a'}
+        handler.rfile = io.BytesIO(body)
+        handler.send_json, handler.send_error_json = mock.Mock(), mock.Mock()
+        stages = []
+        def check_switch(stage):
+            self.assertEqual(server._work[0], 1)
+            with self.assertRaises(server.Failure):
+                server.devices_post({'action': 'use', 'id': 'b'})
+            stages.append(stage)
+        def send(events):
+            check_switch('send')
+            return {'state': 'ready', 'sent': True}
+        def enqueue(events):
+            check_switch('enqueue')
+            self.assertEqual(events, [{'key': 'é'}])
+            return True
+        with mock.patch.object(server.frame_link, 'devices_action', self.real_devices_action), \
+                mock.patch.object(server._touch, 'send', side_effect=send), \
+                mock.patch.object(server, '_queue_for_kde', side_effect=enqueue):
+            handler.do_POST()
+        handler.send_error_json.assert_not_called()
+        self.assertTrue(handler.send_json.call_args.args[0]['sent'])
+        self.assertEqual(stages, ['send', 'enqueue'])
+        self.assertEqual(self.active['id'], 'a')
+        self.assertEqual(server._work[0], 0)
+        server.devices_post({'action': 'use', 'id': 'b'})
+        self.assertEqual(self.active['id'], 'b')
+
    def test_backfill_counts_work_until_error_cleanup(self):
        entered, release = threading.Event(), threading.Event()
        writes = []
@@ -380,9 +437,9 @@ class FinalGetStartTests(unittest.TestCase):
        self.active.update(id='b', name='Headset B')
        for name in ('input', 'touch'):
            with self.subTest(name=name):
-                fresh = server.InputAgent(packages=[]) if name == 'input' else server.TouchAgent()
+                fresh = server.TouchAgent()
                handler = self.handler('/api/%s?start=1' % name, 'a')
-                with mock.patch.object(server, '_' + name, fresh), mock.patch.object(fresh, 'start') as start:
+                with mock.patch.object(server, '_touch', fresh), mock.patch.object(fresh, 'start') as start:
                    handler.do_GET()
                start.assert_not_called()
                self.assertEqual(handler.send_error_json.call_args.args[1], 409)
@@ -391,14 +448,46 @@ class FinalGetStartTests(unittest.TestCase):
    def test_desktop_get_start_requires_an_intended_device(self):
        for name in ('input', 'touch'):
            with self.subTest(name=name):
-                fresh = server.InputAgent(packages=[]) if name == 'input' else server.TouchAgent()
+                fresh = server.TouchAgent()
                handler = self.handler('/api/%s?start=1' % name, None)
-                with mock.patch.object(server, '_' + name, fresh), mock.patch.object(fresh, 'start') as start:
+                with mock.patch.object(server, '_touch', fresh), mock.patch.object(fresh, 'start') as start:
                    handler.do_GET()
                start.assert_not_called()
                self.assertEqual(handler.send_error_json.call_args.args[1], 400)
                self.assertEqual(server._work[0], 0)

+    def test_input_get_starts_and_polls_gamescope_without_starting_kde_connect(self):
+        touch, kde = mock.Mock(), mock.Mock()
+        touch.status = {'state': 'ready', 'focus': 7}
+        touch.send.return_value = {'state': 'starting', 'sent': False}
+        with mock.patch.object(server, '_touch', touch), mock.patch.object(server, '_input', kde):
+            start = self.handler('/api/input?start=1', 'a')
+            start.do_GET()
+            touch.send.assert_called_once_with([])
+            start.send_json.assert_called_once_with(touch.send.return_value)
+            status = self.handler('/api/input', 'a')
+            status.do_GET()
+            status.send_json.assert_called_once_with(touch.status)
+        kde.send.assert_not_called()
+        kde.start.assert_not_called()
+
+    def test_input_poll_exposes_retained_text_error_and_start_retries(self):
+        touch = mock.Mock(status={'state': 'ready'})
+        touch.send.return_value = {'state': 'ready', 'sent': False}
+        with mock.patch.object(server, '_touch', touch), \
+                mock.patch.object(server, '_kde_queue', [{'key': 'é'}]), \
+                mock.patch.object(server, '_kde_error', 'Text is retained; try again.'), \
+                mock.patch.object(server, '_kde_worker', [None]), \
+                mock.patch.object(server, '_start_kde_locked') as retry:
+            status = self.handler('/api/input', 'a')
+            status.do_GET()
+            self.assertEqual(status.send_json.call_args.args[0]['state'], 'error')
+            retry.assert_not_called()  # polling never retries typing on its own
+            start = self.handler('/api/input?start=1', 'a')
+            start.do_GET()
+            retry.assert_called_once_with()
+            touch.send.assert_called_once_with([])
+
    def test_get_start_validation_and_thread_registration_are_one_reservation(self):
        attempts = []
        fresh = server.TouchAgent()
@@ -458,10 +547,10 @@ class FinalGetStartTests(unittest.TestCase):
                                    (None, None, '?start=1')):
            for name in ('input', 'touch'):
                with self.subTest(name=name, query=query, local=link is None):
-                    fresh = server.InputAgent(packages=[]) if name == 'input' else server.TouchAgent()
+                    fresh = server.TouchAgent()
                    handler = self.handler('/api/' + name + query, meant)
                    with mock.patch.object(server, 'LINK', link), mock.patch.object(server, 'LOCAL', link is None), \
-                            mock.patch.object(server, '_' + name, fresh), mock.patch.object(fresh, 'start') as start:
+                            mock.patch.object(server, '_touch', fresh), mock.patch.object(fresh, 'start') as start:
                        handler.do_GET()
                    self.assertEqual(start.call_count, 1 if query else 0)
                    handler.send_error_json.assert_not_called()
@@ -0,0 +1,261 @@
+"""PC-only Steam helper tests. All app launches and KDE calls are mocked.
+No portal, interactive Wayland session, Steam installation or Frame is used.
+"""
+import sandbox  # noqa: F401
+import contextlib
+import http.client
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+from unittest import mock
+from http.server import ThreadingHTTPServer
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'ui'))
+import frame_steam_pipewire as helper
+import server
+
+ENV = {'XDG_SESSION_TYPE': 'wayland', 'WAYLAND_DISPLAY': 'wayland-0',
+       'DBUS_SESSION_BUS_ADDRESS': 'unix:path=/mock/session-bus', 'XDG_CURRENT_DESKTOP': 'KDE'}
+
+
+class HelperTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = contextlib.ExitStack()
+        self.addCleanup(self.stack.close)
+        patches = [mock.patch.dict(os.environ, ENV, clear=True),
+                   mock.patch.object(helper.sys, 'platform', 'linux'),
+                   mock.patch.object(helper.os, 'geteuid', return_value=1000, create=True),
+                   mock.patch.object(helper.Path, 'exists', return_value=False),
+                   mock.patch.object(helper, '_launch', None),
+                   mock.patch.object(helper, '_steam_running', return_value=False),
+                   mock.patch.object(helper.shutil, 'which', side_effect=lambda n: '/usr/bin/' + n),
+                   mock.patch.object(helper.subprocess, 'Popen'),
+                   mock.patch.object(helper.subprocess, 'run')]
+        started = [self.stack.enter_context(p) for p in patches]
+        self.running, self.which, self.spawn, self.run = started[-4:]
+        self.spawn.return_value.poll.return_value = None
+        self.spawn.return_value.wait.side_effect = subprocess.TimeoutExpired('app', 1)
+        self.run.return_value = subprocess.CompletedProcess([], 0, 'kcm_app-permissions - Application Permissions\n', '')
+
+    def action(self, action):
+        return helper.action({'action': action, 'confirmed': True})
+
+    def test_status_is_read_only(self):
+        self.assertTrue(helper.status()['available'])
+        self.spawn.assert_not_called()
+        self.run.assert_not_called()
+        self.running.assert_not_called()
+
+    def test_platform_and_local_session_gates(self):
+        for platform in ('win32', 'darwin'):
+            with self.subTest(platform=platform), mock.patch.object(helper.sys, 'platform', platform):
+                self.assertFalse(helper.status()['available'])
+                with self.assertRaises(helper.HelperError):
+                    self.action('launch')
+        for change in ({'FRAME_LOCAL': '1'}, {'XDG_SESSION_TYPE': 'x11'}, {'WAYLAND_DISPLAY': ''},
+                       {'DBUS_SESSION_BUS_ADDRESS': ''}, {'SSH_CONNECTION': 'remote'}, {'SSH_CLIENT': 'remote'}):
+            with self.subTest(change=change), mock.patch.dict(os.environ, change):
+                for action in ('launch', 'permissions'):
+                    with self.assertRaises(helper.HelperError):
+                        self.action(action)
+        self.spawn.assert_not_called()
+        self.run.assert_not_called()
+
+    def test_root_and_sandbox_refused(self):
+        with mock.patch.object(helper.os, 'geteuid', return_value=0):
+            self.assertIn('not root', helper.status()['reason'])
+        with mock.patch.object(helper.Path, 'exists', return_value=True):
+            with self.assertRaisesRegex(helper.HelperError, 'sandbox'):
+                self.action('launch')
+        self.spawn.assert_not_called()
+
+    def test_only_explicit_supported_actions(self):
+        for body in ({}, {'action': 'launch'}, {'action': 'permissions', 'confirmed': 'true'},
+                     {'action': 'delete-all', 'confirmed': True}):
+            with self.subTest(body=body), self.assertRaises(helper.HelperError):
+                helper.action(body)
+        self.spawn.assert_not_called()
+        self.run.assert_not_called()
+
+    def test_launch_exact_command_and_duplicate_guard(self):
+        result = self.action('launch')
+        self.assertTrue(result['launched'])
+        self.assertIn('does not confirm', result['message'])
+        self.spawn.assert_called_once_with(['/usr/bin/steam', '-pipewire'], stdin=subprocess.DEVNULL,
+                                          stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                                          start_new_session=True)
+        with self.assertRaisesRegex(helper.HelperError, 'already running or starting'):
+            self.action('launch')
+        self.assertEqual(self.spawn.call_count, 1)
+        self.run.assert_not_called()
+
+    def test_running_and_unknown_steam_fail_closed(self):
+        self.running.return_value = True
+        with self.assertRaisesRegex(helper.HelperError, 'Steam > Exit'):
+            self.action('launch')
+        self.running.side_effect = helper.HelperError('Cannot verify')
+        with self.assertRaisesRegex(helper.HelperError, 'Cannot verify'):
+            self.action('launch')
+        self.spawn.assert_not_called()
+
+    def test_missing_launcher_does_not_guess_flatpak(self):
+        self.which.side_effect = None
+        self.which.return_value = None
+        with self.assertRaisesRegex(helper.HelperError, 'Flatpak-only'):
+            self.action('launch')
+        self.spawn.assert_not_called()
+
+    def test_launch_error_is_not_success(self):
+        self.spawn.side_effect = OSError('missing')
+        with self.assertRaisesRegex(helper.HelperError, 'Could not start'):
+            self.action('launch')
+
+    def test_immediate_application_failure_is_not_success(self):
+        self.spawn.return_value.wait.side_effect = None
+        self.spawn.return_value.wait.return_value = 1
+        for action in ('launch', 'permissions'):
+            with self.subTest(action=action), mock.patch.object(helper, '_launch', None):
+                with self.assertRaisesRegex(helper.HelperError, 'exited with an error'):
+                    self.action(action)
+
+    def test_permissions_opens_only_verified_exact_module_never_resets(self):
+        result = self.action('permissions')
+        self.assertTrue(result['opened'])
+        self.assertFalse(result['reset'])
+        self.assertIn('No permission was changed', result['message'])
+        self.run.assert_called_once_with(['/usr/bin/kcmshell6', '--list'], capture_output=True,
+                                         text=True, timeout=5, stdin=subprocess.DEVNULL)
+        self.assertEqual(self.spawn.call_args.args[0], ['/usr/bin/kcmshell6', 'kcm_app-permissions'])
+        self.running.assert_not_called()
+
+    def test_wrong_module_missing_tool_and_other_desktops_only_give_guidance(self):
+        for listing in ('kcm_flatpak - Flatpak Permissions', 'evil_kcm_app-permissions - nope', ''):
+            self.run.return_value.stdout = listing
+            result = self.action('permissions')
+            self.assertFalse(result['reset'])
+            self.assertFalse(result['opened'])
+        self.which.side_effect = None
+        self.which.return_value = None
+        self.assertFalse(self.action('permissions')['opened'])
+        self.which.reset_mock()
+        with mock.patch.dict(os.environ, {'XDG_CURRENT_DESKTOP': 'GNOME'}):
+            self.assertFalse(self.action('permissions')['opened'])
+            self.which.assert_not_called()
+        self.spawn.assert_not_called()
+
+    def test_module_listing_error_or_timeout_is_guidance_not_reset(self):
+        for error in (OSError('missing'), subprocess.TimeoutExpired('kcm', 5)):
+            self.run.side_effect = error
+            result = self.action('permissions')
+            self.assertFalse(result['opened'])
+            self.assertFalse(result['reset'])
+            self.assertIn('kde-config-flatpak', result['message'])
+        self.spawn.assert_not_called()
+
+
+class ProcessTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = contextlib.ExitStack()
+        self.addCleanup(self.stack.close)
+        self.tmp = self.stack.enter_context(tempfile.TemporaryDirectory())
+        self.proc = Path(self.tmp)
+        # Match the temp files' owner even when tests run as root or on Windows.
+        self.stack.enter_context(mock.patch.object(helper.os, 'geteuid', return_value=self.proc.stat().st_uid, create=True))
+        self.add('1', 'python', b'python\0server.py\0')
+
+    def add(self, pid, comm, cmdline):
+        p = self.proc / pid
+        p.mkdir()
+        (p / 'comm').write_text(comm)
+        (p / 'cmdline').write_bytes(cmdline)
+
+    def test_native_launcher_webhelper_and_flatpak_detected(self):
+        for comm, cmd in [('steam', b'/x/steam\0'), ('bash', b'bash\0/x/steam.sh\0'),
+                          ('steamwebhelper', b'/x/steamwebhelper\0'),
+                          ('flatpak', b'flatpak\0run\0com.valvesoftware.Steam\0')]:
+            with self.subTest(comm=comm):
+                (self.proc / '1' / 'comm').write_text(comm)
+                (self.proc / '1' / 'cmdline').write_bytes(cmd)
+                self.assertTrue(helper._steam_running(self.proc))
+
+    def test_unrelated_names_are_not_steam(self):
+        self.add('2', 'steamdeck-tools', b'/bin/steam-tools\0')
+        self.assertFalse(helper._steam_running(self.proc))
+
+    def test_other_user_steam_is_not_this_users_instance(self):
+        self.add('2', 'steam', b'steam\0')
+        with mock.patch.object(helper.os, 'geteuid', return_value=self.proc.stat().st_uid + 1):
+            self.assertFalse(helper._steam_running(self.proc))
+
+    def test_exited_process_is_skipped(self):
+        (self.proc / '2').mkdir()
+        self.assertFalse(helper._steam_running(self.proc))
+
+    def test_unreadable_or_missing_inventory_fails_closed(self):
+        with self.assertRaisesRegex(helper.HelperError, 'Cannot verify'):
+            helper._steam_running(self.proc / 'missing')
+        with mock.patch.object(helper.Path, 'read_bytes', side_effect=PermissionError('denied')):
+            with self.assertRaisesRegex(helper.HelperError, 'Cannot verify'):
+                helper._steam_running(self.proc)
+
+
+class RouteTests(unittest.TestCase):
+    def test_headset_and_private_servers_never_call_helper(self):
+        for local, private in ((True, False), (False, True)):
+            with mock.patch.object(server, 'LOCAL', local), mock.patch.object(server, 'PRIVATE', private), \
+                    mock.patch.object(helper, 'action') as action, mock.patch.object(helper, 'status') as status:
+                self.assertFalse(server.steam_pipewire_state()['available'])
+                with self.assertRaises(server.Failure):
+                    server.steam_pipewire_action({'action': 'launch', 'confirmed': True})
+                action.assert_not_called()
+                status.assert_not_called()
+
+    def test_http_guards_get_read_only_and_post_bypasses_headset_work(self):
+        with ThreadingHTTPServer(('127.0.0.1', 0), server.Handler) as httpd:
+            thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+            thread.start()
+            try:
+                def request(method, body=None, headers=None):
+                    conn = http.client.HTTPConnection('127.0.0.1', httpd.server_port)
+                    conn.request(method, '/api/steam-pipewire', json.dumps(body) if body else None, headers or {})
+                    reply = conn.getresponse()
+                    code, data = reply.status, json.loads(reply.read())
+                    conn.close()
+                    return code, data
+                with mock.patch.object(server, 'LOCAL', False), mock.patch.object(server, 'PRIVATE', False), \
+                        mock.patch.object(server, 'working', side_effect=AssertionError('headset work')), \
+                        mock.patch.object(server, 'ssh', side_effect=AssertionError('Frame access')), \
+                        mock.patch.object(helper, 'action', return_value={'reset': False}) as action, \
+                        mock.patch.object(helper, 'status', return_value={'available': True}) as status:
+                    self.assertEqual(request('POST', {'action': 'launch'})[0], 403)
+                    self.assertEqual(request('GET')[0], 403)
+                    action.assert_not_called()
+                    headers = {'X-Frame-UI': server.UI_KEY, 'X-Frame-Device': 'unrelated-device'}
+                    self.assertEqual(request('GET', headers=headers), (200, {'available': True}))
+                    action.assert_not_called()
+                    status.assert_called_once()
+                    body = {'action': 'permissions', 'confirmed': True}
+                    self.assertEqual(request('POST', body, headers), (200, {'reset': False}))
+                    action.assert_called_once_with(body)
+            finally:
+                httpd.shutdown()
+                thread.join()
+
+
+class PageTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which('node'), 'Node exercises production page handlers')
+    def test_production_page_handlers(self):
+        result = subprocess.run(['node', '--test', str(ROOT / 'tests/steam_pipewire_ui.cjs')],
+                                capture_output=True, text=True)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -150,6 +150,14 @@ class Apply(unittest.TestCase):
        self.assertFalse(self.t.STALE[0])
        self.assertEqual(self.said[-1][1].get("stale"), None)

