Merge main and preserve tracking and Windows test guidance

chore: resolve conflicts with main
fix(tracking): review 7 - rescan on cleanup, non-finite Health values
2026-10-24 07:02:00 +02:00 · 2026-10-18 00:06:01 +00:00 · 2026-10-17 22:10:01 +00:00 · 2026-09-29 20:29:56 +10:00 · 2026-09-29 20:20:23 +10:00 · 2026-09-29 20:15:24 +10:00
143 changed files with 3377 additions and 16123 deletions
@@ -22,7 +22,6 @@ desktop or panels.
 | See the Frame from the Mac, or the Mac inside the Frame | `docs/streaming.md` | `scripts/run-on-frame.sh mac-screen` |
 | Files and clipboard | `docs/file-transfer.md` | `scripts/push.sh`, `scripts/paste-to-frame.sh` |
 | Android apps (Lepton) | `docs/apks.md` | `scripts/install-apk.sh` |
-| Browse and install Android apps from inside the headset (APK Store panel) | `docs/apks.md` | `scripts/store-on-frame.sh` |
 | Reach the Frame off the home LAN (Tailscale) | `docs/tailscale.md` | `scripts/tailscale-on-frame.sh` |
 | Install or buy Steam games, Frame ratings | `docs/steam-games.md` | `ui/frame_steam.py` |
 | Flatpaks | `docs/streaming.md` | `scripts/install-apps.sh` |
@@ -43,8 +43,8 @@ jobs:
        run: python -m unittest discover -s tests -v
      - name: App syntax
        run: node --check app/main.js && node --check app/build/make-icon.js && node --check app/build/fetch-deps.js && node --check app/preload.js && node --check app/install-link.js && node --check app/updater.js
-      - name: App tests
-        run: node --test app/test/*.test.js
+      - name: Updater tests
+        run: node --test app/test/updater.test.js
      - name: Website
        run: node --test site/test/*.test.mjs && node --check site/public/js/site.js && node --check site/public/js/feedback.js

@@ -1,53 +0,0 @@
-name: PC host libraries
-# PC in the headset (Experimental). The Windows job builds the native adapter
-# and runs the real-encoder protocol tests; the installer's own bundle is
-# tested in release.yml. The Linux adapter from PR #38 isn't shipped or offered
-# in the app, but shares capture.c and controller.c, so it's still built here.
-# These builds add the GPL x264 encoder for headless tests only: they're never
-# uploaded or shipped.
-on:
-  pull_request:
-    paths: ["desktop/**", "ui/**", "tests/**", "scripts/macview-bench.py", ".github/workflows/pc-host.yml"]
-  workflow_dispatch:
-jobs:
-  linux:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Native libraries
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libglib2.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-pipewire libpipewire-0.3-modules libspa-0.2-modules
-          python3 desktop/build.py --with-x264
-      - name: Tests (real x264, fake capture consent/input)
-        env:
-          FRAME_PC_REQUIRE_NATIVE: "1"
-          FRAME_PC_REQUIRE_X264: "1"
-        run: python3 -m unittest discover -s tests -p 'test_pc*.py' -v
-  windows:
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: msys2/setup-msys2@v2
-        with:
-          msystem: UCRT64
-          update: true
-      # A mirror's HTTP 429 once failed this install (2026-10-24): retry, so a
-      # flaky mirror can't break a release build.
-      - name: MSYS2 packages for the PC host
-        shell: msys2 {0}
-        run: |
-          for attempt in 1 2 3; do
-            pacman -S --needed --noconfirm mingw-w64-ucrt-x86_64-gcc mingw-w64-ucrt-x86_64-pkgconf mingw-w64-ucrt-x86_64-python mingw-w64-ucrt-x86_64-gstreamer mingw-w64-ucrt-x86_64-gst-plugins-base mingw-w64-ucrt-x86_64-gst-plugins-good mingw-w64-ucrt-x86_64-gst-plugins-bad mingw-w64-ucrt-x86_64-gst-plugins-ugly && exit 0
-            sleep $((attempt * 30))
-          done
-          exit 1
-      - name: Native build and tests (x264; WGC and MF need a desktop/GPU)
-        shell: msys2 {0}
-        run: |
-          python desktop/build.py --with-x264
-          FRAME_PC_REQUIRE_NATIVE=1 FRAME_PC_REQUIRE_X264=1 python -m unittest discover -s tests -p 'test_pc*.py' -v
@@ -3,14 +3,14 @@ name: release
 # Pushing a v* tag builds Frame Control for macOS, Windows and Linux and attaches
 # the installers to that tag's GitHub release (created as a draft if missing).
 # Pull requests that change how the installers are built (the Electron app, the
-# Windows PC helper libraries, the macOS helper, or this workflow) build the same installers as
+# macOS helper it compiles, or this workflow) build the same installers as
 # artifacts. ui/, scripts/, frame/ and apk-catalog/ are copied in as they are and
 # are tested by the checks workflow; run this one by hand to package them early.
 on:
  push:
    tags: ["v*"]
  pull_request:
-    paths: ["app/**", "desktop/**", "mac/frame-mac-view/**", ".github/workflows/release.yml"]
+    paths: ["app/**", "mac/frame-mac-view/**", ".github/workflows/release.yml"]
  workflow_dispatch:

 # A newer push to the same pull request supersedes a build still in progress.
@@ -75,28 +75,6 @@ jobs:
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
-      # PC in the headset (Experimental, Windows only): our capture adapter and
-      # the GStreamer libraries it uses, bundled into resources/desktop/bundle.
-      - uses: msys2/setup-msys2@v2
-        if: runner.os == 'Windows'
-        with:
-          msystem: UCRT64
-          update: true
-      # A mirror's HTTP 429 once failed this install (2026-10-24): retry, so a
-      # flaky mirror can't break a release build.
-      - name: MSYS2 packages for the PC host
-        if: runner.os == 'Windows'
-        shell: msys2 {0}
-        run: |
-          for attempt in 1 2 3; do
-            pacman -S --needed --noconfirm mingw-w64-ucrt-x86_64-gcc mingw-w64-ucrt-x86_64-pkgconf mingw-w64-ucrt-x86_64-python mingw-w64-ucrt-x86_64-gstreamer mingw-w64-ucrt-x86_64-gst-plugins-base mingw-w64-ucrt-x86_64-gst-plugins-good mingw-w64-ucrt-x86_64-gst-plugins-bad mingw-w64-ucrt-x86_64-gst-plugins-ugly && exit 0
-            sleep $((attempt * 30))
-          done
-          exit 1
-      - name: Windows PC streaming libraries
-        if: runner.os == 'Windows'
-        shell: msys2 {0}
-        run: python desktop/build.py --out app/build/desktop/win-x64
      - name: Build
        working-directory: app
        shell: bash
@@ -117,19 +95,6 @@ jobs:
          for ($i = 0; $i -lt 60 -and -not (Test-Path (Join-Path $installed 'Uninstall Frame Control.exe')); $i++) { Start-Sleep 2 }
          node app/build/check-resources.js (Join-Path $installed 'resources') app/dist/win-unpacked/resources
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-      # From the installed app, so this also proves the installer carries the
-      # libraries. After the check above, and without writing __pycache__,
-      # so it can't change what that check compares.
-      - name: Test the installed app's Python with the Windows PC libraries
-        if: runner.os == 'Windows'
-        shell: bash
-        env:
-          PYTHONDONTWRITEBYTECODE: "1"
-        run: |
-          resources="$(cygpath -u "$LOCALAPPDATA")/Programs/Frame Control/resources"
-          python="$resources/python/python.exe"
-          native="$(cygpath -w "$resources/desktop/bundle")"
-          FRAME_PC_NATIVE="$native" FRAME_PC_REQUIRE_NATIVE=1 FRAME_PC_INSTALLER_BUNDLE=1 "$python" -B -m unittest discover -s tests -p 'test_pc*.py' -v
      - name: Upload to the release
        if: startsWith(github.ref, 'refs/tags/')
        shell: bash
@@ -7,15 +7,5 @@ compat-db/.lakebed/
 tests/smoke/results/
 mac/bin/

-# Shared desktop streaming controller build products
-desktop/controller.dll
-desktop/controller.dylib
-desktop/controller.so
-desktop/*.obj
-desktop/*.lib
-desktop/*.exp
-desktop/bundle/
-app/build/desktop/
-
 # Downloaded at build time (frame/kdeconnect/fetch.py, app/build/fetch-deps.js)
 frame/kdeconnect/packages/
@@ -50,7 +50,7 @@ Charge, charging watts and time left, storage, memory, temperature, Wi-Fi, and w
 <td valign="top">

 **🎮 Steam games**<br>
-Everything you own with its Steam Frame rating. Install onto the headset with live progress, search the store, and force quit a game that stops responding.
+Everything you own with its Steam Frame rating. Install onto the headset with live progress, and search the store.

 </td>
 <td valign="top">
@@ -63,17 +63,17 @@ About 4,500 F-Droid apps rated for the Frame. One click installs each as its own
 <tr>
 <td valign="top">

-**📁 Files and games**<br>
-Drag files onto the window to send them. Drop a game's .zip, folder or .exe to add it to the Steam library, with Proton or the Linux runtime picked for you.
+**📁 Files, games and clipboard**<br>
+Drag files onto the window to send them. Drop a game's .zip, folder or .exe to add it to the Steam library, with Proton or the Linux runtime picked for you. Send text or your clipboard straight to the headset's desktop.

 </td>
 <td valign="top">

-**📸 Screenshots and recordings**<br>
-Browse the shots you take in the headset and save them to your Pictures folder, or have new ones and your Steam clips copied over automatically. Record what the headset shows, with its sound, or export Steam's clips at any length, as .mp4 files in your Videos folder ([not tested on a headset yet](docs/recording.md)).
+**📸 Screenshots**<br>
+Browse the shots you take in the headset and save them to your Pictures folder.

-**⌨️ Type on the headset**<br>
-Type and point in the Frame's apps from your computer or phone, through KDE Connect, which Frame Control brings along and sets up on the Frame. Copy text to the headset's clipboard and back again. Nothing else to install, anywhere. Press T to open it.
+**⌨️ Keyboard and trackpad**<br>
+Type and point in the Frame's apps from your computer or phone, through KDE Connect, which Frame Control brings along and sets up on the Frame. Nothing else to install, anywhere.

 </td>
 </tr>
@@ -89,14 +89,6 @@ Install desktop apps like Moonlight or VLC, and set each Android app's resolutio
 **⚡ One-click tools**<br>
 SSH, SFTP, Steam Link, remote desktop, volume, sleep, restart and shut down.

-</td>
-</tr>
-<tr>
-<td colspan="2" valign="top">
-
-**💾 Backup and recovery**<br>
-Copy game saves, settings and Android app data to your computer, and restore them after a factory reset. Sign-in files and keys are never copied. A Return to Game Mode button helps when the headset is stuck in Desktop Mode. Not tested on a headset yet. [How it works](docs/backup-and-recovery.md).
-
 </td>
 </tr>
 </table>
@@ -197,7 +189,7 @@ entry to `~/.ssh/config` and keys at `~/.ssh/id_ed25519_frame` and

 This is a first public test, so reports are really useful, especially from
 Windows and Linux. The quickest way is **Report a problem** in the app (the
-speech-bubble button at the top, or **Help → Report a Problem…**). It adds
+warning-sign button at the top, or **Help → Report a Problem…**). It adds
 diagnostics with personal details removed, shows you exactly what's included,
 and sends it privately to the maintainer; nothing is published. Without the app,
 use the [feedback form](https://frame-control.pages.dev/feedback/). Please include:
@@ -226,12 +218,12 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
 | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
-| [PC in the headset](docs/pc-in-headset.md) | Experimental, Windows only, off until you turn it on: your PC's windows and screens as panels in the Frame. Not yet tried on a real Windows desktop or headset |
 | [Mac in the headset](docs/mac-in-headset.md) | Mac windows and screens as panels in the Frame, with laser and keyboard input |
 | [VR mods and custom songs](docs/mods.md) | UEVR for Unreal games from Frame Control (install, play in VR, remove), the per-game table, Beat Saber blockers |
 | [SSH](docs/ssh.md) · [Streaming](docs/streaming.md) · [Files](docs/file-transfer.md) · [Panels](docs/panels.md) · [Tailscale](docs/tailscale.md) | Topic notes |
 | [Frame Control for iPhone](docs/iphone.md) | The iPhone and iPad app, how it runs the server on the Frame, pairing |
 | [Recovery and OS images](docs/recovery-and-images.md) | Where to download the Frame's OS, what's inside, testing without the headset |
+| [Eye tracking and heart rate](docs/tracking.md) | Our OpenXR → OSC bridge, BlueZ heart-rate panel and optional local session log; SlimeVR feasibility notes |
 | [AI agents and assistant](docs/agents.md) | Key-free MCP tools, human approvals, and an opt-in assistant panel |
 | [Testing](docs/testing.md) | Unit tests, end-to-end tests against a fake Frame in Docker, the headset smoke test and a Windows test VM |
 | [Open questions](docs/open-questions.md) | What's still unchecked |
@@ -10,8 +10,6 @@ ship other people's software, unchanged, each under its own licence:
 | adb (Android SDK Platform-Tools) | Desktop apps (not Linux arm64) | Apache-2.0 and others | `NOTICE.txt` in the app's `tools` folder |
 | Mozilla's CA certificate list, as published by curl | Desktop apps | MPL-2.0 | https://curl.se/docs/caextract.html |
 | Electron | Desktop apps | MIT (Chromium: BSD-3-Clause and others) | `LICENSE` and `LICENSES.chromium.html` in the app |
-| GStreamer 1.x, a few of its plugins and the libraries they need, as [MSYS2](https://packages.msys2.org/) builds them | Windows app only, for the experimental [PC in the headset](docs/pc-in-headset.md) | LGPL-2.1-or-later and others (per package); the GPL x264 encoder is left out | `libraries.json` (exact package versions) and the `licenses` folder in the app's `desktop/bundle` folder |

 Frame Control starts KDE Connect and talks to it over its network protocol;
-it doesn't link to it or include its code. On Windows, Frame Control's own
-`pc-host.dll` links to GStreamer dynamically; the libraries are unmodified.
+it doesn't link to it or include its code.
@@ -11,7 +11,6 @@ const os = require("os");
 const path = require("path");
 const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link");
 const updater = require("./updater");
-const { preferenceStore } = require("./preferences");
 const { createMetaSignIn } = require("./meta-signin");

 const run = promisify(execFile);
@@ -29,7 +28,6 @@ const LOG_DIR = IS_MAC ? path.join(os.homedir(), "Library", "Logs", "Frame Contr
 const LOG = path.join(LOG_DIR, "server.log");
 const BG = "#0d1117";
 const FRAME = process.env.FRAME_ALIAS || "frame";
-const preferences = preferenceStore(path.join(app.getPath("userData"), "client-preferences.json"));

 let server = null;
 let url = null;
@@ -282,14 +280,6 @@ ipcMain.handle("server:restart", (e) => {
  if (win && e.sender === win.webContents && e.senderFrame && e.senderFrame.url.startsWith("data:")) restartServer();
 });
 ipcMain.handle("clipboard:read", (e) => fromUi(e) ? clipboard.readText() : "");
-// Text from the headset's clipboard onto this computer's.
-ipcMain.handle("clipboard:write", (e, text) => {
-  if (!fromUi(e) || typeof text !== "string") return false;
-  clipboard.writeText(text);
-  return true;
-});
-ipcMain.handle("preferences:read", (e) => fromUi(e) ? preferences.read() : {});
-ipcMain.handle("preferences:write", (e, key, value) => fromUi(e) ? preferences.write(key, value) : false);
 // A PNG or JPEG (a screenshot) onto the clipboard as an image.
 ipcMain.handle("clipboard:writeImage", (e, bytes) => {
  if (!fromUi(e) || !(bytes instanceof Uint8Array)) return false;
@@ -1,12 +1,12 @@
 {
  "name": "frame-control",
-  "version": "0.4.10",
+  "version": "0.4.7",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "frame-control",
-      "version": "0.4.10",
+      "version": "0.4.7",
      "license": "MIT",
      "devDependencies": {
        "electron": "^44.4.5",
@@ -1,7 +1,7 @@
 {
  "name": "frame-control",
  "productName": "Frame Control",
-  "version": "0.4.10",
+  "version": "0.4.7",
  "description": "Desktop app for managing a Valve Steam Frame over SSH",
  "private": true,
  "main": "main.js",
@@ -39,7 +39,6 @@
      "preload.js",
      "install-link.js",
      "updater.js",
-      "preferences.js",
      "meta-signin.js",
      "package.json",
      "build/icon.png"
@@ -198,16 +197,7 @@
        "zip"
      ],
      "icon": "build/icon.png",
-      "artifactName": "Frame-Control-win-${arch}.${ext}",
-      "extraResources": [
-        {
-          "from": "build/desktop/${os}-${arch}",
-          "to": "desktop/bundle",
-          "filter": [
-            "**/*"
-          ]
-        }
-      ]
+      "artifactName": "Frame-Control-win-${arch}.${ext}"
    },
    "nsis": {
      "oneClick": false,
@@ -1,27 +0,0 @@
-// Client choices live outside the local server's changing URL/origin.
-const fs = require("node:fs");
-const path = require("node:path");
-const KEYS = ["mvSeparate", "padUsed", "pcView"];
-const valid = value => value === "0" || value === "1";
-
-function preferenceStore(file) {
-  function read() {
-    try {
-      const saved = JSON.parse(fs.readFileSync(file, "utf8"));
-      if (!saved || typeof saved !== "object" || Array.isArray(saved)) return {};
-      return Object.fromEntries(KEYS.filter(key => valid(saved[key])).map(key => [key, saved[key]]));
-    } catch { return {}; }
-  }
-  function write(key, value) {
-    if (!KEYS.includes(key) || !valid(value)) throw new Error("Invalid preference");
-    const saved = { ...read(), [key]: value };
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const tmp = file + ".tmp";
-    fs.writeFileSync(tmp, JSON.stringify(saved), { mode: 0o600 });
-    fs.renameSync(tmp, file);
-    return true;
-  }
-  return { read, write };
-}
-
-module.exports = { preferenceStore };
@@ -1,5 +1,5 @@
-// Lets the page read and write this computer's clipboard through Electron, so sending
-// it to the Frame, and copying the Frame's back, needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
+// Lets the page read this computer's clipboard through Electron, so sending it
+// to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
 // the page where a dropped file or folder lives, so a folder can be sideloaded
 // as a title without zipping it (the local server reads it from there).
 // It can put a screenshot on the clipboard as an image, open Set Up Connection when
@@ -11,13 +11,8 @@
 const { contextBridge, ipcRenderer, webUtils } = require("electron");