+    def test_stale_survives_a_bare_release(self):
+        gs = FakeGamescope()
+        panel = self.t.apply(gs, {"button": "left", "down": True, "window": 99, "display": ":1"}, None)
+        self.assertTrue(self.t.STALE[0])
+        self.t.apply(gs, {"button": "left", "down": False}, panel)  # the page's release names no panel
+        self.assertTrue(self.t.STALE[0])
+        self.assertEqual(self.said[-1][1].get("stale"), True)
+
    def test_same_window_id_on_the_other_display_is_another_panel(self):
        gs = FakeGamescope()
        self.t.apply(gs, {"fx": 0.5, "fy": 0.5, "window": 7, "display": ":0"}, None)
@@ -355,6 +363,8 @@ class FindingPanels(unittest.TestCase):
        t.subprocess.run = lambda *a, **k: subprocess.CompletedProcess(a, 0, out, "")
        self.assertEqual(self.real_read_props(":0"), {"GAMESCOPE_FOCUSABLE_WINDOWS": [1, 0, 2, 3, 769, 4],
                                                      "GAMESCOPE_FOCUSED_WINDOW": [0]})
+        t.subprocess.run = lambda *a, **k: subprocess.CompletedProcess(a, 0, "GAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = \n", "")
+        self.assertEqual(self.real_read_props(":0"), {"GAMESCOPE_FOCUSABLE_WINDOWS": []})
        t.subprocess.run = lambda *a, **k: subprocess.CompletedProcess(a, 0, "GAMESCOPE_FOCUSED_WINDOW:  not found.\n", "")
        self.assertEqual(self.real_read_props(":0"), {})

@@ -392,17 +402,52 @@ class FindingPanels(unittest.TestCase):
        self.assertIn("Headset view", out["why"])

    def test_desktop_running_but_not_listed(self):
+        self.props[(":0", "GAMESCOPE_FOCUSABLE_WINDOWS")] = []
        self.t.desktop_running = lambda: True
        out = self.t.panels()
        self.assertEqual(out["panels"], [])
        self.assertIn("desktop is running", out["why"])

    def test_nothing_open(self):
+        self.props[(":0", "GAMESCOPE_FOCUSABLE_WINDOWS")] = []
        out = self.t.panels()
        self.assertEqual(out, {"focus": None, "focus_display": None, "panels": [],
                               "why": "No app panel is open in the headset. Open the desktop or an app in "
                                      "the headset, then try again."})