 contextBridge.exposeInMainWorld("frameApp", {
-  preferences: {
-    read: () => ipcRenderer.invoke("preferences:read"),
-    write: (key, value) => ipcRenderer.invoke("preferences:write", key, value),
-  },
  notify: (message, request) => ipcRenderer.invoke("comfort:notify", message, request),
  readClipboard: () => ipcRenderer.invoke("clipboard:read"),
-  writeClipboard: (text) => ipcRenderer.invoke("clipboard:write", text),
  writeImage: (bytes) => ipcRenderer.invoke("clipboard:writeImage", bytes),
  setUpConnection: () => ipcRenderer.invoke("connection:setup"),
  restartServer: () => ipcRenderer.invoke("server:restart"),  // the "couldn't start" page's Try Again
@@ -1,68 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const { preferenceStore } = require("../preferences");
-
-function fixture(t) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "frame-preferences-"));
-  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
-  return path.join(dir, "client-preferences.json");
-}
-
-test("desktop packaging includes every local application module dependency", () => {
-  const root = path.resolve(__dirname, "..");
-  const packaged = new Set(require("../package.json").build.files);
-  for (const file of ["main.js", "preload.js"]) {
-    const source = fs.readFileSync(path.join(root, file), "utf8");
-    for (const match of source.matchAll(/require\(["'](\.\/[^"']+)["']\)/g)) {
-      const target = match[1].slice(2) + ".js";
-      assert.ok(packaged.has(target), `${file} needs packaged ${target}`);
-    }
-  }
-});
-
-test("client choices survive a new native session and local server origin", t => {
-  const file = fixture(t);
-  const first = preferenceStore(file);
-  assert.deepEqual(first.read(), {});
-  first.write("mvSeparate", "0");
-  first.write("padUsed", "1");
-  // A new process/session reads the same client store, regardless of its URL.
-  const second = preferenceStore(file);
-  assert.deepEqual(second.read(), { mvSeparate: "0", padUsed: "1" });
-  second.write("mvSeparate", "1");
-  assert.deepEqual(first.read(), { mvSeparate: "1", padUsed: "1" });
-});
-
-test("only the non-sensitive binary choices can enter the native store", t => {
-  const file = fixture(t), store = preferenceStore(file);
-  for (const [key, value] of [["token", "secret"], ["__proto__", "1"], ["padUsed", true], ["mvSeparate", "yes"]]) {
-    assert.throws(() => store.write(key, value), /Invalid preference/);
-  }
-  assert.equal(fs.existsSync(file), false);
-  fs.writeFileSync(file, JSON.stringify({ token: "discard", mvSeparate: "0", padUsed: 1 }));
-  assert.deepEqual(store.read(), { mvSeparate: "0" });
-  store.write("padUsed", "1");
-  assert.deepEqual(JSON.parse(fs.readFileSync(file, "utf8")), { mvSeparate: "0", padUsed: "1" });
-});
-
-test("a missing or damaged preference file retains usable defaults", t => {
-  const file = fixture(t), store = preferenceStore(file);
-  assert.deepEqual(store.read(), {});
-  for (const bad of ["{broken", "null", "[]", '"text"']) {
-    fs.writeFileSync(file, bad);
-    assert.deepEqual(store.read(), {});
-  }
-  store.write("padUsed", "1");
-  assert.deepEqual(store.read(), { padUsed: "1" });
-});
-
-test("the PC in the headset opt-in is remembered and off unless saved", t => {
-  const file = fixture(t), store = preferenceStore(file);
-  assert.equal(store.read().pcView, undefined);
-  store.write("pcView", "1");
-  assert.deepEqual(preferenceStore(file).read(), { pcView: "1" });
-  assert.throws(() => store.write("pcView", "on"), /Invalid preference/);
-});
@@ -1,311 +0,0 @@
-{
- "label": "pc-agent-frame-arm64-hairpin",
- "date": "2026-09-28T22:36:19",
- "commit": "c5fc552+dirty",
- "config": {
-  "quality": "balanced",
-  "mode": "separate",
-  "net": "none",
-  "delay_ms": 0,
-  "buffer_ms": 250,
-  "host": "frame",
-  "usb": false,
-  "ssh_opts": [],
-  "encoder": "",
-  "duration_s": 10.0,
-  "browser_flags": []
- },
- "frame_build": "20260925.6191901",
- "mac": "26.5.2",
- "host_platform": "Linux aarch64, SteamOS Frame, BUILD_ID 20260925.6191901 (synthetic host only)",
- "source": "",
- "pc_host": true,
- "headset": "0:03.056203 [Info] - 1 - leaving standby",
- "scenarios": [
-  {
-   "scenario": "test",
-   "frames_sent": 351,
-   "frames_drawn": 351,
-   "frames_shown": 324,
-   "duration_s": 10.1,
-   "stages_ms": {
-    "capture": {
-     "p50": 0.1,
-     "p95": 0.2,
-     "p99": 0.5,
-     "n": 351
-    },
-    "queue": {
-     "p50": 0.1,
-     "p95": 0.3,
-     "p99": 0.4,
-     "n": 351
-    },
-    "encode": {
-     "p50": 2.0,
-     "p95": 2.9,
-     "p99": 3.5,
-     "n": 351
-    },
-    "socket": {
-     "p50": 0.1,
-     "p95": 0.4,
-     "p99": 0.6,
-     "n": 351
-    },
-    "network": {
-     "p50": 11.6,
-     "p95": 75.7,
-     "p99": 130.1,
-     "n": 351
-    },
-    "decode": {
-     "p50": 0.7,
-     "p95": 2.1,
-     "p99": 4.1,
-     "n": 351
-    },
-    "draw": {
-     "p50": 0.4,
-     "p95": 0.8,
-     "p99": 1.1,
-     "n": 351
-    },
-    "present": {
-     "p50": 0.8,
-     "p95": 18.1,
-     "p99": 24.9,
-     "n": 324
-    },
-    "content": {
-     "p50": 15.1,
-     "p95": 80.3,
-     "p99": 134.2,
-     "n": 351
-    },
-    "content_shown": {
-     "p50": 21.0,
-     "p95": 71.8,
-     "p99": 146.3,
-     "n": 324
-    }
-   },
-   "fps": 34.8,
-   "fps_shown": 32.0,
-   "late_pct": 53.41,
-   "stall_max": 226.8,
-   "stalls_over_100ms": 7,
-   "mbps": 0.26,
-   "keyframes": 6,
-   "size": "1280x720",
-   "captured": 607,
-   "viewer_never_drawn": 0,
-   "input_ms": {
-    "p50": 43.3,
-    "p95": 98.4,
-    "p99": 110.1,
-    "n": 18
-   },
-   "input_shown_ms": {
-    "p50": 54.7,
-    "p95": 98.9,
-    "p99": 114.0,
-    "n": 18
-   },
-   "input_parts_ms": {
-    "uplink": {
-     "p50": 17.1,
-     "p95": 48.3,
-     "p99": 53.1,
-     "n": 18
-    },
-    "mac": {
-     "p50": 12.5,
-     "p95": 32.9,
-     "p99": 35.7,
-     "n": 18
-    },
-    "back": {
-     "p50": 16.8,
-     "p95": 50.0,
-     "p99": 55.9,
-     "n": 18
-    }
-   },
-   "inputs": {
-    "asked": 18,
-    "sent": 18,
-    "seen": 18
-   },
-   "timeline": [
-    {
-     "t": 0,
-     "fps": 38,
-     "mbps": 0.3,
-     "content_p50": 14.8,
-     "content_p95": 25.3,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 1,
-     "fps": 33,
-     "mbps": 0.24,
-     "content_p50": 15.6,
-     "content_p95": 103.5,
-     "bitrate": 3845448,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 2,
-     "fps": 39,
-     "mbps": 0.28,
-     "content_p50": 15.6,
-     "content_p95": 29.9,
-     "bitrate": 5283790,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 3,
-     "fps": 25,
-     "mbps": 0.21,
-     "content_p50": 17.8,
-     "content_p95": 175.9,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 4,
-     "fps": 34,
-     "mbps": 0.22,
-     "content_p50": 15.4,
-     "content_p95": 69.8,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 5,
-     "fps": 38,
-     "mbps": 0.29,
-     "content_p50": 17.7,
-     "content_p95": 68.7,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 6,
-     "fps": 38,
-     "mbps": 0.26,
-     "content_p50": 15.0,
-     "content_p95": 18.2,
-     "bitrate": 3091280,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 7,
-     "fps": 30,
-     "mbps": 0.22,
-     "content_p50": 19.2,
-     "content_p95": 111.0,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 8,
-     "fps": 35,
-     "mbps": 0.26,
-     "content_p50": 13.4,
-     "content_p95": 102.6,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 9,
-     "fps": 38,
-     "mbps": 0.28,
-     "content_p50": 12.3,
-     "content_p95": 20.9,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 10,
-     "fps": 3,
-     "mbps": 0.02,
-     "content_p50": 20.9,
-     "content_p95": 24.7,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    }
-   ],
-   "adapt": [],
-   "content_p50": 15.1,
-   "content_p95": 80.3,
-   "input_p50": 43.3,
-   "input_p95": 98.4,
-   "grades": {
-    "input_replies": "local",
-    "content_p50": "local",
-    "content_p95": "acceptable",
-    "input_p50": "local",
-    "input_p95": "acceptable",
-    "fps": "bad",
-    "late_pct": "bad",
-    "stall_max": "acceptable"
-   },
-   "controller": {
-    "target": 3442081,
-    "ceiling": 5529600,
-    "tier": 0,
-    "fps": 60,
-    "scale": 1.0,
-    "baseRtt": 13.334,
-    "inFlight": 1,
-    "slack": 71.738,
-    "adapt": true
-   },
-   "events": [
-    {
-     "t": 3.77,
-     "e": "target 2764800 bit/s; tier 0"
-    },
-    {
-     "t": 7.42,
-     "e": "target 1725204 bit/s; tier 0"
-    }
-   ],
-   "source_fps": 60.1,
-   "cpu": {
-    "host": "not sampled"
-   },
-   "viewer": "h264 software; ANGLE (Mesa, zink Vulkan 1.4(Turnip Adreno (TM) 750 (MESA_TURNIP)), OpenGL 4.6); raf 71 Hz",
-   "show_s": 1.88,
-   "panel": "valve.steam.desktopgame.2001932457",
-   "src": "test",
-   "route": "network"
-  }
- ],
- "proof": "Synthetic x264 PC agent runs on the Frame itself, forwarded via Mac and back. Not Windows/Linux desktop capture or laser input."
-}
@@ -1,302 +0,0 @@
-{
- "label": "pc-agent-frame-arm64-final",
- "date": "2026-09-28T22:55:27",
- "commit": "cd20243",
- "config": {
-  "quality": "balanced",
-  "mode": "native",
-  "net": "none",
-  "delay_ms": 0,
-  "buffer_ms": 250,
-  "host": "frame",
-  "usb": false,
-  "ssh_opts": [],
-  "encoder": "",
-  "duration_s": 10.0,
-  "browser_flags": []
- },
- "frame_build": "20260925.6191901",
- "mac": "26.5.2",
- "host_platform": "Linux aarch64, SteamOS Frame, BUILD_ID 20260925.6191901 (synthetic host only)",
- "source": "",
- "pc_host": true,
- "headset": "0:03.056203 [Info] - 1 - leaving standby",
- "scenarios": [
-  {
-   "scenario": "test",
-   "frames_sent": 400,
-   "frames_drawn": 400,
-   "frames_shown": 339,
-   "duration_s": 10.2,
-   "stages_ms": {
-    "capture": {
-     "p50": 0.1,
-     "p95": 0.1,
-     "p99": 0.2,
-     "n": 400
-    },
-    "queue": {
-     "p50": 0.1,
-     "p95": 0.2,
-     "p99": 0.4,
-     "n": 400
-    },
-    "encode": {
-     "p50": 2.0,
-     "p95": 2.7,
-     "p99": 3.1,
-     "n": 400
-    },
-    "socket": {
-     "p50": 0.1,
-     "p95": 0.3,
-     "p99": 0.4,
-     "n": 400
-    },
-    "network": {
-     "p50": 11.8,
-     "p95": 25.2,
-     "p99": 37.8,
-     "n": 400
-    },
-    "decode": {
-     "p50": 0.7,
-     "p95": 1.5,
-     "p99": 2.0,
-     "n": 400
-    },
-    "draw": {
-     "p50": 0.3,
-     "p95": 0.7,
-     "p99": 1.0,
-     "n": 400
-    },
-    "present": {
-     "p50": 0.8,
-     "p95": 19.3,
-     "p99": 26.8,
-     "n": 339
-    },
-    "content": {
-     "p50": 15.1,
-     "p95": 28.6,
-     "p99": 41.3,
-     "n": 400
-    },
-    "content_shown": {
-     "p50": 17.6,
-     "p95": 39.0,
-     "p99": 47.2,
-     "n": 339
-    }
-   },
-   "fps": 39.3,
-   "fps_shown": 33.4,
-   "late_pct": 50.25,
-   "stall_max": 69.3,
-   "stalls_over_100ms": 0,
-   "mbps": 0.35,
-   "keyframes": 6,
-   "size": "1280x720",
-   "captured": 612,
-   "viewer_never_drawn": 0,
-   "input_ms": {
-    "p50": 76.6,
-    "p95": 98.2,
-    "p99": 127.8,
-    "n": 19
-   },
-   "input_shown_ms": {
-    "p50": 80.5,
-    "p95": 107.8,
-    "p99": 128.1,
-    "n": 16
-   },
-   "input_parts_ms": {
-    "uplink": {
-     "p50": 36.5,
-     "p95": 57.6,
-     "p99": 83.2,
-     "n": 19
-    },
-    "mac": {
-     "p50": 14.6,
-     "p95": 31.3,
-     "p99": 31.7,
-     "n": 19
-    },
-    "back": {
-     "p50": 15.1,
-     "p95": 32.8,
-     "p99": 36.2,
-     "n": 19
-    }
-   },
-   "inputs": {
-    "asked": 19,
-    "sent": 19,
-    "seen": 19
-   },
-   "timeline": [
-    {
-     "t": 0,
-     "fps": 40,
-     "mbps": 0.34,
-     "content_p50": 11.7,
-     "content_p95": 27.4,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 1,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 11.9,
-     "content_p95": 28.2,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 2,
-     "fps": 41,
-     "mbps": 0.35,
-     "content_p50": 11.4,
-     "content_p95": 16.6,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 3,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 12.7,
-     "content_p95": 28.0,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 4,
-     "fps": 38,
-     "mbps": 0.33,
-     "content_p50": 15.3,
-     "content_p95": 30.0,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 5,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 16.7,
-     "content_p95": 28.5,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 6,
-     "fps": 41,
-     "mbps": 0.38,
-     "content_p50": 15.9,
-     "content_p95": 29.4,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 7,
-     "fps": 41,
-     "mbps": 0.31,
-     "content_p50": 15.6,
-     "content_p95": 28.2,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 8,
-     "fps": 38,
-     "mbps": 0.38,
-     "content_p50": 15.5,
-     "content_p95": 25.9,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 9,
-     "fps": 38,
-     "mbps": 0.29,
-     "content_p50": 16.7,
-     "content_p95": 28.8,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 10,
-     "fps": 6,
-     "mbps": 0.03,
-     "content_p50": 17.6,
-     "content_p95": 23.1,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    }
-   ],
-   "adapt": [],
-   "content_p50": 15.1,
-   "content_p95": 28.6,
-   "input_p50": 76.6,
-   "input_p95": 98.2,
-   "grades": {
-    "input_replies": "local",
-    "content_p50": "local",
-    "content_p95": "local",
-    "input_p50": "acceptable",
-    "input_p95": "acceptable",
-    "fps": "bad",
-    "late_pct": "bad",
-    "stall_max": "local"
-   },
-   "controller": {
-    "target": 5529600,
-    "ceiling": 5529600,
-    "tier": 0,
-    "fps": 60,
-    "scale": 1.0,
-    "baseRtt": 12.332,
-    "inFlight": 0,
-    "slack": 74.12,
-    "adapt": true
-   },
-   "events": [],
-   "source_fps": 60.0,
-   "cpu": {
-    "host": "not sampled"
-   },
-   "viewer": "h264 software; ANGLE (Mesa, zink Vulkan 1.4(Turnip Adreno (TM) 750 (MESA_TURNIP)), OpenGL 4.6); raf 72 Hz",
-   "show_s": 1.75,
-   "panel": "valve.steam.desktopgame.2001932457",
-   "src": "test",
-   "route": "network"
-  }
- ],
- "proof": "Synthetic x264 PC agent runs on the Frame itself, forwarded via Mac and back. Not Windows/Linux desktop capture or laser input."
-}
@@ -1,16 +0,0 @@
-#!/usr/bin/env python3
-"""Build the common controller for the Python PC host (a C11 compiler needed)."""
-import os
-from pathlib import Path
-import subprocess
-import sys
-
-root = Path(__file__).resolve().parent
-suffix = '.dll' if sys.platform == 'win32' else '.dylib' if sys.platform == 'darwin' else '.so'
-out = root / ('controller' + suffix)
-if sys.platform == 'win32' and os.environ.get('CC', 'cl') == 'cl':
-    cmd = ['cl', '/nologo', '/O2', '/LD', '/std:c11', str(root / 'controller.c'), '/link', '/OUT:' + str(out)]
-else:
-    cmd = [os.environ.get('CC', 'cc'), '-O2', '-std=c11', '-shared', '-fPIC', str(root / 'controller.c'), '-o', str(out)]
-subprocess.run(cmd, cwd=root, check=True)
-print(out)
@@ -1,126 +0,0 @@
-#!/usr/bin/env python3
-"""Build our native PC adapter and bundle its ordinary shared libraries.
-
-Run on the target architecture after installing GStreamer development packages.
-No GStreamer executable or desktop streaming application is shipped or invoked.
-Linux libc, display/GPU drivers and the portal service remain platform pieces.
-
-x264 is GPL, so the bundle the Windows installer ships leaves it out: Windows
-encodes with Media Foundation. --with-x264 adds it for CI's headless protocol
-tests, which have no GPU or desktop to encode with.
-"""
-import argparse
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import subprocess
-import sys
-
-ROOT = Path(__file__).resolve().parent
-
-
-def output(*args):
-    return subprocess.check_output(args, text=True).strip()
-
-
-def build(destination, with_x264=False):
-    win = sys.platform == 'win32'
-    destination.mkdir(parents=True, exist_ok=True)
-    modules = ['gstreamer-1.0', 'gstreamer-app-1.0', 'gstreamer-video-1.0']
-    if not win:
-        modules += ['gio-unix-2.0']
-    import shlex
-    flags = shlex.split(output('pkg-config', '--cflags', '--libs', *modules))
-    lib = destination / ('pc-host.dll' if win else 'pc-host.so')
-    cmd = [os.environ.get('CC', 'gcc' if win else 'cc'), '-std=c11', '-O2', '-shared', '-Wall', '-Wextra']
-    if not win:
-        cmd += ['-fPIC', '-Wl,-rpath,$ORIGIN/lib']
-    subprocess.run(cmd + [str(ROOT / f) for f in ('controller.c', 'capture.c', 'portal.c')] + flags + ['-o', str(lib)], check=True)
-    prefix = Path(output('pkg-config', '--variable=prefix', 'gstreamer-1.0'))
-    plugin_dir = Path(output('pkg-config', '--variable=pluginsdir', 'gstreamer-1.0'))
-    plugins_out, libs_out = destination / 'lib' / 'gstreamer-1.0', destination / ('bin' if win else 'lib')
-    plugins_out.mkdir(parents=True, exist_ok=True)
-    libs_out.mkdir(parents=True, exist_ok=True)
-    names = ['coreelements', 'videotestsrc', 'videoconvertscale', 'app', 'jpeg', 'videoparsersbad']
-    if with_x264:
-        names.append('x264')
-    names += ['d3d11', 'mediafoundation'] if win else ['pipewire', 'va']
-    pending = [lib]
-    for name in names:
-        matches = list(plugin_dir.glob('*gst' + name + ('.dll' if win else '.so')))
-        if not matches:
-            raise SystemExit('Missing GStreamer library: ' + name)
-        for source in matches:
-            target = plugins_out / source.name
-            shutil.copy2(source, target)
-            pending.append(source)
-    if not win:
-        # PipeWire dynamically loads support and protocol modules. ldd cannot
-        # discover those; bundle them with a private client-only config instead
-        # of accidentally loading a different distro's client modules/config.
-        libdir = plugin_dir.parent
-        for relative in ('pipewire-0.3/libpipewire-module-protocol-native.so',
-                         'pipewire-0.3/libpipewire-module-client-node.so',
-                         'pipewire-0.3/libpipewire-module-adapter.so',
-                         'spa-0.2/support/libspa-support.so',
-                         'spa-0.2/support/libspa-dbus.so',
-                         'spa-0.2/videoconvert/libspa-videoconvert.so'):
-            source = libdir / relative
-            if not source.is_file():
-                raise SystemExit('Missing PipeWire runtime library: ' + str(source))
-            target = destination / 'lib' / relative
-            target.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(source, target)
-            pending.append(source)
-        config = destination / 'share' / 'pipewire'
-        config.mkdir(parents=True, exist_ok=True)
-        (config / 'client.conf').write_text(
-            'context.spa-libs = { support.* = support/libspa-support video.* = videoconvert/libspa-videoconvert }\n'
-            'context.modules = [\n'
-            '  { name = libpipewire-module-protocol-native }\n'
-            '  { name = libpipewire-module-client-node }\n'
-            '  { name = libpipewire-module-adapter }\n'
-            ']\n')
-    copied = set()
-    while pending:
-        binary = pending.pop()
-        if win:
-            imported = re.findall(r'DLL Name:\s*(\S+)', output('objdump', '-p', str(binary)))
-            dependencies = [prefix / 'bin' / name for name in imported]
-        else:
-            dependencies = [Path(p) for p in re.findall(r'=>\s+(/\S+)', output('ldd', str(binary)))]
-        for dep in dependencies:
-            if not dep.is_file() or dep.name in copied:
-                continue
-            if not win and re.match(r'lib(c|m|dl|rt|pthread|resolv)\.so', dep.name):
-                continue
-            shutil.copy2(dep, libs_out / dep.name)
-            copied.add(dep.name)
-            pending.append(dep)
-    # License texts and package provenance accompany the dynamically linked
-    # libraries. Distribution builders keep the upstream package/source URLs.
-    licenses = destination / 'licenses'
-    licenses.mkdir(exist_ok=True)
-    if win:
-        source = prefix / 'share' / 'licenses'
-        if source.exists():
-            shutil.copytree(source, licenses, dirs_exist_ok=True)
-        packages = output('pacman', '-Q') if shutil.which('pacman') else 'See MSYS2 build log'
-    else:
-        packages = output('dpkg-query', '-W', '-f=${Package} ${Version}\n') if shutil.which('dpkg-query') else ''
-        # Debian copyright files contain licenses and source homepage details.
-        for path in Path('/usr/share/doc').glob('*/copyright'):
-            shutil.copy2(path, licenses / (path.parent.name + '.copyright'))
-    (destination / 'libraries.json').write_text(json.dumps(dict(gstreamer=output('pkg-config', '--modversion', 'gstreamer-1.0'),
-        plugins=names, libraries=sorted(copied), packages=packages), indent=2))
-    print(lib)
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--out', type=Path, default=ROOT / 'bundle')
-    parser.add_argument('--with-x264', action='store_true', help='add the GPL x264 encoder (CI tests only, never shipped)')
-    args = parser.parse_args()
-    build(args.out.resolve(), args.with_x264)
@@ -1,125 +0,0 @@
-/* Frame Control's capture/encode adapter. GStreamer is a bundled library;
- * capture uses WGC on Windows and the consented PipeWire fd on Linux. */
-#include "controller.h"
-#include <gst/gst.h>
-#include <gst/app/gstappsink.h>
-#include <gst/video/video-event.h>
-#include <string.h>
-
-typedef int (*Gate)(int stage, int64_t pts, int64_t capture, int64_t arrived);
-typedef struct {
-    GstElement *pipeline, *encoder, *sink, *raw_queue;
-    Gate gate;
-    GstSample *sample;
-    GstMapInfo map;
-    int mapped;
-    char error[512];
-} Capture;
-typedef struct { const unsigned char *data; int size, key, width, height; int64_t pts; } Encoded;
-FC_API int64_t fc_now(void) {return g_get_monotonic_time();}
-FC_API void fc_gst_init(void) {gst_init(NULL,NULL);}
-FC_API int fc_has_element(const char *name) {
-    GstElementFactory *f=gst_element_factory_find(name);
-    if(!f)return 0;gst_object_unref(f);return 1;
-}
-static GstPadProbeReturn probe(GstPad *pad,GstPadProbeInfo *info,gpointer data) {
-    Capture *c=data; GstBuffer *b=GST_PAD_PROBE_INFO_BUFFER(info);
-    if(!b)return GST_PAD_PROBE_OK;
-    int64_t now=fc_now(), cap=now;
-    GstClock *clock=gst_element_get_clock(c->pipeline);
-    if(clock && GST_BUFFER_PTS_IS_VALID(b)) {
-        GstClockTime current=gst_clock_get_time(clock),origin=gst_element_get_base_time(c->pipeline);
-        if(current>=origin && current-origin>=GST_BUFFER_PTS(b))
-            cap-= (int64_t)((current-origin-GST_BUFFER_PTS(b))/1000);
-    }
-    if(clock)gst_object_unref(clock);
-    int stage=GPOINTER_TO_INT(g_object_get_data(G_OBJECT(pad),"stage"));
-    if(stage==1) return c->gate(stage,(int64_t)GST_BUFFER_PTS(b),cap,now)>0 ? GST_PAD_PROBE_OK : GST_PAD_PROBE_DROP;
-    int phase=0;
-    for(;;) {
-        /* While congested, prefer a newer raw picture queued upstream. If
-         * nothing changed, retain this last picture until the gate opens;
-         * an idle window must not stay stale after a dropped final update. */
-        guint queued=0;
-        if(phase && c->raw_queue)g_object_get(c->raw_queue,"current-level-buffers",&queued,NULL);
-        if(queued)return GST_PAD_PROBE_DROP;
-        int decision=c->gate(phase,(int64_t)GST_BUFFER_PTS(b),cap,now);
-        if(decision)return decision>0 ? GST_PAD_PROBE_OK : GST_PAD_PROBE_DROP;
-        phase=2;g_usleep(2000);
-    }
-}
-FC_API Capture *fc_capture_open(const char *pipeline,Gate gate,char *error,int capacity) {
-    GError *e=NULL;Capture *c=g_new0(Capture,1);c->gate=gate;
-    c->pipeline=gst_parse_launch(pipeline,&e);
-    if(e || !c->pipeline) {
-        g_strlcpy(error,e?e->message:"No pipeline",capacity);
-        if(e)g_error_free(e);if(c->pipeline)gst_object_unref(c->pipeline);g_free(c);return NULL;
-    }
-    c->encoder=gst_bin_get_by_name(GST_BIN(c->pipeline),"enc");
-    c->sink=gst_bin_get_by_name(GST_BIN(c->pipeline),"out");
-    GstElement *raw=gst_bin_get_by_name(GST_BIN(c->pipeline),"gate");
-    if(!c->encoder || !c->sink || !raw) {
-        g_strlcpy(error,"Pipeline is missing enc, out or gate",capacity);
-        if(raw)gst_object_unref(raw);if(c->encoder)gst_object_unref(c->encoder);
-        if(c->sink)gst_object_unref(c->sink);gst_object_unref(c->pipeline);g_free(c);return NULL;
-    }
-    c->raw_queue=gst_bin_get_by_name(GST_BIN(c->pipeline),"raw_queue");
-    GstPad *p=gst_element_get_static_pad(raw,"src");
-    g_object_set_data(G_OBJECT(p),"stage",GINT_TO_POINTER(0));
-    gst_pad_add_probe(p,GST_PAD_PROBE_TYPE_BUFFER,probe,c,NULL);gst_object_unref(p);gst_object_unref(raw);
-    p=gst_element_get_static_pad(c->encoder,"sink");
-    g_object_set_data(G_OBJECT(p),"stage",GINT_TO_POINTER(1));
-    gst_pad_add_probe(p,GST_PAD_PROBE_TYPE_BUFFER,probe,c,NULL);gst_object_unref(p);
-    gst_element_set_state(c->pipeline,GST_STATE_PLAYING);
-    return c;
-}
-FC_API int fc_capture_pull(Capture *c,Encoded *out) {
-    if(c->mapped) {gst_buffer_unmap(gst_sample_get_buffer(c->sample),&c->map);c->mapped=0;}
-    if(c->sample){gst_sample_unref(c->sample);c->sample=NULL;}
-    GstBus *bus=gst_element_get_bus(c->pipeline);
-    GstMessage *m=gst_bus_pop_filtered(bus,GST_MESSAGE_ERROR);gst_object_unref(bus);
-    if(m) {
-        if(GST_MESSAGE_TYPE(m)==GST_MESSAGE_ERROR) {
-            GError *e=NULL;char *debug=NULL;gst_message_parse_error(m,&e,&debug);
-            g_strlcpy(c->error,e->message,sizeof(c->error));g_error_free(e);g_free(debug);
-        } else g_strlcpy(c->error,"The capture source closed",sizeof(c->error));
-        gst_message_unref(m);return -1;
-    }
-    c->sample=gst_app_sink_try_pull_sample(GST_APP_SINK(c->sink),100*GST_MSECOND);
-    if(!c->sample) {
-        if(gst_app_sink_is_eos(GST_APP_SINK(c->sink))) {
-            g_strlcpy(c->error,"The capture source closed",sizeof(c->error));return -1;
-        }
-        return 0;
-    }
-    GstBuffer *b=gst_sample_get_buffer(c->sample);
-    if(!gst_buffer_map(b,&c->map,GST_MAP_READ))return 0;
-    c->mapped=1;out->data=c->map.data;out->size=(int)c->map.size;
-    out->key=!GST_BUFFER_FLAG_IS_SET(b,GST_BUFFER_FLAG_DELTA_UNIT);out->pts=(int64_t)GST_BUFFER_PTS(b);
-    const GstStructure *s=gst_caps_get_structure(gst_sample_get_caps(c->sample),0);
-    gst_structure_get_int(s,"width",&out->width);gst_structure_get_int(s,"height",&out->height);return 1;
-}
-FC_API const char *fc_capture_error(Capture *c) {return c->error;}
-FC_API void fc_capture_bitrate(Capture *c,int bps) {
-    g_object_set(c->encoder,"bitrate",(guint)MAX(1,bps/1000),NULL);
-}
-FC_API void fc_capture_test(Capture *c,uint32_t input) {
-    GstElement *source=gst_bin_get_by_name(GST_BIN(c->pipeline),"source");
-    if(source) {
-        /* Each benchmark click visibly changes the ball, before injection is
-         * timestamped. This is a response, not merely a protocol input echo. */
-        guint color=0xff000000u | ((input*2654435761u)&0x00ffffffu);
-        g_object_set(source,"foreground-color",color,NULL);gst_object_unref(source);
-    }
-}
-FC_API void fc_capture_key(Capture *c) {
-    GstPad *p=gst_element_get_static_pad(c->encoder,"src");
-    gst_pad_send_event(p,gst_video_event_new_upstream_force_key_unit(GST_CLOCK_TIME_NONE,TRUE,0));gst_object_unref(p);
-}
-FC_API void fc_capture_close(Capture *c) {
-    gst_element_set_state(c->pipeline,GST_STATE_NULL);
-    if(c->mapped)gst_buffer_unmap(gst_sample_get_buffer(c->sample),&c->map);
-    if(c->sample)gst_sample_unref(c->sample);
-    if(c->raw_queue)gst_object_unref(c->raw_queue);
-    gst_object_unref(c->sink);gst_object_unref(c->encoder);gst_object_unref(c->pipeline);g_free(c);
-}
@@ -1,130 +0,0 @@
-/* A C port of the Mac agent's RateController (mac/frame-mac-view/Sources/
- * Controller.swift) for the Windows host. Same gate, demand protection, bitrate
- * recovery and tier hysteresis; bounded sample buffers. The Mac agent keeps its
- * Swift original, so a change to either must be made to both:
- * tests/test_pc_controller.py checks this one against the Swift trace. */
-#include "controller.h"
-#include <stdlib.h>
-#include <string.h>
-#define CAP 1024
-#define MIN(a,b) ((a)<(b)?(a):(b))
-#define MAX(a,b) ((a)>(b)?(a):(b))
-typedef struct { int64_t t, v; uint32_t seq; } Sample;
-typedef struct { Sample a[CAP]; int n; } Samples;
-struct FCController {
-    int max_fps, enabled, ceiling, target, tier, frame_bytes, held, signal, saw_ack;
-    int64_t decrease, increase, below, above, slack;
-    Samples flight, rtts, acked, sent, captures;
-};
-static const int fps[] = {60,45,30,30,30}, scale[] = {100,100,100,75,50};
-static const double floors[] = {.45,.28,.16,.08,0};
-static void remove_first(Samples *s, int n) {
-    s->n -= n; memmove(s->a, s->a+n, (size_t)s->n*sizeof(Sample));
-}
-static void add(Samples *s, Sample v, int cap) {
-    if (s->n >= cap) remove_first(s, 1);
-    s->a[s->n++] = v;
-}
-static void expire(Samples *s, int64_t oldest) {
-    int n=0; while(n<s->n && s->a[n].t<oldest) n++;
-    remove_first(s,n);
-}
-static int64_t base(FCController *c) {
-    int64_t v=0;
-    for(int i=0;i<c->rtts.n;i++) if(!i || c->rtts.a[i].v<v) v=c->rtts.a[i].v;
-    return v;
-}
-static int compare(const void *a, const void *b) {
-    int64_t x=*(const int64_t*)a, y=*(const int64_t*)b;
-    return (x>y)-(x<y);
-}
-static int64_t quantile(Samples *s,int64_t since,int numerator,int denominator) {
-    int64_t a[CAP]; int n=0;
-    for(int i=0;i<s->n;i++) if(s->a[i].t>since) a[n++]=s->a[i].v;
-    if(!n) return 0;
-    qsort(a,(size_t)n,sizeof(int64_t),compare);
-    return a[n*numerator/denominator];
-}
-static int rate(Samples *s) {
-    int64_t total=0; for(int i=0;i<s->n;i++) total+=s->a[i].v;
-    return (int)MIN(total*16,2147483647);
-}
-FCController *fc_new(int max_fps,int enabled) {
-    FCController *c=calloc(1,sizeof(*c));
-    if(c) {c->max_fps=MAX(1,max_fps);c->enabled=enabled;c->slack=40000;}
-    return c;
-}
-void fc_free(FCController *c) {free(c);}
-void fc_ceiling(FCController *c,int bps) {
-    if(!c->target || c->target>bps) c->target=bps;
-    c->ceiling=bps;
-}
-int fc_gate(FCController *c,int64_t now,int counts) {
-    if(!c->enabled || !c->saw_ack) return 1;
-    expire(&c->flight,now-2000000);
-    if(!c->flight.n) return 1;
-    int64_t interval=1000000/MIN(c->max_fps,fps[c->tier]);
-    int window=MAX(3,(int)((base(c)+c->slack)/interval)+1);
-    if(c->flight.n<window && now-c->flight.a[0].t<=base(c)+c->slack) return 1;
-    if(counts) c->held++;
-    return 0;
-}
-void fc_capture(FCController *c,int64_t now) {add(&c->captures,(Sample){now,0,0},256);}
-void fc_sent(FCController *c,uint32_t seq,int bytes,int64_t now) {
-    Sample s={now,bytes,seq};add(&c->flight,s,512);add(&c->sent,s,CAP);
-}
-int fc_ack(FCController *c,uint32_t seq,int64_t now) {
-    c->saw_ack=1;
-    for(int i=0;i<c->flight.n;i++) if(c->flight.a[i].seq==seq) {
-        Sample s=c->flight.a[i];remove_first(&c->flight,i+1);
-        add(&c->rtts,(Sample){now,now-s.t,0},CAP);
-        add(&c->acked,(Sample){now,s.v,0},CAP);return 1;
-    }
-    return 0;
-}
-int fc_update(FCController *c,int64_t now) {
-    expire(&c->rtts,now-10000000);expire(&c->acked,now-500000);
-    expire(&c->sent,now-500000);expire(&c->flight,now-2000000);
-    expire(&c->captures,now-1000000);
-    if(!c->enabled || c->ceiling<=0) return 0;
-    int64_t baseline=base(c), spread=quantile(&c->rtts,now-2000000,9,10);
-    int64_t jitter=spread ? spread-baseline : 0;
-    c->slack=1000000/MIN(c->max_fps,fps[c->tier])+MIN(MAX(jitter*3/2,25000),80000);
-    int64_t recent=quantile(&c->rtts,now-300000,1,2);
-    int64_t queue=recent ? recent-baseline : 0;
-    int64_t age=c->flight.n ? now-c->flight.a[0].t : 0;
-    int delivered=rate(&c->acked),sending=rate(&c->sent);
-    if(c->sent.n) c->frame_bytes=sending/16/c->sent.n;
-    int demand=(int)MIN((int64_t)MIN(c->captures.n,MIN(c->max_fps,fps[c->tier]))*c->frame_bytes*8,2147483647);
-    int signal=(sending>=c->target/2 && queue>40000)||c->held>=3||age>baseline+100000;
-    int congested=signal && c->signal;c->signal=signal;c->held=0;
-    if(congested && now-c->decrease>300000) {
-        int next=MAX(300000,MIN((int64_t)c->target*4/5,MAX((int64_t)delivered*9/10,c->target/2)));
-        if(demand>0 && (int64_t)demand*2<=(int64_t)c->target*5/4) next=MAX(next,MIN(c->target,(int64_t)demand*2));
-        c->target=next;c->decrease=now;
-    } else if(!congested && now-c->decrease>1000000 && now-c->increase>250000 && c->target<c->ceiling &&
-              (sending>(int64_t)c->target*6/10 || now-c->decrease>3000000)) {
-        c->target=MIN(c->ceiling,(int64_t)(c->target*1.1)+50000);c->increase=now;
-    }
-    double share=(double)c->target/MAX(c->ceiling,1);
-    if(c->tier<4 && share<floors[c->tier] && sending>=(int64_t)c->target*7/10) {
-        if(!c->below)c->below=now;
-        if(now-c->below>500000) {
-            for(c->tier=0;c->tier<4 && share<floors[c->tier];c->tier++) {}
-            c->below=0;
-        }
-    } else c->below=0;
-    if(c->tier>0 && share>floors[c->tier-1]*1.25) {
-        if(!c->above)c->above=now;
-        if(now-c->above>2000000) {c->tier--;c->above=0;}
-    } else c->above=0;
-    return c->target;
-}
-int64_t fc_value(FCController *c,int field) {
-    switch(field) {
-    case 0:return c->target;case 1:return c->ceiling;case 2:return c->tier;
-    case 3:return MIN(c->max_fps,fps[c->tier]);case 4:return scale[c->tier];
-    case 5:return base(c);case 6:return c->flight.n;case 7:return c->slack;
-    default:return 0;
-    }
-}
@@ -1,29 +0,0 @@
-/* Shared latency controller. Times are monotonic host microseconds.
- * Callers serialize access. Capture is gated BEFORE encoding: dropping an
- * encoded inter frame would break the decoder's reference chain. */
-#ifndef FRAME_CONTROLLER_H
-#define FRAME_CONTROLLER_H
-#include <stdint.h>
-#ifdef _WIN32
-#define FC_API __declspec(dllexport)
-#else
-#define FC_API
-#endif
-#ifdef __cplusplus
-extern "C" {
-#endif
-typedef struct FCController FCController;
-FC_API FCController *fc_new(int fps, int enabled);
-FC_API void fc_free(FCController *c);
-FC_API void fc_ceiling(FCController *c, int bps);
-FC_API int fc_gate(FCController *c, int64_t now, int counts);
-FC_API void fc_capture(FCController *c, int64_t now);
-FC_API void fc_sent(FCController *c, uint32_t seq, int bytes, int64_t now);
-FC_API int fc_ack(FCController *c, uint32_t seq, int64_t now);
-FC_API int fc_update(FCController *c, int64_t now);
-/* target, ceiling, tier, fps, scale percent, baseline us, in flight, slack us */
-FC_API int64_t fc_value(FCController *c, int field);
-#ifdef __cplusplus
-}
-#endif
-#endif
@@ -1,147 +0,0 @@
-/* xdg-desktop-portal RemoteDesktop + ScreenCast, one consented session per
- * panel. PipeWire receives the portal fd, never the unrestricted daemon fd.
- * Input uses only the devices granted in Start's response. */
-#ifndef _WIN32
-#include "controller.h"
-#include <gio/gio.h>
-#include <gio/gunixfdlist.h>
-#include <unistd.h>
-#include <string.h>
-#define BUS "org.freedesktop.portal.Desktop"
-#define PATH "/org/freedesktop/portal/desktop"
-#define RD "org.freedesktop.portal.RemoteDesktop"
-#define SC "org.freedesktop.portal.ScreenCast"
-typedef struct {
-    GDBusConnection *bus;
-    GMainContext *context;
-    char *session;
-    int fd;
-    unsigned node, devices;
-    int width,height;
-} Portal;
-typedef struct {GVariant *result;int done;unsigned code;} Response;
-static void response(GDBusConnection *c,const char *sender,const char *path,const char *iface,
-                     const char *signal,GVariant *params,gpointer data) {
-    (void)c;(void)sender;(void)path;(void)iface;(void)signal;
-    Response *r=data;g_variant_get(params,"(u@a{sv})",&r->code,&r->result);r->done=1;
-}
-static void option(GVariantBuilder *b,const char *key,GVariant *v) {g_variant_builder_add(b,"{sv}",key,v);}
-static GVariant *request(Portal *p,const char *iface,const char *method,GVariant *args,
-                         const char *token,char *error,int capacity) {
-    char *sender=g_strdup(g_dbus_connection_get_unique_name(p->bus)+1);
-    for(char *c=sender;*c;c++)if(*c=='.')*c='_';
-    char *path=g_strdup_printf(PATH "/request/%s/%s",sender,token);g_free(sender);
-    Response r={0};GError *e=NULL;
-    guint sub=g_dbus_connection_signal_subscribe(p->bus,BUS,"org.freedesktop.portal.Request","Response",
-                                                 path,NULL,G_DBUS_SIGNAL_FLAGS_NONE,response,&r,NULL);
-    GVariant *reply=g_dbus_connection_call_sync(p->bus,BUS,PATH,iface,method,args,G_VARIANT_TYPE("(o)"),
-                                               G_DBUS_CALL_FLAGS_NONE,10000,NULL,&e);
-    if(reply)g_variant_unref(reply);
-    int64_t deadline=g_get_monotonic_time()+120000000;
-    while(!e && !r.done && g_get_monotonic_time()<deadline) {
-        while(g_main_context_iteration(p->context,FALSE)) {}
-        g_usleep(10000);
-    }
-    if(!r.done) {
-        GVariant *closed=g_dbus_connection_call_sync(p->bus,BUS,path,"org.freedesktop.portal.Request","Close",
-                                NULL,NULL,G_DBUS_CALL_FLAGS_NONE,2000,NULL,NULL);
-        if(closed)g_variant_unref(closed);
-    }
-    g_dbus_connection_signal_unsubscribe(p->bus,sub);g_free(path);
-    if(e || !r.done || r.code) {
-        g_strlcpy(error,e?e->message:!r.done?"Screen sharing request timed out":"Screen sharing was cancelled or refused",capacity);
-        if(e)g_error_free(e);if(r.result)g_variant_unref(r.result);return NULL;
-    }
-    return r.result;
-}
-FC_API void fc_portal_close(Portal *p) {
-    if(!p)return;
-    if(p->session && p->bus) {
-        GVariant *r=g_dbus_connection_call_sync(p->bus,BUS,p->session,"org.freedesktop.portal.Session","Close",
-                                                NULL,NULL,G_DBUS_CALL_FLAGS_NONE,2000,NULL,NULL);
-        if(r)g_variant_unref(r);
-    }
-    if(p->fd>=0){close(p->fd);p->fd=-1;}
-    g_free(p->session);if(p->bus)g_object_unref(p->bus);
-    if(p->context)g_main_context_unref(p->context);g_free(p);
-}
-/* Each pipeline gets a fresh restricted PipeWire connection. A dup of a
- * previously consumed protocol socket is not a new connection.
- * Ownership: the Portal owns p->fd for its whole life and is its only closer.
- * pipewiresrc never takes the fd it is given: its core connects with
- * pw_context_connect_fd(ctx, fcntl(fd, F_DUPFD_CLOEXEC, 3), ...) and that
- * duplicate is what PipeWire closes on teardown (src/gst/gstpipewirecore.c,
- * unchanged from 0.3.19 through 1.x). So closing p->fd here is not a double
- * close; not closing it would leak one socket per pipeline reopen. The
- * caller closes the previous pipeline before asking for a new fd. */
-FC_API int fc_portal_refresh(Portal *p,char *error,int capacity) {
-    GVariantBuilder b;g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    GUnixFDList *fds=NULL;GError *e=NULL;
-    GVariant *r=g_dbus_connection_call_with_unix_fd_list_sync(p->bus,BUS,PATH,SC,"OpenPipeWireRemote",
-         g_variant_new("(oa{sv})",p->session,&b),G_VARIANT_TYPE("(h)"),G_DBUS_CALL_FLAGS_NONE,10000,NULL,&fds,NULL,&e);
-    if(!r){g_strlcpy(error,e->message,capacity);g_error_free(e);return -1;}
-    int handle;g_variant_get(r,"(h)",&handle);g_variant_unref(r);
-    int fd=g_unix_fd_list_get(fds,handle,&e);g_object_unref(fds);
-    if(fd<0){g_strlcpy(error,e->message,capacity);g_error_free(e);return -1;}
-    if(p->fd>=0)close(p->fd);
-    p->fd=fd;return fd;
-}
-FC_API Portal *fc_portal_select(char *error,int capacity) {
-    Portal *p=g_new0(Portal,1);p->fd=-1;p->context=g_main_context_new();
-    g_main_context_push_thread_default(p->context);
-    GError *e=NULL;GVariant *r=NULL;
-    p->bus=g_bus_get_sync(G_BUS_TYPE_SESSION,NULL,&e);
-    if(!p->bus) {g_strlcpy(error,e->message,capacity);g_error_free(e);goto fail;}
-    GVariantBuilder b;char token[64],session[64];
-    g_snprintf(session,sizeof(session),"fc_%u",g_random_int());
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());
-    g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"session_handle_token",g_variant_new_string(session));
-    r=request(p,RD,"CreateSession",g_variant_new("(a{sv})",&b),token,error,capacity);if(!r)goto fail;
-    g_variant_lookup(r,"session_handle","s",&p->session);g_variant_unref(r);r=NULL;
-    if(!p->session){g_strlcpy(error,"Portal did not return a session",capacity);goto fail;}
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"types",g_variant_new_uint32(3));
-    r=request(p,RD,"SelectDevices",g_variant_new("(oa{sv})",p->session,&b),token,error,capacity);if(!r)goto fail;g_variant_unref(r);
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"types",g_variant_new_uint32(3));
-    option(&b,"multiple",g_variant_new_boolean(FALSE));option(&b,"cursor_mode",g_variant_new_uint32(2));
-    r=request(p,SC,"SelectSources",g_variant_new("(oa{sv})",p->session,&b),token,error,capacity);if(!r)goto fail;g_variant_unref(r);
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));
-    r=request(p,RD,"Start",g_variant_new("(osa{sv})",p->session,"",&b),token,error,capacity);if(!r)goto fail;
-    g_variant_lookup(r,"devices","u",&p->devices);
-    GVariant *streams=g_variant_lookup_value(r,"streams",G_VARIANT_TYPE("a(ua{sv})"));
-    if(streams && g_variant_n_children(streams)>0) {
-        GVariant *entry=g_variant_get_child_value(streams,0),*props=NULL;
-        g_variant_get(entry,"(u@a{sv})",&p->node,&props);
-        g_variant_lookup(props,"size","(ii)",&p->width,&p->height);
-        g_variant_unref(props);g_variant_unref(entry);
-    }
-    if(streams)g_variant_unref(streams);g_variant_unref(r);r=NULL;
-    if(!p->node || p->width<=0 || p->height<=0) {g_strlcpy(error,"Portal returned no stream size",capacity);goto fail;}
-    if(fc_portal_refresh(p,error,capacity)<0)goto fail;
-    g_main_context_pop_thread_default(p->context);return p;
-fail:
-    g_main_context_pop_thread_default(p->context);fc_portal_close(p);return NULL;
-}
-FC_API int fc_portal_value(Portal *p,int field) {
-    switch(field){case 0:return p->fd;case 1:return (int)p->node;case 2:return p->width;
-                 case 3:return p->height;case 4:return (int)p->devices;default:return 0;}
-}
-FC_API int fc_portal_input(Portal *p,int type,double x,double y,int code,int down) {
-    const char *method=NULL;GVariant *args=NULL;GVariantBuilder b;g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    if(type==0 && (p->devices&2)) {
-        method="NotifyPointerMotionAbsolute";args=g_variant_new("(oa{sv}udd)",p->session,&b,p->node,x,y);
-    } else if(type==1 && (p->devices&2)) {
-        method="NotifyPointerButton";args=g_variant_new("(oa{sv}iu)",p->session,&b,code,(guint)down);
-    } else if(type==2 && (p->devices&2)) {
-        method="NotifyPointerAxis";args=g_variant_new("(oa{sv}dd)",p->session,&b,x,y);
-    } else if(type==3 && (p->devices&1)) {
-        method="NotifyKeyboardKeysym";args=g_variant_new("(oa{sv}iu)",p->session,&b,code,(guint)down);
-    } else return 0;
-    GError *e=NULL;GVariant *r=g_dbus_connection_call_sync(p->bus,BUS,PATH,RD,method,args,NULL,
-                                                       G_DBUS_CALL_FLAGS_NONE,2000,NULL,&e);
-    if(e)g_error_free(e);if(r)g_variant_unref(r);return r!=NULL;
-}
-#endif
@@ -97,7 +97,7 @@ replies, screenshots and approval payloads are not sent to analytics.