+    def test_absent_list_is_unknown_even_when_desktop_is_running(self):
+        for desktop in (False, True):
+            with self.subTest(desktop=desktop):
+                self.t.desktop_running = lambda: desktop
+                self.t._ROOT.clear()
+                out = self.t.panels()
+                self.assertEqual(out["panels"], [])
+                self.assertIn("couldn't read gamescope's panel list", out["why"])
+                self.assertIn("can't tell whether", out["why"])
+                self.assertIn("Headset view", out["why"])
+                self.assertNotIn("No app panel is open", out["why"])
+
+    def test_focus_property_without_panel_list_is_unknown(self):
+        self.props[(":0", "GAMESCOPE_FOCUSED_WINDOW")] = [0]
+        self.assertIn("couldn't read gamescope's panel list", self.t.panels()["why"])
+
+    def test_failed_xprop_does_not_claim_no_panels_are_open(self):
+        t = self.t
+        t.read_props = self.real_read_props
+        saved = t.subprocess.run
+        self.addCleanup(setattr, t.subprocess, "run", saved)
+        for failure in ("refused", "timeout"):
+            with self.subTest(failure=failure):
+                def run(*args, **kwargs):
+                    if failure == "timeout":
+                        raise subprocess.TimeoutExpired(args[0], kwargs["timeout"])
+                    return subprocess.CompletedProcess(args[0], 1, "", "Can't open display")
+                t.subprocess.run = run
+                t._ROOT.clear()
+                out = t.panels()
+                self.assertIn("couldn't read gamescope's panel list", out["why"])
+                self.assertNotIn("No app panel is open", out["why"])
+
    def test_missing_x_tools_are_named(self):
        self.plasma_on(":0")
        self.t.shutil.which = lambda tool: None if tool == "xwininfo" else "/usr/bin/" + tool
@@ -0,0 +1,233 @@
+"""PC-only wireless diagnosis: fixtures, HTTP boundaries and live Windows queries.
+
+Never starts the app connector or contacts a headset, including on Windows CI.
+"""
+import sandbox  # noqa: F401
+import base64
+import copy
+import http.client
+import json
+import shutil
+import subprocess
+import sys
+import threading
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / 'ui'))
+import frame_wireless as wireless
+import server
+
+G1 = '11111111-2222-3333-4444-555555555555'
+G2 = '66666666-2222-3333-4444-555555555555'
+DIRECT = 'SWD\\WIFIDIRECT\\one'
+DIRECT2 = 'SWD\\WIFIDIRECT\\two'
+PC = 'PCI\\radio'
+
+
+def wlan(guid=G1, channel=1, band='2.4', state='connected'):
+    return f'    Name : Wi-Fi\n    GUID : {{{guid}}}\n    State : {state}\n    Channel : {channel}\n    Band : {band} GHz\n'
+
+
+def sample():
+    return {'sources': dict.fromkeys(('pnp', 'present', 'adapters', 'routes', 'wlan'), 'ok'),
+            'pnp': [{'InstanceId': DIRECT, 'FriendlyName': 'Microsoft Wi-Fi Direct Virtual Adapter', 'Status': 'OK', 'Problem': 0},
+                    {'InstanceId': DIRECT2, 'FriendlyName': 'Microsoft Wi-Fi Direct Virtual Adapter #2', 'Status': 'Error', 'Problem': 22},
+                    {'InstanceId': PC, 'FriendlyName': 'PC radio', 'Status': 'OK', 'Problem': 0}],
+            'present': [DIRECT, PC],
+            'adapters': [{'PnPDeviceID': DIRECT, 'InterfaceGuid': G2, 'ifIndex': 2, 'InterfaceOperationalStatus': 2, 'MediaConnectState': 2},
+                         {'PnPDeviceID': PC, 'InterfaceGuid': '{' + G1.upper() + '}', 'ifIndex': 3,
+                          'InterfaceOperationalStatus': 1, 'MediaConnectState': 1, 'NdisPhysicalMedium': 9, 'HardwareInterface': True}],
+            'routes': [{'InterfaceIndex': 3}], 'wlan': wlan()}
+
+
+class Inventory(unittest.TestCase):
+    def test_distinct_instances_presence_disabled_and_activity_are_separate(self):
+        r = wireless.analyse(sample())
+        self.assertTrue(r['multipleWifiDirect'])
+        self.assertEqual(r['wifiDirectInstances'], [DIRECT, DIRECT2])
+        first, second, pc = r['devices']
+        self.assertTrue(first['present'])
+        self.assertEqual(first['operational'], 2)
+        self.assertFalse(second['present'])
+        self.assertEqual(second['problemCode'], 22)
+        self.assertIsNone(second['operational'])
+        self.assertTrue(pc['defaultRoute'])
+        self.assertTrue(pc['wifi'])
+        self.assertTrue(pc['hardware'])
+        self.assertFalse(first['defaultRoute'])
+        self.assertEqual(pc['channel'], 1)
+        self.assertIsNone(first['channel'])
+        self.assertEqual(r['overlap'], 'possible')
+
+    def test_counts_unique_pnp_ids_not_rows_or_suffix_order(self):
+        d = sample()
+        d['pnp'].append(dict(d['pnp'][0], InstanceId=DIRECT.upper()))
+        d['pnp'][1]['FriendlyName'] = 'Microsoft Wi-Fi Direct Virtual Adapter #57'
+        r = wireless.analyse(d)
+        self.assertEqual(len(r['wifiDirectInstances']), 2)
+        self.assertEqual(len(r['devices']), 3)
+        d['pnp'] = [dict(d['pnp'][0], FriendlyName='ローカライズされた名前')]
+        d['adapters'] = []
+        r = wireless.analyse(d)
+        self.assertTrue(r['devices'][0]['wifiDirect'])
+        self.assertEqual(r['devices'][0]['identityEvidence'], 'PnP enumerator')
+        self.assertFalse(r['multipleWifiDirect'])
+
+    def test_friendly_name_is_only_a_candidate_and_other_duplicate_names_are_not_direct(self):
+        d = sample()
+        d['pnp'] = [{'InstanceId': 'ROOT\\1', 'FriendlyName': 'Microsoft Wi-Fi Direct Virtual Adapter #4'},
+                    {'InstanceId': 'ROOT\\2', 'FriendlyName': 'Ethernet'},
+                    {'InstanceId': 'ROOT\\3', 'FriendlyName': 'Ethernet'}]
+        d['adapters'] = []
+        r = wireless.analyse(d)
+        self.assertEqual(r['wifiDirectInstances'], ['ROOT\\1'])
+        self.assertEqual(r['devices'][0]['identityEvidence'], 'Name only')
+
+    def test_missing_sources_are_unknown_and_adapter_fallback_is_retained(self):
+        for source in ('present', 'adapters', 'routes', 'wlan'):
+            d = sample()
+            d['sources'][source] = 'unavailable'
+            r = wireless.analyse(d)
+            pc = r['devices'][2]
+            self.assertEqual(r['state'], 'partial')
+            field = {'present': 'present', 'adapters': 'operational', 'routes': 'defaultRoute', 'wlan': 'channel'}[source]
+            self.assertIsNone(pc[field])
+        d = sample()
+        d['sources']['pnp'] = 'unavailable'
+        r = wireless.analyse(d)
+        pc = next(x for x in r['devices'] if x['id'] == PC)
+        self.assertTrue(pc['wifi'])
+        self.assertIsNone(pc['pnpStatus'])
+
+    def test_ambiguous_adapter_join_never_selects_the_first_match(self):
+        d = sample()
+        d['adapters'].append(copy.deepcopy(d['adapters'][1]))
+        pc = wireless.analyse(d)['devices'][2]
+        self.assertIsNone(pc['channel'])
+        self.assertIsNone(pc['operational'])
+        self.assertIsNone(pc['defaultRoute'])
+
+    def test_missing_interface_metadata_and_invalid_guids_stay_unknown(self):
+        d = sample()
+        d['adapters'][1].pop('NdisPhysicalMedium')
+        d['adapters'][1].pop('ifIndex')
+        d['routes'].append({})
+        pc = wireless.analyse(d)['devices'][2]
+        self.assertIsNone(pc['wifi'])
+        self.assertIsNone(pc['defaultRoute'])
+        for invalid in ('{' + G1, G1 + '}', 'not-a-guid'):
+            d['adapters'][1]['InterfaceGuid'] = invalid
+            self.assertIsNone(wireless.analyse(d)['devices'][2]['channel'])
+
+    def test_channels_require_exact_guid_and_band_is_never_guessed(self):
+        d = sample()
+        d['wlan'] = wlan(G2, 149, '5') + wlan(G1, 1, '6')
+        r = wireless.analyse(d)
+        self.assertEqual([(x['channel'], x['band']) for x in (r['devices'][0], r['devices'][2])], [(149, '5'), (1, '6')])
+        self.assertEqual(r['overlap'], 'unknown')
+        d['wlan'] = wlan().replace('    Band : 2.4 GHz\n', '')
+        r = wireless.analyse(d)
+        self.assertEqual(r['devices'][2]['channel'], 1)
+        self.assertIsNone(r['devices'][2]['band'])
+        self.assertEqual(r['overlap'], 'unknown')
+        for raw in (wlan(G2), wlan(state='disconnected'), wlan(channel='oops'),
+                    wlan().replace('Channel', 'チャネル'), 'Access denied. Location consent required.'):
+            d['wlan'] = raw
+            self.assertIsNone(wireless.analyse(d)['devices'][2]['channel'])
+        d['wlan'] = wlan() + wlan()
+        self.assertIsNone(wireless.analyse(d)['devices'][2]['channel'])
+
+    def test_raw_ssid_mac_and_errors_are_not_returned(self):
+        d = sample()
+        d['wlan'] += '    SSID : private-network\n    BSSID : 11:22:33:44:55:66\nsecret error text\n'
+        out = json.dumps(wireless.analyse(d))
+        for value in ('private-network', '11:22:33:44:55:66', 'secret error text'):
+            self.assertNotIn(value, out)
+
+
+class Probe(unittest.TestCase):
+    def test_non_windows_starts_nothing(self):
+        with patch.object(wireless.frame_host, 'WINDOWS', False), patch.object(wireless.subprocess, 'run') as run:
+            self.assertEqual(wireless.diagnose()['state'], 'unsupported')
+            run.assert_not_called()
+
+    def test_static_noninteractive_local_command_and_timeout(self):
+        result = subprocess.CompletedProcess([], 0, json.dumps(sample()).encode(), b'')
+        with patch.object(wireless.frame_host, 'WINDOWS', True), patch.object(wireless.subprocess, 'run', return_value=result) as run:
+            r = wireless.diagnose()
+            self.assertEqual(r['state'], 'ok')
+            self.assertIn('observedAt', r)
+            args, kwargs = run.call_args
+            command = args[0]
+            self.assertTrue(command[0].endswith('powershell.exe'))
+            self.assertEqual(command[1:4], ['-NoProfile', '-NonInteractive', '-EncodedCommand'])
+            self.assertEqual(base64.b64decode(command[4]).decode('utf-16-le'), wireless.PROBE)
+            self.assertEqual(kwargs['stdin'], subprocess.DEVNULL)
+            self.assertEqual(kwargs['timeout'], 20)
+            self.assertNotIn('shell', kwargs)
+
+    def test_failure_timeout_and_invalid_output_are_explicit_and_release_lock(self):
+        for error in (OSError('private error'), subprocess.TimeoutExpired('powershell', 20)):
+            with patch.object(wireless.frame_host, 'WINDOWS', True), patch.object(wireless.subprocess, 'run', side_effect=error):
+                r = wireless.diagnose()
+                self.assertEqual(r['state'], 'unavailable')
+                self.assertNotIn('private error', json.dumps(r))
+                self.assertFalse(wireless._lock.locked())
+        for output in (b'not JSON', b'[]', b'{}', b'x' * 1_000_001):
+            with patch.object(wireless.frame_host, 'WINDOWS', True), patch.object(wireless.subprocess, 'run', return_value=subprocess.CompletedProcess([], 0, output, b'')):
+                self.assertEqual(wireless.diagnose()['state'], 'unavailable')
+
+    def test_concurrent_requests_do_not_spawn_more_probes(self):
+        wireless._lock.acquire()
+        try:
+            with patch.object(wireless.frame_host, 'WINDOWS', True), patch.object(wireless.subprocess, 'run') as run:
+                self.assertEqual(wireless.diagnose()['state'], 'busy')
+                run.assert_not_called()
+        finally:
+            wireless._lock.release()
+
+    @unittest.skipUnless(wireless.frame_host.WINDOWS, 'Live read-only Windows inventory runs on Windows CI')
+    def test_live_windows_inventory(self):
+        r = wireless.diagnose()
+        self.assertIn(r['state'], ('ok', 'partial'), r)
+        self.assertEqual(r['sources']['adapters'], 'ok', r['sources'])
+        self.assertTrue(r['devices'], 'Windows runner should expose at least its virtual network interface')
+        print('Windows wireless smoke:', r['state'], r['sources'], 'devices=', len(r['devices']))
+
+    def test_http_is_authenticated_pc_only_and_never_calls_ssh(self):
+        httpd = server.ThreadingHTTPServer(('127.0.0.1', 0), server.Handler)
+        thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+        thread.start()
+        try:
+            with patch.object(server, 'ssh', side_effect=AssertionError('No headset access')), patch.object(server.frame_wireless, 'diagnose', return_value={'state': 'partial'}) as diagnose:
+                conn = http.client.HTTPConnection(*httpd.server_address)
+                conn.request('GET', '/api/host/wireless')
+                response = conn.getresponse()
+                self.assertEqual(response.status, 403)
+                response.read()
+                diagnose.assert_not_called()
+                with patch.object(server, 'LOCAL', True):
+                    conn.request('GET', '/api/host/wireless', headers={'X-Frame-UI': server.UI_KEY})
+                    response = conn.getresponse()
+                    self.assertEqual(response.status, 400)
+                    response.read()
+                    diagnose.assert_not_called()
+                with patch.object(server, 'LOCAL', False):
+                    conn.request('GET', '/api/host/wireless', headers={'X-Frame-UI': server.UI_KEY})
+                    response = conn.getresponse()
+                    self.assertEqual(response.status, 200)
+                    self.assertEqual(json.loads(response.read()), {'state': 'partial'})
+                    diagnose.assert_called_once_with()
+                conn.close()
+        finally:
+            httpd.shutdown()
+            httpd.server_close()
+            thread.join()
+
+    @unittest.skipUnless(shutil.which('node'), 'Node required')
+    def test_ui_behavior(self):
+        r = subprocess.run(['node', '--test', str(ROOT / 'tests/wireless.cjs')], capture_output=True, text=True)
+        self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
@@ -0,0 +1,287 @@
+"""Synthetic sysfs fixtures and loopback HTTP; never require an adapter or a Frame."""
+import sandbox  # noqa: F401
+import contextlib
+import http.client
+import io
+import json
+import os
+import shutil
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / 'ui'))
+import frame_wireless_doctor as wd
+
+
+class Parsers(unittest.TestCase):
+    def test_channel_without_leaking_identifiers(self):
+        for frequency, band, channel in [(2412, '2.4 GHz', 1), (5180, '5 GHz', 36), (5975, '6 GHz', 5)]:
+            text = f'Interface wlan0\n addr aa:bb:cc:dd:ee:ff\n ssid private\n channel {channel} ({frequency} MHz), width: 80 MHz'
+            self.assertEqual(wd.radio_info(text), dict(channel=channel, frequency_mhz=frequency, band=band))
+        self.assertIsNone(wd.radio_info('Interface wlan0\n type managed\n'))
+        self.assertEqual(wd.supported_frequencies('* 2412 MHz [1] (20.0 dBm)\n* 5975 MHz [5] (disabled)\n* 5180 MHz [36] (23.0 dBm)'), [2412, 5180])
+
+    def test_non_linux_and_headset_mode_do_not_read_or_run(self):
+        for kwargs in ({'system': 'darwin'}, {'system': 'win32'}, {'system': 'linux', 'local': True}):
+            with patch.object(wd, 'Reader', side_effect=AssertionError('must not probe')):
+                self.assertFalse(wd.diagnose(**kwargs)['supported'])
+        with patch.dict(os.environ, {'FRAME_LOCAL': '1'}), patch.object(wd, 'Reader') as reader:
+            self.assertFalse(wd.diagnose(system='linux')['supported'])
+            reader.assert_not_called()
+
+    def test_command_failure_is_not_empty_success(self):
+        reader = wd.Reader()
+        for error, status in [(FileNotFoundError(), 'missing'), (PermissionError(), 'unavailable'),
+                              (subprocess.TimeoutExpired('iw', 3), 'timeout')]:
+            with patch.object(wd.subprocess, 'run', side_effect=error):
+                self.assertEqual(reader.command(['iw', 'dev', 'wlan0', 'info'])['status'], status)
+        with patch.object(wd.subprocess, 'run', return_value=subprocess.CompletedProcess([], 1, '', 'Operation not permitted')) as run:
+            result = reader.command(['iw', 'dev', 'wlan0', 'info'])
+            self.assertEqual(result['status'], 'denied')
+            self.assertEqual(result['text'], '')
+            self.assertEqual(run.call_args.kwargs['stdin'], subprocess.DEVNULL)
+            self.assertEqual(run.call_args.kwargs['timeout'], 3)
+            self.assertNotIn('shell', run.call_args.kwargs)
+
+    def test_read_failure_and_empty_inventory_remain_unknown(self):
+        with tempfile.TemporaryDirectory() as root:
+            reader = wd.Reader(root, root, root)
+            report = wd.diagnose(reader=reader, system='linux', local=False)
+        checks = {c['id']: c for c in report['checks']}
+        self.assertEqual(checks['presence']['status'], 'unknown')
+        self.assertIn('reads', checks)
+        with patch.object(Path, 'open', side_effect=PermissionError()):
+            self.assertIsNone(reader.read(Path('/synthetic/denied')))
+        self.assertIn('PermissionError', reader.gaps[-1])
+
+
+class Page(unittest.TestCase):
+    @unittest.skipUnless(shutil.which('node'), 'Node is needed for real page script checks')
+    def test_on_demand_selection_and_failure_recovery(self):
+        result = subprocess.run(['node', str(Path(__file__).parent / 'page/wireless_doctor.mjs')],
+                                capture_output=True, text=True, timeout=20)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+
+class FixtureReader(wd.Reader):
+    """Invented USB 1234:5678; it is deliberately not a claimed Valve ID."""
+    def __init__(self, root):
+        super().__init__(root / 'sys', root / 'dev', root / 'proc')
+        self.commands = []
+        self.responses = {}
+
+    def command(self, argv):
+        self.commands.append(argv)
+        return self.responses.get(argv[0], {'status': 'missing', 'detail': argv[0] + ' is not installed', 'text': ''})
+
+
+@unittest.skipUnless(sys.platform == 'linux', 'Linux sysfs symlink fixture')
+class LinuxEvidence(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.r = FixtureReader(self.root)
+        self.usb = self.r.sysfs / 'devices/pci0000:00/usb1/1-2'
+        for name, content in {'idVendor': '1234', 'idProduct': '5678', 'product': 'Synthetic adapter', 'busnum': '1', 'devnum': '2'}.items():
+            self.write(self.usb / name, content)
+        bus = self.r.sysfs / 'bus/usb/devices'
+        bus.mkdir(parents=True)
+        (bus / '1-2').symlink_to(self.usb, target_is_directory=True)
+        (self.r.sysfs / 'class/net').mkdir(parents=True)
+        (self.r.sysfs / 'class/rfkill').mkdir(parents=True)
+        self.r.proc.mkdir(parents=True)
+        self.write(self.r.dev / 'bus/usb/001/002', '')
+
+    def write(self, path, text):
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text)
+
+    def nic(self, name='wlan0', index=0, driver=True):
+        device = self.usb / f'1-2:1.{index}'
+        device.mkdir(parents=True, exist_ok=True)
+        net = self.r.sysfs / 'class/net' / name
+        net.mkdir()
+        (net / 'device').symlink_to(device, target_is_directory=True)
+        (net / 'wireless').mkdir()
+        self.write(net / 'operstate', 'down')
+        phy = self.r.sysfs / f'devices/ieee80211/phy{index}'
+        phy.mkdir(parents=True)
+        (net / 'phy80211').symlink_to(phy, target_is_directory=True)
+        if driver:
+            binding = self.r.sysfs / 'bus/usb/drivers/synthetic_driver'
+            binding.mkdir(parents=True, exist_ok=True)
+            module = self.r.sysfs / 'module/synthetic_module'
+            module.mkdir(parents=True, exist_ok=True)
+            if not (binding / 'module').exists():
+                (binding / 'module').symlink_to(module, target_is_directory=True)
+            (device / 'driver').symlink_to(binding, target_is_directory=True)
+        return net
+
+    def report(self, device='usb:1-2'):
+        return wd.diagnose(device, reader=self.r, system='linux', local=False)
+
+    def checks(self, report):
+        return {c['id']: c for c in report['checks']}
+
+    def test_inventory_does_not_select_or_execute_commands(self):
+        self.nic()
+        report = self.report(None)
+        self.assertIsNone(report['selected'])
+        self.assertEqual(report['usb'][0]['interfaces'], ['net:wlan0'])
+        self.assertEqual(report['interfaces'][0]['usb'], 'usb:1-2')
+        self.assertIn('Unverified', report['identity'])
+        self.assertEqual(self.r.commands, [])
+
+    def test_nearest_usb_ancestor_wins_over_upstream_hub(self):
+        hub = self.usb.parent / '1-1'
+        hub.mkdir()
+        old = self.usb
+        self.usb = hub / old.name
+        old.rename(self.usb)
+        bus = self.r.sysfs / 'bus/usb/devices'
+        (bus / '1-2').unlink()
+        (bus / '1-2').symlink_to(self.usb, target_is_directory=True)
+        for name, content in {'idVendor': '4321', 'idProduct': '8765', 'busnum': '1', 'devnum': '1'}.items():
+            self.write(hub / name, content)
+        (bus / '1-1').symlink_to(hub, target_is_directory=True)
+        self.nic()
+        report = self.report(None)
+        self.assertEqual(report['interfaces'][0]['usb'], 'usb:1-2')
+        upstream_hub = next(d for d in report['usb'] if d['port'] == '1-1')
+        self.assertEqual(upstream_hub['interfaces'], [])
+
+    def test_unbound_usb_is_selectable_without_guessing_driver(self):
+        report = self.report()
+        checks = self.checks(report)
+        self.assertEqual(checks['binding']['status'], 'unknown')
+        self.assertIn('No wireless interface', checks['binding']['evidence'][0])
+        self.assertEqual(checks['channel']['status'], 'unknown')
+        self.assertNotIn('iw', [a[0] for a in self.r.commands])
+        self.assertIn('1234:5678', json.dumps(report))
+
+    def test_selected_radio_and_all_commands_are_read_only(self):
+        self.nic()
+        for key, value in {'type': 'wlan', 'name': 'phy0', 'soft': '1', 'hard': '0'}.items():
+            self.write(self.r.sysfs / 'class/rfkill/rfkill0' / key, value)
+        for pid, name in enumerate(('NetworkManager', 'iwd', 'wpa_supplicant'), 1):
+            self.write(self.r.proc / str(pid) / 'comm', name)
+        self.r.responses = {
+            'udevadm': dict(status='ok', detail='udevadm completed', text='ID_NET_DRIVER=synthetic_driver\nID_SERIAL=secret_serial\nTAGS=:uaccess:\n'),
+            'iw': dict(status='ok', detail='iw completed', text='channel 5 (5975 MHz)\naddr aa:bb:cc:dd:ee:ff\nssid private\n* 5975 MHz [5] (23.0 dBm)'),
+            'nmcli': dict(status='ok', detail='nmcli completed', text='30 (disconnected)\nyes\nsynthetic_driver\n')}
+        report = self.report('net:wlan0')
+        checks = self.checks(report)
+        self.assertEqual(checks['binding']['status'], 'ok')
+        self.assertIn('module=synthetic_module', checks['binding']['evidence'][0])
+        self.assertEqual(checks['rfkill']['status'], 'warning')
+        self.assertIn('6 GHz', json.dumps(checks['channel']))
+        self.assertIn('coexistence alone is not a conflict', checks['managers']['suggestion'])
+        self.assertIn('Both iwd and wpa_supplicant', checks['managers']['suggestion'])
+        for secret in ('secret_serial', 'aa:bb:cc:dd:ee:ff', 'ssid private'):
+            self.assertNotIn(secret, json.dumps(report))
+        self.assertEqual(self.r.commands, [
+            ['udevadm', 'info', '--query=property', '--path=' + str(self.r.sysfs / 'class/net/wlan0')],
+            ['iw', 'dev', 'wlan0', 'info'], ['iw', 'phy', 'phy0', 'info'],
+            ['nmcli', '-g', 'GENERAL.STATE,GENERAL.NM-MANAGED,GENERAL.DRIVER', 'device', 'show', 'wlan0']])
+
+    def test_unrelated_rfkill_and_missing_tools_are_not_healthy(self):
+        self.nic(driver=False)
+        for key, value in {'type': 'wlan', 'name': 'phy7', 'soft': '1', 'hard': '1'}.items():
+            self.write(self.r.sysfs / 'class/rfkill/rfkill7' / key, value)
+        checks = self.checks(self.report())
+        self.assertEqual(checks['binding']['status'], 'unknown')
+        self.assertEqual(checks['rfkill']['status'], 'unknown')
+        self.assertEqual(checks['permissions']['status'], 'unknown')
+        self.assertEqual(checks['channel']['status'], 'unknown')
+        self.r.responses['iw'] = dict(status='denied', detail='iw exited 1 (permission denied)', text='')
+        self.assertIn('permission denied', json.dumps(self.checks(self.report())['channel']))
+
+    def test_unmanaged_interface_does_not_trigger_a_network_repair(self):
+        self.nic()
+        self.r.responses['nmcli'] = dict(status='ok', detail='nmcli completed', text='10 (unmanaged)\nno\nsynthetic_driver\n')
+        check = self.checks(self.report())['managers']
+        self.assertIn('NetworkManager managed: no', check['evidence'])
+        self.assertIn('unmanaged alone is not a fault', check['suggestion'])
+        self.assertIn('Do not force management on', check['suggestion'])
+
+    def test_multiple_interfaces_require_explicit_interface(self):
+        self.nic()
+        self.nic('wlan1', 1)
+        checks = self.checks(self.report())
+        self.assertIn('interface-selection', checks)
+        self.assertEqual(checks['channel']['status'], 'unknown')
+        self.assertNotIn('iw', [a[0] for a in self.r.commands])
+        self.assertNotIn('interface-selection', self.checks(self.report('net:wlan1')))
+
+    def test_disappeared_or_injected_selector_is_rejected_before_commands(self):
+        for selector in ('net:missing', 'usb:../../etc', 'net:;sudo reboot', '', ['wlan0']):
+            with self.assertRaises(ValueError):
+                self.report(selector)
+        self.assertEqual(self.r.commands, [])
+
+    def test_cli_json_and_exit_contract(self):
+        with patch.object(wd, 'diagnose', return_value=self.report(None)), contextlib.redirect_stdout(io.StringIO()) as out:
+            self.assertEqual(wd.main(['--json']), 0)
+        self.assertEqual(json.loads(out.getvalue())['schema'], 1)
+        with patch.object(wd, 'diagnose', return_value={'supported': False}), contextlib.redirect_stdout(io.StringIO()):
+            self.assertEqual(wd.main(['--json']), 2)
+
+
+class HttpBoundary(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        import server
+        cls.server_module = server
+        # Serve the real handler only: main() would start unrelated headset workers.
+        cls.httpd = server.LoopbackServer(('127.0.0.1', 0), server.Handler)
+        cls.thread = threading.Thread(target=cls.httpd.serve_forever, daemon=True)
+        cls.thread.start()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.httpd.shutdown()
+        cls.httpd.server_close()
+        cls.thread.join()
+
+    def request(self, path, key=True):
+        conn = http.client.HTTPConnection('127.0.0.1', self.httpd.server_address[1], timeout=10)
+        headers = {'X-Frame-UI': self.server_module.UI_KEY} if key else {}
+        conn.request('GET', path, headers=headers)
+        response = conn.getresponse()
+        result = response.status, response.read()
+        conn.close()
+        return result
+
+    def test_auth_and_headset_independence(self):
+        with patch.object(self.server_module, 'ssh', side_effect=AssertionError('no SSH')), \
+                patch.object(self.server_module, 'working', side_effect=AssertionError('no headset lock')), \
+                patch.object(wd, 'diagnose', return_value={'supported': True, 'checks': []}) as probe:
+            self.assertEqual(self.request('/api/wireless-doctor', key=False)[0], 403)
+            probe.assert_not_called()
+            code, data = self.request('/api/wireless-doctor?device=net%3Awlan0')
+            self.assertEqual(code, 200)
+            self.assertTrue(json.loads(data)['supported'])
+            probe.assert_called_once_with('net:wlan0', local=self.server_module.LOCAL)
+
+    def test_local_mode_refuses_before_collection(self):
+        with patch.object(self.server_module, 'LOCAL', True), patch.object(wd, 'Reader', side_effect=AssertionError('no probes')):
+            code, body = self.request('/api/wireless-doctor')
+            self.assertEqual(code, 200)
+            self.assertFalse(json.loads(body)['supported'])
+
+    def test_stale_selection_is_bad_request_and_page_is_packaged(self):
+        with patch.object(wd, 'diagnose', side_effect=ValueError('Device is no longer present')):
+            self.assertEqual(self.request('/api/wireless-doctor?device=net:gone')[0], 400)
+        code, page = self.request('/wireless-doctor')
+        self.assertEqual(code, 200)
+        self.assertIn(b'No checks have run', page)
+        package = json.loads((Path(__file__).resolve().parent.parent / 'app/package.json').read_text())
+        filters = next(r['filter'] for r in package['build']['extraResources'] if r['from'] == '../ui')
+        self.assertIn('*.py', filters)
+        self.assertIn('*.html', filters)
@@ -10,6 +10,8 @@ function connectionFixture() {
    sourceState:{jobs:new Map(),detail:null,detailRequest:0},touches:new Map(),gesture:null,padType:{blur(){},value:''},
    log(){},renderPill(){},renderConnDlg(){},renderHome(){},resetShots(){},resetClips(){},renderBanner(){},loadDevices(){},renderDevices(){},renderTests(){},viaText(){return 'test';},netLabel(){return 'test';},refresh:()=>Promise.resolve(),reloadAll(){},checkContactPrompt(){},ctrlReset(){},padShow:s=>{c.pad.state=s.state;}});
  c.window.connDevice='a';
+  c.document.addEventListener=()=>{};
+  f.run(pick(html,'class DesktopBatteryAlert {','// ---- battery ----'));
  f.run('const UI_KEY="test";'+pick(html,'const HEADSET_FREE =','// What a panel shows'));
  f.run(pick(html,'function onConnection(s) {','// Read the event stream'));
  return f;
@@ -41,8 +43,15 @@ test('a device switch discards completed install results and the open detail',()
  Object.assign(c,{pad:{state:'off',queue:[]},padReset(){},sourceState:{jobs:new Map([['test:one',{done:true,result:{package:'app.on.a',game_data:true}}]]),detail:{app:{}},detailRequest:0}});
  f.el('appDetail').open=true;
  f.el('storageResult').textContent='Old headset storage';
+  f.el('desktopBatteryAlert').checked=true;
+  f.run('desktopBattery.pending={condition:"low",at:0};desktopBattery.latched=true;desktopBattery.lastAlert=42;');
  f.run('onConnection({phase:"connected",device:{id:"b",name:"B"},devices_rev:1,now:0})');
  assert.match(f.el('storageResult').textContent,/Headset changed/);
+  assert.equal(f.el('desktopBatteryAlert').checked,false);
+  assert.equal(f.run('desktopBattery.pending'),null);
+  assert.equal(f.run('desktopBattery.latched'),false);
+  assert.equal(f.run('desktopBattery.lastAlert'),42);
+  assert.match(f.el('desktopBatteryStatus').textContent,/Off.*Headset changed/);
  assert.equal(c.sourceState.jobs.size,0);assert.equal(c.sourceState.detail,null);assert.equal(f.el('appDetail').open,false);
 });
 test('only a preview matching current diagnostics consent can be sent or copied',async()=>{
@@ -0,0 +1,49 @@
+const {test}=require('node:test');
+const assert=require('node:assert/strict');
+const {workspaceFixture,html}=require('./workspace_fixture.cjs');
+function fixture() {
+  const f=workspaceFixture();
+  const start=html.indexOf('// ---- Read-only PC wireless doctor ----');
+  f.run(html.slice(start,html.indexOf('// ---- Read-only game storage ----',start)));
+  return f;
+}
+const sample={state:'partial',observedAt:'2026-10-24T12:00:00Z',sources:{pnp:'ok',wlan:'unavailable'},
+  multipleWifiDirect:true,wifiDirectInstances:['one','two'],overlap:'unknown',devices:[{
+  id:'SWD\\WIFIDIRECT\\<unsafe>',name:'<img onerror=alert(1)>',interface:'<script>bad</script>',
+  wifiDirect:true,identityEvidence:'PnP enumerator',present:false,pnpStatus:'Error',problemCode:22,
+  operational:null,media:null,defaultRoute:null,channel:1,band:null}]};
+test('opening and revisiting the tool never starts a query',()=>{
+  const f=fixture();let calls=0;f.context.api=()=>calls++;
+  f.navigate('#wireless');assert.equal(f.activePage,'tools');
+  assert.equal(f.el('wireless').hidden,false);assert.equal(f.el('wireless').parentNode,f.el('toolWorkspace'));
+  f.navigate('#tools');f.navigate('#wireless');assert.equal(calls,0);
+});
+test('distinct instances, unknown states and privacy limits remain explicit and escaped',()=>{
+  const f=fixture();f.context.sample=sample;const out=f.run('renderWireless(sample)');
+  for(const phrase of ['2 distinct','do not prove','overlap is unknown','Unknown','(disabled)',
+    'English netsh','not the Steam dongle channel','review before sharing','&lt;img','&lt;script','&lt;unsafe&gt;']) assert.ok(out.includes(phrase),phrase);
+  assert.doesNotMatch(out,/<script>|<img/);
+  assert.doesNotMatch(out,/disable.*button|onclick=/);
+  f.context.sample={...sample,overlap:'possible'};
+  assert.match(f.run('renderWireless(sample)'),/spectrum overlap.*possible; interference is unconfirmed/);
+});
+test('click reads once, disables repeated clicks and renders partial inventory',async()=>{
+  const f=fixture();let resolve,calls=0;
+  f.context.api=path=>{assert.equal(path,'/api/host/wireless');calls++;return new Promise(yes=>resolve=yes);};
+  const request=f.el('wirelessRead').onclick();
+  assert.equal(f.el('wirelessRead').disabled,true);assert.match(f.el('wirelessStatus').textContent,/Reading/);
+  resolve(sample);await request;
+  assert.equal(calls,1);assert.equal(f.el('wirelessRead').disabled,false);
+  assert.match(f.el('wirelessResult').innerHTML,/distinct Wi-Fi Direct/);
+  assert.match(f.el('wirelessStatus').textContent,/Partial PC snapshot/);
+});
+test('unsupported, busy and failed probes leave no stale inventory and allow retry',async()=>{
+  for(const result of [{state:'unsupported',message:'Windows only'},{state:'busy',message:'Try again'},new Error('Denied')]) {
+    const f=fixture();f.el('wirelessResult').textContent='stale inventory';
+    f.context.api=async()=>{if(result instanceof Error) throw result; return result;};
+    await f.el('wirelessRead').onclick();
+    assert.equal(f.el('wirelessResult').textContent,'');
+    assert.match(f.el('wirelessStatus').textContent,/Windows only|Try again|Denied/);
+    assert.equal(f.el('wirelessRead').disabled,false);
+  }
+});
@@ -25,7 +25,7 @@ function workspaceFixture() {
  const context={URL,document:{querySelectorAll:s=>s==='.page'?pages:s==='#nav a'?links:controls[s]||[],title:'',body:{addEventListener(k,fn){listeners['body-'+k]=fn;}}},
    window:win,location,scroller:()=>({get scrollTop(){return win.scrollY;},scrollTo:o=>win.scrollTo(o)}),scrollToY:y=>win.scrollTo({top:y}),requestAnimationFrame:fn=>fn(),$:el,live:false,toggleLive(on){this.live=on;calls.push(['live',on]);},
    loadAndroid(){calls.push(['android']);},closeDevPop(){},metaLib:{connected:false},renderMetaApps(){},
-    loadMacView(){calls.push(['macview']);},loadPanelSwitcher(){calls.push(['panels']);},loadDisplays(){calls.push(['displays']);},
+    loadSteamPipewire(){calls.push(['steam-pipewire']);},loadMacView(){calls.push(['macview']);},loadPanelSwitcher(){calls.push(['panels']);},loadDisplays(){calls.push(['displays']);},
    gm:{src:'owned',dl:null,byId:new Map(),shown:0,shownBySource:{owned:0,store:0}},setGameSource(src){context.gm.src=src;},state:null,stateRead:{valid:false},online:null,devGen:0,androidApps:[],jobsRunning:0,viewGen:0,
    esc:s=>String(s??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]))};
  vm.createContext(context);
@@ -30,9 +30,8 @@ ARCHIVE = re.compile(r'^(saves|settings|android)/[A-Za-z0-9._-]{1,200}\.tar\.gz$
 PART = re.compile(r'^(saves:(\d{1,10}|linux)|settings:(steam|system)|android:[A-Za-z][\w]*(\.[A-Za-z_][\w]*)+)$')
 KINDS = ('saves', 'settings', 'android')
 FORMAT = 1
-# The switch Valve's own devkit tools use (frame/devkit-utils/steamos-delete). Nothing else
-# is ever run as a session command.
-SELECTORS = ('holo-session-select', 'steamos-session-select')
+# Fixed SteamOS switches only; never execute a command supplied by remote status.
+SELECTORS = ('steamosctl', 'holo-session-select', 'steamos-session-select')
 REASONS = {
    'not_installed': 'Install the game first, then restore its saves',
    'no_prefix': 'Start the game once so Proton sets up its folders, then restore',
@@ -344,10 +343,10 @@ def session_status():