 ## Assistant panel

-Open **Settings** (the gear in the header) **→ Open assistant settings**, or `http://127.0.0.1:47810/assistant`.
+Open **Tools → Open assistant**, or `http://127.0.0.1:47810/assistant`.
 To put the same page in the headset, with the HTTP server still running:

 ```sh
@@ -1,57 +0,0 @@
-# Import an Android game backup
-
-A SideQuest backup can contain a small APK and much larger `main.…obb` and
-`patch.…obb` files. All of them belong to the same game. Installing only the APK
-can leave the game unable to start because its assets are missing.
-
-In **Add / Install → Import Android game** (or **Apps → Browse → Import Android game**), choose the APK and its OBB files together.
-You can also drop them anywhere in the window. In the desktop app, dropping the
-APK alone finds matching OBB files beside it; dropping a folder containing the
-APK and OBBs also works. Browsers can read only the files you explicitly choose.
-
-The import screen shows the game app and its game-data files together. **Import
-game & data** installs the APK, starts its own Steam library instance, waits for
-Android and the installed package, copies the OBBs, and closes the game. Open it
-again from the Steam library to play. The screen explains this before import;
-choosing files alone never starts a game.
-
-Files are matched using the package inside the APK and the standard
-`main|patch.<version>.<package>.obb` name, not the APK's filename. Both main and
-patch files are preserved. OBB version numbers need not equal the APK's current
-version code: updates can reuse older expansion files. The copy uses the existing
-SHA-256 transfer check inside Android and writes to that game's own
-`/sdcard/Android/obb/<package>` folder.
-
-If no data files are selected, the screen reminds you to include any OBBs in the
-backup before offering **Install game app**. An APK cannot reliably tell Frame
-Control whether separate expansion files are required. Game-data files are never
-silently sent to Downloads by this flow.
-
-If setup fails, the import screen keeps the error and retry instructions visible.
-The APK may already be installed, but the game is not reported ready. Import the
-same backup again, or choose just its OBB files to add data to an existing install.
-The importer checks the installed package and version before writing data and
-closes the instance after a failed copy. Unrelated or duplicate files, running
-games that would be replaced, and downgrades are rejected. Uploaded staging files
-are discarded after use or cancellation; abandoned imports expire after an hour
-when the importer is next used, and dead-server staging folders are swept at
-startup.
-
-This flow handles one ordinary APK and standard OBB files for one game at a time.
-Split APKs, XAPK/APKS archives, nested Android/data folders and private save
-archives need their own import handling. PC ZIP/folder/EXE imports keep their
-existing route. Quest USB and Meta library imports keep their existing workflow.
-
-Validation covers actual APK parsing, the three-file backup layout, package
-matching, sibling discovery, browser upload staging and cleanup, instance/version
-guards and failure recovery with mocked headset operations. Browser verification
-uses the real page and upload/inspection endpoints with simulated installation.
-**Verified 2026-10-20 on a real Steam Frame**, BUILD_ID `20260925.6191901`:
-F-Droid Basic 2.0.2 with two synthetic main/patch OBBs completed the automatic
-install/start/copy/close sequence. Reopening its persistent instance confirmed
-both SHA-256 hashes in `/sdcard/Android/obb/org.fdroid.basic`. The test app,
-shortcut and instance were removed afterward, the shared device lock was
-released, and the battery remained at 99%. See [device evidence](evidence/android-import/device.json).
-The headset was unworn; this checks transfer and persistence, not rendering,
-Resident Evil 4 gameplay, or a game that exits before data can be copied. This
-flow does not change APK compatibility or remove licence checks.
@@ -183,63 +183,6 @@ See
 [compat-db/README.md](../compat-db/README.md) and
 [apk-catalog/README.md](../apk-catalog/README.md).

-## Store and Library in Frame Control
-
-The Android tab has two views. **Store** finds apps across the sources (F-Droid,
-IzzyOnDroid, curated GitHub releases, itch.io). **Library** shows the apps on the
-Frame as cards, with Play and a menu for Test, Report and Remove; the display
-settings and recent reports are below it.
-
-The store groups apps by what a headset is good for, not by F-Droid's list:
-VR, Games, Emulators, Watch & listen, Read & learn, Create, Work, Web & chat
-and Tools (`ui/apk_sources/_categories.py`). A VR app is always in VR. Otherwise
-F-Droid's own categories decide, the finer one first (an app in *Multimedia* and
-*Social Network* is Web & chat).
-
-Apps built around a phone are hidden from browsing unless **Show phone-only
-apps** is on; a search always finds them, labelled *Phone app*. Hidden: apps in
-a category that only makes sense in a phone's own system (launchers, keyboards,
-wallpapers, Xposed modules), apps in a phone-side category (calls and SMS, VPNs,
-fitness, alarms, system tools) unless a useful category says otherwise
-(FluffyChat is in Phone & SMS, but it's a messenger), apps named for a phone
-part (a widget, a launcher, a battery tool), and apps that need hardware the
-Frame lacks (an IR blaster, a watch, NFC, root). They would install and run in
-Lepton, but do nothing useful on the Frame. In the October 2026 indexes that is
-about 1,600 of F-Droid's 4,500 apps and 550 of IzzyOnDroid's 1,300.
-
-Without a search, each source offers its best 300 for the chosen category:
-apps with a banner first, then with screenshots, then the newest.
-
-## The store in the headset: Frame Control's store as a panel (inferred, not yet run on the Frame)
-
-The **APK Store** panel is the Store above, drawn for the laser: the same
-sources, categories and artwork, with Install, Open, Stop and Remove, opened as
-its own floating panel:
-
-```sh
-scripts/store-on-frame.sh open     # copy the server over if it changed, start it, open the panel
-scripts/store-on-frame.sh close
-```
-
-`open` copies the same bundle the iPhone app uses
-(`ios/scripts/make_frame_bundle.py`) to
-`~/.local/share/frame-control/store-server/<version>` on the Frame. It then
-starts `ui/server.py` there with `FRAME_LOCAL=1` on `127.0.0.1:47812`, with a
-fresh `X-Frame-UI` key. Chromium XR (or the `org.chromium.Chromium` Flatpak)
-opens `/store` (`ui/store.html`) in a 1280×800 app window, tagged as panel
-`2001947812` ([panels.md](panels.md)). Downloads, SHA-256 checks and installs
-all run on the Frame, so the Mac can go away after `open`.
-
-The page has a category rail (Home, the store's categories, Installed), eight
-art cards a page, and a featured VR app on Home. It turns pages instead of
-scrolling, because a tagged panel gets mouse clicks and a drag would select
-text; the thumbstick (a mouse wheel) turns pages, and an on-screen keyboard is
-there for search. **Checked on the Mac only** (2026-10-14, 1280×800, against
-the real sources): Home, categories, Installed, the detail sheet. **Still to
-check in the headset:** that the panel opens and takes laser clicks, that an
-install completes when run on the Frame, and that **Open** brings up the app's
-panel.
-
 ## In-headset app store: F-Droid 1.17 (verified 2026-09-25)

 F-Droid 1.23 uses an old Compose and crashes on launch. **F-Droid 1.17.2**, the
@@ -1,167 +0,0 @@
-# Backup and recovery
-
-**Tools → Backup & recovery** copies what a factory reset would lose from the
-Steam Frame to your computer, puts it back afterwards, and gets the headset out
-of Desktop Mode. It runs from Frame Control on a computer, not from the iPhone
-app or the Frame itself.
-
-**Partly tested on a headset.** On a Frame running SteamOS 0.5.6 (build
-20261015.6141207), a full backup saved 26 parts (40.7 MB): 14 games' Proton
-saves, Linux game saves, Steam and desktop settings and 9 Android apps' data,
-with no sign-in files or keys in the archives. Restoring one game's saves on top
-of identical files wrote nothing and left nothing behind. The session check
-reported Game Mode, so **Return to Game Mode** changed nothing. Not tested on a
-headset: a restore after a real factory reset, a restore that replaces files,
-Android data restore, and the switch out of a real Desktop Mode session. Unit
-tests and the fake Frame cover those (see [Verification](#verification)).
-
-## Back up
-
-Choose **Game saves**, **Steam and desktop settings** and **Android app data**
-(all three by default), then **Back up now**. **See what's included** lists each
-part and its size first. Backing up only reads the headset.
-
-Each backup is a folder named after the time it started:
-
-```
-~/Documents/Frame Control Backups/2026-10-23-142530/
-  manifest.json
-  saves/saves-1234.tar.gz          one per game
-  saves/saves-linux.tar.gz
-  settings/settings-steam.tar.gz
-  settings/settings-system.tar.gz
-  android/org.example.game.tar.gz  one per Android app
-```
-
-`manifest.json` records the headset's name, SteamOS version and BUILD_ID, every
-file with its size and SHA-256, and each archive's SHA-256. It also lists what
-was skipped and why. A backup is written under a hidden `.…partial` name and
-renamed when complete, so a cut-off backup never shows up as one.
-
-### What's saved
-
-| Part | From the headset (`~` is `/home/steamos`) | Restored? |
-|---|---|---|
-| Windows game saves | `~/.local/share/Steam/steamapps/compatdata/<appid>/pfx/drive_c/users/steamuser/` → `AppData/Roaming`, `AppData/Local`, `AppData/LocalLow`, `Documents`, `Saved Games`. Wine's own folders in them (`Temp`, `Microsoft`, `D3DSCache`, `CrashDumps`) are left out. Sideloaded Windows games (non-Steam shortcuts) have prefixes here too | Yes |
-| Linux game saves | `~/.config/unity3d`, `~/.local/share/godot/app_userdata`: where Unity and Godot games save by default | Yes |
-| Steam controller layouts | `userdata/<account>/241100/remote/controller_config`, `steamapps/common/Steam Controller Configs/<account>/config` | Yes |
-| Steam library settings | `userdata/<account>/config/localconfig.vdf`, `shortcuts.vdf`, `grid/` (custom artwork) | Kept for reference |
-| Desktop settings | `~/.config/kdeglobals`, `kwinrc`, `kxkbrc` (keyboard layout), `konsolerc`, `dolphinrc` | Yes |
-| SteamVR settings | `~/.config/openvr/config/steamvr.vrsettings` | Kept for reference |
-| Android app data | Each Frame Control Android app's private data, through the existing `backup-data` helper ([sidequest.md](sidequest.md#private-app-data-backups)) | Yes |
-
-"Kept for reference" files are in the backup but not put back automatically:
-Steam and SteamVR rewrite them while they run, and an old `shortcuts.vdf` would
-point at apps that aren't installed after a reset. Open the backup folder to
-copy one by hand if you need it.
-
-### What's never copied
-
- **Steam sign-in:** `steam.token`, `config/config.vdf`, `loginusers.vdf`,
-  `registry.vdf` and `ssfn*` files.
- **Keys and passwords:** `~/.ssh`, `~/.gnupg`, keyrings and KWallet, any
-  `*.token`, `*.key` or `*.pem` file, Tailscale state and proxy settings
-  (`secrets.env`). These are refused by name wherever they turn up, including
-  inside a game's folder, and a restore refuses them too.
- Games, Proton and the Steam runtimes: reinstall them from Steam.
- Steam Cloud's own folders (`userdata/<account>/<appid>`), shader caches and
-  screenshots (**Tools → Capture & Live** saves those to Pictures).
- Android apps themselves, their OBB files and shared storage (`/sdcard`).
- Symbolic links (never followed), and single files over 2 GiB.
-
-Backups aren't encrypted. Game folders can still hold a launcher's login, and
-Android app data can hold an app's, so keep backups private.
-
-Android apps that are open are skipped (the helper needs the app closed); close
-them and back up again.
-
-## Restore after a factory reset
-
-1. Set up the headset again: Developer Mode, **Set Up Connection**, sign in to
-   Steam with the same account.
-2. Reinstall your games, and **start each once** so Proton creates its folders.
-3. Reinstall your Android apps from Frame Control.
-4. **Tools → Backup & recovery → Restore…** on a backup. Frame Control checks
-   each part against the headset and says what it would do: how many files it
-   replaces and how many are new.
-5. Tick the parts to restore and **Restore selected**. It asks before replacing
-   anything.
-
-Parts that can't go back yet are skipped, not failed, with the reason:
-
-| Reason | What to do |
-|---|---|
-| Install the game first | Install it from Steam, then restore |
-| Start the game once | Proton hasn't made its folders yet; start the game, quit, restore |
-| Sign in to Steam first | Controller layouts go under your account's folder |
-| Install the app first / close the app first | Android app data needs the app installed and closed |
-| The backup file doesn't match its checksum | The archive changed since it was made |
-
-A restore writes only the files in the parts you chose, and only inside that
-part's folders: it never deletes a file, and a save archive can't write outside
-its game. Before replacing a file it copies the current one to
-`~/.local/share/frame-control/restore-previous/<time>/` on the headset. Files
-already identical are left alone. Android app data goes through the existing
-`restore-data` helper, which keeps the previous data folder beside it.
-
-## Stuck in Desktop Mode
-
-On the Frame, Game Mode is gamescope running Steam, and the Linux desktop
-normally runs *inside* it as one panel (`steamos-nested-desktop`, see
-[how-the-frame-works.md](how-the-frame-works.md#the-layer-cake)). If that panel
-is what you see, you're already in Game Mode: close it from the Steam dashboard.
-
-Full Desktop Mode is a different session. SteamOS picks the session through
-SDDM's autologin file, `/etc/sddm.conf.d/zz-steamos-autologin.conf` (or the
-default `/etc/sddm.conf.d/steamos.conf`), and switches with
-`steamos-session-select` (`holo-session-select` on newer images). This is what
-Valve's own devkit tools on the Frame read and run
-([`steamos-get-status`](../frame/devkit-utils/steamos-get-status),
-[`steamos-delete`](../frame/devkit-utils/steamos-delete)).
-
-**Check** reads that file and whether gamescope and Plasma are running; it
-changes nothing. On the Frame gamescope's process is `gamescope-wl`, started by
-`start-gamescope-session`, and either counts as Game Mode. Only when Plasma is
-running without gamescope (Desktop Mode) does **Return to Game Mode** run
-exactly `steamos-session-select gamescope` (or `holo-session-select
-gamescope`) over SSH, after asking. It closes the desktop and anything open in
-it. Frame Control never edits the SDDM files itself, and runs nothing when the
-headset is in Game Mode, when it can't tell which mode it's in, or when the
-image has neither command.
-
-**Uncertain:** whether the Frame offers a full Desktop Mode session at all
-(only the nested desktop has been seen on BUILD_ID 20260922.6101926 and
-20260925.6191901), and whether `steamos-session-select` there works without
-the Developer Mode password. If the switch is refused, Frame Control says so and
-leaves the headset as it was.
-
-### Manual fallback
-
-If the button can't help, or the headset isn't reachable:
-
-1. **Restart it:** hold Power about 10 seconds until the light goes off, then
-   power on. On the Steam Deck, **Switch to Desktop** starts a one-shot
-   Desktop Mode session, so a restart brings Game Mode back. That the Frame
-   behaves the same is **inferred**, not tested.
-2. **Over SSH** (Developer Mode on), run Valve's switch yourself:
-   `ssh frame steamos-session-select gamescope`.
-3. **Boot menu:** hold Power 10 seconds, then power on while holding the AUX
-   button on top of Power. Choose `Current`, or `Previous` to start the other
-   SteamOS slot; both keep your data. Details and the further options
-   (`Repair Steam Installation`, `Erase User Data`, a full re-image) are in
-   [how-the-frame-works.md](how-the-frame-works.md#facts-worth-knowing) and
-   [recovery-and-images.md](recovery-and-images.md). Back up first if you can:
-   `Erase User Data` is a factory reset.
-
-## Verification
-
-`tests/test_backup.py` runs the headset-side script (`ui/frame_backup_remote.py`)
-for real against a folder laid out like the Frame's home, with only SSH faked:
-which paths are picked, that sign-in files and keys never are (also inside game
-folders), links never followed, the manifest and its checksums, restore checks
-after a reset (game not installed, no Proton folders yet, not signed in), that a
-restore replaces only its own files and keeps the old ones, unsafe archives
-(`..`, absolute paths, links, other games' folders) writing nothing, backup
-names that try to leave the backups folder, and the exact Game Mode command.
-`tests/e2e/test_recovery_kit.py` backs up a Proton save from the fake Frame through
-the server, deletes it and restores it. Neither involves a real headset.
@@ -1,165 +0,0 @@
-# Battery charge limit (80%): research
-
-**Question:** can Frame Control set an 80% battery charge limit on the Frame
-over SSH or adb, safely?
-
-**Verdict: don't build it.** Valve's supported mechanism (the one Steam's own
-charge-limit setting uses on the Deck) is not configured for the Frame. The
-only control the Frame has is a vendor charger attribute that Valve's own
-charging daemon also manages. Research as of 2026-10-23, confirmed with the
-read-only checks below on a Frame running SteamOS 0.5.6 (build 20261015.6141207):
-
- `steamosctl get-max-charge-level` fails with `UnknownInterface: ...BatteryChargeLimit1`.
- `/usr/share/steamos-manager/devices/` has `[battery_charge_limit]` only for
-  the Steam Deck, ROG Ally, ROG Xbox Ally and MSI Claw, not the Frame.
- Power supplies: `max1720x_bat_7-36` (Battery, driver `max1720x`),
-  `pm8550b-charger` (driver `qcom,pm8550b-charger`) and the USB-C `tcpm-source-psy-…`.
-  No `charge_control_end_threshold` anywhere; `pm8550b-charger` has
-  `charging_enable` and `charging_pause`, both `root`-only (`-rw-r--r--`).
- `deckard-charger.service` (Deckard Battery Charger service) is enabled and running.
-
-## How Steam does it on other devices
-
- Steam's **Settings → Power → Battery Charge Limit** shipped to the Deck in
-  SteamOS 3.7.8 (beta client 2025-05-08)
-  ([GamingOnLinux](https://www.gamingonlinux.com/2025/05/steamos-3-7-7-beta-brings-a-battery-charge-limit-option-and-improved-lenovo-legion-go-s-support/)).
- Steam calls SteamOS Manager on the session bus:
-  `com.steampowered.SteamOSManager1.BatteryChargeLimit1`, with properties
-  `MaxChargeLevel` (`i`, read/write; `-1` resets to the default) and
-  `SuggestedMinimumLimit` (`i`, read-only). The CLI is
-  `steamosctl get-max-charge-level` / `set-max-charge-level` /
-  `suggested-minimum-charge-limit`. Source: `data/interfaces/com.steampowered.SteamOSManager1.xml`
-  and `steamos-manager/src/bin/steamosctl.rs` in
-  [holo/steamos-manager](https://gitlab.steamos.cloud/holo/steamos-manager),
-  read at commit `83981ab` (2026-10-21).
- The root daemon writes the value to sysfs only if the device's TOML in
-  `data/devices/` has a `[battery_charge_limit]` section. Two methods exist
-  (`steamos-manager/src/power.rs`, `BatteryChargeLimitMethod`):
-  - `hwmon_attribute`: the Deck writes `max_battery_charge_level` on
-    `steamdeck_hwmon` (`data/devices/steam-deck.toml`).
-  - `acpi_sb`: ROG Ally, MSI Claw and others write the standard
-    `charge_control_end_threshold` on the ACPI battery
-    (`/sys/bus/{platform,acpi}/drivers/…battery…/PNP0C0A:00/…/power_supply/*/`).
-    On ARM there's no ACPI, so this path can't match there either.
- With no `[battery_charge_limit]` section, the interface fails with
-  `UnknownInterface` (Steam can still show its toggle on unsupported hardware:
-  [steam-for-linux#12044](https://github.com/ValveSoftware/steam-for-linux/issues/12044)).
-
-## What the Frame has
-
- **Upstream `data/devices/steam-frame.toml`** (matched by
-  `dt.compatible = "qcom,sm8650"`, variant `Deckard`) configures GPU clocks
-  and performance profiles only. It has **no `[battery_charge_limit]`**, so
-  SteamOS Manager on the Frame has no charge-limit backend. Its git history
-  (2026-09-10 to 2026-10-12) never added one.
- **Battery driver:** the Frame's battery is
-  `/sys/class/power_supply/max1720x_bat_7-36`, and the charger is a
-  `tcpm-source-psy-…` USB-PD supply ([how-the-frame-works.md](how-the-frame-works.md)).
-  Both were verified 2026-09-25, and `ui/frame_status.py` `battery()` and
-  `power_source()` read them. The Maxim MAX1720x is a **fuel gauge** and
-  can't control charging. Mainline `drivers/power/supply/max1720x_battery.c`
-  exposes only read-only properties (capacity, voltage, current, temp,
-  charge_full…), with no `charge_control_end_threshold`. Valve's build is
-  patched: it reports `time_to_full_now`, which mainline doesn't have. Even
-  so, a charge stop would have to come from the separate charger IC, not this
-  node.
- **Not the qcom_battmgr path.** Some other SM8650/SM8750 handhelds get
-  `charge_control_end_threshold` from Qualcomm's `qcom_battmgr`
-  (pmic_glink) driver, clamped at 55% or above. A third-party distro enabled
-  Steam's limit on those by patching steamos-manager
-  ([armada-os/armada#758](https://github.com/armada-os/armada/pull/758)). The
-  Frame's battery isn't exposed by `qcom_battmgr`, so that doesn't carry over.
-  (Unverified: whether a `qcom_battmgr` node also exists on the Frame. The
-  read-only checks below answer this.)
- **What third parties found:**
-  [y0usaf/frame-charge](https://github.com/y0usaf/frame-charge) reports that
-  the Frame has no `charge_control_end_threshold` and falls back to a vendor
-  `charging_pause` attribute. It also reports that `constant_charge_current`
-  changes on its own, which it attributes to Valve's `deckard_charge_daemon`
-  (`deckard-charger.service`). By its own README, that tool has only run its
-  read-only `status` on a Frame and has **not** been tested against real
-  charging. Two questions are still open: whether pausing stops the current,
-  and whether Valve's daemon undoes it.
-
-## Why not build it now
-
- **No supported endpoint.** The only Valve-supported interface,
-  `BatteryChargeLimit1`, isn't backed on the Frame. Writing sysfs ourselves
-  would bypass Steam and SteamOS Manager, and it needs root (`sudo -S` with
-  the user's password).
- **A rival owner.** Valve's charge daemon already adjusts charging
-  parameters. Toggling `charging_pause` underneath it could be undone without
-  warning, fight it in a loop, or leave charging paused.
- **Stuck at a low charge.** If the app or the Frame dies while charging is
-  paused, the Frame could sit at a low charge on the charger. Whether a
-  reboot clears `charging_pause` is unknown.
- **The UI would mislead.** Steam's setting (if it shows at all) wouldn't
-  reflect our limit.
- **adb doesn't help.** Wi-Fi adb (`frame:5555`) reaches the Lepton Android
-  container only. USB-C adb reaches the Linux side as `steamos` (non-root, the
-  same as SSH, [ssh.md](ssh.md)). Neither adds a charging-control route.
-  Android's `dumpsys battery` in Lepton is a container view, not the hardware.
-
-**Revisit when** a SteamOS update adds `[battery_charge_limit]` to
-`steam-frame.toml` (or `steamosctl get-max-charge-level` stops returning
-`UnknownInterface` on the Frame). Then the feature is just a SteamOS Manager
-call:
-
- Read: `steamosctl get-max-charge-level`
- Set: `steamosctl set-max-charge-level 80`
- Undo: `steamosctl set-max-charge-level -- -1`
-
-That runs as `steamos` with no sudo. It's the same value Steam's own
-Settings → Power shows, so both stay in sync.
-
-## Headset checks (read-only first)
-
-Run these over SSH as `steamos`. Steps 1–4 only read.
-
-```sh
-# 1. Does SteamOS Manager offer the interface on this build?
-steamosctl get-max-charge-level; steamosctl suggested-minimum-charge-limit
-busctl --user introspect com.steampowered.SteamOSManager1 \
-  /com/steampowered/SteamOSManager1 | grep -i -A3 ChargeLimit
-grep -n battery_charge_limit /usr/share/steamos-manager/devices/*frame* 2>/dev/null
-
-# 2. Which power supplies exist, and which drivers back them?
-for d in /sys/class/power_supply/*; do
-  echo "== $d ($(cat $d/type)) driver=$(basename "$(readlink -f $d/device/driver)" 2>/dev/null)"
-  ls $d
-done
-
-# 3. Any charge-control attributes, with their values and permissions?
-ls -l /sys/class/power_supply/*/{charge_control_*,charging_pause,charging_enable,constant_charge_current*,charge_behaviour} 2>/dev/null
-grep -H . /sys/class/power_supply/*/{charge_control_*,charging_pause,charging_enable,constant_charge_current*,charge_behaviour} 2>/dev/null
-
-# 4. What is Valve's charger daemon, and what does it touch?
-systemctl status deckard-charger.service --no-pager
-systemctl cat deckard-charger.service
-journalctl -b -u deckard-charger.service --no-pager | tail -50
-```
-
-If step 1 succeeds on some build, test `steamosctl set-max-charge-level 80`
-on a charger at a charge above 80%. Watch `current_now` on the
-`max1720x_bat_*` node fall to about 0, then `steamosctl set-max-charge-level -- -1` and
-confirm charging resumes. Do this on a supervised Frame only. If only step 3
-finds a vendor attribute, **stop**: don't write it, and leave the question
-with Valve.
-
-## Sources
-
- steamos-manager source, commit `83981ab` (2026-10-21):
-  `data/devices/steam-frame.toml`, `data/devices/steam-deck.toml`,
-  `data/interfaces/com.steampowered.SteamOSManager1.xml`,
-  `steamos-manager/src/power.rs`, `steamos-manager/src/manager/user.rs`.
-  [gitlab.steamos.cloud/holo/steamos-manager](https://gitlab.steamos.cloud/holo/steamos-manager)
- Mainline [`max1720x_battery.c`](https://github.com/torvalds/linux/blob/master/drivers/power/supply/max1720x_battery.c)
- [ValveSoftware/steam-for-linux#12044](https://github.com/ValveSoftware/steam-for-linux/issues/12044):
-  the Steam toggle shows on unsupported hardware
- [armada-os/armada#758](https://github.com/armada-os/armada/pull/758):
-  `qcom_battmgr` threshold on other SM8650/SM8750 devices
- [y0usaf/frame-charge](https://github.com/y0usaf/frame-charge): third-party,
-  untested on real charging
- [GamingOnLinux: SteamOS 3.7.7 beta charge limit](https://www.gamingonlinux.com/2025/05/steamos-3-7-7-beta-brings-a-battery-charge-limit-option-and-improved-lenovo-legion-go-s-support/)
- Repo: [how-the-frame-works.md](how-the-frame-works.md) (battery and
-  charger nodes), [ssh.md](ssh.md) (adb scope), `ui/frame_status.py`
@@ -3,9 +3,8 @@
 Frame Control can manage more than one Steam Frame, and each headset can be
 reached at more than one address: a LAN IP at home, another at the office, its
 mDNS name (`frame.local`), its Tailscale IP or MagicDNS name. The **Devices**
-tab (key 5) lists them. The connection pill in the header says whether the one in
-use is connected and how (Tailscale, or the network's name); click it to add,
-edit or reorder that headset's addresses, or to see each step of connecting.
+tab (key 5) lists them, and the connection pill in the header shows what the
+app is doing to reach the one in use, step by step, as it happens.

 The code is in three modules, all stdlib-only Python on your computer:

@@ -58,7 +57,7 @@ and ranks them:
 5. addresses that only ever worked on other networks;
 6. Tailscale addresses while Tailscale is off.

-Your order (on the Devices tab, or in the pill's dialog) breaks ties. The best-ranked address that answers
+Your order on the Devices tab breaks ties. The best-ranked address that answers
 wins; one that answers first waits up to 0.35 s for a better-ranked one that is
 still trying. If SSH to the winner fails in a way another address could fix
 (a different device answered there, or the link dropped), the next one that
@@ -73,16 +72,6 @@ status --json`, including the Mac app's own CLI) with buttons to add their
 MagicDNS name or IP. **Find on this network** asks mDNS for SteamOS devkit
 services and checks `ALIAS.local` and `frame.local`.

-**The pill's dialog** lists the same addresses, with what each one answered, and
-can add, edit, reorder and remove them without leaving the page you're on. When
-the headset reports a LAN IP on the same network as this computer and that IP
-isn't saved, it offers to add it. The offer puts the address first in the list,
-so on that network it wins over the Tailscale name; away from home the Tailscale
-name still leads. A new or edited address is tested straight away. While
-connected, **Reconnect** applies your changes now rather than at the next
-connection: it tries the addresses again, ranked as above, and the best-ranked
-one that answers promptly wins. It doesn't pick a particular address.
-
 ## Networks

 A network is told apart by its default gateway: the router's IP address plus its
@@ -1,34 +0,0 @@
-{
-  "date": "2026-10-20T03:53:25Z",
-  "build_id": "20260925.6191901",
-  "app": "F-Droid Basic 2.0.2 (org.fdroid.basic, version code 2000052)",
-  "input": "One real APK plus synthetic main and patch OBBs named with older version code 2000050",
-  "sibling_discovery": true,
-  "automatic_import": "passed",
-  "closed_after_import": true,
-  "independent_readback": [
-    "5023b41e7ac80f8b26a868db1f66884976bf864fab81a070ad37539f3481b352  /sdcard/Android/obb/org.fdroid.basic/main.2000050.org.fdroid.basic.obb",
-    "aecbed7433e81aaeef40942069d03ad23130f09d93b7e78bbe224865a9573157  /sdcard/Android/obb/org.fdroid.basic/patch.2000050.org.fdroid.basic.obb"
-  ],
-  "cleanup": {
-    "test_install_removed": true,
-    "running_instances_before": {},
-    "running_instances_after": {},
-    "battery_before": [
-      "100",
-      "Full",
-      "Charging"
-    ],
-    "battery_after": [
-      "99",
-      "Discharging",
-      "Charging"
-    ],
-    "shared_lock_released": true
-  },
-  "limits": [
-    "No headset rendering or gameplay assertion; headset unworn.",
-    "Synthetic expansion files verify transport and persistence, not Resident Evil 4 compatibility.",
-    "A game that exits before its Lepton instance can accept data was not tested."
-  ]
-}
@@ -58,7 +58,7 @@ not been verified and is not guaranteed.

 ## Casting

-**Cast to this screen** (Home → **Right now**) starts the existing headset Live view and requests full
+**Cast headset view** starts the existing headset Live view and requests full
 screen where supported. Show that screen to people in the room, or use the
 computer/phone's own screen mirroring. It creates no new stream transport,
 public URL or LAN server. iPhone uses the inline viewer if full screen is not
@@ -15,10 +15,6 @@ depends on SSH working through the `frame` alias from `scripts/connect.sh`.
 | KDE Connect | KDE Connect on both | Guess | There's a macOS build of KDE Connect, but whether it's present or installable on the Frame wasn't confirmed. It would give you clipboard sync, file send, and remote input. Worth checking on-device. |
 | microSD | Physical card | Confirmed that the slot exists ([Wikipedia](https://en.wikipedia.org/wiki/Steam_Frame)) | Offline fallback. |

-Screenshots and Steam clips have their own buttons on **Tools → Capture &
-Live**, and **Settings → Copy to this computer** copies new ones here
-automatically: see [recording.md](recording.md#copying-new-ones-automatically).
-
 ## Clipboard

 `scripts/paste-to-frame.sh` sends the Mac clipboard (or stdin) to the
@@ -40,28 +36,3 @@ desktop has to be running in the headset. It's text only, and pastes over about

 A simpler fallback: `ssh frame 'cat > ~/clip.txt'` < file, then open it in the
 headset.
-
-### In Frame Control
-
-**Tools → Type on the headset** (also on Home, and press `T` anywhere) has the
-clipboard next to the keyboard and trackpad, both ways:
-
- **Send text** or **Send this computer's clipboard** puts text on the headset's
-  clipboard, as above.
- **Copy the headset's clipboard** brings it back: copy something in a desktop
-  app on the Frame, then press it, and paste on your computer. It calls
-  Klipper's `getClipboardContents` on the same D-Bus bus, and sends the text
-  back as base64, so accents, emoji and line breaks arrive unchanged. The
-  desktop app and the iPhone app put it on their own clipboard. With the server
-  in a browser, the server sets the clipboard of the computer it runs on:
-  `pbcopy` on macOS, PowerShell's `Set-Clipboard` (or `clip.exe`) on Windows,
-  `wl-copy`, `xclip` or `xsel` on Linux.
-
-It's text only, and copying back takes up to 1 MB; a bigger clipboard is
-refused with a message, so send big things as a file. An empty clipboard, or
-one holding an image, says so. Neither the server nor its log ever records what
-was on the clipboard.
-
-**Not tested on a headset yet.** Reading uses the same Klipper interface as
-sending, which was verified on 2026-09-25, but `getClipboardContents` itself
-hasn't been tried on a Frame. The fake Frame (`tests/fakeframe`) answers it.
@@ -17,21 +17,15 @@ python3 ui/server.py         # anywhere: then open http://127.0.0.1:47810

 ## Features

-The window has six tabs: **Home** (what the headset's doing and what you'd do
-next, the headset view, screenshots, family and comfort, the keyboard and
-trackpad, and VR performance, folded away), **Games** (installed games,
-sideloaded titles, getting games), **Android** (apps, the catalogue, display
-settings, reports), **Tools** (in the headset: your computer's windows, the media
-player and the panel switcher; then sending files and text, Flatpaks, remote and
-power), **Devices** (your headsets and their addresses), and **Control** (the
-searchable Control Center, metrics, supported settings and headset guidance).
-Keys 1–6 switch between them, and `T` opens Type on the headset. The gear in the header (key 7) opens **Settings**:
-privacy and updates, library artwork and the assistant. The battery chip opens
-the headset's details: storage, memory, temperature, Wi-Fi, uptime and SteamOS
-build. Files can be dropped anywhere in the window. A
-connection pill in the header always shows which headset and whether it's
-connected, and how (Tailscale, or the network's name). Click it to add, edit or
-reorder the headset's addresses, or to see each step of connecting. When the Frame can't be
+The window has six tabs: **Home** (headset view, status, screenshots),
+**Games** (installed games, sideloaded titles, getting games), **Android** (apps,
+the catalogue, display settings, reports), **Tools** (sending files and text,
+Flatpaks, remote and power), **Devices** (your headsets and their addresses),
+and **Control** (the searchable Control Center, metrics, supported settings and
+headset guidance). Keys 1–6 switch between them. Files can be dropped anywhere in the window. A
+connection pill in the header always shows which headset, which network this
+computer is on, the address in use or being tried, and each step of connecting
+as it happens; click it for the whole timeline. When the Frame can't be
 reached, a banner says why in plain words, what was tried, and counts down to
 the next try, filling everything in once it answers. Flatpak and Android installs run in the background; the bottom bar
 counts them while they run.
@@ -49,27 +43,11 @@ counts them while they run.
  gamescope's flat layer instead.
 - **Screenshots** you take in the headset with Steam's shortcut: browse them and
  save them to `~/Pictures/SteamFrame`.
- **Record** what the headset shows, with its sound, to an `.mp4` in
-  `~/Videos/SteamFrame`, and **Steam clips**: export clips and background
-  recordings from Steam's game recording at any length, without re-encoding.
-  See [recording.md](recording.md). Not tested on a headset yet.
- **Backup & recovery** (Tools): copy game saves, settings and Android app data
-  to `~/Documents/Frame Control Backups/<time>/` with a checksummed manifest,
-  restore chosen parts after a factory reset, and **Return to Game Mode** when
-  the headset is stuck in Desktop Mode. Sign-in files and keys are never copied.
-  Not tested on a headset yet. See [backup-and-recovery.md](backup-and-recovery.md).
 - **Battery** with charging state: charge rate in watts, time to full or empty,
  charger type and wattage (for example USB-C PD 20 W), and battery temperature.
 - **Status**: storage, memory, temperature, Wi-Fi, uptime, and whether SteamVR,
  the desktop, Lepton and xrdp are running.
 - **Library** shelf with Steam cover art and a Play button (`steam://rungameid`).
- **Force quit** a game that has stopped responding: Steam games, sideloaded
-  titles, non-Steam shortcuts and Android apps. **Running now** at the top of
-  Games lists what's running; each game's own **Force quit…** (on its library
-  tile, or in a sideloaded title's ⋯ menu) and the Control Center's **Force quit
-  a game** card do the same. Each asks first, because unsaved progress is lost.
-  Steam is asked to quit the game, then its processes get SIGTERM and SIGKILL;
-  see [steam-games.md](steam-games.md#force-quitting-a-running-game).
 - **Get games**: every game you own with its Steam Frame rating (Verified,
  Playable, Unsupported, Unknown). Install on Frame downloads it to the headset
  with live progress. Search the Steam store with prices and Frame ratings; Buy
@@ -96,14 +74,8 @@ counts them while they run.
  their own Android app. A game's `.zip`, folder or `.exe` becomes a title in
  the Steam library (Valve's Devkit Game path, with Proton or the Steam Linux
  Runtime picked from the program's header), listed under **Sideloaded titles**
-  with Launch and Remove; see [sideloading.md](sideloading.md).
- **Type on the headset** (on Home, in Tools, in the Control Center, or press
-  `T`): use your computer's keyboard and mouse, or a phone's touchscreen, in the
-  Frame's apps through KDE Connect, and move clipboard text both ways. Send
-  typed text or your computer's clipboard to the headset, or copy the headset's
-  clipboard back: copy in a desktop app on the Frame, then **Copy the headset's
-  clipboard**. The clipboard needs the desktop panel open in the headset; it's
-  text only, up to 1 MB. See [file-transfer.md](file-transfer.md#clipboard).
+  with Launch and Remove; see [sideloading.md](sideloading.md). Send typed text, or your computer's clipboard, to the
+  Frame clipboard.
 - **Mac in the headset** (macOS): show any Mac window, or a whole screen, as
  its own panel in the headset. Place it with the SteamVR dashboard, click and
  scroll with the laser, and type on the Mac. Streams hardware H.264 through
@@ -149,12 +121,6 @@ GPU time is render time, not GPU utilisation. The temperature is the hottest
 readable sensor. Thermal trip warnings use per-zone kernel hot/critical limits,
 not a guessed universal temperature threshold.

-**Force quit a game** lists what's running only when you choose **Check what's
-running**, and says so when nothing is. Each **Force quit…** names the game and
-warns that unsaved progress will be lost before anything is sent; it uses the
-selected headset, refuses a second quit while one is running, and drops the
-list when you switch headsets.
-
 **Audio** controls the default output sink through the existing `/api/volume`
 endpoint. Moving its slider prepares a value; **Apply volume** sends it. **Mute**
 and **Unmute** send explicit mute states. The UI captures the selected headset,
@@ -167,7 +133,7 @@ rejects invalid types, out-of-range levels and invalid mute states before SSH.
 Other settings link to the existing forms and their validation, progress,
 confirmations and reset behavior: per-instance Android resolution/density/text,
 comfort sessions and alerts, media layouts, Mac streaming quality, privacy,
-sources and artwork. Android display links reveal the **Library** before
+sources and artwork. Android display links reveal **On your Frame** before
 scrolling to the form. Mac streaming remains searchable on all platforms, with
 its action shown only when the server is on macOS.

@@ -248,8 +214,8 @@ Google publishes no arm64 Linux platform-tools. Set Up Connection runs
 `ui/frame_connect.py` in your terminal emulator (GNOME Terminal, Konsole, xterm
 and others). The log is at
 `~/.config/Frame Control/logs/server.log`. Running `ui/server.py` in a browser
-instead of the app, sending the clipboard, or copying the headset's to this
-computer, needs `wl-clipboard` (Wayland), `xclip` or `xsel` (X11).
+instead of the app, sending the clipboard needs `wl-clipboard` (Wayland) or
+`xclip` (X11).

 ## Building

@@ -273,5 +239,5 @@ Control implementations. MCP wraps this HTTP API without API keys. Changes
 require a separate user approval; power also retains its password prompt. The
 assistant uses a user-chosen endpoint and sends nothing until the user opts in
 for a message. Screenshot context is separately opt-in. Model replies cannot
-operate the headset. Settings → Open assistant settings opens the page; the linked guide
+operate the headset. Tools → Open assistant opens the page; the linked guide
 covers putting it in a Chromium panel on the Frame.
@@ -20,6 +20,15 @@ SteamVR  (vrserver, vrcompositor, vrdashboard)       ← renders the room + pane
 Lepton (Android 11, podman container "lepton-dev") ← its own panel, app 3056000
 ```

+## Tracking additions (verified 2026-09-28)
+
+On SteamOS 0.4.1, build `20260925.6191901`, SteamVR exposes combined gaze
+through `XR_EXT_eye_gaze_interaction` in a headless OpenXR 1.0 session. Our
+reader obtained valid tracked samples and sent OSC to a configured loopback
+receiver. BlueZ LE discovery works; GTK4/GI can render our heart-rate panel.
+No BLE strap or SlimeVR trackers were attached. See [tracking](tracking.md)
+for the evidence, privacy defaults and untested integration boundaries.
+
 ## Facts worth knowing

 | Fact | Where it matters |
@@ -96,6 +105,5 @@ ssh frame 'cat /opt/steamvr/resources/webinterface/dashboard/localization/dashbo
 - Remote access from anywhere: [tailscale.md](tailscale.md)
 - Floating windows in space: [panels.md](panels.md)
 - Recovery images, what's in them, testing without the headset: [recovery-and-images.md](recovery-and-images.md)
- Backing up saves and settings, restoring after a reset, leaving Desktop Mode: [backup-and-recovery.md](backup-and-recovery.md)
 - Frame Control on iPhone (the server running on the Frame itself): [iphone.md](iphone.md)
 - What's still unverified: [open-questions.md](open-questions.md)
@@ -102,9 +102,8 @@ app installed opens its App Store page.
 Things iOS asks the first time: **Local Network** (tap Allow, or the app can't
 see the Frame), and **Paste** when you send the iPhone's clipboard (tap Allow
 Paste, or set Settings → Apps → Frame Control → Paste from Other Apps → Allow).
-Sending text to the Frame's clipboard, or copying the Frame's to the phone
-(**Type on the headset → Copy the headset's clipboard**), needs the desktop
-panel open in the headset, as on the desktop app.
+Sending text to the Frame's clipboard needs the desktop panel open in the
+headset, as on the desktop app.

 Not yet exercised: Android display changes through podman (no Android app was
 running), a real sleep/restart/shut down on the Frame, and a physical iPhone.
@@ -115,8 +114,8 @@ don't.

 ## Family and comfort

-The shared Home card sets session limits, breaks and check-ins; **Cast to this
-screen** is in Home's **Right now** card. **Enable / test notifications** requests iOS notification
+The shared Home card sets session limits, breaks and check-ins, and offers
+**Cast headset view**. **Enable / test notifications** requests iOS notification
 permission and sends a local test. These are local notifications, not APNs push;
 iOS background suspension can interrupt phone alerts. The headset timer still
 runs. See [the behavior and verification limits](family-comfort.md).
@@ -4,8 +4,7 @@ Frame Control can show any Mac window, or a whole Mac screen, as its own panel
 in the Steam Frame. You place each panel anywhere in the room with the SteamVR
 dashboard. The laser clicks and drags, the thumbstick scrolls, and you type on
 the Mac's own keyboard. Find it under **Tools → Mac in the headset** (macOS
-only). On Windows there's an experimental port,
-[PC in the headset](pc-in-headset.md).
+only).

 The confidence labels are the same as in [ssh.md](ssh.md).

@@ -143,15 +143,6 @@ check in the headset:
 - Keys from SteamVR's on-screen keyboard.
 - Whether Flathub Chromium decodes H.264 (otherwise use Compatible).

-## Battery charge limit (2026-10-23)
-
-Can an 80% charge limit be set over SSH or adb? **Not safely yet.** SteamOS
-Manager's `BatteryChargeLimit1` (the interface Steam's own setting uses) has
-no backend in the Frame's device config, and the battery node is a
-`max1720x` fuel gauge with no `charge_control_end_threshold`. Research and
-read-only headset checks are in [charge-limit.md](charge-limit.md). Not tested
-on a headset.
-
 ## Unconfirmed claims made in these docs

 - `/home` and `/etc` persist across Frame OS updates. This is inferred from
@@ -125,7 +125,7 @@ a limit on the number of floating panels.
  separate from Frame Control. Public reports describe some Proton support;
  Windows-only does not by itself prove a Frame app cannot run. Local status
  and sources are in [VR utilities](vr-utilities.md).
- **Our performance HUD:** Home → VR performance (unfold it) → Open HUD in
+- **Our performance HUD:** Home → VR comfort and performance → Open HUD in
  headset creates its own gamescope panel using built-in tools. It needs no
  third-party overlay app. [Metrics and verification](vr-utilities.md).

@@ -1,137 +0,0 @@
-# PC in the headset (Experimental)
-
-**Tools → PC in the headset**, on Windows only. It's the Windows version of
-[Mac in the headset](mac-in-headset.md): a window or a whole screen on your PC
-becomes its own SteamVR panel in the Frame. Place it with the dashboard's Float
-in World, Move and Size, point and click with the laser, scroll with the
-thumbstick, and type on the PC's keyboard.
-
-**It's experimental and not yet tried on a real Windows desktop or with a
-headset.** It builds and passes its protocol tests on Windows in CI, but desktop
-capture, Media Foundation encoding and laser input have never run on a real
-PC. Expect it not to work yet. Reports are welcome through the
-[feedback form](https://frame-control.pages.dev/feedback/).
-
-## Turning it on
-
-It's off by default. Until you tick **Turn on PC in the headset** on the card,
-Frame Control starts no helper, loads none of the streaming libraries and lists
-no windows. The choice is remembered on this computer. Turning it off ends
-every stream, closes the viewers in the headset and stops the helper.
-
-The card and its Tools link only appear in the Windows app. On macOS the card
-is Mac in the headset, as before; on Linux and the iPhone app there's no card.
-
-## How it works
-
-The ported pieces are from [PR #38](https://github.com/saphid/frame-control/pull/38).
-Frame Control owns the host helper, input, authentication, streaming protocol,
-panel launcher and adaptation. It doesn't need Sunshine, OBS or any other
-streaming app. GStreamer is bundled as ordinary libraries.
-
-| | Windows |
-|---|---|
-| Capture | Windows.Graphics.Capture, through GStreamer's `d3d11screencapturesrc capture-api=wgc`, by window (HWND) or screen (HMONITOR) |
-| Encoding | Media Foundation's H.264 encoder (`mfh264enc`), low latency, no B-frames. Whether it uses the GPU depends on the PC; **not verified** |
-| Input | `SendInput`, mapped through the source's bounds, with per-monitor DPI awareness |
-
-API choices are documented, not device-verified:
-[Windows capture](https://learn.microsoft.com/en-us/windows/uwp/audio-video-camera/screen-capture),
-[GStreamer WGC](https://gstreamer.freedesktop.org/documentation/d3d11/d3d11screencapturesrc.html),
-[Media Foundation encoder](https://gstreamer.freedesktop.org/documentation/mediafoundation/mfh264enc.html).
-
-It needs Windows 10 or 11 with Windows.Graphics.Capture and a Media Foundation
-H.264 encoder (Windows "N" editions need the Media Feature Pack). Clicks and
-keys can't reach administrator apps or the sign-in screen, which an ordinary
-process can't drive. If Windows won't bring the chosen window to the front,
-input is refused rather than sent to the app covering it: bring the window
-forward, then Stop and Show again. Minimised or closed windows stop sending
-pictures. Protected video isn't supported. Mac in the headset's "own display
-per window" is Mac-only.
-
-The pieces it shares with Mac in the headset:
-
- `ui/frame_macview.py` owns the SSH tunnel, reconnects, quality presets and
-  panel launch. `ui/frame_pcview.py` picks the Windows helper
-  (`ui/frame_pc_agent.py`, `ui/frame_pc_capture.py`, `desktop/capture.c`) and
-  holds the on/off switch. `/api/macview` is the endpoint for both.
- `ui/mac-view.html` is the one viewer in the headset. Its frame header, H.264
-  and JPEG payloads, reconnect handshake, clock sync, timing reports and input
-  messages are unchanged.
- `desktop/controller.c` is a C port of the Mac helper's Swift rate controller,
-  for the Windows helper. The Mac keeps its Swift original;
-  `tests/test_pc_controller.py` checks the port against a frozen 600-state
-  trace from it. Capture is gated before encoding, so encoded frames are never
-  dropped, and an idle window's last picture still goes out once the link
-  clears.
- Stream records use the Mac helper's JSON schema (`ui/frame_stream_stats.py`),
-  so the benchmark's analysis is shared.
-
-## Packaging
-
-The Windows installer carries `resources/desktop/bundle`: `pc-host.dll` (our
-adapter and the controller), the GStreamer plugins it uses (`coreelements`,
-`videotestsrc`, `videoconvertscale`, `app`, `jpeg`, `videoparsersbad`,
-`d3d11`, `mediafoundation`) and the DLLs they depend on, all from MSYS2's
-UCRT64 packages. `libraries.json` records the GStreamer version, the plugins,
-each copied DLL and the exact package versions; licence texts are in
-`licenses/`.
-
-The x264 encoder is **not** in the installer. It's GPL, and Windows encodes
-with Media Foundation, so only CI's test builds include it
-(`desktop/build.py --with-x264`). The macOS and Linux installers are unchanged.
-
-From a source checkout on Windows, build the bundle from an MSYS2 UCRT64 shell
-with the packages listed in `.github/workflows/pc-host.yml`:
-
-```sh
-python desktop/build.py              # what the installer ships
-python desktop/build.py --with-x264  # for the native tests
-```
-
-A missing bundle is reported on the card; nothing is downloaded on first use.
-
-The Linux adapter from #38 (desktop portal, PipeWire, VA-API) is in the tree,
-because it shares `capture.c` and the controller, and CI still builds and tests
-it. The app never offers it and the Linux installers don't include it.
-
-## Measuring
-
-The Mac benchmark accepts the PC host:
-
-```sh
-python scripts/macview-bench.py run --pc --scenario test --label pc-test
-python scripts/macview-bench.py run --pc --scenario capture --source window:12345 --label windows-window
-```
-
-`capture` needs a window or screen id from the helper's `/windows` or
-`/displays`. CPU sampling isn't available on PC hosts. See
-[Mac in the headset](mac-in-headset.md) for the targets and shaping options.
-
-## What's verified
-
- **Verified in CI, this PR:** on `windows-latest`, the native adapter builds
-  and a real x264 synthetic stream passes the ticket, reconnect, timing and
-  input-echo tests through the helper. The Windows installer builds with the
-  bundle, and its bundled Python loads the bundle, starts the helper and
-  confirms x264 isn't in it. Unit tests check the Windows-only, off-by-default
-  gating, the card and the Tools link on macOS, Windows and Linux.
- **Verified, #38, 2026-09-28, real Frame on SteamOS BUILD_ID 20260925.6191901:**
-  the PC helper (ARM64, on the Frame itself, x264 test pattern) streamed
-  through a Mac SSH relay into the shared viewer: 400 frames at 39.3 fps,
-  content latency p50/p95 15.1/28.6 ms, synthetic input p50 76.6 ms, at
-  revision `cd20243`. The frame-rate and late-frame targets failed. This
-  proves the helper and the viewer work together; it isn't Windows capture or
-  a real PC link.
-  [Raw result](../bench/results/2026-09-28-cd20243-pc-agent-frame-arm64-final.json),
-  [earlier probe](../bench/results/2026-09-28-c5fc552-dirty-pc-agent-frame-arm64-hairpin.json).
- **Verified, #38, on a Mac:** the C controller matched all 600 states of the
-  Swift controller's congestion and recovery trace.
- **Not verified:** anything on a real Windows desktop. Windows.Graphics.Capture,
-  Media Foundation (hardware or software), encoder restarts when the bitrate
-  changes, mixed-DPI and multi-monitor input alignment, window resize and
-  minimise, non-US keyboard layouts, physical laser input, and how it performs
-  in a worn headset. No numbers are claimed for these. Not tested with a
-  headset from this branch.
- **Not reviewed independently.** #38 tried an independent review that never
-  completed.
@@ -132,8 +132,8 @@ runs.

 ## Report a problem

-**Report a problem** is the speech-bubble button in the header, also in the
-Settings page (**Privacy & updates**) and under **Help → Report a Problem…**. It sends the report
+**Report a problem** is the warning-sign button in the header, also in the
+Privacy panel and under **Help → Report a Problem…**. It sends the report
 privately to Frame Control's PostHog project as a `problem_report` event, the
 same way as the analytics above, so only the maintainer can read it and
 nothing is published. It works whatever the analytics settings are, because
@@ -287,12 +287,3 @@ then every 6 hours: the latest release's `update.json` on GitHub, or
 `api.github.com/repos/saphid/frame-control/releases/latest` if that fails.
 Those requests carry no id. To stop it, set
 `FRAME_CONTROL_NO_UPDATE_CHECK=1`. See [releasing.md](releasing.md).
-
-## Screenshots and clips
-
-Copying screenshots and Steam clips to your computer, by hand or with
-**Settings → Copy to this computer**, goes straight from the headset to your
-computer over the same SSH connection as everything else. Nothing is uploaded
-anywhere. What automatic copying has copied is listed, by file id, in
-`auto-sync.json` in Frame Control's data folder; see
-[recording.md](recording.md#copying-new-ones-automatically).
@@ -1,164 +0,0 @@
-# Recording and Steam clips
-
-Frame Control can record what the headset shows, with its sound, and save it as
-an `.mp4` on your computer. It can also export the clips and background
-recordings from Steam's own game recording, at any length, as one `.mp4` each.
-Both are on **Tools → Capture & Live**. Everything is saved to
-`~/Videos/SteamFrame`, next to the screenshots in `~/Pictures/SteamFrame`.
-Nothing needs installing on the computer or on the Frame: the work is done by
-the `ffmpeg` that SteamOS ships.
-
-**Recording is tested on a headset; Steam clip export isn't yet.** On a Frame
-running SteamOS 0.5.6 (build 20261015.6141207), Record and Stop saved an
-8-second 1080p H.264 recording with AAC sound to the computer, Stop took about a
-second, and nothing was left running or stored on the Frame. That Frame had no
-Steam recordings, so the clip list came back empty and export has only been
-tested with files in Steam's format made by `ffmpeg`. The parts we're least sure
-of are listed under [What hasn't been checked](#what-hasnt-been-checked).
-
-## Record
-
-Press **Record** next to **Live**. The button turns into **Stop**, and a line
-under the viewer counts the time. Press **Stop**: the recording is finished on
-the Frame, converted to `.mp4` there (without re-encoding) and copied to
-`~/Videos/SteamFrame/rec-<date>-<time>.mp4`. The line says when it's saved.
-
- **What's in it**: the same picture as **Live**, SteamVR's copy of the headset
-  view (one undistorted 1920×1080 eye, from `/dev/video99`), at 30 fps and
-  8 Mbit/s, encoded with x264 (the Frame's hardware encoder crashes `ffmpeg`).
-  The sound is what the headset plays: the monitor of PipeWire's default
-  output, read through its PulseAudio server (`-f pulse -i @DEFAULT_MONITOR@`).
-  The microphone isn't recorded.
- **Without sound**: before each recording Frame Control checks for a fraction
-  of a second that `ffmpeg` can read that audio. If it can't, the recording goes
-  ahead as video only, and the page and the saved message say so.
- **Limits**: a recording stops by itself after 20 minutes and is saved as if
-  you'd pressed Stop. It needs about 2.9 GB free on the Frame to start (room for
-  a full-length recording twice, while it's converted), and checks the space on
-  your computer before copying. One recording runs at a time.
- **Where it waits on the Frame**: `~/.cache/frame-control/video/`, not `/tmp`,
-  which is a RAM disk on SteamOS. It's deleted once copied.
- **If the connection drops or the app quits** while recording, the Frame
-  stops `ffmpeg` cleanly when the SSH channel closes: it types `q` into
-  `ffmpeg`'s input, as at its keyboard, and kills it if it's still there 10
-  seconds later. Not a signal: SteamOS's `ffmpeg` 7.0 catches SIGTERM and
-  SIGINT and carries on recording. A recording that was never copied is
-  deleted when the next one starts.
-
-Recording and **Live** can run together; both read the same device.
-
-## Steam clips
-
-**Steam clips** lists what Steam's game recording has kept on the Frame: saved
-clips and background recordings, newest first, with the game, length and size.
-**Export** joins one into a single `.mp4` in `~/Videos/SteamFrame`, named after
-its folder (for example `clip_620_20261020_202134.mp4`), however long it is.
-Steam's own export is reported to stop at about 60 seconds. Exports run in the
-background; ones already on your computer are marked.
-
-How it works: Steam keeps each recording as MPEG-DASH segments, one folder per
-recording session.
-
-```
-~/.local/share/Steam/userdata/<account>/gamerecordings/
-  video/bg_<appid>_<YYYYMMDD>_<HHMMSS>/                 background recording
-  clips/clip_<appid>_<YYYYMMDD>_<HHMMSS>/video/bg_<...>/ a saved clip
-      session.mpd
-      init-stream0.m4s  chunk-stream0-00001.m4s  chunk-stream0-00002.m4s ...
-      init-stream1.m4s  chunk-stream1-00001.m4s ...
-```
-
-Each stream's `init-stream` segment followed by its chunks, in number order, is
-a playable fragmented MP4 of that stream. On the Frame, `ui/frame_clips.py`
-builds those files and has `ffmpeg` put the video and audio into one `.mp4`
-with `-c copy`, so nothing is re-encoded and it takes seconds. The result is
-copied to the computer and deleted from the Frame. The export needs free space
-on the Frame of about twice the recording's size while it runs.
-
-The listing doesn't rely on the folder names: any folder under `clips/` or
-`video/` (up to four levels down) holding `init-stream*.m4s` counts. A stream
-missing its init segment or its chunks is left out. Missing chunk numbers are
-shown as "pieces missing"; the rest still exports.
-
-## Copying new ones automatically
-
-**Settings → Copy to this computer** copies new screenshots and Steam clips
-here on their own. It's off until you turn it on, with a switch each for
-screenshots and Steam clips. While a headset is connected, Frame Control looks
-about once a minute and copies what's new with the same code as **Save** and
-**Export**: screenshots to `~/Pictures/SteamFrame`, clips to
-`~/Videos/SteamFrame`.
-
- **Only what's new.** It copies what you take after turning it on, so the
-  shots and clips already on the headset don't all arrive at once. **Copy
-  everything now** copies everything that isn't on this computer yet, once.
- **Deleted stays deleted.** What it has copied is remembered, per headset, in
-  `auto-sync.json` in Frame Control's data folder, so a file you delete here
-  isn't copied again (**Copy everything now** would bring it back).
- **Saved clips only.** Steam's background recording is a rolling buffer, not
-  something you chose to keep, so it isn't copied; export it by hand. A clip
-  Steam wrote to in the last 30 seconds is still being saved and waits for the
-  next look.
- **It gives way.** It waits while an install, an export, a recording or
-  anything else is running on the headset, and stops between files if one
-  starts. While a copy is running, switching headsets waits for it, as it does
-  for an export. When the headset can't be reached it waits longer each time,
-  up to 15 minutes, and starts over once it answers.
- **When this computer is full** (under 512 MB free, or a copy runs out of
-  space) it pauses and says so in Settings and above the lists. Free some space
-  and press **Resume**.
- **With several headsets** it copies from the one you're connected to.
-
-Settings shows when it last checked, how many files it last copied and when,
-and the last problem it had. The screenshot and clip lists say when it's on.
-
-## For developers
-
-`ui/frame_clips.py` holds the logic, so other features can reuse it (automatic
-copying, in `ui/frame_autosync.py`, does):
-
- `list_clips(run_frame)` and `export_clip(id, run_frame, run, fetch)` are the
-  computer's side; the server passes how to reach the Frame.
- `list_recordings(userdata)` and `export(userdata, id)` are the Frame's side,
-  run as `python3 - list` / `python3 - export ID` with the file on stdin.
- `Recorder` runs one recording from Start to the copy.
- `parse_id` checks a clip id (`<account>/<clips|video>/<folder>...`, plain
-  names only, no `.` or `..`) before it reaches a path or a shell.
-
-The API, with the same guards as every other request:
-
-| Request | Does |
-|---|---|
-| `GET /api/record` | The recording's state: `idle`, `starting`, `recording` (with `elapsed`, `audio`, `limit`), `stopping`, `saving`, `saved` (with `file`) or `failed` (with `error`) |
-| `POST /api/record {"action": "start"\|"stop"}` | Start or stop |
-| `GET /api/clips` | Steam's recordings on the Frame, each with `saved` |
-| `POST /api/clips/export {"id"}` | Starts an export; poll `/api/job` |
-| `POST /api/open {"what": "videos"}` | Opens `~/Videos/SteamFrame` |
-| `GET /api/autosync` | Automatic copying: `screenshots`, `clips`, `since` (the watermark), `checked`, `copied`, `copied_time`, `error`, `paused`, `waiting` (clips still being written) |
-| `POST /api/autosync {"action": "settings", "screenshots", "clips"}` | Turn either on or off; turning it on sets `since` to now |
-| `POST /api/autosync {"action": "now"\|"resume"}` | Copy everything not here yet, once; or resume after running out of space |
-
-They aren't available when the server runs on the Frame itself (the iPhone
-app), since they save to a computer.
-
-Tests: `tests/test_clips.py`, and `tests/test_autosync.py` for automatic
-copying (with a fake headset). They run the recording's shell under bash with a
-stand-in `ffmpeg`, so Stop, the time limit and the clean-up are tested as they
-run on the Frame. Where `ffmpeg` is installed, they also make a 65-second DASH
-recording with Steam's file names and export it with the real `ffmpeg`.
-
-## What hasn't been checked
-
-None of this has run on a Steam Frame yet. In particular:
-
- That SteamOS's `ffmpeg` can read `@DEFAULT_MONITOR@`. It has the PulseAudio
-  output device (the media player plays through it), so the input is expected,
-  but if it fails the recording is video only, as above.
- Audio and video sync. Both inputs are stamped with the wall clock, because
-  the camera device and the audio server otherwise count from different clocks.
- The exact layout of `gamerecordings` on the Frame's SteamOS build, and
-  whether a clip's segments start mid-recording. The parser is deliberately
-  loose about the layout.
- How much x264 at 1080p30 costs the Frame while a game is running.
- Automatic copying: that 30 seconds without a write is a safe sign Steam has
-  finished saving a clip, and how a once-a-minute listing feels on the Frame.
@@ -4,9 +4,6 @@ Where to get the Steam Frame's operating system, what's inside it, and how to
 run it for testing without the headset. For recovering a Frame that won't boot,
 see the boot menu and boot-loop entries in
 [how-the-frame-works.md](how-the-frame-works.md#facts-worth-knowing).
-To keep your game saves, settings and Android app data through a factory reset
-(`Erase User Data`) or a re-image, and to get out of Desktop Mode, see
-[backup-and-recovery.md](backup-and-recovery.md).

 ## Downloads

@@ -89,7 +89,6 @@ controls to place each panel. See [docs/panels.md](panels.md).
 | Script | Runs on | Purpose |
 |---|---|---|
 | `scripts/tailscale-on-frame.sh` | Mac → Frame | Install Tailscale in `~` as a userspace user service so `frame` works from anywhere; `--uninstall` (**verified** on the LAN) |
-| `scripts/store-on-frame.sh` | Mac → Frame | Open the APK Store (Frame Control's Android store) as a panel in the headset; installs run on the Frame (**inferred**; see [docs/apks.md](apks.md)) |
 | `scripts/connect.sh` | Mac | Discover, set up key and `~/.ssh/config`, copy key, optional `--harden` (**verified**; `--harden` untested) |
 | `scripts/install-apps.sh` | Mac → Frame | Install Flatpaks (Remmina, Moonlight, …) on the Frame over SSH as `--user` (**verified** with Remmina) |
 | `scripts/paste-to-frame.sh` | Mac → Frame | Send the Mac clipboard (or stdin) to the Frame clipboard (**verified**) |
@@ -30,8 +30,7 @@ it.) A dialog shows:

 Install copies it to the Frame and registers it with Steam; progress shows in
 the bar and the activity log. **Sideloaded titles** lists what's installed,
-with Launch, Remove and, for a game that has stopped responding, **Force
-quit…** in its ⋯ menu ([how](steam-games.md#force-quitting-a-running-game)). **Copy to ~/Downloads instead** keeps the old
+with Launch and Remove. **Copy to ~/Downloads instead** keeps the old
 behaviour for a zip that isn't a game.

 From a terminal:
@@ -24,7 +24,7 @@ No SideQuest implementation code was copied.
 | Installed-app management (launch, uninstall, backup) | List, launch, stop, remove, probe | Already mostly covered. Backup added here. |
 | Update notices / account library | Compatible-version lookup; no source-aware installed update notices | Useful later, medium; needs original version code and source identity recorded on install. |
 | Custom repositories | Built-in F-Droid catalogue and compatible-version indexes | Separate user-repos worker. Legacy SideQuest source has a fixed SideQuestRepos index; arbitrary current custom-repo support was not verified. |
-| Drag-and-drop APK/OBB install | APK drag-and-drop already works | The [Android backup importer](android-backups.md) now groups the APK and matching OBBs, detects desktop siblings and guides installation and data setup. |
+| Drag-and-drop APK/OBB install | APK drag-and-drop already works | OBB backend added here; future UI can call it. UI drop wiring is not included. |
 | Tags, price, headset filters, reviews | Text search and Lepton verdicts, not Quest headset metadata | Useful, medium; search worker owns filters. Keep source headset claims distinct from tested Frame compatibility. |
 | Screenshot/video capture and streaming | Frame screenshots/VR capture already present | Reuse existing tools; do not port Quest capture commands. |
 | Device settings and ADB utilities | Frame/Android display settings, SSH and own-instance tools | Borrow selectively; Quest CPU/GPU presets and wireless-ADB setup do not map directly to Lepton. |
@@ -65,8 +65,6 @@ flow, not evidence of an anonymous download API. It is not implemented here.
 - `search()` raises a user-readable `SourceError` with the browse URL (zero
  limit returns no rows). It does not invent app results or report a false
  “no matching games”. The aggregate search UI should surface this source error.
-  In the app, Discover doesn't link to it; the **Sources** dialog lists SideQuest
-  with a link to its website instead of an on/off switch.
 - `details()` accepts a numeric listing id and returns its canonical page link,
  `downloadable: False`, empty versions/tags/headsets and the `images` shape
  `{icon: None, banner: None, screenshots: []}`. Name is explicitly a listing id;
@@ -85,9 +83,6 @@ local SHA-256 alone must not be called publisher verification.