 def session_command(selector):
-    """The switch to Game Mode, exactly as Valve's devkit tools run it."""
+    """Allow only fixed Game Mode commands, including older devkit selectors."""
    if selector not in SELECTORS:
        raise BackupError('this SteamOS build has no session switch command; use the steps in the guide')
-    return shlex.join([selector, 'gamescope'])
+    return shlex.join([selector, 'switch-to-game-mode' if selector == 'steamosctl' else 'gamescope'])


 def return_to_game_mode(confirmed=False):
@@ -373,15 +373,40 @@ def restore(part, stamp, source):
 # The Frame normally runs gamescope (Game Mode) with Plasma nested inside it as one panel
 # (steamos-nested-desktop). A full Desktop Mode session is SDDM autologin into Plasma
 # instead. Valve's own devkit tools (frame/devkit-utils: steamos-get-status, steamos-delete)
-# read the session from these files and switch with holo-session-select or
-# steamos-session-select, so that's what this reads and suggests.
+# read the login preference from these files. It is not the running session.

 SDDM_CONFS = ('/etc/sddm.conf.d/zz-steamos-autologin.conf', '/etc/sddm.conf.d/steamos.conf')
+SESSION_TARGETS = ('gamescope-session.target', 'plasma-workspace-wayland.target')
+
+
+def _session_target(unit):
+    """Read the main user's manager, not a nested Plasma session bus over SSH."""
+    runtime = '/run/user/%d' % os.getuid()
+    env = dict(os.environ, XDG_RUNTIME_DIR=runtime,
+               DBUS_SESSION_BUS_ADDRESS='unix:path=%s/bus' % runtime)
+    try:
+        result = subprocess.run(['systemctl', '--user', 'show', unit,
+                                 '--property=LoadState', '--property=ActiveState'],
+                                capture_output=True, text=True, timeout=5, env=env)
+    except (OSError, subprocess.TimeoutExpired):
+        return 'unknown'
+    if result.returncode:
+        return 'unknown'
+    properties = dict(line.split('=', 1) for line in result.stdout.splitlines() if '=' in line)
+    if properties.get('LoadState') == 'not-found':
+        return 'not-found'
+    if properties.get('LoadState') == 'loaded':
+        return properties.get('ActiveState', 'unknown')
+    return 'unknown'


 def _running(name, full=False):
+    # This module is sent as `python3 -c <source>`: unanchored pgrep -f would
+    # match the script names inside our own source, even when no script runs.
+    pattern = (r'^([^ ]*/)?((ba|da|z)?sh +([^ ]*/)?)?%s( |$)' % re.escape(name)
+               if full else name)
    try:
-        return subprocess.call(['pgrep', '-f' if full else '-x', name], stdout=subprocess.DEVNULL,
+        return subprocess.call(['pgrep', '-f' if full else '-x', pattern], stdout=subprocess.DEVNULL,
                               stderr=subprocess.DEVNULL) == 0
    except OSError:
        return False
@@ -397,21 +422,33 @@ def session():
        m = re.search(r'^\s*Session\s*=\s*(\S+)', text, re.M)
        conf, configured = path, (m.group(1) if m else None)
        break
-    selector = next((s for s in ('holo-session-select', 'steamos-session-select') if shutil.which(s)), None)
+    selector = next((s for s in ('steamosctl', 'holo-session-select', 'steamos-session-select') if shutil.which(s)), None)
    # On the Frame gamescope's process is named gamescope-wl (seen on build 20261015.6141207),
    # under the start-gamescope-session script.
    gamescope = (_running('gamescope') or _running('gamescope-wl') or
                 _running('start-gamescope-session', full=True))
    plasma = _running('plasmashell')
-    nested = _running('steamos-nested-desktop', full=True)  # a script: its process name is the shell's
-    if gamescope:
+    nested = (_running('holo-nested-desktop', full=True) or
+              _running('steamos-nested-desktop', full=True))  # scripts: process name is the shell's
+    targets = {unit: _session_target(unit) for unit in SESSION_TARGETS}
+    game, desktop = (targets[unit] for unit in SESSION_TARGETS)
+    mode = 'unknown'
+    source = 'session-targets'
+    if (game, desktop) == ('active', 'inactive'):
        mode = 'game'
-    elif plasma or (configured and 'plasma' in configured):
+    elif (game, desktop) == ('inactive', 'active'):
        mode = 'desktop'
-    else:
-        mode = 'unknown'
+    elif game == desktop == 'not-found':
+        # Older images have neither target. A compositor plus Plasma is ambiguous:
+        # Desktop Mode's steamvr-plasma.service also runs gamescope and nested scripts.
+        source = 'legacy-processes'
+        if gamescope and not plasma and not nested:
+            mode = 'game'
+        elif plasma and not gamescope and not nested:
+            mode = 'desktop'
    return {'mode': mode, 'gamescope': gamescope, 'plasma': plasma, 'nested_desktop': nested,
-            'configured': configured, 'config_file': conf, 'selector': selector}
+            'configured': configured, 'config_file': conf, 'selector': selector,
+            'session_targets': targets, 'mode_source': source}


 def main(argv):
@@ -249,7 +249,10 @@ def pick_host(arg):
    if arg and not HOST_RE.fullmatch(arg):
        say(f"  - {arg!r} isn't a host name or IP address")
        return None
-    for cand in [arg] if arg else [f"{FRAME_ALIAS}.local", FRAME_ALIAS]:
+    candidates = [arg] if arg else list(dict.fromkeys([configured_host(), f"{FRAME_ALIAS}.local", FRAME_ALIAS]))
+    for cand in candidates:
+        if not cand:
+            continue
        host, port = split_port(cand)
        if reachable(host, port):
            return host, port
@@ -374,6 +377,20 @@ def configured_user():
    return None


+def configured_host():
+    """Reuse the last configured route before trying a deprecated .local name."""
+    if not CONFIG.exists():
+        return None
+    inside = False
+    for line in CONFIG.read_text(encoding="utf-8").splitlines():
+        if line in (BEGIN, END):
+            inside = line == BEGIN
+        elif inside and line.startswith("  HostName "):
+            host = line[11:].strip()
+            return host if HOST_RE.fullmatch(host) else None
+    return None
+
+
 def pair_with_devkit(host, port, user):
    """Try devkit pairing and confirm key login. -> (user, None) or (user, reason to fall back)."""
    say("==> Pairing through the headset's SteamOS devkit service (no password)")
@@ -424,6 +441,7 @@ def main(argv):
    found = pick_host(argv[0] if argv else None)
    while not found:
        say("Could not reach the Frame over SSH.")
+        say("SteamOS 0.5.6 stopped publishing .local names; use the IP shown in Quick Settings.")
        say("Check: Developer Mode on and a user password set; same network; no client isolation.")
        try:
            typed = input("Type the Frame's IP address (Quick Settings shows it), or press Enter to quit: ").strip()
@@ -599,6 +599,11 @@ class Registry:
            for a in d["addresses"]:
                a.setdefault("networks", [])
                a.setdefault("label", "")
+                # Old or hand-edited registries must not turn a cached route into an
+                # arbitrary hostname or an SSH option. Only a numeric address is used.
+                if not frame_network.valid_ip(a.get("last_ip", "")):
+                    a.pop("last_ip", None)
+                    a.pop("last_ip_network", None)
            if d.get("identity") or any(a.get("last_ok") for a in d["addresses"]):
                # Files from before the flag existed: it had an identity (or a connection that
                # worked, which saved one). Kept from now on, whatever happens to its addresses.
@@ -774,6 +779,8 @@ class Registry:
            label = None if label is None else check_text(label, "label")
            if moved:
                a.update(host=new_host, networks=[], last_ok=None, last_rtt_ms=None)  # a new place: learn again
+                a.pop("last_ip", None)
+                a.pop("last_ip_network", None)
            if kind is not None:
                a["kind"] = kind
            if label is not None:
@@ -796,7 +803,7 @@ class Registry:
            d["addresses"].insert(j, d["addresses"].pop(i))
            self.save()

-    def record_success(self, device_id, host, network_id, rtt_ms):
+    def record_success(self, device_id, host, network_id, rtt_ms, ip=None):
        """Learn: this address worked on this network."""
        with self._changing():
            try:
@@ -807,6 +814,9 @@ class Registry:
                a["networks"] = (a["networks"] + [network_id])[-16:]
            a["last_ok"] = time.time()
            a["last_rtt_ms"] = rtt_ms
+            if ip and frame_network.valid_ip(ip) and network_id:
+                a["last_ip"] = ip
+                a["last_ip_network"] = network_id
            self._find(device_id)["identity_established"] = True  # survives editing the address away
            self.save()

@@ -26,6 +26,7 @@ when the page asks.
 Python stdlib only. Runs on this computer, never on the Frame.
 """
 from bisect import bisect_right
+from concurrent.futures import ThreadPoolExecutor, as_completed
 import copy
 import hashlib
 import ipaddress
@@ -169,6 +170,18 @@ def probe(host, port, timeout=PROBE_TIMEOUT, update=None):
    return last or {"state": "timeout", "detail": "No answer"}


+def probe_address(address, port, network_id, update=None):
+    """Try a saved mDNS address, then its last authenticated IP on this network."""
+    res = probe(address["host"], port, update=update)
+    cached = address.get("last_ip") if address.get("last_ip_network") == network_id else None
+    if (address["kind"] == "mdns" and cached and frame_network.valid_ip(cached) and
+            res["state"] in ("unresolved", "timeout", "unreachable")):
+        fallback = probe(cached, port)
+        if fallback["state"] == "answered":
+            return dict(fallback, detail="Last known IP answered (mDNS unavailable)")
+    return res
+
+
 def _ip_kind(text):
    """ipv4, ipv6, ipv6 link-local or tailscale for an IP address (zone allowed), else None."""
    try:
@@ -1049,7 +1062,8 @@ class Link:
        attempt_no = self.state["attempt"]

        def run_probe(i, host):
-            res = probe(host, port, update=lambda **f: self.probe_update(i, attempt_no, **f))
+            res = probe_address(ranked[i][0], port, net.get("id"),
+                                update=lambda **f: self.probe_update(i, attempt_no, **f))
            res.setdefault("ip", None)
            res.setdefault("rtt_ms", None)
            self.probe_update(i, attempt_no, **{k: res[k] for k in ("state", "detail", "ip", "rtt_ms")})
@@ -1080,7 +1094,7 @@ class Link:
                       "rtt_ms": results[pick]["rtt_ms"], "why": ranked[pick][1], "network": net.get("id"),
                       "network_name": net["name"]}
                self.publish(via=via)
-                self.learn(device, a["host"], net, results[pick]["rtt_ms"])
+                self.learn(device, a["host"], net, results[pick]["rtt_ms"], results[pick]["ip"])
                return True
            with self.cond:
                why_not = failure_detail(self.state["error"])
@@ -1135,10 +1149,10 @@ class Link:
                else:
                    done.wait(min(0.5, max(0.01, deadline - time.monotonic())))

-    def learn(self, device, host, net, rtt):
+    def learn(self, device, host, net, rtt, ip=None):
        if device.get("transient"):
            return
-        self.reg.record_success(device["id"], host, net.get("id"), rtt)
+        self.reg.record_success(device["id"], host, net.get("id"), rtt, ip=ip)
        self.reg.record_identity(device["id"], [f for _, f in frame_devices.pinned_keys(device["id"])])
        # Set Up Connection may have changed the block while this attempt ran: take that
        # in (and reconnect) rather than writing this attempt's older settings over it.
@@ -1858,8 +1872,32 @@ def tailscale_find(link, device_id=None):
    return {"up": True, "peers": peers, "tailnet": ts.get("tailnet"), "message": None}