 ## OBB files

-For the app's guided APK and OBB import, see [Import an Android game backup](android-backups.md).
-The CLI helper below remains available for a running instance.
-
 ```sh
 python3 ui/frame_android.py install-obb org.example.game main.42.org.example.game.obb
 python3 ui/frame_android.py install-obb org.example.game main.42.org.example.game.obb patch.42.org.example.game.obb
@@ -101,62 +101,6 @@ Store search uses `store.steampowered.com/api/storesearch/?term=…&cc=…`. It
 returns nothing without `cc`, so Frame Control takes the country from
 `SteamClient.User.GetIPCountry()` on the Frame.

-## Force quitting a running game
-
-**Running now**, at the top of Games, lists what's running on the Frame: Steam
-games, sideloaded titles, non-Steam shortcuts and Android apps. A game's library
-tile, a sideloaded title's ⋯ menu and the Control Center's **Force quit a game**
-card have **Force quit…** too. Each asks first ("Unsaved progress will be
-lost"); from a game's own menu it checks that the game is running and says so if
-it isn't. SteamVR (app 250820, and its beta 1009850) is never listed or quit:
-on the Frame it shows the headset view, so quitting it isn't a way out of a game.
-
-`ui/frame_running.py` does the work on the Frame, piped over SSH with
-`frame_steam.py` as its DevTools client:
-
-```sh
-scp ui/frame_steam.py ui/frame_running.py frame:/tmp/
-ssh frame 'python3 /tmp/frame_running.py list'       # {"running": [{appid, gameid, name, kind, ...}]}
-ssh frame 'python3 /tmp/frame_running.py quit 620'   # {"name", "method", "message"}
-```
-
-1. **What's running.** Steam starts every game, shortcut and devkit title under
-   its `reaper`, as `reaper SteamLaunch AppId=<id> -- <command>`, and the reaper
-   stays the parent of the game's processes. So a running game is one of your
-   own processes whose program is named `reaper`, with `SteamLaunch` and an
-   `AppId=` before `--`; the game is that reaper's process tree. Steam's own list
-   (`SteamUIStore.RunningApps`) and Android apps whose Lepton container is up
-   (`podman ps`) are added. Names come from `appStore`, else the app manifest,
-   the Android app's `meta.json` or the devkit title's folder.
-2. **Steam first.** `SteamClient.Apps.TerminateApp(<game id>, false)`, the
-   call Steam's own Stop makes for Android apps ([vr-apks.md](vr-apks.md)). The
-   game id is the appid, or `(appid << 32) | 0x02000000` for a non-Steam
-   shortcut. An Android app's container is also stopped, as the Apps tab's Stop
-   does (`podman stop -t 5 lepton-steamlaunch-<instance>`).
-3. **Then signals.** If the game's processes are still there after 5 seconds,
-   they get SIGTERM, deepest first; whatever is left 3 seconds later gets
-   SIGKILL, the reaper last, so nothing it holds is orphaned unsignalled. A pid
-   is only signalled while its start time still matches, so a reused pid is safe.
-
-Nothing is found by name. These are never signalled, even inside a game's tree:
-init, the helper itself and every process above it (the SSH session), other
-users' processes, and anything named `steam`, `steamwebhelper`, `gamescope`,
-`gamescope-wl`, `gamescopereaper`, `gamescope-session`, `sshd`, `sshd-session`,
-`ssh-agent`, `systemd`, `dbus-daemon`, `dbus-broker`, `pipewire`,
-`pipewire-pulse`, `wireplumber`, `plasmashell`, `kwin_wayland`, `kwin_x11`,
-`Xwayland`, `sddm`, `vrserver`, `vrcompositor`, `vrmonitor`, `vrdashboard`,
-`vrwebhelper` or `vrstartup`, with everything under them.
-
-**Not tested on a headset.** The reaper command line is how Steam launches games
-on Linux desktops and the Steam Deck, **inferred** for the Frame.
-`SteamUIStore.RunningApps` comes from Steam's client code as plugin loaders use
-it and hasn't been seen on the Frame's build; without it, the reapers alone
-decide. `TerminateApp` with a shortcut's game id is the call Steam's Stop was
-seen making for an Android app (docs/vr-apks.md); for Steam games it is
-**inferred**. Unit tests (`tests/test_force_quit.py`) cover the parsing, the
-process selection and the escalation; the fake Frame launches its games under a
-stand-in `reaper` so `tests/e2e/test_running.py` force quits a real process tree.
-
 ## Not yet checked

 - Free-to-play games: `steam://install` should stop at state 3 (free license)
@@ -144,7 +144,7 @@ capture it.

 ## Input: type and point in the Frame from the Mac or iPhone

-**Built: Home → Type on the headset** (or press `T`), in every version of Frame Control
+**Built: Home → Keyboard and trackpad**, in every version of Frame Control
 (Mac, Windows, Linux, iPhone and iPad), with nothing to install on the device
 you're holding. On a phone the panel is a trackpad (drag to move, tap to click,
 two fingers to scroll, two-finger tap to right-click) plus a text field that
@@ -76,8 +76,8 @@ its guards want.
 | `sshd` with key and password logins, `rsync`, `python3` | Real |
 | Valve's steamos-devkit-service on port 32000 and its hooks, vendored unmodified in `tests/fakeframe/steamos-devkit-service` | Real; only its `dbus` import (for mDNS through systemd-resolved) is a stand-in that logs the registration |
 | Valve's devkit-utils, copied over by Frame Control itself | Real |
-| **fakesteam**: `~/.steam/steam.pid`, `steam.token` and the `steam.pipe` FIFO; answers `approve-ssh-key`, `create-shortcut`, `run-game`, `list-shortcuts` and `delete-shortcut` with the response files devkit-utils waits for; takes `steam://rungameid`, `install` and `store` URLs. Games it really runs start under a stand-in `reaper SteamLaunch AppId=<id> -- <command>` (bash with that command line), so force quit finds a real process tree | Fake |
-| DevTools on `127.0.0.1:8080` with a `SharedJSContext` target. The JavaScript Frame Control sends runs for real in Node against stand-in `SteamClient`, `appStore` and `downloadsStore` objects (`cef_shim.js`), so async functions, optional chaining and `Map`s behave as in Steam's CEF. `SteamUIStore.RunningApps` lists launches that haven't exited; `TerminateApp` ends only launches that never ran a process, so a running program needs Frame Control's signals | The JS engine is real; the objects are fake |
+| **fakesteam**: `~/.steam/steam.pid`, `steam.token` and the `steam.pipe` FIFO; answers `approve-ssh-key`, `create-shortcut`, `run-game`, `list-shortcuts` and `delete-shortcut` with the response files devkit-utils waits for; takes `steam://rungameid`, `install` and `store` URLs | Fake |
+| DevTools on `127.0.0.1:8080` with a `SharedJSContext` target. The JavaScript Frame Control sends runs for real in Node against stand-in `SteamClient`, `appStore` and `downloadsStore` objects (`cef_shim.js`), so async functions, optional chaining and `Map`s behave as in Steam's CEF | The JS engine is real; the objects are fake |
 | `steam`, `wpctl`, `flatpak`, `podman`, `nmcli`, `qdbus6`, `gamescopectl`, SteamOS's `steamos-enable-sshd` helper, and Lepton's launcher | Stubs that record their calls |
 | Battery, charger and thermal zones under `/sys/class` | Files the supervisor writes. `/sys` is read-only in a container and Docker's AppArmor profile refuses writes under it, so each folder is a volume mounted twice: over `/sys/class/...` for `frame_status.py` to read, and under `/var/lib/fakeframe/sys` for the supervisor to write |
 | `vrserver` and `plasmashell` | Renamed `sleep` processes, so the status page and the clipboard find them |
@@ -187,26 +187,12 @@ refuses ids with a hyphen (`missing/invalid arguments`), which the fake had
 accepted. The fake now refuses them the same way, and Frame Control makes ids
 Steam accepts.

-## PC panel host tests
+## Tracking protocols and fake BlueZ

-PC in the headset (Experimental, Windows only). `tests/test_pcview.py` checks
-that only Windows gets the PC host and that it starts nothing until turned on,
-the Tools link and card wording, source-bound tickets, reconnect/Stop
-revocation, input release, source-coordinate mapping and use of the existing
-panel launcher. `tests/test_pc_controller.py` checks the C rate controller
-against a frozen trace of the Mac's Swift one.
-
-The `PC host libraries` workflow builds the native adapter on Windows (and
-the unshipped Linux adapter on Ubuntu x64 and ARM64), then runs a real x264
-synthetic stream through the HTTP/WebSocket agent. x264 is GPL, so only these
-CI builds include it (`desktop/build.py --with-x264`); the release workflow
-tests the installer's own bundle with its bundled Python and checks x264 isn't
-in it. `FRAME_PC_REQUIRE_NATIVE=1` and `FRAME_PC_REQUIRE_X264=1` make a missing
-bundle or encoder fail CI instead of skipping.
-
-None of this captures a desktop, exercises Media Foundation or a GPU, or
-checks laser alignment. The [Windows test VM](#windows-test-vm) is the next
-step for that. See [what's verified](pc-in-headset.md#whats-verified).
+`tests/test_tracking.py` exercises our gaze conversion, OSC sender, HRS parser
+and BlueZ lifecycle with an in-memory fake object tree. It runs in the normal
+unit suite without Bluetooth, GTK or OpenXR. Real Frame results and the absent
+strap/tracker boundaries are recorded in [tracking](tracking.md).

 ## Windows test VM

@@ -288,17 +274,6 @@ connect it to the Frame and follow Remote Desktop through to the Frame's
 desktop ([what it does](streaming.md#a-see-and-control-the-frame-from-the-mac)).
 `frame-key` left `authorized_keys` byte-for-byte as it was.

-## Force quit
-
-`tests/test_force_quit.py` feeds `ui/frame_running.py` made-up process tables:
-the `reaper SteamLaunch AppId=` parsing, naming from Steam, manifests, Android
-`meta.json` and devkit folders, and a Frame's worth of Steam, gamescope, SteamVR,
-sshd and session processes that must never be signalled. Processes that ignore
-SIGTERM, survive SIGKILL or exit and have their pid reused check the escalation.
-The Control Center's confirmation, duplicate and headset-switch handling run in
-`tests/control_center.cjs`. `tests/e2e/test_running.py` force quits real process
-trees on the fake Frame. None of it has run on a headset.
-
 ## Owned media player

 `tests/test_media.py` covers layout evidence and overrides, OU eye ordering,
@@ -346,14 +321,3 @@ Chromium rendering and the same helper through HTTP. Close the switcher after
 testing. [The recorded device checks](panels.md#frame-controls-panel-switcher)
 cover actual focus, HTTP guards and an OpenXR sample transition, and separately
 identify the unverified Steam-game, spatial layout, reboot and laser behaviors.
-
-## Backup and recovery kit
-
-`tests/test_backup.py` runs the headset-side script `ui/frame_backup_remote.py`
-for real against a temporary folder laid out like the Frame's home, with only
-SSH faked: path selection and the secrets it must never copy, the manifest and
-checksums, restore checks after a reset, restore writing only its own files,
-unsafe archives and backup names, and the exact Game Mode command.
-`tests/e2e/test_recovery_kit.py` backs up and restores a Proton save on the fake
-Frame through the server. See [backup-and-recovery.md](backup-and-recovery.md#verification).
-No backup or restore has been run on a real headset yet.
@@ -0,0 +1,329 @@
+# Eye tracking and heart rate
+
+Frame Control's own tools run on the Frame, using OpenXR and BlueZ. No
+VRCFaceTracking, LunaHR, Pulsoid or other tracking app is required. This is a
+command-line first version; it does not add a desktop app tab.
+
+## What was checked
+
+**Verified 2026-09-28**, on a real aarch64 Frame running SteamOS 0.4.1,
+BUILD_ID `20260925.6191901`:
+
+| Check | Result |
+|---|---|
+| OpenXR gaze | SteamVR advertises `XR_EXT_eye_gaze_interaction`, `XR_MND_headless` and `XR_KHR_convert_timespec_time`. `supportsEyeGazeInteraction=1`. A headless session reached FOCUSED and produced 269 valid, tracked orientations in the first ten-second probe. |
+| Our gaze → OSC bridge | A separate ten-second run produced 280 valid samples and 280 correctly padded 44-byte `/tracking/eye/CenterPitchYaw` messages at an explicitly configured loopback receiver. Only counters and packet-layout checks were retained. |
+| Bluetooth stack | BlueZ active, adapter powered, central/peripheral roles available. LE discovery started and stopped successfully. No pairing or adapter power settings changed. |
+| Our heart-rate panel | GTK4/GI runs on the stock image. A **synthetic 72 BPM** notification displayed in our X11 window, tagged `STEAM_GAME=2000000027`. Window capture checked; no real heart-rate measurement was taken. |
+| SlimeVR, separate feasibility check | Native aarch64 server v21.1.0 ran with an isolated Temurin 21 JRE, created its driver sockets and accepted a local TCP connection on port 21110. Driver v6.0.0 loaded with all shared libraries resolved; `HmdDriverFactory("IServerTrackedDeviceProvider_004")` returned a non-null provider and error 0. |
+
+![Our heart-rate panel on the Frame, showing synthetic 72 BPM](img/heart-rate-panel.png)
+
+The image is a capture of our own Frame window using a fake notification,
+not a real sensor reading.
+
+**Untested:** a real BLE strap's notifications, physical fit/contact behaviour,
+end-to-end heart-rate display/OSC/log with a strap, avatar response in VRChat,
+gaze accuracy/calibration, coexistence with every immersive app, in-headset
+panel placement, SlimeVR tracker/calibration data and the SlimeVR driver running
+inside SteamVR. No trackers or strap are attached. The driver was loaded in a
+separate process; it was **not registered or activated in SteamVR**. Steam and
+SteamVR were not stopped or restarted.
+
+**Verified blocker resolved:** importing `tkinter` fails because `libtk8.6.so`
+is absent. The panel uses the installed GTK4/GI bindings instead. The Frame's
+OpenXR headers advertise a newer API version than the runtime accepts; our
+reader requests OpenXR 1.0 explicitly.
+
+## Install our tools
+
+From this checkout on your computer, while the Frame is awake:
+
+```sh
+python3 scripts/tracking-on-frame.py install
+```
+
+This copies our Python code and compiles our small C OpenXR reader into
+`~/.local/share/frame-control/tracking/` on the Frame. It uses the Frame's
+existing compiler, OpenXR headers/loader, Python, dbus-python, GI and GTK4.
+Nothing is downloaded, and no sudo, driver registration, system setting,
+service or autostart is added. `FRAME_ALIAS` can select another SSH alias.
+The desktop app/server keeps its existing stdlib-only dependency set.
+
+## Eye tracking → OSC
+
+Start with a ten-second capability/data-availability check:
+
+```sh
+python3 scripts/tracking-on-frame.py gaze --seconds 10
+```
+
+This prints support, session-state numbers and sample counters. It opens no
+OSC socket and prints no gaze coordinates. Exit 0 means at least one valid
+sample, 3 means no valid sample was observed, and 1 means an API/runtime error.
+If there are no valid samples, wake/wear the headset and check its tracking
+setup; a successful capability check alone does not prove usable gaze.
+
+To send to VRChat running **on the Frame**, explicitly enable OSC in VRChat
+and choose its local UDP endpoint:
+
+```sh
+python3 scripts/tracking-on-frame.py gaze --seconds 3600 --osc 127.0.0.1 9000
+```
+
+For a receiver on another computer, replace `127.0.0.1` with that computer's
+IP address and choose its listening port. Addresses are IP literals (IPv4 or
+IPv6); there is no discovery or default destination. Loopback here always
+means **the Frame**, not the computer running the SSH command. OSC uses
+unencrypted UDP: configure only a receiver you intend to receive this data.
+
+**Documented:** [VRChat's eye OSC interface](https://docs.vrchat.com/docs/osc-eye-tracking)
+accepts `/tracking/eye/CenterPitchYaw` with two floats in degrees, positive down
+and right. We locate OpenXR's combined gaze pose relative to VIEW (the head),
+rotate its -Z forward vector and convert that direction to these angles.
+Only active, orientation-valid **and tracked** samples are sent, at up to
+30 Hz. No eyelid/blink, individual-eye or face values are invented. We do not
+send neutral gaze on tracking loss; VRChat's documented timeout restores its
+automatic eye behaviour after input stops.
+
+**Privacy:** gaze is personal data. It stays in process memory and a private
+pipe between our reader and bridge. There is no gaze log option, telemetry,
+OSC receiver or raw gaze on stdout/stderr. Only an explicit `--osc IP PORT`
+opens an output socket. Runtime diagnostics and validity counters are not
+measurements. Stop with Ctrl-C or let `--seconds` expire (maximum 24 hours).
+A lost headless session ends the run; it does not silently reconnect.
+
+## BLE heart rate → our panel, OSC and optional log
+
+First discover/pair your strap in SteamOS's Bluetooth settings. Select that
+strap's Bluetooth address explicitly; our tool does not scan for or connect
+to arbitrary nearby devices.
+
+```sh
+python3 scripts/tracking-on-frame.py heart \
+  --device AA:BB:CC:DD:EE:FF --panel --seconds 3600
+```
+
+This uses BlueZ's standard Heart Rate Service (`180d`) and Heart Rate
+Measurement (`2a37`) notifications. It finds the characteristic only beneath
+the selected device's HRS service. The reader handles 8- and 16-bit BPM,
+contact flags and optional energy/RR fields; energy and RR intervals are
+validated for length but discarded. Zero BPM, reported loss of skin contact,
+malformed packets and readings older than five seconds are not shown as a
+current measurement. A disconnect stops the run; reconnect and start again.
+This is a social/fitness readout, not a medical monitor.
+
+The panel is our GTK4 window on gamescope's X display. Use SteamVR's panel
+controls to float/dock it (see [panels](panels.md)). **Stop**, closing the panel,
+Ctrl-C, SSH hangup or the duration limit ends our subscription. A connection
+that was already open when we started is preserved; a connection we opened
+is disconnected on exit. No Bluetooth power or pairing state is changed.
+
+Add either output explicitly:
+
+```sh
+python3 scripts/tracking-on-frame.py heart \
+  --device AA:BB:CC:DD:EE:FF --panel --seconds 3600 \
+  --osc 127.0.0.1 9000 --address /avatar/parameters/HeartRate \
+  --log /home/steamos/heart-session.csv
+```
+
+The OSC value is integer BPM. `HeartRate` is a chosen avatar parameter, **not a
+built-in VRChat heart-rate feature**; your avatar/receiver must define the
+matching parameter. `--address` can select another literal OSC path. The local
+panel works without OSC, a log or an avatar integration.
+
+The optional CSV contains only `unix_seconds,bpm`. It is created privately
+(mode 0600), refuses existing files/symlinks, and lives **on the Frame** at the
+path you specify. Nothing is logged by default, and heart-rate values are not
+printed to the terminal. Delete your session file when you no longer need it.
+
+### Checking heart rate against a reference
+
+`scripts/heart-check.py` runs on your computer. `listen` shows our OSC
+readings live as they arrive, so you can watch them next to another device:
+
+```sh
+python3 scripts/heart-check.py listen --port 9000 --out ours.csv
+```
+
+Point the Frame at it with `--osc <your computer's IP> 9000`. `compare` lines
+up two recordings by time and reports the mean difference, bias, the share
+within ±5 BPM and the delay between them. It passes when the mean difference
+is at most 5 BPM, at least 80% of reference readings are matched and nothing
+was shown while the sensor reported lost skin contact:
+
+```sh
+python3 scripts/heart-check.py compare ours.csv reference.csv
+python3 scripts/heart-check.py compare ours.csv ~/Downloads/export.zip
+```
+
+The reference can be a CSV (`time,bpm[,flags]`, time in unix seconds or ISO
+8601) or an Apple Health export (`export.zip` or `export.xml`). Only heart-rate
+records within the recording's time range are read. Everything stays on your
+computer.
+
+`scripts/heart-test-strap.swift` turns a Mac into a synthetic strap. It
+advertises the standard Heart Rate Service and sends a fixed, known sequence
+(8-bit and 16-bit values and a skin-contact loss), printing each sent value, so
+`compare` can check that the Frame shows exactly what was sent. It needs
+Bluetooth permission for the process that runs it. **Untested on 2026-09-29:**
+it compiled, but on this Mac, launched from an agent session, macOS never
+delivered a Bluetooth state and no permission prompt appeared, so it never
+advertised.
+
+## Pulse from the eye cameras (experimental)
+
+The Frame has no heart-rate sensor. **Verified 2026-09-29** (SteamOS 0.4.1,
+build `20260925.6191901`): its sensors are an ambient light/proximity sensor
+(`vcnl4000`), a hall sensor (`als31300`), two passthrough cameras
+(`arcimx616`), two tracking cameras (`og01a1b`) and two IR eye cameras
+(`og0ve10`). There is no optical heart-rate (PPG) sensor.
+
+The experiment asks whether the eye cameras can see a pulse anyway. With each
+heartbeat, the blood volume in the skin around the eye changes slightly and
+its IR reflectance changes with it. This is camera-based photoplethysmography;
+near-IR works, though the signal is weaker than in green light.
+
+```sh
+python3 scripts/tracking-on-frame.py pulse --seconds 60 --show
+```
+
+How it works:
+
+- **Capture (verified).** SteamVR ships `eyetracking --calib N`, which saves
+  both eye cameras for N seconds as 400×400 8-bit IR PNGs with a monotonic
+  timestamp per frame, at about 90 fps per eye. SteamVR's live eye tracker,
+  part of `steamvr.service`, gets its frames from the DSP and stops its
+  cameras when the headset is off. Unworn captures ran alongside it: its PID
+  and log were unchanged and our OpenXR gaze session still started
+  afterwards. **Untested:** whether the capture and the live tracker coexist
+  while the headset is worn and tracking.
+- **Privacy.** Each image is reduced to a 16×16 grid of patch averages as
+  soon as it is complete, then deleted. Three worker processes do this beside
+  the capture. If more than 900 images (about five seconds) ever wait, we stop
+  reading them and delete them undecoded until the capture ends, and report
+  an error. The capture directory is removed on exit, even after errors. No image is kept or leaves the Frame. The estimate
+  is printed only with `--show`, and sent or saved only with `--osc` or
+  `--log`, as for the strap.
+- **Estimate.** Patch traces are averaged down to 15 Hz and turned into
+  relative change. A 2-second moving median removes drift and blinks.
+  Patches with frequent spikes (the eyeball and eyelid) are dropped, as are
+  dark or saturated ones. The 20% of patches with the clearest rhythm between
+  42 and 180 BPM are combined in the frequency domain. Output is an overall
+  estimate plus one estimate per second over 15-second windows. A result
+  counts as **clear** only when the top patches agree and the combined signal
+  stands out from the noise. Otherwise the command exits 3 and sends no OSC.
+  `--log` still records the per-second estimates, so a comparison shows how
+  far off an unclear result was.
+  The thresholds are provisional until checked on real wearers.
+
+**Verified on the Frame, unworn, 2026-09-29:** captures of 3,600-5,400 eye
+frames never had more than 8 images on disk, finished a few seconds after the
+capture ended and left no capture directory. **The estimator alone gave a
+false "clear" pulse.** With nobody wearing the headset, five runs reported a
+steady, self-consistent rhythm (90, 90, 93, 94 and 96 BPM; patch agreement
+100%, signal/noise 0.63-0.70), and earlier runs reported 127-129 BPM at lower
+signal/noise. It is a periodic camera or illumination artifact, and its
+frequency drifts between runs. A wearer-less scene cannot contain a pulse, so
+the signal/noise gate cannot tell this artifact from one. Because of that,
+`pulse` reads the Frame's proximity sensor (`vcnl4000`) before and after the
+capture. It reads about 3 unworn (**verified**). If either reading is below 20
+the result is never called clear, nothing is sent over OSC, and the command
+exits 3. **Inferred, unmeasured:** that a worn reading is well above 20; the
+cut-off is provisional until someone wears the headset. If the sensor can't be
+read, the guard is skipped. Confirming a real pulse also needs a reference
+(below).
+
+**Do not interrupt the capture. Verified on the Frame, 2026-09-29:** sending
+SIGTERM to `eyetracking --calib` left the DSP service's eye camera (OV6211)
+stuck "streaming": its log had no "Stopping streaming" line, and every later
+request failed with "Failed to start streaming". Head tracking kept working.
+Clearing it needs the DSP service restarted or the Frame rebooted, so `pulse`
+never signals the tool. After Ctrl-C or a failure it keeps deleting images
+until the tool ends by itself (at most the `--seconds` plus a few seconds),
+and only kills a tool that overruns by 30 s, with a warning that the eye
+cameras may need a reboot. So an interrupted run can take a while to return.
+
+**Verified on synthetic data** (unit tests): a 0.3% brightness pulse in a
+third of the patches, with noise, drift, blinks and eye movement, is
+recovered within 1.5 BPM at 58, 72 and 115 BPM; noise and blinks alone are
+not reported as a pulse. **Not yet verified:** whether a real wearer's eye
+images contain a usable pulse, and how accurate it is. That needs someone
+wearing the headset and a reference, as below.
+
+### Comparing with an Apple Watch
+
+1. On the watch, start a workout (for example **Other**) so it measures heart
+   rate every few seconds rather than occasionally.
+2. Put the Frame on, sit still and look ahead. Run:
+
+   ```sh
+   python3 scripts/tracking-on-frame.py pulse --seconds 120 --show \
+     --log /home/steamos/pulse.csv
+   ```
+
+   The per-second estimates print at the end. Compare them with what the
+   watch showed.
+3. End the workout. On the iPhone, open Health → your picture → **Export All
+   Health Data**, and AirDrop `export.zip` to the Mac.
+4. On the Mac:
+
+   ```sh
+   scp frame:pulse.csv . && ssh frame rm pulse.csv
+   python3 scripts/heart-check.py compare pulse.csv ~/Downloads/export.zip
+   ```
+
+This first version analyses after the capture ends, because the method must
+prove itself before a live panel is worth building. The Apple Watch is a
+reference, not ground truth: in workouts it is typically within a few BPM of
+a chest strap when you are still.
+
+## SlimeVR: feasibility only
+
+SlimeVR is an independent application stack. Neither of our features installs,
+launches or depends on it. Users who want it can follow
+[SlimeVR's setup documentation](https://docs.slimevr.dev/server/index.html).
+The consented upstream releases tested were
+[server v21.1.0](https://github.com/SlimeVR/SlimeVR-Server/releases/tag/v21.1.0)
+and [driver v6.0.0](https://github.com/SlimeVR/SlimeVR-OpenVR-Driver/releases/tag/v6.0.0),
+under SlimeVR's MIT/Apache-2.0 licensing.
+
+**Verified layout, read-only:** the Frame's registered runtime is `/opt/steamvr`;
+its native driver is `drivers/cv/bin/linuxarm64/driver_cv.so`, with a
+`drivers/cv/driver.vrdrivermanifest`. Frame controller manifests/resources are
+under `drivers/frame_controller/`. Configuration is under
+`~/.config/openvr/config/`, not the Steam client's config directory. The
+SlimeVR release also uses `slimevr/bin/linuxarm64/driver_slimevr.so` plus its
+manifest. Nothing in those installed SteamVR directories was changed.
+
+**Inferred:** the matching ABI/layout and standalone factory success make
+SteamVR integration plausible. They do not prove successful driver `Init`,
+server/driver IPC, tracking, or calibration. That needs a separate integration
+check with hardware and an agreed SteamVR restart. No Java executable was on
+PATH for this check, so an isolated JRE was used. SlimeVR's server opens LAN
+listeners; our temporary server was stopped and the temporary downloads,
+configuration and logs were removed. It is not left installed or running.
+
+## Tests and remaining checks
+
+```sh
+python3 -m unittest discover -s tests
+```
+
+`tests/test_tracking.py` covers HRS packet parsing, contact/staleness, OSC
+padding/types and a real loopback socket, quaternion signs, opt-in networking,
+private/exclusive logging and a fake BlueZ object tree. The fake checks service
+ownership, notification routing, delayed GATT discovery and connection cleanup.
+It does not pretend to be a physical strap or a real OpenXR runtime.
+
+Before calling hardware support complete, attach a strap and check BPM against
+its own display/reference, loss of contact, disconnect/reconnect, Stop, OSC and
+CSV together. Check avatar eyes while looking up/down/left/right in a supported
+VRChat session. No third-party tracking app is needed for either test.
+
+Independent review attempt: `devin -p --model swe-2-max` with the frozen diff,
+contribution standards and read-only instructions returned no output for ten
+minutes. It was terminated with exit 143. No completed review or actual model
+identity was returned; hardware checks and independent review remain follow-up
+work before making the draft ready.
@@ -94,7 +94,7 @@ A new shortcut is rolled back if artwork fails; failure is never reported as
 an installed app with a blank tile.

 Artwork preference is **SteamGridDB → source images → generated fallback**.
-Set the optional free key in Frame Control's **Settings → Library artwork**, or
+Set the optional free key in Frame Control's **Library artwork settings**, or
 `STEAMGRIDDB_API_KEY` (`FRAME_STEAMGRIDDB_API_KEY` also works). Environment
 settings override the saved key. Without a key there are no provider calls or
 warnings. Saved keys stay in host app data, mode 0600 on POSIX, and are never
@@ -11,7 +11,7 @@ checks below. The PR stays draft.

 ## Our performance HUD

-On **Home → VR performance** (folded until you open it), the app shows a timestamped sample
+On **Home → VR comfort and performance**, the app shows a timestamped sample
 with each status refresh (30 seconds, or Refresh). **Open HUD in headset**
 starts our text HUD as a gamescope panel, refreshed every two seconds. In the
 SteamVR dashboard, select **Frame Control HUD**, then Float in World or dock
@@ -26,7 +26,7 @@ it twice reuses the existing process.
 | Compositor CPU | OpenVR compositor render CPU milliseconds, not game CPU time. |
 | System CPU | `/proc/stat` busy-time delta across the sample, with guest time counted once and iowait treated as idle. |
 | GPU clock | `3d00000.gpu/cur_freq`, converted from Hz to MHz; frequency is not load. |
-| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. In the headset HUD only: the app shows them once, in the battery menu at the top. |
+| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. |

 OpenVR uses background application mode, which does not start SteamVR or keep
 it running. This mode also returned live timing in a read-only device probe.
@@ -6,7 +6,7 @@ is required.** Chromium and immersive WebXR are not in this playback path.

 ## Use it

-In **Tools → Media player** (or **Play a video or photo** on Home), send a file, choose its layout and press
+In **Tools → Media in the headset**, send a file, choose its layout and press
 **Play**. **Theatre** gives it a larger screen and an 85% black surround.
 **Stop** removes both. Refresh reads the library and the player's state.
 The screen follows your head; it isn't a saved world-space panel.
@@ -0,0 +1,135 @@
+/* Frame Control's OpenXR gaze source. No values on stdout/stderr or disk.
+ * The Python bridge supplies a private pipe with --fd; standalone probes only
+ * report counters. Uses a headless session, never submits frames or takes focus. */
+#define XR_USE_TIMESPEC
+#include <time.h>
+#include <openxr/openxr.h>
+#include <openxr/openxr_platform.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+static volatile sig_atomic_t stopped;
+static void stop(int sig) { (void)sig; stopped = 1; }
+#define CHECK(call) do { result = (call); if (XR_FAILED(result)) { \
+    fprintf(stderr, "%s failed (%d)\n", #call, result); goto cleanup; } } while (0)
+
+int main(int argc, char **argv) {
+    int seconds = 10, fd = -1, running = 0, rc = 1;
+    unsigned active = 0, valid = 0, samples = 0;
+    for (int i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "--seconds") && i+1 < argc) seconds = atoi(argv[++i]);
+        else if (!strcmp(argv[i], "--fd") && i+1 < argc) fd = atoi(argv[++i]);
+        else { fprintf(stderr, "usage: gaze [--seconds 1..86400] [--fd private-pipe]\n"); return 2; }
+    }
+    if (seconds < 1 || seconds > 86400 || (fd != -1 && fd < 3)) return 2;
+    FILE *out = fd == -1 ? NULL : fdopen(fd, "w");
+    if (fd != -1 && !out) return 2;
+    signal(SIGINT, stop); signal(SIGTERM, stop); signal(SIGHUP, stop); signal(SIGPIPE, SIG_IGN);
+    XrResult result;
+    XrInstance instance = XR_NULL_HANDLE;
+    XrSession session = XR_NULL_HANDLE;
+    XrActionSet set = XR_NULL_HANDLE;
+    XrSpace gaze = XR_NULL_HANDLE, view = XR_NULL_HANDLE;
+    const char *extensions[] = {"XR_EXT_eye_gaze_interaction", "XR_MND_headless", "XR_KHR_convert_timespec_time"};
+    XrInstanceCreateInfo create = {.type = XR_TYPE_INSTANCE_CREATE_INFO};
+    strcpy(create.applicationInfo.applicationName, "Frame Control gaze");
+    create.applicationInfo.apiVersion = XR_MAKE_VERSION(1, 0, 0);
+    create.enabledExtensionCount = 3; create.enabledExtensionNames = extensions;
+    CHECK(xrCreateInstance(&create, &instance));
+    XrSystemGetInfo get = {.type = XR_TYPE_SYSTEM_GET_INFO, .formFactor = XR_FORM_FACTOR_HEAD_MOUNTED_DISPLAY};
+    XrSystemId system;
+    CHECK(xrGetSystem(instance, &get, &system));
+    XrSystemEyeGazeInteractionPropertiesEXT eye = {.type = XR_TYPE_SYSTEM_EYE_GAZE_INTERACTION_PROPERTIES_EXT};
+    XrSystemProperties props = {.type = XR_TYPE_SYSTEM_PROPERTIES, .next = &eye};
+    CHECK(xrGetSystemProperties(instance, system, &props));
+    printf("supportsEyeGazeInteraction=%u\n", eye.supportsEyeGazeInteraction);
+    if (!eye.supportsEyeGazeInteraction) goto cleanup;
+    XrSessionCreateInfo sc = {.type = XR_TYPE_SESSION_CREATE_INFO, .systemId = system};
+    CHECK(xrCreateSession(instance, &sc, &session));
+    XrActionSetCreateInfo asc = {.type = XR_TYPE_ACTION_SET_CREATE_INFO};
+    strcpy(asc.actionSetName, "gaze"); strcpy(asc.localizedActionSetName, "Gaze");
+    CHECK(xrCreateActionSet(instance, &asc, &set));
+    XrActionCreateInfo ac = {.type = XR_TYPE_ACTION_CREATE_INFO, .actionType = XR_ACTION_TYPE_POSE_INPUT};
+    strcpy(ac.actionName, "gaze_pose"); strcpy(ac.localizedActionName, "Gaze pose");
+    XrAction action;
+    CHECK(xrCreateAction(set, &ac, &action));
+    XrPath profile, input;
+    CHECK(xrStringToPath(instance, "/interaction_profiles/ext/eye_gaze_interaction", &profile));
+    CHECK(xrStringToPath(instance, "/user/eyes_ext/input/gaze_ext/pose", &input));
+    XrActionSuggestedBinding binding = {action, input};
+    XrInteractionProfileSuggestedBinding suggested = {.type = XR_TYPE_INTERACTION_PROFILE_SUGGESTED_BINDING,
+        .interactionProfile = profile, .countSuggestedBindings = 1, .suggestedBindings = &binding};
+    CHECK(xrSuggestInteractionProfileBindings(instance, &suggested));
+    XrSessionActionSetsAttachInfo attach = {.type = XR_TYPE_SESSION_ACTION_SETS_ATTACH_INFO, .countActionSets = 1, .actionSets = &set};
+    CHECK(xrAttachSessionActionSets(session, &attach));
+    XrActionSpaceCreateInfo space = {.type = XR_TYPE_ACTION_SPACE_CREATE_INFO, .action = action, .poseInActionSpace.orientation.w = 1};
+    CHECK(xrCreateActionSpace(session, &space, &gaze));
+    XrReferenceSpaceCreateInfo ref = {.type = XR_TYPE_REFERENCE_SPACE_CREATE_INFO, .referenceSpaceType = XR_REFERENCE_SPACE_TYPE_VIEW,
+        .poseInReferenceSpace.orientation.w = 1};
+    CHECK(xrCreateReferenceSpace(session, &ref, &view));
+    PFN_xrConvertTimespecTimeToTimeKHR convert;
+    CHECK(xrGetInstanceProcAddr(instance, "xrConvertTimespecTimeToTimeKHR", (PFN_xrVoidFunction *)&convert));
+    struct timespec start, now;
+    clock_gettime(CLOCK_MONOTONIC, &start);
+    while (!stopped) {
+        clock_gettime(CLOCK_MONOTONIC, &now);
+        if (now.tv_sec - start.tv_sec >= seconds) break;
+        XrEventDataBuffer event = {.type = XR_TYPE_EVENT_DATA_BUFFER};
+        while ((result = xrPollEvent(instance, &event)) == XR_SUCCESS) {
+            if (event.type == XR_TYPE_EVENT_DATA_SESSION_STATE_CHANGED) {
+                XrSessionState state = ((XrEventDataSessionStateChanged *)&event)->state;
+                printf("sessionState=%d\n", state); fflush(stdout);
+                if (state == XR_SESSION_STATE_READY && !running) {
+                    XrSessionBeginInfo begin = {.type = XR_TYPE_SESSION_BEGIN_INFO, .primaryViewConfigurationType = XR_VIEW_CONFIGURATION_TYPE_PRIMARY_STEREO};
+                    CHECK(xrBeginSession(session, &begin)); running = 1;
+                } else if (state == XR_SESSION_STATE_STOPPING) {
+                    CHECK(xrEndSession(session)); running = 0; stopped = 1;
+                } else if (state == XR_SESSION_STATE_EXITING || state == XR_SESSION_STATE_LOSS_PENDING) stopped = 1;
+            } else if (event.type == XR_TYPE_EVENT_DATA_INSTANCE_LOSS_PENDING) stopped = 1;
+            event.type = XR_TYPE_EVENT_DATA_BUFFER;
+        }
+        if (XR_FAILED(result)) goto cleanup;
+        if (running && !stopped) {
+            XrActiveActionSet activeSet = {set, XR_NULL_PATH};
+            XrActionsSyncInfo sync = {.type = XR_TYPE_ACTIONS_SYNC_INFO, .countActiveActionSets = 1, .activeActionSets = &activeSet};
+            CHECK(xrSyncActions(session, &sync));
+            if (result != XR_SUCCESS) {
+                struct timespec delay = {.tv_nsec = 33333333};
+                nanosleep(&delay, NULL);
+                continue; /* No stale gaze when the runtime denies focus. */
+            }
+            XrActionStateGetInfo ag = {.type = XR_TYPE_ACTION_STATE_GET_INFO, .action = action};
+            XrActionStatePose pose = {.type = XR_TYPE_ACTION_STATE_POSE};
+            CHECK(xrGetActionStatePose(session, &ag, &pose));
+            samples++;
+            if (pose.isActive) {
+                active++;
+                XrTime time; CHECK(convert(instance, &now, &time));
+                XrSpaceLocation location = {.type = XR_TYPE_SPACE_LOCATION};
+                CHECK(xrLocateSpace(gaze, view, time, &location));
+                XrSpaceLocationFlags needed = XR_SPACE_LOCATION_ORIENTATION_VALID_BIT | XR_SPACE_LOCATION_ORIENTATION_TRACKED_BIT;
+                if ((location.locationFlags & needed) == needed) {
+                    valid++;
+                    if (out) {
+                        XrQuaternionf q = location.pose.orientation;
+                        if (fprintf(out, "%g %g %g %g\n", q.x, q.y, q.z, q.w) < 0 || fflush(out)) goto cleanup;
+                    }
+                }
+            }
+        }
+        struct timespec delay = {.tv_nsec = 33333333}; nanosleep(&delay, NULL);
+    }
+    printf("samples=%u active=%u valid=%u\n", samples, active, valid);
+    rc = valid ? 0 : 3; /* Distinguish a working session from observed gaze. */
+cleanup:
+    if (view) xrDestroySpace(view);
+    if (gaze) xrDestroySpace(gaze);
+    if (session) xrDestroySession(session);
+    if (set) xrDestroyActionSet(set);
+    if (instance) xrDestroyInstance(instance);
+    if (out) fclose(out);
+    return rc;
+}
@@ -0,0 +1,481 @@
+"""Experimental pulse estimate from the Frame's IR eye-tracking cameras.
+
+Skin brightens and darkens very slightly with each heartbeat as blood volume
+changes (photoplethysmography). The eye cameras film the skin around each eye
+under steady IR light at about 90 frames per second, so that rhythm may be
+visible in the average brightness of small patches of skin.
+
+Capture uses SteamVR's own `eyetracking --calib` mode, which writes PNG pairs
+to /tmp. Each image is reduced to a grid of patch averages the moment it is
+complete, then deleted; the capture directory is removed on exit. No image
+leaves the Frame or outlives the run. This is an experiment, not a medical
+measurement.
+"""
+from array import array
+import bisect
+import cmath
+import json
+import math
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import time
+
+ET_DIR = Path("/opt/steamvr/tools/eyetracking")
+ET_BIN = ET_DIR / "bin/linuxarm64/eyetracking"
+ET_WEIGHTS = ET_DIR / "resources/et_dsp_20250610_03136.weights"
+GRID = 16        # 16 × 16 patches of 25 × 25 pixels on the 400 × 400 image
+RATE = 15.0      # analysis sample rate, Hz; the band of interest ends at 3 Hz
+LOW, HIGH = 42.0, 180.0  # BPM search band
+# The Frame's proximity sensor (vcnl4000) reads about 3 with nobody wearing it.
+# A worn reading has not been measured yet, so the cut-off is provisional.
+IIO = Path("/sys/bus/iio/devices")
+WORN_MIN = 20.0
+WINDOW = 15.0    # seconds per windowed estimate
+
+
+# ---------------------------------------------------------------- capture ---
+
+def grid_means(pixels, width, height, stride, channels, grid=GRID):
+    """Average of channel 0 in each of grid × grid equal patches."""
+    bw, bh = width // grid, height // grid
+    sums = [0] * (grid * grid)
+    for y in range(bh * grid):
+        start = y * stride
+        row = pixels[start:start + width * channels:channels]
+        base = (y // bh) * grid
+        for bx in range(grid):
+            sums[base + bx] += sum(row[bx * bw:(bx + 1) * bw])
+    area = bw * bh
+    return [s / area for s in sums]
+
+
+def load_grid(path):
+    import gi
+    gi.require_version("GdkPixbuf", "2.0")
+    from gi.repository import GdkPixbuf
+    image = GdkPixbuf.Pixbuf.new_from_file(str(path))
+    return grid_means(image.read_pixel_bytes().get_data(), image.get_width(), image.get_height(),
+                      image.get_rowstride(), image.get_n_channels())
+
+
+def reduce_file(loader, path):
+    """Reduce one image to its patch grid and delete it, whatever happens."""
+    try:
+        return loader(path)
+    finally:
+        os.unlink(path)
+
+
+class Capture:
+    """Run SteamVR's eye-camera capture and reduce frames as they arrive."""
+    NAME = re.compile(r"^(left|right)_(\d+)\.png$")
+    # Only SteamVR's own capture directories are read and removed.
+    PREFIX = "/tmp/etcalib_"
+    # Printed by the capture tool; its output is only flushed when it exits.
+    WRITING = re.compile(r"Writing capture to: (\S+)")
+    # About five seconds of frames (~65 MB in RAM-backed /tmp). If reduction
+    # falls further behind than this, the capture stops rather than letting
+    # eye images pile up.
+    MAX_BACKLOG = 900
+
+    def __init__(self, seconds, runner=subprocess.Popen, loader=load_grid, workers=3):
+        self.seconds, self.runner, self.loader, self.workers = seconds, runner, loader, workers
+        self.grids = {"left": {}, "right": {}}
+        self.directory = None
+        self.pool = None
+        self.submitted = set()
+        self.futures = {}
+        self.new = set()  # every capture directory that appeared during our run
+        self.before = None  # capture directories that existed before the run
+        self.log = None
+
+    def candidates(self):
+        parent, stem = os.path.split(self.PREFIX)
+        return {Path(entry.path) for entry in os.scandir(parent)
+                if entry.name.startswith(stem) and entry.is_dir(follow_symlinks=False)}
+
+    def run(self):
+        # The capture tool's output goes to a private temporary file, read for
+        # failure messages. It is block-buffered, so the capture directory is
+        # found by watching for a new one rather than waiting for its name.
+        import tempfile
+        self.before = before = self.candidates()
+        process = None
+        with tempfile.TemporaryFile("w+") as log:
+            self.log = log
+            try:
+                if self.workers:
+                    # SteamVR pins its eye tracker to cores 0-1; decoding runs beside it.
+                    import concurrent.futures
+                    import multiprocessing
+                    self.pool = concurrent.futures.ProcessPoolExecutor(
+                        self.workers, mp_context=multiprocessing.get_context("fork"))
+                process = self.runner([str(ET_BIN), "-b", "CDSP", "-w", str(ET_WEIGHTS), "--calib", str(self.seconds)],
+                                      cwd=str(ET_BIN.parent), stdout=log, stderr=subprocess.STDOUT)
+                deadline = time.monotonic() + self.seconds + 30
+                while True:
+                    # Checked on every poll: a second capture directory means
+                    # we can't tell which images are ours, so stop.
+                    self.new |= self.candidates() - before
+                    if len(self.new) > 1:
+                        raise RuntimeError("another eye-camera capture is running")
+                    if not self.directory and self.new:
+                        self.directory = next(iter(self.new))
+                    finished = process.poll() is not None
+                    self.reduce(final=finished)
+                    if finished:
+                        break
+                    if time.monotonic() > deadline:
+                        raise RuntimeError("eye-camera capture did not finish")
+                    time.sleep(0.02)
+                log.seek(0)
+                text = log.read()
+                if process.returncode or not self.directory:
+                    reason = "cameras unavailable" if "Failed to" in text else f"exit {process.returncode}"
+                    raise RuntimeError(f"eye-camera capture failed ({reason})")
+                named = self.written(log)
+                if named and named != self.directory:
+                    raise RuntimeError("the capture wrote somewhere else; not using those images")
+                return self.frames()
+            finally:
+                # Each step runs even if an earlier one failed: eye images must
+                # be removed whatever else went wrong.
+                # Ctrl-C and SIGTERM (raised as KeyboardInterrupt) are held
+                # until the images are gone, then re-raised.
+                interrupted, failed = None, None
+                for step in (lambda: self.finish(process),
+                             lambda: self.pool and self.pool.shutdown(wait=True, cancel_futures=True),
+                             self.adopt_reported):
+                    try:
+                        step()
+                    except BaseException as error:
+                        if isinstance(error, Exception):
+                            failed = failed or error
+                        else:
+                            interrupted = interrupted or error
+                self.log = None
+                self.remove()
+                if interrupted:
+                    raise interrupted
+                if failed:
+                    raise RuntimeError(f"the eye-camera capture did not stop cleanly: {failed}")
+
+    def finish(self, process):
+        """Let the capture tool end by itself, deleting its images meanwhile.
+
+        Never signal it: stopping the tool early leaves the headset's eye
+        camera stuck streaming until the DSP service restarts (verified on the
+        Frame with SIGTERM). Its run is bounded by `seconds`, so waiting is
+        short. Only if it overruns by a wide margin is it killed."""
+        if not process:
+            return
+        interrupted = None
+        give_up = time.monotonic() + self.seconds + 30
+        while True:
+            try:
+                if process.poll() is not None:
+                    break
+                self.discard()
+                if time.monotonic() > give_up:
+                    process.kill()
+                    process.wait()
+                    raise RuntimeError("the eye-camera capture had to be killed; "
+                                       "the eye cameras may need a reboot to stream again")
+                time.sleep(0.05)
+            except KeyboardInterrupt as error:  # keep cleaning up until it ends
+                interrupted = interrupted or error
+        if interrupted:
+            raise interrupted
+
+    def discard(self):
+        """Delete the eye images written so far, without reading them."""
+        if self.before is not None:
+            self.new |= self.candidates() - self.before
+        for directory in self.new | ({self.directory} if self.directory else set()):
+            if str(directory).startswith(self.PREFIX) and directory.is_dir() and not directory.is_symlink():
+                for entry in os.scandir(directory):
+                    if self.NAME.match(entry.name):
+                        try:
+                            os.unlink(entry.path)
+                        except OSError:
+                            pass
+
+    def adopt_reported(self):
+        """The directory the tool reported is ours by its own account."""
+        named = self.written(self.log)
+        if named and str(named).startswith(self.PREFIX):
+            self.new.add(named)
+
+    def written(self, log):
+        """The directory the capture tool reported, once its output is flushed."""
+        log.seek(0)
+        match = self.WRITING.search(log.read())
+        return Path(match.group(1)) if match else None
+
+    def reduce(self, final=False):
+        """Reduce and delete every complete image; an image is complete once a
+        later one of the same eye exists, or the capture has ended."""
+        if not self.directory or not self.directory.is_dir():
+            return
+        pending = {"left": [], "right": []}
+        for entry in os.scandir(self.directory):
+            match = self.NAME.match(entry.name)
+            if match:
+                pending[match.group(1)].append((int(match.group(2)), entry.path))
+        if sum(len(files) for files in pending.values()) > self.MAX_BACKLOG:
+            raise RuntimeError("eye-image processing fell behind; capture abandoned")
+        for eye, files in pending.items():
+            files.sort()
+            ready = files if final else files[:-1]
+            for index, path in ready:
+                if path in self.submitted:
+                    continue
+                self.submitted.add(path)
+                if self.pool:
+                    self.futures[(eye, index)] = self.pool.submit(reduce_file, self.loader, path)
+                else:
+                    self.grids[eye][index] = array("f", reduce_file(self.loader, path))
+        for key, future in list(self.futures.items()):
+            if final or future.done():
+                self.grids[key[0]][key[1]] = array("f", future.result())
+                del self.futures[key]
+
+    def frames(self):
+        """[(monotonic seconds, eye, grid)] joined with the capture metadata."""
+        meta = json.loads((self.directory / "meta.json").read_text())
+        frames = []
+        for pair in meta["frames"]:
+            for eye in ("left", "right"):
+                info = pair.get(eye) or {}
+                match = self.NAME.match(Path(info.get("fname", "")).name)
+                grid = self.grids[eye].get(int(match.group(2))) if match else None
+                if info.get("valid") and grid is not None:
+                    frames.append((float(info["tsMono"]), eye, grid))
+        return frames
+
+    def remove(self):
+        """Remove every capture directory that appeared during the run. Eye
+        images must not outlive it, so a failure to delete is an error."""
+        left = []
+        if self.before is not None:
+            try:
+                self.new |= self.candidates() - self.before  # even if interrupted before the first poll
+            except OSError:
+                pass
+        for directory in self.new | ({self.directory} if self.directory else set()):
+            if str(directory).startswith(self.PREFIX) and directory.is_dir() and not directory.is_symlink():
+                try:
+                    shutil.rmtree(directory)
+                except OSError:
+                    left.append(str(directory))
+        if left:
+            raise RuntimeError("could not delete eye images in " + ", ".join(sorted(left)))
+
+
+# --------------------------------------------------------------- analysis ---
+
+def fft(values):
+    """In-place iterative radix-2 FFT of a list whose length is a power of 2."""
+    n = len(values)
+    a = list(values)
+    j = 0
+    for i in range(1, n):
+        bit = n >> 1
+        while j & bit:
+            j ^= bit
+            bit >>= 1
+        j |= bit
+        if i < j:
+            a[i], a[j] = a[j], a[i]
+    size = 2
+    while size <= n:
+        step = cmath.exp(-2j * math.pi / size)
+        half = size // 2
+        for start in range(0, n, size):
+            w = 1
+            for k in range(start, start + half):
+                t = w * a[k + half]
+                a[k + half] = a[k] - t
+                a[k] += t
+                w *= step
+        size *= 2
+    return a
+
+
+def resample(times, values, rate=RATE):
+    """Average samples into 1/rate bins from the first sample; empty bins are
+    filled from the previous bin."""
+    if not times:
+        return []
+    start = times[0]
+    count = int((times[-1] - start) * rate) + 1
+    sums, counts = [0.0] * count, [0] * count
+    for t, v in zip(times, values):
+        i = min(int((t - start) * rate), count - 1)
+        sums[i] += v
+        counts[i] += 1
+    out, last = [], None
+    for s, c in zip(sums, counts):
+        last = s / c if c else last
+        out.append(last)
+    first = next(v for v in out if v is not None)
+    return [first if v is None else v for v in out]
+
+
+def clean(signal, rate=RATE):
+    """Relative change with slow drift removed; None if the patch is mostly
+    blinks or eye movement. Spikes (blinks, saccades) become gaps at the
+    local level rather than clipped steps, which would add false rhythm."""
+    mean = sum(signal) / len(signal)
+    x = [v / mean - 1 for v in signal]
+    half = int(rate)  # 2-second centred moving median removes drift and blinks
+    trend = []
+    for i in range(len(x)):
+        chunk = sorted(x[max(0, i - half):i + half + 1])
+        trend.append(chunk[len(chunk) // 2])
+    residual = [v - m for v, m in zip(x, trend)]
+    mad = sorted(abs(v) for v in residual)[len(residual) // 2] or 1e-9
+    limit = 4 * 1.4826 * mad
+    spikes = sum(1 for v in residual if abs(v) > limit)
+    if spikes > 0.05 * len(residual):
+        return None
+    return [v if abs(v) <= limit else 0.0 for v in residual]
+
+
+def spectrum(signal, rate=RATE):
+    """[(bpm, power)] within the search band, Hann-windowed and zero-padded."""
+    n = len(signal)
+    size = 1
+    while size < max(n * 4, 256):
+        size *= 2
+    window = [0.5 - 0.5 * math.cos(2 * math.pi * i / (n - 1)) for i in range(n)] if n > 1 else [1.0]
+    padded = [s * w for s, w in zip(signal, window)] + [0.0] * (size - n)
+    result = fft(padded)
+    out = []
+    for k in range(size // 2):
+        bpm = k * rate / size * 60
+        if LOW <= bpm <= HIGH:
+            out.append((bpm, abs(result[k]) ** 2))
+    return out
+
+
+def peak(spec):
+    """Peak BPM with parabolic interpolation between spectral bins."""
+    i = max(range(len(spec)), key=lambda k: spec[k][1])
+    if 0 < i < len(spec) - 1:
+        a, b, c = spec[i - 1][1], spec[i][1], spec[i + 1][1]
+        denominator = a - 2 * b + c
+        offset = 0.5 * (a - c) / denominator if denominator else 0.0
+        return spec[i][0] + offset * (spec[1][0] - spec[0][0])
+    return spec[i][0]
+
+
+def snr(spec, bpm, width=4.0):
+    """Power near the pulse and its first harmonic against the rest of the band."""
+    near = sum(p for f, p in spec if abs(f - bpm) <= width or abs(f - 2 * bpm) <= width)
+    rest = sum(p for f, p in spec) - near
+    if near <= 0:
+        return 0.0
+    return near / rest if rest > 0 else float("inf")
+
+
+def normalised(spec):
+    total = sum(p for _, p in spec) or 1.0
+    return [p / total for _, p in spec]
+
+
+def usable(values):
+    """Patches that are neither dark nor saturated for the whole recording."""
+    mean = sum(values) / len(values)
+    return 8 <= mean <= 245
+
+
+def estimate(times, patches, rate=RATE, share=0.2, window=WINDOW):
+    """Estimate pulse from patch brightness traces.
+
+    times: monotonic seconds per frame. patches: {name: [brightness per frame]}.
+    Selects the share of usable patches with the clearest periodic signal,
+    combines their spectra and reports the overall and windowed estimates.
+    """
+    cleaned = {}
+    for name, values in patches.items():
+        if usable(values):
+            signal = clean(resample(times, values, rate), rate)
+            if signal is not None and any(signal):  # flat patches carry no rhythm
+                cleaned[name] = signal
+    if not cleaned or len(next(iter(cleaned.values()))) < rate * 8:
+        raise ValueError("need at least 8 seconds of usable eye-camera frames")
+    quality = []
+    for name, signal in cleaned.items():
+        spec = spectrum(signal, rate)
+        own = peak(spec)
+        quality.append((snr(spec, own), name, own, spec))
+    quality.sort(reverse=True)
+    chosen = quality[:max(4, int(len(quality) * share))]
+    combined = [sum(values) for values in zip(*(normalised(spec) for _, _, _, spec in chosen))]
+    bins = [f for f, _ in chosen[0][3]]
+    bpm = peak(list(zip(bins, combined)))
+    top = chosen[:8]
+    agree = sum(1 for _, _, own, _ in top if abs(own - bpm) <= 5) / len(top)
+    series = []
+    samples = int(window * rate)
+    length = len(next(iter(cleaned.values())))
+    for end in range(samples, length + 1, int(rate)):
+        specs = [spectrum(cleaned[name][end - samples:end], rate) for _, name, _, _ in chosen]
+        total = [sum(values) for values in zip(*(normalised(s) for s in specs))]
+        window_bins = [f for f, _ in specs[0]]
+        series.append((times[0] + end / rate, peak(list(zip(window_bins, total)))))
+    return {
+        "bpm": bpm,
+        "agreement": agree,
+        "patches": len(chosen),
+        "usable": len(cleaned),
+        "snr": snr(list(zip(bins, combined)), bpm),
+        "series": series,
+    }
+
+
+def analyse(frames):
+    """Estimate from Capture.frames(); both eyes' patches are analysed together
+    on a shared time base, each sample taken from that eye's nearest frame."""
+    times = sorted({t for t, _, _ in frames})
+    patches = {}
+    for eye in ("left", "right"):
+        eye_frames = sorted((t, grid) for t, e, grid in frames if e == eye)
+        if not eye_frames:
+            continue
+        eye_times = [t for t, _ in eye_frames]
+        nearest = []
+        for t in times:
+            i = bisect.bisect_left(eye_times, t)
+            if i == len(eye_times) or (i > 0 and t - eye_times[i - 1] <= eye_times[i] - t):
+                i -= 1
+            nearest.append(i)
+        for k in range(len(eye_frames[0][1])):
+            patches[f"{eye}{k}"] = [eye_frames[i][1][k] for i in nearest]
+    return estimate(times, patches)
+
+
+def proximity(root=None):
+    """The headset's proximity reading, or None if it can't be read."""
+    try:
+        for device in sorted(Path(root or IIO).glob("iio:device*")):
+            if (device / "name").read_text().strip() == "vcnl4000":
+                return float((device / "in_proximity_raw").read_text())
+    except (OSError, ValueError):
+        pass
+    return None
+
+
+def worn(reading):
+    """False only when the sensor says the headset is not on a face."""
+    return reading is None or reading >= WORN_MIN
+
+
+def reliable(result):
+    """Whether the estimate is clear enough to show as a reading. Thresholds
+    are provisional until checked against a reference on a real wearer."""
+    return result["agreement"] >= 0.75 and result["snr"] >= 0.5
@@ -0,0 +1,438 @@
+#!/usr/bin/env python3
+"""Frame-local tracking tools. No network destination or data log by default."""
+import argparse
+import math
+import os
+from pathlib import Path
+import signal
+import socket
+import struct
+import subprocess
+import time
+
+
+class TrackingError(RuntimeError):
+    """A safe, actionable status message containing no sensor data."""
+
+
+HRS = "0000180d-0000-1000-8000-00805f9b34fb"
+MEASUREMENT = "00002a37-0000-1000-8000-00805f9b34fb"
+DEVICE = "org.bluez.Device1"
+SERVICE = "org.bluez.GattService1"
+CHARACTERISTIC = "org.bluez.GattCharacteristic1"
+
+
+def heart_rate(data):
+    """Validate the Bluetooth HRS measurement, returning BPM/contact only.
+
+    Energy and RR intervals are checked for length but never retained.
+    None means contact is supported and the strap reports no skin contact.
+    """
+    data = bytes(data)
+    if len(data) < 2 or data[0] & 0xe0:
+        raise ValueError("invalid HRS measurement")
+    flags = data[0]
+    size = 2 if flags & 1 else 1
+    end = 1 + size + (2 if flags & 8 else 0)
+    if len(data) < end:
+        raise ValueError("truncated HRS measurement")
+    extra = len(data) - end
+    if (flags & 16 and (extra < 2 or extra % 2)) or (not flags & 16 and extra):
+        raise ValueError("invalid HRS optional fields")
+    if flags & 4 and not flags & 2:
+        return None
+    bpm = int.from_bytes(data[1:1 + size], "little")
+    return bpm if bpm else None
+
+
+def gaze_angles(quaternion):
+    """OpenXR head-relative -Z forward → VRChat degrees, down/right positive."""
+    if len(quaternion) != 4 or not all(math.isfinite(v) for v in quaternion):
+        raise ValueError("invalid gaze orientation")
+    norm = math.sqrt(sum(v * v for v in quaternion))
+    if not 0.9 < norm < 1.1:
+        raise ValueError("invalid gaze orientation")
+    x, y, z, w = (v / norm for v in quaternion)
+    # Rotate OpenXR's forward vector (0, 0, -1) into VIEW space.
+    dx, dy, dz = -2 * (x*z + w*y), 2 * (w*x - y*z), 2 * (x*x + y*y) - 1
+    return math.degrees(math.atan2(-dy, math.hypot(dx, dz))), math.degrees(math.atan2(dx, -dz))
+
+
+def osc_message(address, values):
+    if not address.startswith("/") or any(c.isspace() or c in '\0#*,?[]{}' for c in address):
+        raise ValueError("OSC address must be a literal path")
+    def string(value):
+        encoded = value.encode("utf-8") + b"\0"
+        return encoded + b"\0" * (-len(encoded) % 4)
+    tags, payload = ",", b""
+    for value in values:
+        if type(value) is int:
+            tags += "i"
+            payload += struct.pack(">i", value)
+        else:
+            if not math.isfinite(value):
+                raise ValueError("OSC value must be finite")
+            tags += "f"
+            payload += struct.pack(">f", value)
+    return string(address) + string(tags) + payload
+
+
+class Osc:
+    def __init__(self, endpoint=None):
+        self.sock = None
+        self.target = None
+        if endpoint:
+            import ipaddress
+            address = ipaddress.ip_address(endpoint[0])
+            port = int(endpoint[1])
+            if address.is_unspecified or address.is_multicast or not 1 <= port <= 65535:
+                raise ValueError("OSC needs a unicast IP address and port 1..65535")
+            self.sock = socket.socket(socket.AF_INET6 if address.version == 6 else socket.AF_INET, socket.SOCK_DGRAM)
+            self.target = (str(address), port)
+
+    def send(self, address, values):
+        if self.sock:
+            self.sock.sendto(osc_message(address, values), self.target)
+
+    def close(self):
+        if self.sock:
+            self.sock.close()
+
+
+class HeartSession:
+    def __init__(self, osc, address, log=None, clock=time.monotonic):
+        self.osc, self.address, self.clock = osc, address, clock
+        self.bpm, self.updated = None, None
+        self.log = None
+        if log:
+            # Exclusive creation refuses existing files and symlinks; mode is
+            # private even with a permissive process umask.
+            fd = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            self.log = os.fdopen(fd, "w")
+            self.log.write("unix_seconds,bpm\n")
+
+    def notification(self, data):
+        self.bpm = heart_rate(data)
+        self.updated = self.clock()
+        if self.bpm is not None:
+            self.osc.send(self.address, [self.bpm])
+            if self.log:
+                self.log.write(f"{time.time():.3f},{self.bpm}\n")
+                self.log.flush()
+
+    def current(self):
+        if self.updated is None or self.clock() - self.updated > 5:
+            return None
+        return self.bpm
+
+    def close(self):
+        if self.log:
+            self.log.close()
+
+
+class BluezHeart:
+    """One explicitly selected, already discovered strap; no ambient scan."""
+    def __init__(self, bus, interface, address, on_value):
+        self.bus, self.interface, self.on_value = bus, interface, on_value
+        self.device = self.characteristic = None
+        self.connected_here = False
+        self.notifying = False
+        self.match = None
+        objects = self.objects()
+        matches = [path for path, interfaces in objects.items()
+                   if str(interfaces.get(DEVICE, {}).get("Address", "")).upper() == address.upper()]
+        if len(matches) != 1:
+            raise TrackingError("Strap not found uniquely in BlueZ; pair/discover it in SteamOS Bluetooth settings first")
+        self.device = matches[0]
+        self.match = bus.add_signal_receiver(self.changed, signal_name="PropertiesChanged",
+                                            dbus_interface="org.freedesktop.DBus.Properties",
+                                            bus_name="org.bluez", path_keyword="path")
+        try:
+            if not objects[self.device][DEVICE].get("Connected"):
+                self.call(self.device, DEVICE).Connect(timeout=20)
+                self.connected_here = True
+        except Exception:
+            self.close()
+            raise
+
+    def objects(self):
+        return self.call("/", "org.freedesktop.DBus.ObjectManager").GetManagedObjects()
+
+    def call(self, path, kind):
+        return self.interface(self.bus.get_object("org.bluez", path), kind)
+
+    def subscribe(self):
+        objects = self.objects()
+        if not objects.get(self.device, {}).get(DEVICE, {}).get("ServicesResolved"):
+            return False
+        services = {p for p, obj in objects.items() if str(obj.get(SERVICE, {}).get("UUID", "")).lower() == HRS
+                    and obj[SERVICE].get("Device") == self.device}
+        for path, obj in objects.items():
+            props = obj.get(CHARACTERISTIC, {})
+            if props.get("Service") in services and str(props.get("UUID", "")).lower() == MEASUREMENT:
+                if "notify" not in props.get("Flags", []):
+                    raise TrackingError("Heart-rate characteristic does not support notifications")
+                self.characteristic = path
+                self.call(path, CHARACTERISTIC).StartNotify()
+                self.notifying = True
+                return True
+        raise TrackingError("Selected device has no standard Heart Rate Service measurement")
+
+    def changed(self, kind, changes, invalidated, path=None):
+        if kind == CHARACTERISTIC and path == self.characteristic and "Value" in changes:
+            self.on_value(changes["Value"])
+        elif kind == DEVICE and path == self.device and "Connected" in changes and not changes["Connected"]:
+            self.on_value(None)
+
+    def close(self):
+        try:
+            if self.notifying:
+                self.call(self.characteristic, CHARACTERISTIC).StopNotify()
+        finally:
+            if self.match:
+                self.match.remove()
+            if self.connected_here:
+                self.call(self.device, DEVICE).Disconnect()
+
+
+def run_gaze(args, osc):
+    binary = Path(__file__).with_name("gaze")
+    command = [str(binary), "--seconds", str(args.seconds)]
+    if not args.osc:
+        return subprocess.call(command)
+    read_fd, write_fd = os.pipe()
+    process = None
+    try:
+        process = subprocess.Popen(command + ["--fd", str(write_fd)], pass_fds=(write_fd,))
+        os.close(write_fd)
+        write_fd = None
+        with os.fdopen(read_fd) as source:
+            read_fd = None
+            for line in source:
+                try:
+                    angles = gaze_angles([float(v) for v in line.split()])
+                except ValueError:
+                    continue
+                osc.send("/tracking/eye/CenterPitchYaw", angles)
+        return process.wait()
+    finally:
+        if read_fd is not None:
+            os.close(read_fd)
+        if write_fd is not None:
+            os.close(write_fd)
+        if process and process.poll() is None:
+            process.terminate()
+            try:
+                process.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.wait()
+
+
+class HeartPanel:
+    """Our GTK panel, using the Frame's existing GTK4/GI platform libraries."""
+    def __init__(self):
+        os.environ["GDK_BACKEND"] = "x11"
+        import gi
+        gi.require_version("Gtk", "4.0")
+        gi.require_version("GdkX11", "4.0")
+        from gi.repository import Gtk, Gdk, GdkX11, GLib
+        Gtk.init()
+        self.running = True
+        self.window = Gtk.Window(title="Frame Control · Heart rate")
+        self.window.set_default_size(480, 320)
+        self.window.connect("close-request", self.stop)
+        Gtk.Settings.get_default().set_property("gtk-application-prefer-dark-theme", True)
+        box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=16)
+        box.set_valign(Gtk.Align.CENTER)
+        box.set_halign(Gtk.Align.CENTER)
+        box.set_size_request(440, -1)
+        for side in ("top", "bottom", "start", "end"):
+            getattr(box, "set_margin_" + side)(24)
+        self.window.set_child(box)
+        title = Gtk.Label(label="Heart rate")
+        title.add_css_class("title-2")
+        box.append(title)
+        self.reading = Gtk.Label(label="—")
+        self.reading.add_css_class("reading")
+        box.append(self.reading)
+        self.status = Gtk.Label(label="Waiting for strap")
+        box.append(self.status)
+        button = Gtk.Button(label="Stop")
+        button.connect("clicked", self.stop)
+        box.append(button)
+        css = Gtk.CssProvider()
+        css.load_from_data(b".reading { font-size: 144px; font-weight: 700; }")
+        Gtk.StyleContext.add_provider_for_display(Gdk.Display.get_default(), css, Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION)
+        self.window.present()
+        context = GLib.MainContext.default()
+        while context.pending():
+            context.iteration(False)
+        try:
+            xid = GdkX11.X11Surface.get_xid(self.window.get_surface())
+            subprocess.run(["xprop", "-id", str(xid), "-f", "STEAM_GAME", "32c", "-set", "STEAM_GAME", "2000000027"],
+                           check=True, stdout=subprocess.DEVNULL)
+        except Exception:
+            self.window.destroy()
+            raise
+
+    def stop(self, *args):
+        self.running = False
+        return True
+
+    def update(self, bpm):
+        self.reading.set_label(str(bpm) if bpm is not None else "—")
+        self.status.set_label("beats per minute" if bpm is not None else "Waiting for strap")
+
+    def close(self):
+        self.window.destroy()
+
+
+def run_heart(args, osc):
+    import dbus
+    from dbus.mainloop.glib import DBusGMainLoop
+    from gi.repository import GLib
+    DBusGMainLoop(set_as_default=True)
+    session = HeartSession(osc, args.address, args.log)
+    reader, root = None, None
+    failure = []
+    def value(data):
+        if data is None:
+            session.bpm = None
+            failure.append("Strap disconnected; reconnect and start again")
+            return
+        try:
+            session.notification(data)
+        except ValueError:
+            session.bpm = None
+        except OSError:
+            failure.append("OSC or session log write failed")
+    try:
+        reader = BluezHeart(dbus.SystemBus(), dbus.Interface, args.device, value)
+        context = GLib.MainContext.default()
+        deadline = time.monotonic() + 20
+        while not reader.subscribe():
+            if time.monotonic() > deadline:
+                raise TrackingError("Timed out waiting for the strap's GATT services")
+            while context.pending():
+                context.iteration(False)
+            time.sleep(0.1)
+        end = time.monotonic() + args.seconds
+        print("Heart-rate notifications started; readings stay local unless OSC or a log was selected.")
+        if args.panel:
+            root = HeartPanel()
+        running = lambda: root.running if root else True
+        while running() and time.monotonic() < end and not failure:
+            while context.pending():
+                context.iteration(False)
+            if root:
+                root.update(session.current())
+            time.sleep(0.05)
+        if failure:
+            raise TrackingError(failure[0])
+        return 0
+    finally:
+        if root:
+            root.close()
+        try:
+            if reader:
+                reader.close()
+        finally:
+            session.close()
+
+
+def run_pulse(args, osc):
+    """Experimental: estimate pulse from the IR eye cameras (see pulse.py)."""
+    import pulse
+    if not pulse.ET_BIN.exists():
+        raise TrackingError("SteamVR's eye-tracking tool is not installed on this Frame")
+    print(f"Capturing {args.seconds} s from the eye cameras. Wear the headset and keep still.", flush=True)
+    readings = [pulse.proximity()]
+    try:
+        frames = pulse.Capture(args.seconds).run()
+        readings.append(pulse.proximity())
+    except RuntimeError as error:  # capture status only; no image data
+        raise TrackingError(str(error))
+    print(f"Captured {len(frames)} eye frames; images already deleted. Analysing...", flush=True)
+    try:
+        result = pulse.analyse(frames)
+    except ValueError as error:
+        raise TrackingError(str(error))
+    on_face = all(pulse.worn(reading) for reading in readings)
+    if not on_face:
+        # Unworn, the cameras still show a steady periodic artifact that looks
+        # like a pulse (verified on the Frame), so it is never called clear.
+        print("The proximity sensor says the headset is not being worn; no pulse can be read.")
+    clear = on_face and pulse.reliable(result)
+    offset = time.time() - time.monotonic()  # the capture's timestamps are CLOCK_MONOTONIC
+    if args.log:
+        fd = os.open(args.log, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "w") as log:
+            log.write("unix_seconds,bpm\n")
+            for when, bpm in result["series"]:
+                log.write(f"{when + offset:.3f},{bpm:.1f}\n")
+    if clear:
+        osc.send(args.address, [round(result["bpm"])])
+    if args.show:
+        print(f"Estimate: {result['bpm']:.1f} BPM ({'clear' if clear else 'NOT clear'}; "
+              f"patch agreement {result['agreement']:.0%}, signal/noise {result['snr']:.2f}, "
+              f"{result['patches']} of {result['usable']} usable patches)")
+        print("Per-second estimates (15 s windows): "
+              + " ".join(str(round(bpm)) for _, bpm in result["series"]))
+    else:
+        print("A clear pulse was found." if clear else "No clear pulse was found.")
+    return 0 if clear else 3
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    gaze = commands.add_parser("gaze", help="headless OpenXR; prints counters only without --osc")
+    heart = commands.add_parser("heart", help="standard BLE HRS from an explicitly selected strap")
+    pulse = commands.add_parser("pulse", help="experimental pulse estimate from the IR eye cameras")
+    for command in (gaze, heart, pulse):
+        command.add_argument("--osc", nargs=2, metavar=("IP", "PORT"), help="explicit UDP destination; no default")
+    for command in (gaze, heart):
+        command.add_argument("--seconds", type=int, default=10, help="bounded run, 1..86400 seconds (default: 10)")
+    pulse.add_argument("--seconds", type=int, default=60, help="capture length, 20..300 seconds (default: 60)")
+    heart.add_argument("--device", required=True, help="strap Bluetooth address already discovered by BlueZ")
+    heart.add_argument("--panel", action="store_true", help="show our panel on gamescope DISPLAY=:0")
+    for command in (heart, pulse):
+        command.add_argument("--address", default="/avatar/parameters/HeartRate", help="integer BPM OSC parameter")
+        command.add_argument("--log", help="new private CSV file; disabled by default")
+    pulse.add_argument("--show", action="store_true", help="print the estimate and per-second series")
+    args = parser.parse_args()
+    if not 1 <= args.seconds <= 86400:
+        parser.error("--seconds must be 1..86400")
+    if args.command == "pulse" and not 20 <= args.seconds <= 300:
+        parser.error("pulse --seconds must be 20..300")
+    def interrupted(signum, frame):
+        raise KeyboardInterrupt
+    signal.signal(signal.SIGTERM, interrupted)
+    if hasattr(signal, "SIGHUP"):
+        signal.signal(signal.SIGHUP, interrupted)
+    osc = None
+    try:
+        if args.command in ("heart", "pulse"):
+            osc_message(args.address, [0])
+            if getattr(args, "panel", False):
+                os.environ["DISPLAY"] = ":0"
+        osc = Osc(args.osc)
+        run = {"gaze": run_gaze, "heart": run_heart, "pulse": run_pulse}[args.command]
+        return run(args, osc)
+    except TrackingError as error:
+        print(str(error))
+        return 1
+    except KeyboardInterrupt:
+        return 130
+    except Exception as error:
+        # Never dump notifications, gaze, BLE addresses or exception payloads.
+        print(f"Tracking stopped ({type(error).__name__}). Check the device, runtime and selected output.")
+        return 1
+    finally:
+        if osc:
+            osc.close()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -7,8 +7,6 @@
 	objects = {

 /* Begin PBXBuildFile section */
-		C1234567890ABCDEF0123456 /* NativeSessionTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = D1234567890ABCDEF0123456 /* NativeSessionTests.swift */; };
-		A1234567890ABCDEF0123456 /* NativeSessionState.swift in Sources */ = {isa = PBXBuildFile; fileRef = B1234567890ABCDEF0123456 /* NativeSessionState.swift */; };
 		0DEE50BD563B1D8C328C4C0A /* HeadsetServer.swift in Sources */ = {isa = PBXBuildFile; fileRef = EDC7BA8014DBC302D08FD397 /* HeadsetServer.swift */; };
 		12B21D3319BAF5AE79948560 /* FrameLink.swift in Sources */ = {isa = PBXBuildFile; fileRef = 16644E7FDA7ADD5B232EB700 /* FrameLink.swift */; };
 		1A07EC692B0FF723907EA77B /* WebShell.swift in Sources */ = {isa = PBXBuildFile; fileRef = D6C4E6C28315CA8729FCAAEA /* WebShell.swift */; };
@@ -37,8 +35,6 @@
 /* End PBXContainerItemProxy section */

 /* Begin PBXFileReference section */
-		D1234567890ABCDEF0123456 /* NativeSessionTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeSessionTests.swift; sourceTree = "<group>"; };
-		B1234567890ABCDEF0123456 /* NativeSessionState.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeSessionState.swift; sourceTree = "<group>"; };
 		16644E7FDA7ADD5B232EB700 /* FrameLink.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameLink.swift; sourceTree = "<group>"; };
 		1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameControlTests.swift; sourceTree = "<group>"; };
 		237D9AF04EEA257AB382F60E /* Keys.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Keys.swift; sourceTree = "<group>"; };
@@ -104,7 +100,6 @@
 			isa = PBXGroup;
 			children = (
 				8A11F3431826A26B247C0695 /* AppModel.swift */,
-				B1234567890ABCDEF0123456 /* NativeSessionState.swift */,
 				93C8E0D7C3F4F628941B3D5A /* FrameControlApp.swift */,
 				BF0FCA7117DA3ABA449B4EE0 /* InstallLink.swift */,
 			);
@@ -116,7 +111,6 @@
 			children = (
 				E81218B75FEEE47B8D8BAE20 /* ComfortNotificationTests.swift */,
 				1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */,
-				D1234567890ABCDEF0123456 /* NativeSessionTests.swift */,
 			);
 			path = FrameControlTests;
 			sourceTree = "<group>";
@@ -266,7 +260,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				F94D0252F8CC5854314B84B2 /* AppModel.swift in Sources */,
-				A1234567890ABCDEF0123456 /* NativeSessionState.swift in Sources */,
 				78427FC66780623F31E7501E /* FrameControlApp.swift in Sources */,
 				E6898C714A92D3979F73B6E1 /* FrameFinder.swift in Sources */,
 				12B21D3319BAF5AE79948560 /* FrameLink.swift in Sources */,
@@ -286,7 +279,6 @@
 			files = (
 				A0C5B00E257230A38DBD9E54 /* ComfortNotificationTests.swift in Sources */,
 				DC043FB74BE2D23F3A5826BF /* FrameControlTests.swift in Sources */,
-				C1234567890ABCDEF0123456 /* NativeSessionTests.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -19,20 +19,6 @@ final class AppModel: ObservableObject {
    /// Install links that arrived before the page was ready for them.
    @Published var pendingInstallLinks: [InstallLink] = []

-    /// Native recovery remains reachable even when WebKit cannot draw a page.
-    @Published private(set) var webRecoveryMessage: String?
-    @Published private(set) var webReloadID = 0
-
-    func webContentFailed(at url: URL, message: String) {
-        guard phase == .ready(url) else { return }
-        webRecoveryMessage = message
-    }
-
-    func retryWebContent() {
-        webRecoveryMessage = nil
-        webReloadID += 1
-    }
-
    private var link: FrameLink?
    private var server: HeadsetServer?
    private var forwarder: PortForwarder?
@@ -113,7 +99,18 @@ final class AppModel: ObservableObject {

    /// "host", "host:port" or "[v6]:port", plus a user name.
    nonisolated static func parse(host: String, user: String) -> FrameSettings? {
-        FrameSettings.parse(host: host, user: user)
+        var target = FrameSettings(host: host.trimmingCharacters(in: .whitespaces), user: user.trimmingCharacters(in: .whitespaces))
+        if target.host.hasPrefix("["), let close = target.host.firstIndex(of: "]") {
+            let rest = target.host[target.host.index(after: close)...]
+            if rest.hasPrefix(":"), let port = Int(rest.dropFirst()) { target.port = port }
+            target.host = String(target.host[target.host.index(after: target.host.startIndex)..<close])
+        } else if target.host.filter({ $0 == ":" }).count == 1, let colon = target.host.lastIndex(of: ":"),
+                  let port = Int(target.host[target.host.index(after: colon)...]) {
+            target.port = port
+            target.host = String(target.host[..<colon])
+        }
+        guard !target.host.isEmpty, !target.user.isEmpty, (1...65535).contains(target.port) else { return nil }
+        return target
    }

    /// This phone's line for ~/.ssh/authorized_keys on the Frame.
@@ -148,7 +145,6 @@ final class AppModel: ObservableObject {
    private func invalidate() {
        attempt += 1
        retrying = false
-        webRecoveryMessage = nil
    }

    /// quiet: a background retry, which leaves the failure screen up until it works.
@@ -1,142 +0,0 @@
-import Foundation
-
-/// The persisted SSH target and its editable, lossless address form.
-struct FrameSettings: Codable, Equatable {
-    var host: String
-    var port: Int = 22