+def matches_pinned_key(host, port, saved):
+    """Only suggest a scanned SSH host when its key matches this headset's pin."""
+    if not saved or not frame_network.valid_ip(host):
+        return False
+    keyscan = frame_host.which("ssh-keyscan")
+    if not keyscan:
+        return False
+    try:
+        reply = frame_host.run_ssh([keyscan, "-T", "2", "-p", str(port), host],
+                                   capture_output=True, text=True, stdin=subprocess.DEVNULL, timeout=4)
+    except (OSError, subprocess.TimeoutExpired):
+        return False
+    pins = set(saved)
+    for line in reply.stdout.splitlines():
+        fields = line.split()
+        if len(fields) >= 3 and (fields[1], frame_devices.fingerprint(fields[2])) in pins:
+            return True
+    return False
+
+
 def mdns_find(link, device_id=None):
-    """Headsets on this network: SteamOS devkit services (mDNS) and <alias>.local."""
+    """Find nearby SSH endpoints using mDNS, a remembered IP and a bounded /24 scan.
+
+    Finding an SSH port does not identify a headset. Adding an address still uses
+    the normal pinned SSH identity check before any command is run on it.
+    """
    device = link.reg.get(device_id) if device_id else link.active_device()
    known = {a["host"].rstrip(".").lower() for a in device.get("addresses") or []}
    try:
@@ -1867,11 +1905,15 @@ def mdns_find(link, device_id=None):
        found = frame_connect.discover_devkit()
    except (ImportError, SystemExit, OSError):
        found = []
-    names = list(dict.fromkeys([h.rstrip(".") for h in found] + [f"{device['alias']}.local", "frame.local"]))
+    cached = [a["last_ip"] for a in device.get("addresses", []) if a.get("kind") == "mdns" and a.get("last_ip") and
+              a.get("last_ip_network") == (link.state.get("network") or {}).get("id")]
+    names = list(dict.fromkeys([h.rstrip(".") for h in found] + cached +
+                               [f"{device['alias']}.local", "frame.local"]))
    rows = [None] * len(names)
+    port = device.get("port") or 22

    def check(i, host):
-        res = probe(host, 22, timeout=3)
+        res = probe(host, port, timeout=3)
        rows[i] = {"host": host, "state": res["state"], "ip": res.get("ip"), "rtt_ms": res.get("rtt_ms"),
                   "detail": res["detail"], "advertised": host in [h.rstrip(".") for h in found],
                   "added": host.lower() in known or (res.get("ip") or "").lower() in known}
@@ -1882,4 +1924,31 @@ def mdns_find(link, device_id=None):
    for t in threads:
        t.join(8)
    hosts = [r for r in rows if r and (r["advertised"] or r["state"] in ("answered", "refused"))]
-    return {"hosts": hosts, "tool": bool(frame_host.which("dns-sd") or frame_host.which("avahi-browse"))}
+    network = link.state.get("network") or {}
+    local = network.get("local_ip") or frame_network.local_ip()
+    candidates = frame_network.local_scan_candidates(local, network.get("gateway"), frame_network.neighbour_cache())
+    candidates = [ip for ip in candidates if ip not in names]
+    saved = frame_devices.pinned_keys(device["id"]) if device.get("id") else []
+    # A random SSH service on the subnet is not a Frame. With no existing pin,
+    # use explicit IP entry; do not offer unverified scan results for pairing.
+    if not saved:
+        candidates = []
+    if candidates:
+        def scan(ip):
+            res = probe(ip, port, timeout=0.3)
+            return res if res["state"] == "answered" and matches_pinned_key(ip, port, saved) else None
+
+        with ThreadPoolExecutor(max_workers=24) as pool:
+            futures = {pool.submit(scan, ip): ip for ip in candidates}
+            for future in as_completed(futures):
+                ip = futures[future]
+                try:
+                    res = future.result()
+                except OSError:
+                    continue
+                if res:
+                    hosts.append({"host": ip, "state": "answered", "ip": ip,
+                                  "rtt_ms": res.get("rtt_ms"), "detail": "Matches this headset's saved SSH identity",
+                                  "advertised": False, "added": ip.lower() in known})
+    return {"hosts": hosts, "tool": bool(frame_host.which("dns-sd") or frame_host.which("avahi-browse")),
+            "scanned": len(candidates), "scan_requires_pin": not bool(saved)}
@@ -88,12 +88,14 @@ class Overlay:
    def close(self):
        # Best effort: SteamVR removes a disconnected client's overlays anyway,
        # and a teardown error must not overwrite a finished playback's status.
-        for h in reversed(self.handles):
-            try:
-                self.call('DestroyOverlay', h)
-            except RuntimeError:
-                pass
-        self.vr.VR_ShutdownInternal()
+        try:
+            for h in reversed(self.handles):
+                try:
+                    self.call('DestroyOverlay', h)
+                except Exception:  # signals are already ignored here, so Stop isn't lost
+                    pass
+        finally:
+            self.vr.VR_ShutdownInternal()


 def probe(path):
@@ -183,6 +185,9 @@ def play(args):
            except OverlayBusy:
                pending.insert(0, item)
                return
+            except RuntimeError as e:
+                # Only the cosmetic surround is queued here.
+                print('Theatre surround unavailable: %s' % e, flush=True)

    def hold(handle, data, w, h):
        """Keep a still (photo or splat) up until Stop, retrying through standby."""
@@ -203,10 +208,14 @@ def play(args):
    try:
        vr = Overlay()
        if args.theatre:
-            surround = vr.create('framecontrol.media.surround', 40, 4, order=0)
-            vr.call('SetOverlayAlpha', surround, .85)
-            if not show(surround, b'\x00\x00\x00\xff', 1, 1):
-                pending.append((surround, b'\x00\x00\x00\xff', 1, 1))
+            try:
+                surround = vr.create('framecontrol.media.surround', 40, 4, order=0)
+                vr.call('SetOverlayAlpha', surround, .85)
+                if not show(surround, b'\x00\x00\x00\xff', 1, 1):
+                    pending.append((surround, b'\x00\x00\x00\xff', 1, 1))
+            except RuntimeError as e:
+                # Cosmetic: play without the dark surround rather than not at all.
+                print('Theatre surround unavailable: %s' % e, flush=True)
        screen = vr.create('framecontrol.media.screen', 3 if args.theatre else 1.6, 2,
                           plan['layout'] != 'mono', aspect)
        if splat:
@@ -240,6 +240,42 @@ def local_ip(towards="192.0.2.1"):
        return None


+def parse_neighbours(text, local, gateway=None):
+    """Numeric IPv4 neighbours on this host's /24, excluding itself and its router.
+
+    Accepts Linux `ip neigh`, macOS `arp -an` and Windows `arp -a`. The active
+    search uses the same /24; the cache just puts recently seen peers first.
+    """
+    if not valid_ip(local):
+        return []
+    subnet = ipaddress.ip_network(local + "/24", strict=False)
+    found = []
+    for match in re.finditer(r"(?<![\d.])(?:\d{1,3}\.){3}\d{1,3}(?![\d.])", text):
+        ip = match.group()
+        if valid_ip(ip) and ipaddress.ip_address(ip) in subnet and ip not in (local, gateway) and ip not in found:
+            found.append(ip)
+    return found
+
+
+def local_scan_candidates(local=None, gateway_ip=None, neighbours=""):
+    """Bounded IPv4 search order for an explicit Find action; never scan a WAN."""
+    local = local or local_ip()
+    if (not valid_ip(local) or not ipaddress.ip_address(local).is_private or
+            ipaddress.ip_address(local).is_loopback or is_tailscale(local)):
+        return []
+    subnet = ipaddress.ip_network(local + "/24", strict=False)
+    recent = parse_neighbours(neighbours, local, gateway_ip)
+    return recent + [str(ip) for ip in subnet.hosts() if str(ip) not in recent and str(ip) not in (local, gateway_ip)]
+
+
+def neighbour_cache():
+    if frame_host.MAC:
+        return run(["arp", "-an"])
+    if frame_host.WINDOWS:
+        return run(["arp", "-a"])
+    return run(["ip", "-4", "neigh", "show"])
+
+
 def gateway():
    """(gateway IP, interface) of the default route."""
    if frame_host.MAC:
@@ -0,0 +1,111 @@
+"""One desktop observation using the read-only sampler; reports stay in memory."""
+import json
+from pathlib import Path
+import sys
+import threading
+import time
+import uuid
+
+# Shared with the source-checkout CLI; shipped as explicit desktop resources.
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'scripts'))
+try:
+    import frame_power_sample as sampler
+    from frame_power_report import render
+except ModuleNotFoundError as exc:
+    # Phone/headset bundles host the same UI without desktop-only resources.
+    if exc.name not in ('frame_power_sample', 'frame_power_report'):
+        raise
+    sampler = render = None
+
+PRESETS = {'minute': (12, 5), 'five-minutes': (60, 5)}
+
+
+class Observation:
+    def __init__(self):
+        self.lock = threading.RLock()
+        self.report = None
+        self.running = False
+        self.thread = None
+        self.cancel = None
+        self.reason = None
+        self.id = None
+        self.started = None
+
+    def status(self):
+        with self.lock:
+            return {'id': self.id, 'running': self.running, 'received': len(self.report['samples']) if self.report else 0,
+                    'requested': self.report['requestedSamples'] if self.report else 0,
+                    'headset': self.report['headset'] if self.report else None,
+                    'started': self.started, 'stopped': self.report['stopped'] if self.report else None}
+
+    def start(self, preset, route, headset):
+        if sampler is None:
+            raise ValueError('Desktop power-report resources are missing; reinstall the desktop app')
+        if preset not in PRESETS:
+            raise ValueError('Choose a one-minute or five-minute observation')
+        with self.lock:
+            if self.running:
+                raise ValueError('An observation is already running')
+            if sampler.LOCK.exists():
+                raise ValueError('Smoke session active (/tmp/frame-test.lock); observation not started')
+            count, interval = PRESETS[preset]
+            self.id = uuid.uuid4().hex
+            self.cancel = threading.Event()
+            self.reason = None
+            self.started = time.time()
+            self.report = {'schemaVersion': 1, 'requestedSamples': count, 'intervalSeconds': interval,
+                           'headset': headset, 'stopped': 'Observation in progress; received samples only',
+                           'samples': [], 'summary': {}}
+            self.running = True
+            # Pin the route before the caller releases the server's route lock.
+            command = [*route[:-1], '-T', '-o', 'StrictHostKeyChecking=yes',
+                       '-o', 'ServerAliveInterval=5', '-o', 'ServerAliveCountMax=2', route[-1],
+                       'python3', '-', '--probe', '--count', str(count), '--interval', str(interval)]
+            self.thread = threading.Thread(target=self._collect, args=(command, count, interval), daemon=True)
+            self.thread.start()
+            return self.status()
+
+    def _collect(self, command, count, interval):
+        def received(sample):
+            with self.lock:
+                self.report['samples'].append(sample)
+        try:
+            result = sampler.stream_report(command, sampler.remote_payload(), count, interval,
+                                           self.cancel, received, discard_errors=True)
+            with self.lock:
+                result['headset'] = self.report['headset']
+                result['stopped'] = self.reason or result['stopped']
+                self.report = result
+        except Exception as exc:
+            with self.lock:
+                self.report['stopped'] = self.reason or f'Observation interrupted: {exc}'
+        finally:
+            with self.lock:
+                self.running = False
+
+    def stop(self, reason='Stopped by user; received samples retained'):
+        with self.lock:
+            if self.running:
+                self.reason = reason
+                self.report['stopped'] = reason
+                self.cancel.set()
+            return self.status()
+
+    def export(self, observation_id, format):
+        if format not in ('html', 'json', 'csv'):
+            raise ValueError('Unknown report format')
+        with self.lock:
+            if not self.report or observation_id != self.id:
+                raise ValueError('This report was replaced; refresh the observation')
+            # Independent snapshot, including samples already received while running.
+            report = json.loads(json.dumps(self.report, allow_nan=False))
+        report['summary'] = sampler.summarize(report['samples'])
+        if format == 'json':
+            return json.dumps(report, allow_nan=False, indent=2), 'application/json'
+        csv = sampler.csv_samples(report)
+        return (render(report, csv), 'text/html; charset=utf-8') if format == 'html' else (csv, 'text/csv; charset=utf-8')
+
+    def shutdown(self):
+        self.stop('App closed; received samples retained')
+        if self.thread:
+            self.thread.join(timeout=8)
@@ -0,0 +1,147 @@
+"""Local Linux helper for Steam's own desktop sharing; never a Frame client.
+
+No portal grants/tokens are read or written. KDE owns the manual Revoke UI.
+"""
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import threading
+
+MODULE = 'kcm_app-permissions'
+GUIDANCE = (
+    'In KDE System Settings > Applications > Application Permissions, find the Steam entry '
+    '(reported as Steam Linux Runtime 3.0). Under Screen sharing, choose Manage 1 Session '
+    '(the count may differ), verify it belongs to Steam, then Revoke only that session. '
+    'Do not use Revoke All or change another app. Retry Steam desktop sharing to choose a screen. '
+    'If the entry is missing or ambiguous, stop; it can appear intermittently. '
+    'If Application Permissions is missing on Ubuntu/Kubuntu, check whether your distribution '
+    'provides kde-config-flatpak; the reporter needed that package and a reboot. '
+    'Frame Control does not install packages or change permissions.'
+)
+_lock = threading.Lock()
+_launch = None
+
+
+class HelperError(RuntimeError):
+    pass
+
+
+def unavailable():
+    if sys.platform != 'linux' or os.environ.get('FRAME_LOCAL') == '1':
+        return 'This helper runs on your Linux PC, not the headset.'
+    if os.geteuid() == 0:
+        return 'Open Frame Control as your normal desktop user, not root.'
+    if Path('/.flatpak-info').exists():
+        return 'This sandbox cannot verify host Steam processes. Use a terminal on your PC.'
+    if os.environ.get('SSH_CONNECTION') or os.environ.get('SSH_CLIENT'):
+        return 'Open Frame Control in your local Wayland desktop session, not over SSH.'
+    if (os.environ.get('XDG_SESSION_TYPE', '').lower() != 'wayland'
+            or not os.environ.get('WAYLAND_DISPLAY') or not os.environ.get('DBUS_SESSION_BUS_ADDRESS')):
+        return 'A local Wayland desktop with its session bus is required. X11 and headless sessions are unsupported.'
+    return ''
+
+
+def status():
+    reason = unavailable()
+    return {'available': not reason, 'reason': reason, 'guidance': GUIDANCE}
+
+
+def _steam_running(proc=Path('/proc')):
+    """Fail closed if our process inventory cannot be read. No command execution.
+
+    Include launch scripts and Flatpak Steam, not just the final Steam binary.
+    Other users' processes are irrelevant to this user's Steam instance.
+    """
+    try:
+        entries = list(proc.iterdir())
+        if not any(p.name.isdecimal() for p in entries):
+            raise OSError('empty process inventory')
+        for p in entries:
+            if not p.name.isdecimal():
+                continue
+            try:
+                if p.stat().st_uid != os.geteuid():
+                    continue
+                comm = (p / 'comm').read_text().strip().lower()
+                args = (p / 'cmdline').read_bytes().decode('utf-8', 'replace').split('\0')
+            except FileNotFoundError:
+                continue  # a process exited while scanning
+            names = {Path(a).name.lower() for a in args if a}
+            if (comm in {'steam', 'steamwebhelper', 'steam.sh'}
+                    or names.intersection({'steam', 'steam.sh', 'steamwebhelper', 'com.valvesoftware.steam'})):
+                return True
+        return False
+    except OSError as exc:
+        raise HelperError('Cannot verify whether Steam is running. Exit Steam and launch '
+                          'steam -pipewire yourself from a local terminal.') from exc
+
+
+def _spawn(argv):
+    try:
+        return subprocess.Popen(argv, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                stderr=subprocess.DEVNULL, start_new_session=True)
+    except OSError as exc:
+        raise HelperError('Could not start the local application. Check it is installed and opens '
+                          'from your desktop. No permission was changed.') from exc
+
+
+def _check_start(child):
+    try:
+        code = child.wait(timeout=1)
+    except subprocess.TimeoutExpired:
+        return
+    if code:
+        raise HelperError('The local application exited with an error. Try opening it from your '
+                          'desktop to see its error. No permission was changed.')
+
+
+def action(body):
+    global _launch
+    kind = body.get('action')
+    if kind not in ('launch', 'permissions'):
+        raise HelperError('Unknown Steam helper action.')
+    if body.get('confirmed') is not True:
+        raise HelperError('Use the Steam helper button to request this action explicitly.')
+    reason = unavailable()
+    if reason:
+        raise HelperError(reason)
+    with _lock:
+        if kind == 'launch':
+            if (_launch is not None and _launch.poll() is None) or _steam_running():
+                raise HelperError('Steam is already running or starting. Exit Steam using Steam > Exit '
+                                  '(after saving games), then click Launch Steam with PipeWire again. '
+                                  'Frame Control will not stop it or change an existing session.')
+            steam = shutil.which('steam')
+            if not steam:
+                raise HelperError('No steam launcher was found on PATH. For a Flatpak-only install, '
+                                  'exit Steam and run flatpak run com.valvesoftware.Steam -pipewire '
+                                  'yourself from a local terminal. Nothing was launched.')
+            _launch = _spawn([steam, '-pipewire'])
+            _check_start(_launch)
+            return {'launched': True, 'message': 'Requested Steam with -pipewire for this launch only. '
+                    'Use Steam\'s desktop-in-headset flow; Steam and your desktop portal control the picker. '
+                    'This does not confirm screen sharing started.'}
+
+        # There is no portable verified mapping from Steam's runtime display name
+        # to a portal restore token. Never guess an app ID or delete a grant.
+        desktop = os.environ.get('XDG_CURRENT_DESKTOP', '').upper().split(':')
+        kcm = shutil.which('kcmshell6') if 'KDE' in desktop else None
+        if not kcm:
+            return {'reset': False, 'opened': False, 'message': 'No permission was changed. '
+                    'KDE Application Permissions could not be opened automatically. ' + GUIDANCE}
+        try:
+            listing = subprocess.run([kcm, '--list'], capture_output=True, text=True, timeout=5,
+                                     stdin=subprocess.DEVNULL)
+        except (OSError, subprocess.TimeoutExpired):
+            listing = None
+        if (listing is None or listing.returncode
+                or not re.search(r'^\s*' + re.escape(MODULE) + r'\s+-', listing.stdout, re.M)):
+            return {'reset': False, 'opened': False, 'message': 'No permission was changed. '
+                    'The KDE Application Permissions module is unavailable. ' + GUIDANCE}
+        child = _spawn([kcm, MODULE])
+        _check_start(child)
+        return {'reset': False, 'opened': True, 'message': 'Requested KDE Application Permissions. '
+                'No permission was changed by Frame Control. ' + GUIDANCE}
@@ -31,6 +31,14 @@ GAMES = 'devkit-game'                     # ditto; steamos-prepare-upload makes
 STAMP = '.frame-control-stamp'
 PY = 'python3 ~/' + UTILS + '/'