-    var user: String = "steamos"
-
-    var address: String {
-        let name = host.contains(":") ? "[\(host)]" : host
-        return port == 22 ? name : "\(name):\(port)"
-    }
-
-    static func parse(host: String, user: String) -> FrameSettings? {
-        var host = host.trimmingCharacters(in: .whitespacesAndNewlines)
-        let user = user.trimmingCharacters(in: .whitespacesAndNewlines)
-        var port = 22
-        if host.hasPrefix("[") {
-            guard let close = host.firstIndex(of: "]") else { return nil }
-            let rest = host[host.index(after: close)...]
-            if !rest.isEmpty {
-                guard rest.hasPrefix(":"), let value = Int(rest.dropFirst()) else { return nil }
-                port = value
-            }
-            host = String(host[host.index(after: host.startIndex)..<close])
-        } else if host.filter({ $0 == ":" }).count == 1, let colon = host.lastIndex(of: ":") {
-            guard let value = Int(host[host.index(after: colon)...]) else { return nil }
-            port = value
-            host = String(host[..<colon])
-        }
-        guard !host.isEmpty, !user.isEmpty, (1...65535).contains(port) else { return nil }
-        return FrameSettings(host: host, port: port, user: user)
-    }
-}
-
-/// Each search owns its callbacks. Cancelling invalidates even probes that cannot
-/// be cancelled while Network.framework finishes opening a connection.
-struct FrameSearchState {
-    private(set) var generation = UUID()
-    private(set) var manualAddress: String?
-
-    mutating func start(manualAddress: String?) -> UUID {
-        generation = UUID()
-        let typed = manualAddress?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
-        self.manualAddress = typed.isEmpty ? nil : typed
-        return generation
-    }
-
-    mutating func stop() { generation = UUID() }
-    func accepts(_ generation: UUID) -> Bool { self.generation == generation }
-    var discovers: Bool { manualAddress == nil }
-
-    static func address(manual: String, discovered: String?) -> String {
-        let typed = manual.trimmingCharacters(in: .whitespacesAndNewlines)
-        return typed.isEmpty ? (discovered ?? "frame.local") : typed
-    }
-}
-
-/// One automatic recovery per session; only a deliberate retry or a new session
-/// replenishes it. A successful load alone must not create a process-crash loop.
-struct WebDocumentState {
-    struct Delivery: Equatable {
-        let generation: UUID
-        let documentID: String
-    }
-
-    private(set) var generation = UUID()
-    private(set) var documentID: String?
-    private(set) var delivering = false
-    private var reloads = 0
-
-    mutating func beginDocument() {
-        generation = UUID()
-        documentID = nil
-        delivering = false
-    }
-
-    mutating func resetSession() {
-        reloads = 0
-        beginDocument()
-    }
-
-    mutating func shouldReloadAfterFailure() -> Bool {
-        beginDocument()
-        guard reloads < 1 else { return false }
-        reloads += 1
-        return true
-    }
-
-    mutating func ready(_ id: String, generation: UUID) {
-        guard self.generation == generation else { return }
-        documentID = id
-    }
-
-    mutating func beginDelivery() -> Delivery? {
-        guard !delivering, let documentID else { return nil }
-        delivering = true
-        return Delivery(generation: generation, documentID: documentID)
-    }
-
-    /// Only acknowledgement from the same live document may consume a link.
-    mutating func finishDelivery(_ delivery: Delivery, acknowledged: Bool) -> Bool {
-        guard delivery.generation == generation, delivering, delivery.documentID == documentID else { return false }
-        delivering = false
-        if !acknowledged { documentID = nil }
-        return acknowledged
-    }
-}
-
-/// Small app-scoped preferences survive the tunnel's intentionally ephemeral port.
-struct FramePreferences {
-    private let defaults: UserDefaults
-    private static let keys = ["mvSeparate", "padUsed"]
-    private static let prefix = "frame.control.preference."
-
-    init(defaults: UserDefaults = .standard) { self.defaults = defaults }
-
-    func read() -> [String: String] {
-        var result: [String: String] = [:]
-        for key in Self.keys {
-            if let value = defaults.object(forKey: Self.prefix + key) as? String, ["0", "1"].contains(value) {
-                result[key] = value
-            }
-        }
-        return result
-    }
-
-    @discardableResult
-    func write(key: String, value: String) -> Bool {
-        guard Self.keys.contains(key), ["0", "1"].contains(value) else { return false }
-        defaults.set(value, forKey: Self.prefix + key)
-        return true
-    }
-}
-
-/// True for the first caller only.
-final class Once: @unchecked Sendable {
-    private let lock = NSLock()
-    private var done = false
-    func claim() -> Bool { lock.withLock { defer { done = true }; return !done } }
-}
-
@@ -1,4 +1,3 @@
-import Combine
 import Foundation
 import Network

@@ -19,30 +18,20 @@ final class FrameFinder: ObservableObject {

    private var browser: NWBrowser?
    private var probeTask: Task<Void, Never>?
-    private var search = FrameSearchState()
-    private let probe: @Sendable (String) async -> Bool
-    private let discoveryEnabled: Bool
+    private var fallback = "frame.local"

-    init(probe: @escaping @Sendable (String) async -> Bool = { await FrameFinder.sshAnswers(host: $0) },
-         discoveryEnabled: Bool = true) {
-        self.probe = probe
-        self.discoveryEnabled = discoveryEnabled
-    }
-
-    func start(fallback: String?, manual: Bool = false) {
+    func start(fallback: String?) {
        stop()
-        let mine = search.start(manualAddress: manual ? fallback : nil)
-        let host = FrameSearchState.address(manual: search.manualAddress ?? "", discovered: fallback)
+        self.fallback = (fallback?.isEmpty == false ? fallback : nil) ?? "frame.local"
        found = nil
        since = Date()
-        if search.discovers && discoveryEnabled { browse(generation: mine) }
+        browse()
        probeTask = Task { [weak self] in
            while !Task.isCancelled {
-                guard let self, self.search.accepts(mine) else { return }
-                if self.found == nil {
-                    let answers = await self.probe(host)
-                    guard !Task.isCancelled, self.search.accepts(mine) else { return }
-                    if answers, self.found == nil { self.found = Found(host: host, name: host) }
+                guard let self else { return }
+                let host = self.fallback
+                if self.found == nil, await Self.sshAnswers(host: host) {
+                    self.found = Found(host: host, name: host)
                }
                try? await Task.sleep(nanoseconds: 3_000_000_000)
            }
@@ -50,21 +39,20 @@ final class FrameFinder: ObservableObject {
    }

    func stop() {
-        search.stop()
        browser?.cancel()
        browser = nil
        probeTask?.cancel()
        probeTask = nil
    }

-    private func browse(generation: UUID) {
+    private func browse() {
        let browser = NWBrowser(for: .bonjour(type: "_steamos-devkit._tcp", domain: nil), using: .tcp)
        browser.browseResultsChangedHandler = { [weak self] results, _ in
            for result in results {
                guard case let .service(name, _, _, _) = result.endpoint else { continue }
                Self.resolve(result.endpoint) { host in
                    Task { @MainActor in
-                        guard let self, self.search.accepts(generation), self.search.discovers, let host else { return }
+                        guard let self, let host else { return }
                        // A found device is used over the fallback probe.
                        self.found = Found(host: host, name: name)
                    }
@@ -103,8 +91,12 @@ final class FrameFinder: ObservableObject {

    /// Whether something answers on the SSH port of "host" or "host:port" within a few seconds.
    nonisolated static func sshAnswers(host address: String) async -> Bool {
-        guard let target = FrameSettings.parse(host: address, user: "steamos") else { return false }
-        return await sshAnswers(host: target.host, port: UInt16(target.port))
+        var host = address, port: UInt16 = 22
+        if let target = AppModel.parse(host: address, user: "steamos") {
+            host = target.host
+            port = UInt16(target.port)
+        }
+        return await sshAnswers(host: host, port: port)
    }

    nonisolated static func sshAnswers(host: String, port: UInt16) async -> Bool {
@@ -4,6 +4,13 @@ import Foundation
 import NIOCore
 import NIOSSH

+/// Where the Frame is and who to log in as.
+struct FrameSettings: Codable, Equatable {
+    var host: String
+    var port: Int = 22
+    var user: String = "steamos"
+}
+
 struct FrameFailure: LocalizedError {
    let message: String
    /// Retrying can't help: the Frame's identity changed, or it refused this phone's login.
@@ -133,6 +140,12 @@ final class FrameLink: @unchecked Sendable {
    }
 }

+/// True for the first caller only.
+final class Once: @unchecked Sendable {
+    private let lock = NSLock()
+    private var done = false
+    func claim() -> Bool { lock.withLock { defer { done = true }; return !done } }
+}

 func shellQuote(_ s: String) -> String {
    "'" + s.replacingOccurrences(of: "'", with: "'\\''") + "'"
@@ -10,31 +10,15 @@ struct RootView: View {
            case .setup:
                SetupView(model: model)
            case .connecting(let step):
-                ConnectingView(step: step, host: model.settings?.address) { model.showSetup() }
+                ConnectingView(step: step, host: model.settings?.host) { model.showSetup() }
            case .failed(let message) where model.retrying && !model.needsPairing:
-                WaitingView(host: model.settings?.address ?? "", detail: message, deviceName: model.deviceName,
+                WaitingView(host: model.settings.map { $0.port == 22 ? $0.host : "\($0.host):\($0.port)" } ?? "", detail: message, deviceName: model.deviceName,
                            reachable: { Task { await model.connect(quiet: true) } }, change: { model.showSetup() })
            case .failed(let message):
                FailedView(message: message, canRetry: model.settings != nil, retrying: model.retrying, needsPairing: model.needsPairing,
                           retry: { Task { await model.connect() } }, change: { model.showSetup() })
            case .ready(let url):
                WebShell(url: url, model: model).ignoresSafeArea()
-                    .accessibilityHidden(model.webRecoveryMessage != nil)
-                    .allowsHitTesting(model.webRecoveryMessage == nil)
-                if let message = model.webRecoveryMessage {
-                    RecoveryLayout {
-                        VStack(spacing: 16) {
-                            Image(systemName: "arrow.clockwise.circle").font(.system(size: 44)).foregroundStyle(.orange)
-                            Text("Reload Frame Control").font(.title3.bold())
-                            Text(message).multilineTextAlignment(.center).foregroundStyle(Color.frameMuted)
-                            Button("Try again") { model.retryWebContent() }
-                                .buttonStyle(.borderedProminent).controlSize(.large)
-                            Button("Change headset") { model.showSetup() }
-                        }
-                        .padding(32).frame(maxWidth: 480)
-                    }
-                    .background(Color.frameBackground.ignoresSafeArea())
-                }
            }
        }
        .preferredColorScheme(.dark)
@@ -49,37 +33,20 @@ extension Color {
    static let frameMuted = Color(red: 0.561, green: 0.596, blue: 0.627)
 }

-/// Recovery controls remain reachable on short screens and with large text.
-private struct RecoveryLayout<Content: View>: View {
-    @ViewBuilder let content: Content
-
-    var body: some View {
-        GeometryReader { geometry in
-            ScrollView {
-                content
-                    .frame(maxWidth: .infinity)
-                    .frame(minHeight: geometry.size.height)
-            }
-        }
-    }
-}
-
 struct ConnectingView: View {
    let step: String
    let host: String?
    let cancel: () -> Void

    var body: some View {
-        RecoveryLayout {
-            VStack(spacing: 18) {
-                Image("AppIconImage").resizable().frame(width: 76, height: 76).clipShape(RoundedRectangle(cornerRadius: 17))
-                ProgressView().controlSize(.large)
-                Text(step).font(.headline).multilineTextAlignment(.center)
-                if let host { Text(host).font(.subheadline).foregroundStyle(Color.frameMuted) }
-                Button("Change headset", action: cancel).padding(.top, 8)
-            }
-            .padding(32)
+        VStack(spacing: 18) {
+            Image("AppIconImage").resizable().frame(width: 76, height: 76).clipShape(RoundedRectangle(cornerRadius: 17))
+            ProgressView().controlSize(.large)
+            Text(step).font(.headline).multilineTextAlignment(.center)
+            if let host { Text(host).font(.subheadline).foregroundStyle(Color.frameMuted) }
+            Button("Change headset", action: cancel).padding(.top, 8)
        }
+        .padding(32)
    }
 }

@@ -92,23 +59,21 @@ struct FailedView: View {
    let change: () -> Void

    var body: some View {
-        RecoveryLayout {
-            VStack(spacing: 16) {
-                Image(systemName: needsPairing ? "lock.trianglebadge.exclamationmark" : "wifi.exclamationmark")
-                    .font(.system(size: 44)).foregroundStyle(.orange)
-                Text(needsPairing ? "Pair with the Frame again" : "Can't reach the Frame").font(.title3.bold())
-                Text(message).multilineTextAlignment(.center).foregroundStyle(Color.frameMuted)
-                if retrying { Text("Trying again every few seconds.").font(.footnote).foregroundStyle(Color.frameMuted) }
-                if needsPairing {
-                    Button("Pair again", action: change).buttonStyle(.borderedProminent).controlSize(.large)
-                } else if canRetry {
-                    Button("Try again", action: retry).buttonStyle(.borderedProminent).controlSize(.large)
-                }
-                if !needsPairing { Button(canRetry ? "Change headset" : "Back", action: change) }
+        VStack(spacing: 16) {
+            Image(systemName: needsPairing ? "lock.trianglebadge.exclamationmark" : "wifi.exclamationmark")
+                .font(.system(size: 44)).foregroundStyle(.orange)
+            Text(needsPairing ? "Pair with the Frame again" : "Can't reach the Frame").font(.title3.bold())
+            Text(message).multilineTextAlignment(.center).foregroundStyle(Color.frameMuted)
+            if retrying { Text("Trying again every few seconds.").font(.footnote).foregroundStyle(Color.frameMuted) }
+            if needsPairing {
+                Button("Pair again", action: change).buttonStyle(.borderedProminent).controlSize(.large)
+            } else if canRetry {
+                Button("Try again", action: retry).buttonStyle(.borderedProminent).controlSize(.large)
            }
-            .padding(32)
-            .frame(maxWidth: 480)
+            if !needsPairing { Button(canRetry ? "Change headset" : "Back", action: change) }
        }
+        .padding(32)
+        .frame(maxWidth: 480)
    }
 }

@@ -121,37 +86,34 @@ struct WaitingView: View {
    let reachable: () -> Void
    let change: () -> Void
    @State private var pulse = false
-    @Environment(\.accessibilityReduceMotion) private var reduceMotion

    var body: some View {
-        RecoveryLayout {
-            VStack(spacing: 18) {
-                Image("AppIconImage").resizable().frame(width: 76, height: 76)
-                    .clipShape(RoundedRectangle(cornerRadius: 17))
-                    .opacity(reduceMotion || pulse ? 1 : 0.55)
-                    .animation(reduceMotion ? nil : .easeInOut(duration: 1.2).repeatForever(autoreverses: true), value: pulse)
-                Text("Waiting for your Frame").font(.title3.bold())
-                Text("Put the headset on, or press its power button, to wake it. Frame Control connects by itself as soon as it's awake.")
-                    .multilineTextAlignment(.center)
-                VStack(alignment: .leading, spacing: 10) {
-                    Tip(icon: "wifi", text: "Same Wi-Fi as this \(deviceName), or both on Tailscale.")
-                    Tip(icon: "bolt.horizontal", text: "Asleep, the Frame drops off the network entirely; nothing can wake it remotely.")
-                }
-                .padding(14)
-                .background(Color.framePanel, in: RoundedRectangle(cornerRadius: 12))
-                Text(detail).font(.footnote).foregroundStyle(Color.frameMuted).multilineTextAlignment(.center)
-                Button("Connect to a different Frame", action: change).font(.footnote)
+        VStack(spacing: 18) {
+            Image("AppIconImage").resizable().frame(width: 76, height: 76)
+                .clipShape(RoundedRectangle(cornerRadius: 17))
+                .opacity(pulse ? 1 : 0.55)
+                .animation(.easeInOut(duration: 1.2).repeatForever(autoreverses: true), value: pulse)
+            Text("Waiting for your Frame").font(.title3.bold())
+            Text("Put the headset on, or press its power button, to wake it. Frame Control connects by itself as soon as it's awake.")
+                .multilineTextAlignment(.center)
+            VStack(alignment: .leading, spacing: 10) {
+                Tip(icon: "wifi", text: "Same Wi-Fi as this \(deviceName), or both on Tailscale.")
+                Tip(icon: "bolt.horizontal", text: "Asleep, the Frame drops off the network entirely; nothing can wake it remotely.")
            }
-            .padding(28)
-            .frame(maxWidth: 480)
-            .onAppear { pulse = true }
-            .task(id: host) {
-                while !Task.isCancelled {
-                    try? await Task.sleep(nanoseconds: 3_000_000_000)
-                    if !Task.isCancelled, !host.isEmpty, await FrameFinder.sshAnswers(host: host), !Task.isCancelled {
-                        reachable()
-                        return
-                    }
+            .padding(14)
+            .background(Color.framePanel, in: RoundedRectangle(cornerRadius: 12))
+            Text(detail).font(.footnote).foregroundStyle(Color.frameMuted).multilineTextAlignment(.center)
+            Button("Connect to a different Frame", action: change).font(.footnote)
+        }
+        .padding(28)
+        .frame(maxWidth: 480)
+        .onAppear { pulse = true }
+        .task(id: host) {
+            while !Task.isCancelled {
+                try? await Task.sleep(nanoseconds: 3_000_000_000)
+                if !host.isEmpty, await FrameFinder.sshAnswers(host: host) {
+                    reachable()
+                    return
                }
            }
        }
@@ -13,9 +13,10 @@ struct SetupView: View {
    @State private var showHelp = false
    @FocusState private var passwordFocused: Bool

-    /// An explicit target always wins over discovery.
+    /// Where Connect goes: what the finder saw, else what was typed, else frame.local.
    private var host: String {
-        FrameSearchState.address(manual: manualHost, discovered: finder.found?.host)
+        let typed = manualHost.trimmingCharacters(in: .whitespaces)
+        return finder.found?.host ?? (typed.isEmpty ? "frame.local" : typed)
    }

    var body: some View {
@@ -33,19 +34,19 @@ struct SetupView: View {
        .scrollDismissesKeyboard(.interactively)
        .background(Color.frameBackground)
        .onAppear {
-            manualHost = model.settings?.address ?? ""
+            manualHost = model.settings?.host ?? ""
            user = model.settings?.user ?? "steamos"
-            var fallback = model.settings?.address
+            var fallback = model.settings?.host
            #if DEBUG
            fallback = ProcessInfo.processInfo.environment["FRAME_TEST_FALLBACK"] ?? fallback  // Simulator test hook
            #endif
-            finder.start(fallback: fallback, manual: !manualHost.isEmpty)
+            finder.start(fallback: fallback)
        }
        .onDisappear { finder.stop() }
        // After a few seconds of not finding it, say exactly what to check.
        .task(id: finder.since) {
            try? await Task.sleep(nanoseconds: 8_000_000_000)
-            if !Task.isCancelled { showHelp = true }
+            showHelp = true
        }
    }

@@ -119,7 +120,7 @@ struct SetupView: View {
                    Text("Address").font(.footnote).foregroundStyle(Color.frameMuted)
                    TextField("frame.local, an IP, or a Tailscale name", text: $manualHost)
                        .keyboardType(.URL).textInputAutocapitalization(.never).autocorrectionDisabled()
-                        .onSubmit { finder.start(fallback: manualHost, manual: true) }
+                        .onSubmit { finder.start(fallback: manualHost) }
                        .padding(10).background(Color.black.opacity(0.28), in: RoundedRectangle(cornerRadius: 8))
                    TextField("User", text: $user)
                        .textInputAutocapitalization(.never).autocorrectionDisabled()
@@ -148,9 +149,7 @@ struct SetupView: View {
        }
        .onChange(of: manualHost) { _, value in
            // A typed address replaces the search.
-            showHelp = false
-            let typed = value.trimmingCharacters(in: .whitespacesAndNewlines)
-            finder.start(fallback: typed, manual: !typed.isEmpty)
+            if !value.trimmingCharacters(in: .whitespaces).isEmpty, finder.found?.host != value { finder.start(fallback: value) }
        }
    }

@@ -31,13 +31,14 @@ struct WebShell: UIViewRepresentable {
        web.isInspectable = true
        #endif
        context.coordinator.web = web
-        context.coordinator.load(url, reloadID: model.webReloadID)
+        web.load(URLRequest(url: url))
        return web
    }

    func updateUIView(_ web: WKWebView, context: Context) {
-        if context.coordinator.loaded != url || context.coordinator.reloadID != model.webReloadID {
-            context.coordinator.load(url, reloadID: model.webReloadID)
+        if context.coordinator.loaded != url {
+            context.coordinator.loaded = url
+            web.load(URLRequest(url: url))
        }
        context.coordinator.deliverInstallLinks()
    }
@@ -46,22 +47,16 @@ struct WebShell: UIViewRepresentable {
    (() => {
      const call = (name, arg) => window.webkit.messageHandlers.frameApp.postMessage({ name, arg: arg ?? null });
      let installCb = null;
-      window.__frameDocumentID = crypto.randomUUID();
      window.frameApp = {
        platform: "ios",
-        preferences: {
-          read: () => call("preferencesRead"),
-          write: (key, value) => call("preferencesWrite", { key, value }),
-        },
        notify: (message, request) => call("notify", { message, request }),
        readClipboard: () => call("readClipboard"),
-        writeClipboard: (text) => call("writeClipboard", text),
        setUpConnection: () => call("setUpConnection"),
        open: (what) => call("open", what),
        saveImages: (images) => call("saveImages", images),
-        onInstallLink: (cb) => { installCb = cb; return call("installLinkReady", window.__frameDocumentID); },
+        onInstallLink: (cb) => { installCb = cb; return call("installLinkReady"); },
      };
-      window.__frameInstallLink = (req) => { if (!installCb) return false; installCb(req); return true; };
+      window.__frameInstallLink = (req) => { if (installCb) installCb(req); };
    })();
    """

@@ -69,18 +64,7 @@ struct WebShell: UIViewRepresentable {
        let model: AppModel
        weak var web: WKWebView?
        var loaded: URL?
-        private(set) var document = WebDocumentState()
-        private(set) var reloadID = 0
-        private var activeNavigation: WKNavigation?
-        private let preferences = FramePreferences()
-
-        @MainActor
-        func load(_ url: URL, reloadID: Int) {
-            loaded = url
-            self.reloadID = reloadID
-            document.resetSession()
-            activeNavigation = web?.load(URLRequest(url: url))
-        }
+        private var installReady = false

        init(model: AppModel) {
            self.model = model
@@ -134,20 +118,8 @@ struct WebShell: UIViewRepresentable {
                        send(settings.authorizationStatus == .authorized || settings.authorizationStatus == .provisional, nil)
                    }
                }
-            case "preferencesRead":
-                replyHandler(preferences.read(), nil)
-            case "preferencesWrite":
-                guard let args = arg as? [String: Any], let key = args["key"] as? String,
-                      let value = args["value"] as? String, preferences.write(key: key, value: value) else {
-                    return replyHandler(nil, "Invalid preference")
-                }
-                replyHandler(true, nil)
            case "readClipboard":
                replyHandler(UIPasteboard.general.string ?? "", nil)
-            case "writeClipboard":
-                guard let text = arg as? String else { return replyHandler(nil, "Expected text") }
-                UIPasteboard.general.string = text
-                replyHandler(true, nil)
            case "setUpConnection":
                model.showSetup()
                replyHandler(nil, nil)
@@ -163,20 +135,9 @@ struct WebShell: UIViewRepresentable {
                share(images)
                replyHandler(["message": "Choose Save Image to keep \(images.count == 1 ? "it" : "them") in Photos"], nil)
            case "installLinkReady":
-                guard let id = arg as? String, let web,
-                      let data = try? JSONSerialization.data(withJSONObject: id, options: .fragmentsAllowed),
-                      let json = String(data: data, encoding: .utf8) else {
-                    return replyHandler(nil, "Invalid document")
-                }
-                let generation = document.generation
-                web.evaluateJavaScript("window.__frameDocumentID === \(json)") { [weak self] result, error in
-                    guard let self else { return replyHandler(nil, "Page closed") }
-                    if error == nil, result as? Bool == true {
-                        self.document.ready(id, generation: generation)
-                        self.deliverInstallLinks()
-                    }
-                    replyHandler(nil, nil)
-                }
+                installReady = true
+                deliverInstallLinks()
+                replyHandler(nil, nil)
            default:
                replyHandler(nil, "unknown request \(name)")
            }
@@ -184,23 +145,13 @@ struct WebShell: UIViewRepresentable {

        @MainActor
        func deliverInstallLinks() {
-            guard let web, let loaded, model.phase == .ready(loaded), reloadID == model.webReloadID,
-                  let link = model.pendingInstallLinks.first, let delivery = document.beginDelivery() else { return }
-            let req = ["kind": link.kind.rawValue, "target": link.target]
-            guard let json = try? JSONSerialization.data(withJSONObject: req),
-                  let text = String(data: json, encoding: .utf8),
-                  let idData = try? JSONSerialization.data(withJSONObject: delivery.documentID, options: .fragmentsAllowed),
-                  let id = String(data: idData, encoding: .utf8) else {
-                _ = document.finishDelivery(delivery, acknowledged: false)
-                return
-            }
-            // Keep the head queued until the live document confirms its callback ran.
-            web.evaluateJavaScript("window.__frameDocumentID === \(id) && window.__frameInstallLink(\(text)) === true") { [weak self] result, error in
-                guard let self, let loaded = self.loaded, self.model.phase == .ready(loaded),
-                      self.reloadID == self.model.webReloadID else { return }
-                guard self.document.finishDelivery(delivery, acknowledged: error == nil && result as? Bool == true) else { return }
-                if self.model.pendingInstallLinks.first == link { self.model.pendingInstallLinks.removeFirst() }
-                self.deliverInstallLinks()
+            guard installReady, let web, !model.pendingInstallLinks.isEmpty else { return }
+            let links = model.pendingInstallLinks
+            model.pendingInstallLinks = []
+            for link in links {
+                let req = ["kind": link.kind.rawValue, "target": link.target]
+                guard let json = try? JSONSerialization.data(withJSONObject: req), let text = String(data: json, encoding: .utf8) else { continue }
+                web.evaluateJavaScript("window.__frameInstallLink(\(text))")
            }
        }

@@ -235,55 +186,13 @@ struct WebShell: UIViewRepresentable {
            (root.presentedViewController ?? root).present(sheet, animated: true)
        }

-        // A new document cannot receive links using the previous page's callback.
-        @MainActor
-        func webView(_ webView: WKWebView, didStartProvisionalNavigation navigation: WKNavigation!) {
-            activeNavigation = navigation
-            document.beginDocument()
-        }
-
-        @MainActor
-        func webViewWebContentProcessDidTerminate(_ webView: WKWebView) {
-            recover(webView, message: "The app page stopped responding. Try loading it again, or change headset.")
-        }
-
-        @MainActor
-        func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-            navigationFailed(webView, navigation: navigation, error: error)
-        }
-
-        @MainActor
-        func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
-            navigationFailed(webView, navigation: navigation, error: error)
-        }
-
-        @MainActor
-        private func navigationFailed(_ webView: WKWebView, navigation: WKNavigation?, error: Error) {
-            guard navigation === activeNavigation, (error as NSError).code != NSURLErrorCancelled else { return }
-            recover(webView, message: "Couldn't load the app page. \(error.localizedDescription)")
-        }
-
-        @MainActor
-        private func recover(_ webView: WKWebView, message: String) {
-            guard let loaded, model.phase == .ready(loaded), reloadID == model.webReloadID,
-                  model.webRecoveryMessage == nil else { return }
-            activeNavigation = nil
-            if document.shouldReloadAfterFailure() {
-                // Reload the original authenticated URL, including its session key.
-                activeNavigation = webView.load(URLRequest(url: loaded))
-            } else {
-                model.webContentFailed(at: loaded, message: message)
-            }
-        }
-
+        #if DEBUG
        /// Simulator test hook: FRAME_TEST_JS runs in the page once it has loaded.
-        @MainActor
        func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
-            #if DEBUG
            guard let js = ProcessInfo.processInfo.environment["FRAME_TEST_JS"] else { return }
            DispatchQueue.main.asyncAfter(deadline: .now() + 4) { webView.evaluateJavaScript(js) }
-            #endif
        }
+        #endif

        // MARK: navigation: the app's page stays here; other sites open in Safari

@@ -1,100 +0,0 @@
-import Foundation
-import XCTest
-#if !NATIVE_CONTRACT_STANDALONE
-@testable import Frame_Control
-#endif
-
-final class NativeSessionTests: XCTestCase {
-    func testSavedAddressesRoundTripWithoutLosingPortOrIPv6() throws {
-        for host in ["frame.local", "100.100.100.2", "2001:db8::42", "fe80::1%en0"] {
-            for port in [22, 2222, 65535] {
-                let target = FrameSettings(host: host, port: port, user: "alex")
-                let saved = try JSONDecoder().decode(FrameSettings.self, from: JSONEncoder().encode(target))
-                XCTAssertEqual(FrameSettings.parse(host: saved.address, user: saved.user), target)
-            }
-        }
-        XCTAssertEqual(FrameSettings.parse(host: "  [2001:db8::42]:2222\n", user: " steamos "),
-                       FrameSettings(host: "2001:db8::42", port: 2222))
-        for host in ["", "frame.local:0", "frame.local:65536", "frame.local:no", "[::1]:no", "[::1]junk", "[::1"] {
-            XCTAssertNil(FrameSettings.parse(host: host, user: "steamos"), host)
-        }
-    }
-
-    func testManualTargetWinsAndSearchCallbacksExpire() {
-        XCTAssertEqual(FrameSearchState.address(manual: " 100.100.100.2:2222 ", discovered: "192.168.1.237"), "100.100.100.2:2222")
-        XCTAssertEqual(FrameSearchState.address(manual: " \n", discovered: "192.168.1.237"), "192.168.1.237")
-        XCTAssertEqual(FrameSearchState.address(manual: "", discovered: nil), "frame.local")
-        var search = FrameSearchState()
-        let bonjour = search.start(manualAddress: nil)
-        XCTAssertTrue(search.discovers)
-        let manual = search.start(manualAddress: "100.100.100.2:2222")
-        XCTAssertFalse(search.discovers)
-        XCTAssertFalse(search.accepts(bonjour))
-        XCTAssertTrue(search.accepts(manual))
-        search.stop()
-        XCTAssertFalse(search.accepts(manual))
-        _ = search.start(manualAddress: "")
-        XCTAssertTrue(search.discovers)
-    }
-
-    func testRecoveryIsBoundedUntilAnExplicitRetry() {
-        var page = WebDocumentState()
-        XCTAssertTrue(page.shouldReloadAfterFailure())
-        page.beginDocument()
-        page.ready("reloaded", generation: page.generation)
-        XCTAssertFalse(page.shouldReloadAfterFailure())
-        XCTAssertFalse(page.shouldReloadAfterFailure())
-        page.resetSession()
-        XCTAssertTrue(page.shouldReloadAfterFailure())
-    }
-
-    func testReplacementDocumentsCannotConsumeQueuedLinks() throws {
-        var page = WebDocumentState()
-        var queue = ["first", "second"]
-        XCTAssertNil(page.beginDelivery())
-        let oldGeneration = page.generation
-        page.ready("first document", generation: oldGeneration)
-        let oldDelivery = try XCTUnwrap(page.beginDelivery())
-        XCTAssertNil(page.beginDelivery(), "Serialize delivery while an acknowledgement is pending")
-        XCTAssertTrue(page.shouldReloadAfterFailure())
-        page.ready("stale readiness", generation: oldGeneration)
-        XCTAssertNil(page.beginDelivery())
-        if page.finishDelivery(oldDelivery, acknowledged: true) { queue.removeFirst() }
-        XCTAssertEqual(queue, ["first", "second"])
-        page.ready("replacement", generation: page.generation)
-        let failedDelivery = try XCTUnwrap(page.beginDelivery())
-        if page.finishDelivery(failedDelivery, acknowledged: false) { queue.removeFirst() }
-        XCTAssertEqual(queue, ["first", "second"])
-        XCTAssertNil(page.beginDelivery(), "An evaluation error needs fresh readiness")
-        page.ready("replacement", generation: page.generation)
-        let liveDelivery = try XCTUnwrap(page.beginDelivery())
-        if page.finishDelivery(liveDelivery, acknowledged: true) { queue.removeFirst() }
-        XCTAssertEqual(queue, ["second"])
-        XCTAssertNotNil(page.beginDelivery())
-        page.beginDocument()
-        XCTAssertNil(page.beginDelivery(), "Even healthy main-document navigation resets readiness")
-    }
-
-    func testPreferencesPersistAcrossSessionsAndRejectOtherKeysAndValues() throws {
-        let suite = "frame-control-contract-\(UUID().uuidString)"
-        let defaults = try XCTUnwrap(UserDefaults(suiteName: suite))
-        defer { defaults.removePersistentDomain(forName: suite) }
-        let first = FramePreferences(defaults: defaults)
-        XCTAssertEqual(first.read(), [:])
-        XCTAssertTrue(first.write(key: "mvSeparate", value: "0"))
-        XCTAssertTrue(first.write(key: "padUsed", value: "1"))
-        let second = FramePreferences(defaults: try XCTUnwrap(UserDefaults(suiteName: suite)))
-        XCTAssertEqual(second.read(), ["mvSeparate": "0", "padUsed": "1"])
-        for (key, value) in [("other", "1"), ("mvSeparate", "false"), ("padUsed", ""), ("padUsed", "2")] {
-            XCTAssertFalse(second.write(key: key, value: value))
-        }
-        XCTAssertEqual(first.read(), ["mvSeparate": "0", "padUsed": "1"])
-        XCTAssertNil(defaults.object(forKey: "frame.control.preference.other"))
-        defaults.set("bad", forKey: "frame.control.preference.mvSeparate")
-        defaults.set("1", forKey: "frame.control.preference.unknown")
-        XCTAssertEqual(second.read(), ["padUsed": "1"])
-        defaults.set(true, forKey: "frame.control.preference.padUsed")
-        XCTAssertEqual(second.read(), [:], "Only stored strings are supported")
-    }
-
-}
@@ -18,8 +18,7 @@ import tarfile
 from pathlib import Path

 ROOT = Path(__file__).resolve().parents[2]
-PATTERNS = ["ui/*.py", "ui/*.html", "ui/*.js", "ui/*.css", "ui/local-bin/*", "ui/apk_sources/*.py", "ui/apk_sources/*.json", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py", "frame/android/*.js",
-            "frame/openxr-compat/XrApiLayer_FRAME_compat.json", "frame/openxr-compat/prebuilt/arm64-v8a/*.so.gz",
+PATTERNS = ["ui/*.py", "ui/*.html", "ui/*.js", "ui/*.css", "ui/local-bin/*", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py",
            "frame/devkit-utils/**/*", "apk-catalog/*.py", "apk-catalog/pins.json", "apk-catalog/site/apps.js",
            "frame/kdeconnect/packages.json", "frame/kdeconnect/NOTICE.md", "frame/kdeconnect/LICENSES/*/*",
            "frame/kdeconnect/packages/*.pkg.tar.zst", "LICENSE", "THIRD_PARTY_NOTICES.md"]
@@ -0,0 +1,274 @@
+#!/usr/bin/env python3
+"""Check Frame Control's heart-rate readings against a reference, on your computer.
+
+  python3 scripts/heart-check.py listen --port 9000 --out ours.csv
+  python3 scripts/heart-check.py compare ours.csv reference.csv
+  python3 scripts/heart-check.py compare ours.csv ~/Downloads/export.zip
+
+`listen` receives our integer-BPM OSC messages (send them here with
+`tracking-on-frame.py heart --osc <this computer's IP> 9000`) and shows each
+reading live, so you can watch it next to a reference such as your Apple
+Watch. `--out` also records `unix_seconds,bpm` to a new private file.
+
+`compare` lines up two recordings by time and reports how far apart they are.
+The reference can be:
+- a CSV whose first column is a time (unix seconds or ISO 8601) and whose
+  second is BPM, such as our own log, `listen --out`, or the test strap's
+  output (a third `flags` column marks skin-contact loss as "no reading");
+- an Apple Health export (`export.zip` or `export.xml`, from Health → your
+  profile → Export All Health Data). Only heart-rate records within the
+  recording's time range are read.
+
+Everything stays on this computer. Nothing is uploaded.
+"""
+import argparse
+import bisect
+import csv
+from datetime import datetime
+import io
+import os
+from pathlib import Path
+import re
+import socket
+import struct
+import sys
+import time
+import zipfile
+from xml.etree import ElementTree
+
+ADDRESS = "/avatar/parameters/HeartRate"
+
+
+def parse_osc(packet):
+    """Return (address, values) for a single OSC message with i/f arguments."""
+    def string(offset):
+        end = packet.index(b"\0", offset)
+        return packet[offset:end].decode("utf-8"), (end + 4) & ~3
+    address, offset = string(0)
+    tags, offset = string(offset)
+    if not tags.startswith(","):
+        raise ValueError("not an OSC message")
+    values = []
+    for tag in tags[1:]:
+        if tag not in "if" or offset + 4 > len(packet):
+            raise ValueError("unsupported OSC argument")
+        values.append(struct.unpack(">i" if tag == "i" else ">f", packet[offset:offset + 4])[0])
+        offset += 4
+    return address, values
+
+
+def listen(port, address, out, seconds, clock=time.time, stream=sys.stdout):
+    log = None
+    if out:
+        log = os.fdopen(os.open(out, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w")
+        log.write("unix_seconds,bpm\n")
+    received = 0
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind(("0.0.0.0", port))
+        sock.settimeout(0.5)
+        print(f"Listening for {address} on UDP port {port}. Ctrl-C stops.", file=stream, flush=True)
+        end = clock() + seconds if seconds else None
+        try:
+            while end is None or clock() < end:
+                try:
+                    packet = sock.recv(1024)
+                except socket.timeout:
+                    continue
+                try:
+                    path, values = parse_osc(packet)
+                except (ValueError, UnicodeDecodeError):
+                    continue
+                if path != address or len(values) != 1:
+                    continue
+                now = clock()
+                bpm = int(values[0])
+                received += 1
+                print(f"{time.strftime('%H:%M:%S', time.localtime(now))}  {bpm:3d} bpm", file=stream, flush=True)
+                if log:
+                    log.write(f"{now:.3f},{bpm}\n")
+                    log.flush()
+        except KeyboardInterrupt:
+            pass
+        finally:
+            if log:
+                log.close()
+    return received
+
+
+def parse_time(text):
+    text = text.strip()
+    if re.fullmatch(r"\d+(\.\d+)?", text):