+
+def devkit_script(name, args=''):
+    """Prefer Valve's holo name when a newer devkit ships it; use our vendored copy otherwise."""
+    if name not in ('prepare-upload', 'delete'):
+        raise ValueError('unknown devkit script')
+    return (f'if [ -f ~/{UTILS}/holo-{name} ]; then {PY}holo-{name} {args}; '
+            f'else {PY}steamos-{name} {args}; fi')
+
 # Valve's reserved sideload names: uploading one of these replaces the Steam client itself.
 # devkit-steam is the trampoline file that switches SteamOS to a sideloaded client
 # (select_steam.sh); a folder there breaks Valve's devkit tools.
@@ -675,7 +683,7 @@ def _install(plan, step, artwork=None):
    ensure_utils()
    existed = ssh(f'test -d {GAMES}/{gid} && echo yes || true', timeout=30).strip() == 'yes'
    step('Preparing the title folder', 0.05)
-    ready = _json_out(ssh(f'{PY}steamos-prepare-upload --gameid {gid}', timeout=60), 'steamos-prepare-upload')
+    ready = _json_out(ssh(devkit_script('prepare-upload', f'--gameid {gid}'), timeout=60), 'steamos-prepare-upload')
    directory = str(ready.get('directory') or '')
    if not DIR_RE.match(directory) or not directory.endswith(f'/{GAMES}/{gid}'):
        raise FrameError(f'steamos-prepare-upload returned an unexpected folder {directory!r}')
@@ -726,7 +734,7 @@ def _install(plan, step, artwork=None):
                if shortcut:
                    frame_android.shortcut_tool('remove', str(shortcut))
                else:
-                    ssh(f'{PY}steamos-delete --delete-title {gid}', timeout=120)
+                    ssh(devkit_script('delete', f'--delete-title {gid}'), timeout=120)
            except FrameError:
                pass
            registered = False
@@ -896,7 +904,7 @@ def remove(gid):
            shortcut = None
        # steamos-delete removes the folder, the shortcut and its Proton prefix (found through the
        # shortcut), so it runs first; its json files stay, so clear them too.
-        ssh(f'{PY}steamos-delete --delete-title {gid}', timeout=120)
+        ssh(devkit_script('delete', f'--delete-title {gid}'), timeout=120)
        ssh(f'rm -f {_json_files(gid)}', timeout=30)
        # Then tidy what it leaves (artwork, collections); best effort.
        if shortcut:
@@ -271,12 +271,13 @@ def panels(limit=None):
        out["why"] = ("The headset took too long to list its panels (its X tools didn't answer in time). "
                      + ("Some may be missing. " if found else "") + "Try again, or use the Headset view.")
    elif not found:
-        out["why"] = why_none(unfound)
+        out["why"] = why_none(unfound, props)
    return out


 # The headset's Linux desktop, by process name (docs/how-the-frame-works.md).
-DESKTOP = ("plasmashell", "kwin_wayland", "kwin_wayland_wrapper", "steamos-nested-desktop", "startplasma-wayland")
+DESKTOP = ("plasmashell", "kwin_wayland", "kwin_wayland_wrapper", "holo-nested-desktop",
+           "steamos-nested-desktop", "startplasma-wayland")


 def desktop_running():
@@ -295,13 +296,18 @@ def desktop_running():
    return False


-def why_none(listed):
+def why_none(listed, props):
    """Why panels() found nothing, in words the person at the computer can act on.
-    listed: how many of the windows gamescope lists aren't X11 windows on any display."""
+    listed: how many of the windows gamescope lists aren't X11 windows on any display.
+    props: the root properties actually read; an absent list is not an empty list."""
    missing = [tool for tool in ("xprop", "xwininfo") if not shutil.which(tool)]
    if missing:
        return (f"This SteamOS build has no {' or '.join(missing)}, which Frame Control uses to find the "
                "headset's panels. Use the Headset view instead, and please report your SteamOS version.")
+    if "GAMESCOPE_FOCUSABLE_WINDOWS" not in props:
+        return ("Frame Control couldn't read gamescope's panel list, so it can't tell whether an app panel is open. "
+                "Check that SteamVR is running in the headset, then try again or use the Headset view. "
+                "If this persists, report your SteamOS version and this exact message.")
    if listed:
        # gamescope lists windows, but none is an X11 window on any display: a Wayland
        # window (a desktop drawn straight to gamescope, say) can't be found or captured this way.
@@ -506,8 +512,10 @@ def apply(gs, event, panel):
        say("ready", focus=panel.get("window"), display=panel.get("display"), stale=True)  # the page re-syncs
        STALE[0] = True
        return panel
-    if STALE[0] and not stale:
+    release = event.get("down") is False and ("button" in event or "key" in event)
+    if STALE[0] and not stale and not (release and "window" not in event):
        # Anything that goes through (a trackpad move names no panel) means caught up: stop re-syncing.
+        # A bare release doesn't: the page leaves the panel off releases, so it says nothing about focus.
        STALE[0] = False
        say("ready", focus=(panel or {}).get("window"), display=(panel or {}).get("display"))
    if "fx" in event and panel and panel.get("window"):
@@ -0,0 +1,188 @@
+"""On-demand, read-only Windows PC wireless inventory. Never contacts a headset.
+
+PnP identity is evidence, not permission to disable a device. Multiple Wi-Fi
+Direct instances are normal on some PCs; neither their suffix nor link state
+identifies an unused instance or proves which radio belongs to Steam.
+"""
+import base64
+import json
+import os
+import re
+import subprocess
+import threading
+from datetime import datetime, timezone
+
+import frame_host
+
+TIMEOUT = 20
+_lock = threading.Lock()
+
+# Static queries only. No user values, execution-policy override, elevation,
+# scans, network traffic, or settings changes. Do not return raw netsh output:
+# it can contain SSIDs, MACs and location-permission instructions.
+PROBE = r"""
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
+$r = @{pnp=@(); present=@(); adapters=@(); routes=@(); wlan=''; sources=@{}}
+try {
+  $r.pnp = @(Get-PnpDevice -Class Net | Select-Object InstanceId,FriendlyName,Status,Problem)
+  $r.sources.pnp = 'ok'
+} catch { $r.sources.pnp = 'unavailable' }
+try {
+  $r.present = @(Get-PnpDevice -Class Net -PresentOnly | ForEach-Object { $_.InstanceId })
+  $r.sources.present = 'ok'
+} catch { $r.sources.present = 'unavailable' }
+try {
+  $r.adapters = @(Get-NetAdapter -IncludeHidden | Select-Object PnPDeviceID,Name,InterfaceDescription,
+    InterfaceGuid,ifIndex,InterfaceOperationalStatus,MediaConnectState,NdisPhysicalMedium,HardwareInterface)
+  $r.sources.adapters = 'ok'
+} catch { $r.sources.adapters = 'unavailable' }
+try {
+  $r.routes = @(Get-NetRoute | Where-Object {
+    $_.DestinationPrefix -eq '0.0.0.0/0' -or $_.DestinationPrefix -eq '::/0'
+  } | Select-Object InterfaceIndex)
+  $r.sources.routes = 'ok'
+} catch { $r.sources.routes = 'unavailable' }
+try {
+  $r.wlan = (& "$env:SystemRoot\System32\netsh.exe" wlan show interfaces | Out-String)
+  if ($LASTEXITCODE -eq 0) { $r.sources.wlan = 'ok' } else { $r.sources.wlan = 'unavailable' }
+} catch { $r.sources.wlan = 'unavailable' }
+ConvertTo-Json -InputObject $r -Depth 5 -Compress
+"""
+
+GUID = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", re.I)
+
+
+def guid(value):
+    value = str(value or '').strip()
+    if value.startswith('{') and value.endswith('}'):
+        value = value[1:-1]
+    return value.lower() if GUID.fullmatch(value) else None
+
+
+def number(value):
+    return value if type(value) is int else None
+
+
+def text(value):
+    return value[:2048] if isinstance(value, str) else ''
+
+
+def rows(value):
+    return [r for r in value if isinstance(r, dict)] if isinstance(value, list) else []
+
+
+def parse_wlan(raw):
+    """English netsh labels only; localised/denied/missing fields stay unknown.
+
+    Bind each block by exact GUID, never by friendly name or output order.
+    Channels 1–14 also exist in 6 GHz: never infer band from channel alone.
+    """
+    blocks, block = [], {}
+    for line in raw.splitlines() if isinstance(raw, str) else []:
+        m = re.match(r'^\s*(Name|GUID|State|Channel|Band)\s*:\s*(.*?)\s*$', line)
+        if not m:
+            continue
+        key, value = m.groups()
+        if key == 'Name':
+            if block:
+                blocks.append(block)
+            block = {}
+        block[key] = value
+    if block:
+        blocks.append(block)
+    out = {}
+    for b in blocks:
+        identity = guid(b.get('GUID'))
+        if not identity or identity in out:
+            # Repeated identities cannot be joined reliably.
+            if identity:
+                out[identity] = {'channel': None, 'band': None}
+            continue
+        channel = b.get('Channel', '')
+        channel = int(channel) if re.fullmatch(r'[0-9]{1,3}', channel) else None
+        band = re.fullmatch(r'(2\.4|5|6)\s*GHz', b.get('Band', ''), re.I)
+        connected = b.get('State') == 'connected'
+        out[identity] = {'channel': channel if connected and channel and 1 <= channel <= 233 else None,
+                         'band': band.group(1) if connected and band else None}
+    return out
+
+
+def analyse(data):
+    if not isinstance(data, dict) or not isinstance(data.get('sources'), dict):
+        raise ValueError('Invalid inventory')
+    sources = {k: 'ok' if data['sources'].get(k) == 'ok' else 'unavailable'
+               for k in ('pnp', 'present', 'adapters', 'routes', 'wlan')}
+    present = {p.casefold() for p in (data.get('present') or []) if isinstance(p, str)}
+    adapters = {}
+    for a in rows(data.get('adapters')) if sources['adapters'] == 'ok' else []:
+        key = text(a.get('PnPDeviceID')).casefold()
+        if key:
+            adapters.setdefault(key, []).append(a)
+    routes = {r['InterfaceIndex'] for r in rows(data.get('routes'))
+              if number(r.get('InterfaceIndex')) is not None} if sources['routes'] == 'ok' else set()
+    wlan = parse_wlan(data.get('wlan', '')) if sources['wlan'] == 'ok' else {}
+    devices, seen = [], set()
+    inventory = rows(data.get('pnp')) if sources['pnp'] == 'ok' else []
+    pnp_ids = {text(p.get('InstanceId')).casefold() for p in inventory}
+    # Retain PC interfaces even when PnP inventory is incomplete/unavailable.
+    inventory += [{'InstanceId': matches[0]['PnPDeviceID'],
+                   'FriendlyName': matches[0].get('InterfaceDescription')}
+                  for key, matches in adapters.items() if key not in pnp_ids]
+    for p in inventory:
+        identity = text(p.get('InstanceId'))
+        if not identity or identity.casefold() in seen:
+            continue
+        seen.add(identity.casefold())
+        matches = adapters.get(identity.casefold(), [])
+        a = matches[0] if len(matches) == 1 else {}
+        name = text(p.get('FriendlyName')) or text(a.get('InterfaceDescription')) or 'Unnamed network device'
+        direct_id = identity.upper().startswith('SWD\\WIFIDIRECT\\')
+        direct_name = re.sub(r'\s*#\d+$', '', name).casefold() == 'microsoft wi-fi direct virtual adapter'
+        radio = wlan.get(guid(a.get('InterfaceGuid')), {})
+        devices.append({
+            'id': identity, 'name': name, 'interface': text(a.get('Name')),
+            'wifiDirect': direct_id or direct_name,
+            'identityEvidence': 'PnP enumerator' if direct_id else 'Name only' if direct_name else None,
+            'wifi': number(a.get('NdisPhysicalMedium')) in (1, 9) if number(a.get('NdisPhysicalMedium')) is not None else None,
+            'hardware': a.get('HardwareInterface') if type(a.get('HardwareInterface')) is bool else None,
+            'present': identity.casefold() in present if sources['present'] == 'ok' else None,
+            'pnpStatus': text(p.get('Status')) or None,
+            'problemCode': number(p.get('Problem')),
+            'operational': number(a.get('InterfaceOperationalStatus')),
+            'media': number(a.get('MediaConnectState')),
+            'defaultRoute': a['ifIndex'] in routes if number(a.get('ifIndex')) is not None and sources['routes'] == 'ok' else None,
+            'channel': radio.get('channel'), 'band': radio.get('band'),
+        })
+    direct = [d['id'] for d in devices if d['wifiDirect']]
+    return {'sources': sources, 'devices': devices, 'wifiDirectInstances': direct,
+            'multipleWifiDirect': len(direct) > 1,
+            'overlap': 'possible' if any(d['band'] == '2.4' for d in devices) else 'unknown',
+            'state': 'ok' if all(s == 'ok' for s in sources.values()) else 'partial'}
+
+
+def diagnose():
+    """No cached inventory, automatic retries, UAC or SSH. One bounded probe."""
+    if not frame_host.WINDOWS:
+        return {'state': 'unsupported', 'message': 'Wireless Adapter doctor is available on a Windows PC.'}
+    if not _lock.acquire(blocking=False):
+        return {'state': 'busy', 'message': 'A PC wireless inventory is already running. Try again shortly.'}
+    try:
+        executable = os.path.join(os.environ.get('SystemRoot', r'C:\Windows'),
+                                  'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+        command = base64.b64encode(PROBE.encode('utf-16-le')).decode('ascii')
+        result = subprocess.run([executable, '-NoProfile', '-NonInteractive', '-EncodedCommand', command],
+                                stdin=subprocess.DEVNULL, capture_output=True, timeout=TIMEOUT,
+                                creationflags=getattr(subprocess, 'CREATE_NO_WINDOW', 0))
+        if result.returncode or len(result.stdout) > 1_000_000:
+            raise ValueError('Probe failed')
+        report = analyse(json.loads(result.stdout.decode('utf-8-sig')))
+        report['observedAt'] = datetime.now(timezone.utc).isoformat()
+        return report
+    except subprocess.TimeoutExpired:
+        return {'state': 'unavailable', 'message': 'Windows wireless inventory timed out. No settings were changed.'}
+    except (OSError, ValueError, TypeError):
+        return {'state': 'unavailable', 'message': 'Windows wireless inventory could not be read. No settings were changed.'}
+    finally:
+        _lock.release()
Author	SHA1	Message	Date
Alex SouthwellandSAPHID	ae63fa584c	Add read-only Windows Wireless Adapter doctor (#166 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:44:24 +00:00
Alex SouthwellandSAPHID	337ac99b3e	Add a read-only Linux Wireless Adapter doctor (#165 ) * Add read-only Linux PC Wireless Adapter doctor * Cross-reference coordinated SteamOS compatibility notes --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:30:08 +00:00
Alex SouthwellandSAPHID	aada257325	Handle Frame OS 0.5.6 discovery and SteamOS name changes (#164 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:24:04 +00:00
Alex SouthwellandSAPHID	8bc3d63126	Add local Linux helper for Steam PipeWire desktop sharing (#163 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:18:08 +00:00
Alex SouthwellandSAPHID	c690e691a3	Bump Frame Control to 0.4.19 (#162 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:04:30 +00:00
Alex Southwell Claude Sonnet 5.5 SAPHID	e3fcd3eef8	Use gamescope input for Frame trackpad and keyboard (#66 ) * Live view: a Desktop view that stays still, and Control to tap on the Frame The live view gets a second source and a way to use the Frame from it: - Desktop: the app panel in use in the headset, streamed from its own window (x11grab of gamescope's redirected window), so it doesn't move as the wearer looks around. A picker shows any other panel, view only. - Control: on the Desktop view a tap or click lands exactly where you put it; drag is a mouse drag, press and hold right-clicks, two fingers scroll, and on a computer the mouse, wheel and keyboard work directly. On the headset view the view is a trackpad. A text field and key row type from a phone. Input goes through gamescope's own EIS socket (the way Steam feeds Remote Play input) with the libei already on the image: ui/frame_touch.py, over the same long-lived ssh machinery as the keyboard agent, nothing to install. It reaches the panel that has focus on either X display, which the KDE Connect route can't. Verified on the Frame and from the iPhone app in the Simulator. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: fixes from review - Keys held on the Frame are released with buttons when Control stops or the view loses focus; keys for the Frame no longer trigger Frame Control's own shortcuts. - Taps only act when the picture on screen is the panel in use; positions, presses, keys, text and scrolls name their panel (display and window: ids repeat across :0 and :1, told apart by pid), and the Frame drops them if focus has moved on. Releases always go. - While connecting, a tap keeps its position; on an error only releases wait and retries back off; trimming a long queue never drops a release. - Lifting one of two scrolling fingers ends the scroll; a cancelled touch isn't a tap; clicks and holds on the bars around the picture do nothing. - A capture loop from before a Live restart can't stop the new video. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: close the targeting gaps from the second review - The focused panel's display comes from GAMESCOPE_FOCUS_DISPLAY (gamescope packs ":1" into the first value), so a window id repeated across :0 and :1 can't be mistaken; the pid is only the fallback. - Presses, keys, text and scrolls read focus afresh on the Frame; only moves use a reading up to a second old. - A gesture remembers the panel it started on and does nothing more if that stops being the one in use; a press with no panel to aim at isn't sent. - Opening a screenshot clears the panel Control would act on; switching to another app releases held keys and buttons. - Trimming keeps a click with its position; the error backoff holds for new input too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: fixes from the SWE-2 Max review - The Frame side tracks keys as well as buttons and lets go of both when the session ends. - A stale tap tells the page, which re-reads the panels at once. - A paused input device waits instead of ending the session; only a disconnect does. An OS error on one event skips it. - Presses check focus with two property reads and do the full lookup only when it changed. - Writes to an agent's stdin are serialized, so two devices sending at once can't tear a line (the keyboard agent too). - Connecting gives up with a message after 15 s instead of hanging on "Connecting…"; text goes in 100-character pieces so releases don't wait behind a long paste; a cancelled mouse gesture releases what's held. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: stale clears, pauses reconverge, pastes split per request - The Frame says it has caught up as soon as an aimed event lands after a stale one, so the page stops re-reading the panels. - After a device pause it lets go of everything it holds (releases that arrived while paused were dropped), and waits for the device once per batch, not once per event. - The quick focus check no longer freshens the panel geometry's age. - Each request carries at most about 100 characters of text. - Turning Control off while it connects doesn't report an error. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * frame_touch: build the socket path on the Frame, so Windows can import it for tests Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * frame_touch: any event that goes through clears the stale flag A trackpad move names no panel, so waiting for an aimed event could leave the page re-reading panels for the rest of the session; a release still aimed at the old panel doesn't count. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Trackpad and key row go through gamescope's input; KDE Connect only for accents and emoji The pad reaches whichever panel has focus (Steam's menus too), needs nothing installed, and no longer clamps to 1280x720. Characters that aren't on a US keyboard start KDE Connect the first time they're typed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Touch: a bare release no longer clears the stale-focus notice before the page has seen it The page leaves the panel off releases, so a release says nothing about focus. Found in review of the stale-latch fix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Pad: keep typing in order and acknowledge it once, with accents through one KDE Connect queue Review found accent-only input repeated forever (sent was false), text split across two transports out of order, accents stuck until the next keypress, duplicated on retry, and racy. A batch with an accent now sends its whole keyboard through KDE Connect; later keys follow while any are queued; the server owns one ordered, bounded queue drained by a single thread; sent means the whole batch is taken. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Pad: drain the KDE Connect queue without losing, stranding or reordering input Second review found the queue could be trimmed under an in-flight send (deleting unsent events), the worker could retire as a request enqueued, and ASCII could overtake an accent still being typed (or the reverse). The worker now takes its batch out while sending and puts it back on failure, retires under the lock, and each way waits out the other's estimated typing time. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Pad: count gamescope's real typing time, with the settle margin added once Review found the estimate used 12 ms a character where the agent takes 16 ms (32 shifted), and added the margin on every request so it piled up. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Document gamescope pad verification and shared-device limits * Prevent Unicode input startup from deadlocking a headset switch * Record real focused-panel click and ASCII key delivery * Retain accepted Unicode input under queue saturation and failure --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 11:54:36 +00:00
Alex SouthwellandSAPHID	0da1fe5077	Bump Frame Control to 0.4.18 (#161 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:53:48 +00:00
Alex Southwell Claude Opus 5.5 SAPHID	1f7615b312	Keep theatre playback running without optional surround (#51 ) * Never end playback over the cosmetic surround; always shut down OpenVR Review (SWE-2 Max): a non-standby error re-sending the theatre surround could end a healthy still, and a non-RuntimeError during DestroyOverlay skipped VR_ShutdownInternal. drain() now drops a surround that fails for other reasons, and close() shuts down in finally. Fake overlay handles no longer depend on call order. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Play without the theatre surround if SteamVR refuses it Review (SWE-2 Max): a non-standby error creating the cosmetic surround at startup still ended playback before the screen appeared. Theatre now logs it and plays without the surround. close() treats any per-overlay teardown error as best effort (signals are already ignored there). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Verify media surround fallback and guard server startup ownership * Record exact-head real Frame theatre playback smoke --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:45:48 +00:00
Alex SouthwellandSAPHID	2ded4c5a0d	Document saved panel layout feasibility on SteamVR 2.18.2 (#160 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:19:35 +00:00
Alex SouthwellandSAPHID	5b47cd3330	Document packaged Desktop Capture result and visibility limit (#159 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:03:36 +00:00
Alex SouthwellandSAPHID	aead570b5d	Clarify Return to Game Mode switch help (#158 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:47:24 +00:00
Alex SouthwellandSAPHID	de931bc56f	Document packaged Return to Game Mode button verification (#157 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:39:21 +00:00
Alex SouthwellandSAPHID	71288d8980	Document packaged desktop Steam clip Export verification (#156 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:19:46 +00:00
Alex SouthwellandSAPHID	64b9babe87	Document Linux PC-host feasibility blocker on lxso2 (#155 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:17:14 +00:00
Alex SouthwellandSAPHID	4e456480ae	Document real 100-second Steam clip export (#154 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:05:12 +00:00
Alex SouthwellandSAPHID	241f538f99	Bump version to 0.4.17 (#153 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 08:43:00 +00:00
Alex SouthwellandSAPHID	21dacfcbe7	Distinguish unreadable panel discovery from an empty list (#152 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 08:34:56 +00:00
Alex SouthwellandSAPHID	eb181d8996	Add opt-in desktop low-battery comfort alerts (#150 ) * Add opt-in desktop low-battery comfort alerts * Fix desktop battery alert test harness and Windows encoding --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 08:22:56 +00:00
Alex SouthwellandSAPHID	827ddcf14f	Clarify desktop installation and first headset connection (#151 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 08:08:47 +00:00
Alex SouthwellandSAPHID	7c3894e630	docs: record real Frame clip Export button check (#149 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 08:04:06 +00:00
Alex SouthwellandSAPHID	040581a4c7	Bump Frame Control to 0.4.16 (#148 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 07:42:37 +00:00
Alex SouthwellandSAPHID	17f6d52717	Document real Steam clip export verification (#147 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 07:34:34 +00:00
Alex SouthwellandSAPHID	b4e80cab0a	Escape power report CSV metadata for spreadsheets (#146 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 07:28:26 +00:00
Alex SouthwellandSAPHID	b98e3e496f	Bump Frame Control to 0.4.15 (#145 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 07:08:23 +00:00
Alex SouthwellandSAPHID	a148e02d39	Add bounded read-only power and heat reports to desktop Tools (#144 ) * Add bounded desktop power and heat observations with offline downloads * Fix desktop power tests on Python 3.9 --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 06:58:19 +00:00
Alex SouthwellandSAPHID	0fb9174c23	Fix Return to Game Mode detection in full Plasma (#143 ) * Fix Frame session detection for full Plasma Desktop Mode * Document real Frame Desktop Mode return verification --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 06:46:17 +00:00