+        return float(text)
+    # Apple Health uses "2026-09-29 09:12:03 +1000".
+    text = re.sub(r" ([+-]\d{2}):?(\d{2})$", r"\1\2", text).replace("Z", "+0000")
+    for pattern in ("%Y-%m-%d %H:%M:%S%z", "%Y-%m-%dT%H:%M:%S%z", "%Y-%m-%dT%H:%M:%S.%f%z"):
+        try:
+            return datetime.strptime(text, pattern).timestamp()
+        except ValueError:
+            pass
+    raise ValueError(f"unrecognised time {text!r}")
+
+
+def read_csv(path):
+    """[(time, bpm or None)], sorted. A header row is skipped."""
+    samples = []
+    with open(path, newline="") as source:
+        for row in csv.reader(source):
+            if len(row) < 2:
+                continue
+            try:
+                when, bpm = parse_time(row[0]), int(float(row[1]))
+            except (ValueError, OverflowError):
+                continue  # header or unparseable line
+            try:
+                flags = int(float(row[2])) if len(row) > 2 else None
+            except (ValueError, OverflowError):
+                flags = None  # an unrecognised flag leaves the reading as it is
+            if flags is not None and flags & 4 and not flags & 2:
+                bpm = None  # contact supported and not detected: no reading
+            samples.append((when, bpm))
+    return sorted(samples, key=lambda s: s[0])
+
+
+def read_health(path, start, end):
+    """Heart-rate records from an Apple Health export between start and end."""
+    samples = []
+    def scan(source):
+        for _, element in ElementTree.iterparse(source):
+            if element.tag == "Record" and element.get("type") == "HKQuantityTypeIdentifierHeartRate":
+                try:
+                    when = parse_time(element.get("startDate") or "")
+                    value = round(float(element.get("value") or ""))
+                except (ValueError, OverflowError):
+                    continue
+                if start <= when <= end:
+                    samples.append((when, value))
+            element.clear()
+    if zipfile.is_zipfile(path):
+        with zipfile.ZipFile(path) as archive:
+            names = [n for n in archive.namelist() if n.endswith("/export.xml") or n == "export.xml"]
+            if not names:
+                raise ValueError("no export.xml in that archive; use Health's Export All Health Data")
+            with archive.open(names[0]) as source:
+                scan(source)
+    else:
+        with open(path, "rb") as source:
+            scan(source)
+    return sorted(samples)
+
+
+def read_any(path, start=None, end=None):
+    path = str(path)
+    if path.endswith((".zip", ".xml")):
+        return read_health(path, start, end)
+    return read_csv(path)
+
+
+def value_at(samples, when, hold, times=None):
+    """Our reading at a moment: the latest sample no older than `hold` seconds.
+    `times` is the samples' time column, if the caller has already built it."""
+    times = times if times is not None else [s[0] for s in samples]
+    i = bisect.bisect_right(times, when) - 1
+    if i < 0 or when - times[i] > hold:
+        return None
+    return samples[i][1]
+
+
+def compare(ours, reference, max_lag=10.0, hold=5.0):
+    """Compare our readings with the reference at each reference moment.
+
+    `lag` is the delay added to reference times before looking up ours (our
+    readings arrive after the sensor's). The best lag within ±max_lag is used.
+    """
+    real = [(t, b) for t, b in reference if b is not None]
+    if not real or not any(b is not None for _, b in ours):
+        raise ValueError("both recordings need at least one reading")
+    best = None
+    ours_times = [t for t, _ in ours]
+    steps = int(max_lag * 4)
+    for step in range(-steps, steps + 1):
+        lag = step / 4
+        pairs = [(value_at(ours, t + lag, hold, ours_times), b) for t, b in real]
+        pairs = [(o, r) for o, r in pairs if o is not None]
+        if not pairs:
+            continue
+        error = sum(abs(o - r) for o, r in pairs) / len(pairs)
+        key = (-len(pairs), error, abs(lag))
+        if best is None or key < best[0]:
+            best = (key, lag, pairs)
+    if best is None:
+        raise ValueError("the recordings do not overlap in time")
+    _, lag, pairs = best
+    differences = [o - r for o, r in pairs]
+    # While the reference says "no reading" (lost skin contact), we must not
+    # produce new readings. Count ours that arrive during such a stretch.
+    gaps = [t for t, b in reference if b is None]
+    reference_times = [t for t, _ in reference]
+    shown_in_gaps = 0
+    for t, bpm in ours:
+        i = bisect.bisect_right(reference_times, t - lag) - 1
+        if bpm is not None and i >= 0 and reference[i][1] is None:
+            shown_in_gaps += 1
+    return {
+        "reference_readings": len(real),
+        "matched": len(pairs),
+        "lag_seconds": lag,
+        "mean_abs_error": sum(abs(d) for d in differences) / len(differences),
+        "bias": sum(differences) / len(differences),
+        "max_abs_error": max(abs(d) for d in differences),
+        "within_5": sum(1 for d in differences if abs(d) <= 5) / len(differences),
+        "exact": sum(1 for d in differences if d == 0) / len(differences),
+        "no_contact_moments": len(gaps),
+        "shown_during_no_contact": shown_in_gaps,
+    }
+
+
+def report(result, tolerance, stream=sys.stdout):
+    print(f"Reference readings: {result['reference_readings']}, matched: {result['matched']}", file=stream)
+    print(f"Best alignment: ours {result['lag_seconds']:+.2f} s after the reference", file=stream)
+    print(f"Mean absolute difference: {result['mean_abs_error']:.2f} BPM "
+          f"(bias {result['bias']:+.2f}, worst {result['max_abs_error']})", file=stream)
+    print(f"Within ±5 BPM: {result['within_5']:.0%}; identical: {result['exact']:.0%}", file=stream)
+    if result["no_contact_moments"]:
+        print(f"No-contact moments: {result['no_contact_moments']}, where we showed a stale "
+              f"reading: {result['shown_during_no_contact']}", file=stream)
+    coverage = result["matched"] / result["reference_readings"]
+    passed = (result["mean_abs_error"] <= tolerance and coverage >= 0.8
+              and not result["shown_during_no_contact"])
+    print(("PASS" if passed else "FAIL") + f" (mean difference ≤ {tolerance} BPM, ≥80% of reference "
+          f"readings matched, nothing shown without contact)", file=stream)
+    return passed
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    commands = parser.add_subparsers(dest="command", required=True)
+    heard = commands.add_parser("listen", help="show and optionally record our OSC readings live")
+    heard.add_argument("--port", type=int, default=9000)
+    heard.add_argument("--address", default=ADDRESS)
+    heard.add_argument("--out", help="new private CSV file")
+    heard.add_argument("--seconds", type=float, default=0, help="stop after this long (default: until Ctrl-C)")
+    check = commands.add_parser("compare", help="compare our recording with a reference")
+    check.add_argument("ours", type=Path)
+    check.add_argument("reference", type=Path)
+    check.add_argument("--tolerance", type=float, default=5.0, help="allowed mean difference in BPM (default 5)")
+    check.add_argument("--max-lag", type=float, default=10.0, help="largest time offset to search, seconds")
+    args = parser.parse_args(argv)
+    if args.command == "listen":
+        count = listen(args.port, args.address, args.out, args.seconds)
+        print(f"Received {count} readings.")
+        return 0 if count else 3
+    try:
+        ours = read_csv(args.ours)
+        if not ours:
+            raise ValueError("our recording has no readings")
+        reference = read_any(args.reference, ours[0][0] - 60, ours[-1][0] + 60)
+        result = compare(ours, reference, args.max_lag)
+    except (ValueError, OSError, csv.Error, ElementTree.ParseError, zipfile.BadZipFile) as error:
+        print(f"Could not compare: {error}")
+        return 1
+    return 0 if report(result, args.tolerance) else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,100 @@
+// A synthetic Bluetooth heart-rate strap for testing, run on the Mac.
+//
+//   swiftc -O scripts/heart-test-strap.swift -o /tmp/heart-test-strap
+//   /tmp/heart-test-strap [seconds]      # default 60
+//
+// Advertises the standard Heart Rate Service (180d) as "FC Test Strap" and,
+// while a central is subscribed, sends one Heart Rate Measurement (2a37) per
+// second from a fixed, known sequence. Each sent value is printed to stdout as
+// `unix_seconds,bpm,flags` so scripts/heart-check.py can compare what the
+// Frame received with what was sent. Every value is synthetic; this is not a
+// sensor. macOS asks for Bluetooth permission the first time it runs.
+import CoreBluetooth
+import Foundation
+
+let hrs = CBUUID(string: "180D")
+let measurement = CBUUID(string: "2A37")
+
+/// The known sequence: an 8-bit ramp, 16-bit encodings, a skin-contact loss
+/// (which must show as no reading) and a recovery.
+func packet(_ second: Int) -> (bpm: Int, flags: UInt8) {
+    switch second % 60 {
+    case 0..<30: return (60 + second % 60 * 4, 0x06)   // 60…176, contact detected
+    case 30..<40: return (180 - (second % 60 - 30) * 3, 0x07) // 16-bit value
+    case 40..<45: return (150, 0x04)                  // contact lost
+    default: return (72 + (second % 60 - 45), 0x06)
+    }
+}
+
+final class Strap: NSObject, CBPeripheralManagerDelegate {
+    let seconds: Int
+    var manager: CBPeripheralManager!
+    var characteristic: CBMutableCharacteristic!
+    var subscribed = false
+    var sent = 0
+
+    init(seconds: Int) {
+        self.seconds = seconds
+        super.init()
+        manager = CBPeripheralManager(delegate: self, queue: nil)
+    }
+
+    func peripheralManagerDidUpdateState(_ peripheral: CBPeripheralManager) {
+        guard peripheral.state == .poweredOn else {
+            FileHandle.standardError.write("Bluetooth state \(peripheral.state.rawValue)\n".data(using: .utf8)!)
+            if peripheral.state == .unauthorized || peripheral.state == .unsupported || peripheral.state == .poweredOff {
+                FileHandle.standardError.write("Bluetooth unavailable (state \(peripheral.state.rawValue))\n".data(using: .utf8)!)
+                exit(1)
+            }
+            return
+        }
+        characteristic = CBMutableCharacteristic(type: measurement, properties: [.notify], value: nil, permissions: [])
+        let service = CBMutableService(type: hrs, primary: true)
+        service.characteristics = [characteristic]
+        peripheral.add(service)
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, didAdd service: CBService, error: Error?) {
+        if let error { fail("add service: \(error.localizedDescription)") }
+        peripheral.startAdvertising([CBAdvertisementDataLocalNameKey: "FC Test Strap",
+                                     CBAdvertisementDataServiceUUIDsKey: [hrs]])
+    }
+
+    func peripheralManagerDidStartAdvertising(_ peripheral: CBPeripheralManager, error: Error?) {
+        if let error { fail("advertise: \(error.localizedDescription)") }
+        FileHandle.standardError.write("Advertising FC Test Strap\n".data(using: .utf8)!)
+        Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { _ in self.tick() }
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didSubscribeTo characteristic: CBCharacteristic) {
+        subscribed = true
+        FileHandle.standardError.write("Central subscribed\n".data(using: .utf8)!)
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didUnsubscribeFrom characteristic: CBCharacteristic) {
+        subscribed = false
+        FileHandle.standardError.write("Central unsubscribed\n".data(using: .utf8)!)
+    }
+
+    func tick() {
+        guard subscribed else { return }
+        if sent >= seconds { exit(0) }
+        let (bpm, flags) = packet(sent)
+        var bytes: [UInt8] = [flags, UInt8(bpm & 0xff)]
+        if flags & 1 != 0 { bytes.append(UInt8(bpm >> 8)) }
+        if manager.updateValue(Data(bytes), for: characteristic, onSubscribedCentrals: nil) {
+            print(String(format: "%.3f,%d,%d", Date().timeIntervalSince1970, bpm, flags))
+            fflush(stdout)
+            sent += 1
+        }
+    }
+
+    func fail(_ message: String) -> Never {
+        FileHandle.standardError.write("\(message)\n".data(using: .utf8)!)
+        exit(1)
+    }
+}
+
+let seconds = CommandLine.arguments.count > 1 ? Int(CommandLine.arguments[1]) ?? 60 : 60
+let strap = Strap(seconds: seconds)
+RunLoop.main.run()
@@ -55,7 +55,6 @@ from urllib.parse import quote, urlencode  # %20, not +: the agent's URLComponen
 ROOT = Path(__file__).resolve().parent.parent
 sys.path.insert(0, str(ROOT / "ui"))
 import frame_macview  # noqa: E402
-import frame_pcview  # noqa: E402

 RESULTS = ROOT / "bench" / "results"
 PAGES = ROOT / "bench" / "pages"
@@ -255,10 +254,7 @@ class LabView(frame_macview.MacView):

 def ssh_runner(base):
    def run(remote, stdin=None, timeout=30):
-        r = subprocess.run([*base, remote], input=stdin.encode("utf-8") if stdin is not None else None,
-                           capture_output=True, timeout=timeout)
-        r.stdout = r.stdout.decode("utf-8", errors="replace")
-        r.stderr = r.stderr.decode("utf-8", errors="replace")
+        r = subprocess.run([*base, remote], input=stdin, capture_output=True, text=True, timeout=timeout)
        if r.returncode:
            e = RuntimeError((r.stderr or r.stdout).strip())
            e.stdout = r.stdout
@@ -385,11 +381,7 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
    if args.browser_flag is not None:
        mv.browser_flags = [f for f in args.browser_flag if f]
    chrome = None
-    src = args.source or "test"
-    cpu = None
-    if args.pc:
-        mv.host = "windows" if sys.platform == "win32" else "linux"
-        mv.viewer_profile = "pc-view"
+    src = "test"
    try:
        if scenario in ("scroll", "type"):
            chrome = chrome_window(f"{scenario}.html")
@@ -413,10 +405,9 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
        since = max([f["s"] for f in first["frames"]] or [0])
        captured_before = first["captured"]
        start_mac_us = mv.call("/stats", id=stream["id"])["now"]
-        if not args.pc:
-            agent_pid = int(subprocess.run(["pgrep", "-f", "Frame Mac View Lab.app/Contents/MacOS/frame-mac-view"],
-                                           capture_output=True, text=True).stdout.split()[0])
-            cpu = CpuSampler(frame_ssh, agent_pid)
+        agent_pid = int(subprocess.run(["pgrep", "-f", "Frame Mac View Lab.app/Contents/MacOS/frame-mac-view"],
+                                       capture_output=True, text=True).stdout.split()[0])
+        cpu = CpuSampler(frame_ssh, agent_pid)
        if relay:
            relay.begin()
        expected = 0  # input events the harness asked the viewer for
@@ -452,8 +443,7 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
        if not streams:
            raise SystemExit(f"{scenario}: the stream ended during the run (did the Frame go to sleep?)")
        data = streams[0]
-        if cpu:
-            cpu.stop()
+        cpu.stop()
        if args.raw:
            Path(f"{args.raw}-{scenario}.json").write_text(json.dumps(data))
        result = summarize(scenario, data, start_mac_us, end_mac_us, args, relay, schedule, expected)
@@ -462,7 +452,7 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
                            for e in data.get("events", []) if e["t"] >= start_mac_us]
        result["captured"] = (captured_end if captured_end is not None else data["captured"]) - captured_before
        result["source_fps"] = round(result["captured"] / max(result["duration_s"], 1), 1)
-        result["cpu"] = cpu.summary() if cpu else {"host": "not sampled"}
+        result["cpu"] = cpu.summary()
        result["viewer"] = data["summary"].get("decoder", "")
        result["show_s"] = show_s
        result["panel"] = shown.get("panel")
@@ -470,8 +460,6 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
        result["route"] = mv.route
        return result
    finally:
-        if cpu:
-            cpu.stop()
        try:
            mv.stop(src)
        except Exception:  # noqa: BLE001 - best effort
@@ -682,8 +670,6 @@ def fmt(v):

 def add_run_args(r):
    r.add_argument("--scenario", default="test,scroll,type")
-    r.add_argument("--pc", action="store_true", help="run the bundled PC host; use --scenario test or capture")
-    r.add_argument("--source", default="", help="PC source: window:ID, display:ID, or choose (Linux portal)")
    r.add_argument("--duration", type=float, default=20)
    r.add_argument("--warmup", type=float, default=3)
    r.add_argument("--quality", default="balanced", choices=list(frame_macview.QUALITY))
@@ -731,7 +717,7 @@ def frame_ssh_for(args):


 def run_suite(args, frame_ssh, quiet=False):
-    agent_port, token = (args.pc_view.port, args.pc_view.token) if args.pc else lab_agent()
+    agent_port, token = lab_agent()
    results = []
    for sc in args.scenario.split(","):
        if not quiet:
@@ -758,12 +744,11 @@ def document(args, frame_ssh, results, **extra):
    commit = git("rev-parse", "--short", "HEAD") + ("+dirty" if git("status", "--porcelain", "--", "mac", "ui") else "")
    return {
        "label": args.label or args.cmd, "date": datetime.datetime.now().isoformat(timespec="seconds"), "commit": commit,
-        "config": {"quality": args.quality, "mode": "native" if args.pc else args.mode, "net": args.net or "none", "delay_ms": args.delay,
+        "config": {"quality": args.quality, "mode": args.mode, "net": args.net or "none", "delay_ms": args.delay,
                   "buffer_ms": args.buffer, "host": args.host or args.frame, "usb": args.usb, "ssh_opts": args.ssh_opt,
                   "encoder": os.environ.get("FRAME_MAC_VIEW_ENCODER", ""), "duration_s": args.duration,
                   "browser_flags": args.browser_flag if args.browser_flag is not None else frame_macview.BROWSER_FLAGS},
-        "frame_build": build.strip().partition("=")[2], "mac": platform.mac_ver()[0],
-        "host_platform": platform.platform(), "source": args.source, "pc_host": args.pc, "headset": standby[-40:],
+        "frame_build": build.strip().partition("=")[2], "mac": platform.mac_ver()[0], "headset": standby[-40:],
        "scenarios": results, **extra,
    }

@@ -834,46 +819,19 @@ def main():
            print("\nworse:\n  " + "\n  ".join(regs))
        sys.exit(1 if regs else 0)

-    if args.pc and (args.cmd == "ab" or args.scenario not in ("test", "capture")):
-        p.error("PC runs use --scenario test or --scenario capture; Mac automation is not portable")
-    if args.pc and args.scenario == "capture" and not args.source:
-        p.error("capture needs --source window:ID, display:ID, or choose")
-    if not args.pc:
-        lab_agent()
+    lab_agent()
    frame_ssh = frame_ssh_for(args)
    # Keep the Mac's screen awake: virtual displays aren't removed while it sleeps.
    runs = 1 if args.cmd == "run" else args.repeat * len(args.arm)
-    awake = subprocess.Popen(["caffeinate", "-d", "-u", "-t", str(int(runs * (args.duration * 4 + 60) + 120))]) if sys.platform == "darwin" else None
-    args.pc_view = None
+    awake = subprocess.Popen(["caffeinate", "-d", "-u", "-t", str(int(runs * (args.duration * 4 + 60) + 120))])
    try:
-        if args.pc:
-            args.pc_view = frame_pcview.PCView(frame_ssh[:-1], ssh_runner(frame_ssh), frame_ssh[-1])
-            args.pc_view.ensure_agent()
-            if args.source == "choose":
-                args.pc_view.call("/permissions", method="POST")
-                print("Choose a window or screen in your desktop's sharing dialog.", flush=True)
-                deadline = time.monotonic()+125
-                while time.monotonic() < deadline:
-                    state = args.pc_view.call("/status")
-                    if not state.get("selecting"):
-                        sources = args.pc_view.call("/windows")["windows"]
-                        if not sources:
-                            raise SystemExit(state.get("selectionError") or "Nothing was shared")
-                        args.source = sources[-1]["src"]
-                        break
-                    time.sleep(.5)
-                else:
-                    raise SystemExit("Sharing dialog timed out")
        if args.cmd == "ab":
            arm_runs, table = ab(args, frame_ssh)
            write(document(args, frame_ssh, [], arms=args.arm, runs=arm_runs, table=table), args)
            return
        results = run_suite(args, frame_ssh)
    finally:
-        if args.pc_view:
-            args.pc_view.shutdown()
-        if awake:
-            awake.terminate()
+        awake.terminate()
    doc = document(args, frame_ssh, results)
    write(doc, args)
    bad = [f"{r['scenario']} {k}" for r in results for k, v in r["grades"].items() if v in ("bad", "missing")]
@@ -1,116 +0,0 @@
-#!/usr/bin/env zsh
-# Mac-side: the APK Store in the headset. Frame Control's Android catalogue
-# (the same rated F-Droid list, Install, Open and Remove) as its own floating
-# panel on the Steam Frame, so you can browse and install apps from inside.
-# See docs/apks.md → "The store in the headset".
-#
-# Frame Control's server runs on the Frame itself (FRAME_LOCAL=1, as the iPhone
-# app runs it) on the Frame's loopback, and Chromium opens ui/store.html as a
-# panel. Installs then download and verify the APK on the Frame; the Mac isn't
-# needed after `open`.
-#
-# Usage:
-#   scripts/store-on-frame.sh open     # copy the server over if it changed, start it, open the panel
-#   scripts/store-on-frame.sh close    # close the panel and stop the server
-#   scripts/store-on-frame.sh status
-set -euo pipefail
-
-FRAME_ALIAS=${FRAME_ALIAS:-frame}
-HERE=${0:A:h}
-ROOT=${HERE:h}
-PORT=47812           # the Frame's 127.0.0.1 only
-APPID=2001947812     # the panel's id (panel-on-frame.sh's range)
-# Not ~/.cache/frame-control: the iPhone app prunes other versions there.
-REMOTE=.local/share/frame-control/store-server
-
-cmd=${1:-}
-
-# Same bundle the iPhone app copies (ios/scripts/make_frame_bundle.py), so the
-# server on the Frame has exactly the files the desktop app ships.
-deploy() {
-  local tmp version
-  tmp=$(mktemp -d)
-  trap "rm -rf ${(q)tmp}" EXIT
-  version=$(python3 "$ROOT/ios/scripts/make_frame_bundle.py" "$tmp/bundle.tar.gz")
-  if ! ssh "$FRAME_ALIAS" "test -f $REMOTE/$version/ui/server.py"; then
-    print -u2 "==> Copying Frame Control ($version) to the Frame"
-    ssh "$FRAME_ALIAS" "set -e; mkdir -p $REMOTE; cd $REMOTE; rm -rf $version.tmp; mkdir $version.tmp
-      tar xzf - -C $version.tmp; rm -rf $version; mv $version.tmp $version" <"$tmp/bundle.tar.gz"
-  fi
-  # Older versions, unless a server is still running from one.
-  ssh "$FRAME_ALIAS" "cd $REMOTE && for d in */; do d=\${d%/}; [ \"\$d\" = $version ] && continue
-    pgrep -f \"\$PWD/\$d/\" >/dev/null && continue; rm -rf -- \"\$d\"; done"
-  print -r -- "$version"
-}
-
-# Runs on the Frame. Args: dir port appid key
-OPEN=$(cat <<'EOF'
-set -u
-dir=$HOME/$1 port=$2 appid=$3 key=$4
-export DISPLAY=:0 LC_ALL=C.UTF-8
-unset WAYLAND_DISPLAY
-xprop -root GAMESCOPE_FOCUSABLE_WINDOWS >/dev/null 2>&1 || { echo "The headset isn't showing anything (gamescope's :0 isn't up). Wake it and try again." >&2; exit 2; }
-if [ -x "$HOME/chromium-xr/chrome" ]; then
-  # Steam's overlay library crashes Chromium's zygote (docs/webxr-chromium.md).
-  browser=(env LD_PRELOAD= "$HOME/chromium-xr/chrome" --user-data-dir="$HOME/.local/share/frame-control/store")
-elif flatpak info org.chromium.Chromium >/dev/null 2>&1; then
-  browser=(flatpak run org.chromium.Chromium --user-data-dir="$HOME/.var/app/org.chromium.Chromium/frame-store")
-else
-  echo "The store needs a Chromium on the Frame: Chromium XR (docs/webxr-chromium.md) or the org.chromium.Chromium Flatpak (scripts/install-apps.sh)." >&2
-  exit 3
-fi
-# A fresh server each time, so it runs this version with this key.
-[ -f /tmp/frame-store-server.pid ] && kill "$(cat /tmp/frame-store-server.pid)" 2>/dev/null
-# Match the browser by its profile flag and the server by its script path: this
-# launcher's own command line holds the bundle path, so a looser pattern kills it.
-pkill -f '[-]-user-data-dir=[^ ]*/(frame-control/store|frame-store) ' || true
-pkill -f '[s]tore-server/[^/ ]*/ui/server[.]py' || true
-sleep 0.5
-cd "$dir" || exit 1
-FRAME_LOCAL=1 FRAME_UI_KEY=$key FRAME_DEVICE=headset setsid nohup python3 -I -u -B "$dir/ui/server.py" --port "$port" \
-  >/tmp/frame-store-server.log 2>&1 </dev/null &
-echo $! > /tmp/frame-store-server.pid
-up=
-for _ in $(seq 1 40); do
-  curl -s -o /dev/null "http://127.0.0.1:$port/store" && { up=1; break; }
-  sleep 0.25
-done
-[ -n "$up" ] || { echo "Frame Control's server didn't start on the Frame:" >&2; tail -n 15 /tmp/frame-store-server.log >&2; exit 1; }
-setsid nohup "${browser[@]}" --ozone-platform=x11 --force-device-scale-factor=1 --no-first-run --no-default-browser-check \
-  --password-store=basic --disable-session-crashed-bubble --noerrdialogs --disable-infobars \
-  --disable-features=Translate,MediaRouter --window-size=1280,800 \
-  "--app=http://127.0.0.1:$port/store?key=$key" >/tmp/frame-store.log 2>&1 </dev/null &
-# Tag the window so it's its own panel (docs/panels.md).
-for _ in $(seq 1 60); do
-  sleep 0.5
-  for win in $(xwininfo -root -children 2>/dev/null | awk '/^ +0x/ {print $1}'); do
-    xprop -id "$win" _NET_WM_NAME WM_NAME 2>/dev/null | grep -qF "APK Store" || continue
-    if xprop -id "$win" -f STEAM_GAME 32c -set STEAM_GAME "$appid" 2>/dev/null; then
-      echo "panel valve.steam.desktopgame.$appid window $win"
-      exit 0
-    fi
-  done
-done
-echo "Chromium started, but its window didn't appear within 30 s:" >&2
-tail -n 15 /tmp/frame-store.log >&2
-exit 1
-EOF
-)
-
-case "$cmd" in
-  open)
-    version=$(deploy | tail -n 1)
-    key=$(openssl rand -hex 16)
-    ssh "$FRAME_ALIAS" bash -s -- "$REMOTE/$version" "$PORT" "$APPID" "$key" <<<"$OPEN"
-    ;;
-  close)
-    ssh "$FRAME_ALIAS" 'pkill -f "[-]-user-data-dir=[^ ]*/(frame-control/store|frame-store) " || true
-      pkill -f "[s]tore-server/[^/ ]*/ui/server[.]py" || true
-      [ -f /tmp/frame-store-server.pid ] && kill "$(cat /tmp/frame-store-server.pid)" 2>/dev/null; rm -f /tmp/frame-store-server.pid; true'
-    ;;
-  status)
-    ssh "$FRAME_ALIAS" "ls $REMOTE 2>/dev/null; curl -s -o /dev/null http://127.0.0.1:$PORT/store && echo 'server up' || echo 'server down'
-      pgrep -af '[-]-user-data-dir=[^ ]*/(frame-control/store|frame-store) |[s]tore-server/[^/ ]*/ui/server[.]py' | head -n 1 | cut -c1-120"
-    ;;
-  *) sed -n '2,15p' "$0"; exit 2 ;;
-esac
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Install or run our local-only tracking tools on the Frame.
+
+  python3 scripts/tracking-on-frame.py install
+  python3 scripts/tracking-on-frame.py gaze --seconds 10
+  python3 scripts/tracking-on-frame.py gaze --seconds 3600 --osc 127.0.0.1 9000
+  python3 scripts/tracking-on-frame.py heart --device AA:BB:CC:DD:EE:FF --panel
+  python3 scripts/tracking-on-frame.py pulse --seconds 60 --show   # experimental
+
+FRAME_ALIAS overrides the SSH alias (default: frame). Runs in the foreground;
+Ctrl-C stops the reader. No service, autostart, sudo or SteamVR settings changes.
+"""
+import os
+from pathlib import Path
+import shlex
+import subprocess
+import sys
+import tarfile
+
+REMOTE = '"$HOME/.local/share/frame-control/tracking"'
+INSTALL = '''set -eu
+base="$HOME/.local/share/frame-control/tracking"
+mkdir -p "$base"
+stage=$(mktemp -d "$base/.install.XXXXXX")
+trap 'rm -rf "$stage"' EXIT
+ tar -xf - -C "$stage"
+cc -O2 -Wall -Wextra -Werror "$stage/gaze.c" \\
+  -L/opt/steamvr/bin/linuxarm64 -Wl,-rpath,/opt/steamvr/bin/linuxarm64 \\
+  -lopenxr_loader -o "$stage/gaze"
+chmod 700 "$stage/gaze" "$stage/tracking.py"
+chmod 600 "$stage/pulse.py"
+mv "$stage/gaze" "$stage/tracking.py" "$stage/pulse.py" "$base/"
+echo 'Installed Frame Control tracking tools (no service started).'
+'''
+
+
+def main():
+    if len(sys.argv) < 2 or sys.argv[1] not in ("install", "gaze", "heart", "pulse"):
+        print(__doc__)
+        return 2
+    host = os.environ.get("FRAME_ALIAS", "frame")
+    if not host or host.startswith("-"):
+        raise ValueError("invalid SSH alias")
+    ssh = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10", host]
+    if sys.argv[1] == "install":
+        import tempfile
+        source = Path(__file__).resolve().parents[1] / "frame" / "tracking"
+        with tempfile.TemporaryFile() as archive:
+            with tarfile.open(fileobj=archive, mode="w") as tar:
+                for name in ("gaze.c", "tracking.py", "pulse.py"):
+                    tar.add(source / name, arcname=name)
+            archive.seek(0)
+            return subprocess.call(ssh + ["bash -c " + shlex.quote(INSTALL)], stdin=archive)
+    # Allocate a tty so SSH forwards Ctrl-C and hangup to the foreground process.
+    command = 'exec python3 ' + REMOTE + '/tracking.py ' + shlex.join(sys.argv[1:])
+    return subprocess.call(ssh[:-1] + ["-tt", host, command])
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -1,72 +0,0 @@
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const vm = require('node:vm');
-const html = fs.readFileSync(require.resolve('../ui/index.html'), 'utf8');
-
-async function session(native, initial = {}, duringRead) {
-  const saved = { ...initial }, element = { checked: true, disabled: false };
-  const storage = { getItem: key => saved[key] ?? null, setItem: (key, value) => { saved[key] = String(value); } };
-  for (const key of ['mvSeparate', 'padUsed']) Object.defineProperty(storage, key, {
-    get: () => saved[key], set: value => { saved[key] = String(value); },
-  });
-  const calls = [];
-  const context = vm.createContext({ window: { frameApp: native ? { preferences: native } : undefined }, localStorage: storage,
-    $: () => element, log: (...args) => calls.push(args),
-    api: async () => ({ state: 'off' }), padStart: () => calls.push('start'), padShow: s => calls.push(s.state) });
-  const marker = html.indexOf('// ---- client preferences');
-  const start = marker >= 0 ? marker : html.indexOf('$("mvSeparate").checked =');
-  vm.runInContext(html.slice(start, html.indexOf('$("macview").onclick', start)), context);
-  if (duringRead) duringRead(context, element);
-  await vm.runInContext('typeof clientPreferences === "undefined" ? Promise.resolve() : clientPreferences.ready', context);
-  return { element, saved, calls, context, async change(value) {
-    element.checked = value; element.onchange({ target: element });
-    await new Promise(resolve => setImmediate(resolve));
-  } };
-}
-
-test('a layout choice survives moving from one native local origin to another', async () => {
-  const values = {};
-  const native = { read: async () => ({ ...values }), write: async (key, value) => { values[key] = value; } };
-  const first = await session(native);
-  await first.change(false);
-  assert.equal(first.element.checked, false);
-  const second = await session(native); // fresh origin storage
-  assert.equal(second.element.checked, false);
-});
-
-test('native values win over stale origin values and missing values migrate', async () => {
-  const values = { mvSeparate: '0' };
-  const native = { read: async () => ({ ...values }), write: async (key, value) => { values[key] = value; } };
-  const page = await session(native, { mvSeparate: '1', padUsed: '1' });
-  assert.equal(page.element.checked, false);
-  assert.equal(values.padUsed, '1');
-});
-
-test('ordinary browser storage and a failed native read retain usable choices', async () => {
-  assert.equal((await session(null, { mvSeparate: '0' })).element.checked, false);
-  const native = { read: async () => { throw Error('Unavailable'); }, write: async () => true };
-  const page = await session(native, { mvSeparate: '0' });
-  assert.equal(page.element.checked, false);
-  assert.equal(page.element.disabled, false);
-});
-
-test('starting input during a native read wins over its stale remembered value', async () => {
-  let resolveRead;
-  const writes = [];
-  const native = { read: () => new Promise(resolve => { resolveRead = resolve; }), write: async (key,value) => writes.push({key,value}) };
-  const page = await session(native, {}, context => {
-    vm.runInContext("clientPreferences.set('padUsed','1')",context);
-    resolveRead({padUsed:'0'});
-  });
-  await new Promise(resolve=>setImmediate(resolve));
-  assert.equal(vm.runInContext("clientPreferences.get('padUsed')",page.context),'1');
-  assert.deepEqual(writes,[{key:'padUsed',value:'1'}]);
-});
-
-test('one failed migration does not hide another native preference', async () => {
-  const native = {read:async()=>({padUsed:'1'}),write:async()=>{throw Error('disk unavailable');}};
-  const page=await session(native,{mvSeparate:'0'});
-  assert.equal(page.element.checked,false);
-  assert.equal(vm.runInContext("clientPreferences.get('padUsed')",page.context),'1');
-});
@@ -14,7 +14,7 @@ function fixture() {
  const elements = new Map();
  function element(id) {
    if (!elements.has(id)) elements.set(id, {id,hidden:false,disabled:false,textContent:'',innerHTML:'',value:'',dataset:{},
-      classList:{toggle(){}},querySelectorAll(){return [];},close(){this.open=false;},setAttribute(key,value){this[key]=value;},addEventListener(key,callback){this[key]=callback;},focus(){this.focused=true;}});
+      classList:{toggle(){}},querySelectorAll(){return [];},setAttribute(key,value){this[key]=value;},addEventListener(key,callback){this[key]=callback;},focus(){this.focused=true;}});
    return elements.get(id);
  }
  const cards = cc.catalog.map(item=>{const e=element(item.id);e.dataset.ccCard=item.id;return e;});
@@ -42,7 +42,7 @@ function sharedPage({productionApi=false} = {}) {
  const f=fixture(), requests=[], writes=[], host=deferred(), job=deferred();
  const context={document:f.document,FrameControlCenter:cc,window:{frameApp:{setUpConnection(){}}},
    Date,setInterval,clearInterval,setTimeout:()=>1,clearTimeout(){},$:f.element,QUICK:[],installing:new Set(),
-    battery(){},setVolume(){},renderHome(){},gb:String,dur:String,esc:String,meter(){},toast(){},
+    battery(){},setVolume(){},gb:String,dur:String,esc:String,meter(){},toast(){},
    runJob(title,id){context.installing.add(id);return job.promise;},
    api:(path,body,device)=>{
      if(path==='/api/host')return host.promise;
@@ -64,12 +64,11 @@ function sharedPage({productionApi=false} = {}) {
      const request=deferred();request.path=path;request.opts=opts;requests.push(request);return request.promise;
    };
    Object.assign(context,{renderPill(){},renderConnDlg(){},renderBanner(){},viaText(){},netLabel(){},
-      padReset(){},ctrlReset(){},resetShots(){},resetClips(){},closeDevPop(){},loadDevices(){},renderDevices(){},renderTests(){},reloadAll(){},checkContactPrompt(){}});
+      resetShots(){},loadDevices(){},renderDevices(){},renderTests(){},reloadAll(){},checkContactPrompt(){}});
    vm.runInContext(`const UI_KEY = 'test-only';
      const link = {s:null,device:'frame-a',phase:'connected',rev:0,net:null};
-      const disp = {}, gm = {seq:0}, cat = {}, wi = {}, sourceState = {jobs:new Map(),detail:null,detailRequest:0};
-      let viewGen = 0, lastImg = null, lastShot = null, androidApps = [], androidSeq = 0, titlesSeq = 0, runningGames = [], runningSeq = 0, page = 'control';
-      const androidPending = new Set();`,context);
+      const disp = {}, gm = {seq:0}, cat = {}, wi = {};
+      let viewGen = 0, lastImg = null, lastShot = null, androidApps = [], titlesSeq = 0, page = 'control';`,context);
    const apiStart=pageSource.indexOf('const HEADSET_FREE ='),apiEnd=pageSource.indexOf('// What a panel shows',apiStart);
    const onlineStart=pageSource.indexOf('function setOnline('),onlineEnd=pageSource.indexOf('function reloadAll()',onlineStart);
    const connectionStart=pageSource.indexOf('function onConnection('),connectionEnd=pageSource.indexOf('// Read the event stream',connectionStart);
@@ -439,77 +438,34 @@ test('mounted filters show empty state, counts, reset and host-dependent feature
  f.ui.host({os:'SteamOS',mobile:true});assert.equal(f.element('macLink').hidden,true);
  f.element('connectionLink').onclick({preventDefault(){}});assert.equal(f.opened,1);
 });
-test('every Control Center workflow reaches its intentional workspace', () => {
-  const {workspaceFixture}=require('./workspace_fixture.cjs');
-  const f=workspaceFixture();
-  const expected={view:'capture',shots:'capture',vrTools:'tools',comfort:'tools',pad:'tools',library:'games',getgames:'games',sideloaded:'games',android:'apps',display:'settings',androidLibrary:'apps',appStore:'apps',power:'settings',transfer:'tools',media:'tools',linuxApps:'apps',artworkSettings:'settings',privacy:'settings',panels:'tools',macview:'tools',devices:'devices'};
+test('every linked workflow selects its real page and section, preserving shortcuts', () => {
+  const html=fs.readFileSync(require.resolve('../ui/index.html'),'utf8');
+  const start=html.indexOf('const PAGES ='),end=html.indexOf('window.addEventListener("hashchange", showPage);',start);
+  const ids=new Set([...html.matchAll(/\bid="([^"]+)"/g)].map(m=>m[1]));
+  let activePage,scrolled;
+  const nodes=['home','games','android','tools','devices','control'].map(page=>({dataset:{page},classList:{toggle(key,on){if(on)activePage=page;}}}));
+  const sections=new Map();
+  const context={location:{hash:'#control'},document:{querySelectorAll:s=>s==='.page'?nodes:[],title:''},
+    window:{scrollTo(){}},$:id=>{
+      if(!ids.has(id))return null;
+      if(!sections.has(id))sections.set(id,{hidden:false,scrollIntoView(){scrolled=id;}});
+      return sections.get(id);
+    },live:false,toggleLive(){},loadMacView(){},loadPanelSwitcher(){}};
+  const androidStart=html.indexOf('function showAndroidTab(');
+  const androidEnd=html.indexOf("document.querySelectorAll('[data-store-tab]').forEach(button => button.onclick",androidStart);
+  vm.createContext(context);vm.runInContext(html.slice(androidStart,androidEnd)+html.slice(start,end)+'\nPAGES.push("devices", "control");',context);
+  vm.runInContext('showPage()',context);assert.equal(activePage,'control');
+  const expected={view:'home',shots:'home',vrTools:'home',comfort:'home',pad:'home',library:'games',getgames:'games',sideloaded:'games',android:'android',display:'android',androidLibrary:'android',appStore:'android',
+    power:'tools',transfer:'tools',media:'tools',apps:'tools',artworkSettings:'tools',privacy:'tools',panels:'tools',macview:'tools',devices:'devices'};
  for(const item of cc.catalog) for(const [href] of item.links||[]) {
    if(!href.startsWith('#')||href==='#connection')continue;
-    f.navigate(href);assert.equal(f.activePage,expected[href.slice(1)],href);
+    const id=href.slice(1);assert.ok(ids.has(id)||['android','devices'].includes(id),href);
+    context.location.hash=href;scrolled=null;vm.runInContext('showPage()',context);
+    assert.equal(activePage,expected[id],href);
+    if(!['android','devices'].includes(id))assert.equal(scrolled,id,href);
+    if(id==='display'||id==='androidLibrary') { assert.equal(sections.get('androidLibrary').hidden,false);assert.equal(sections.get('appStore').hidden,true); }
+    if(id==='appStore') { assert.equal(sections.get('appStore').hidden,false);assert.equal(sections.get('androidLibrary').hidden,true); }
  }
-  assert.equal(f.run('PAGES.length'),4);
-});
-// Force quit: an explicit check, a confirmation naming the game, and the captured headset.
-function quitPage({confirmAnswer=true, running=[{appid:620,name:'Portal <2>',kind:'steam'}], quit} = {}) {
-  const asked=[], calls=[];
-  const f=mounted({confirm:text=>{asked.push(text);return confirmAnswer;},
-    api:async(path,body,device)=>{calls.push({path,body,device});
-      if(body===undefined)return {running};
-      return quit ? quit(body) : {message:'Quit Portal 2',method:'steam'};}});
-  return Object.assign(f,{asked,apiCalls:calls,click:appid=>f.element('ccRunningList').onclick({target:{closest:()=>({dataset:{ccQuit:String(appid)}})}})});
-}
-test('force quit lists what is running and says so when nothing is', async t => {
-  const f=quitPage({running:[]});t.after(()=>f.ui.destroy());
-  await f.element('ccRunningCheck').onclick();
-  assert.deepEqual(f.apiCalls,[{path:'/api/running',body:undefined,device:'frame-a'}]);
-  assert.equal(f.element('ccRunningResult').textContent,'Nothing is running on the Frame.');
-  assert.equal(f.element('ccRunningList').innerHTML,'');
-  const g=quitPage();t.after(()=>g.ui.destroy());
-  await g.element('ccRunningCheck').onclick();
-  assert.match(g.element('ccRunningList').innerHTML,/Portal &lt;2&gt;<small>Steam game<\/small>.*data-cc-quit="620"/);
-  assert.match(g.element('ccRunningResult').textContent,/^1 running/);
-});
-test('force quit confirms with the unsaved-progress warning before any request', async t => {
-  const f=quitPage({confirmAnswer:false});t.after(()=>f.ui.destroy());
-  await f.element('ccRunningCheck').onclick();
-  f.click(620);await flush();
-  assert.deepEqual(f.asked,['Force quit Portal <2>? Unsaved progress will be lost.']);
-  assert.equal(f.apiCalls.length,1,'declining sends nothing');
-  const g=quitPage();t.after(()=>g.ui.destroy());
-  await g.element('ccRunningCheck').onclick();
-  g.click(620);await flush();
-  assert.deepEqual(g.apiCalls[1],{path:'/api/running',body:{action:'quit',appid:'620'},device:'frame-a'});
-  assert.equal(g.element('ccRunningResult').textContent,'Quit Portal 2');
-  assert.equal(g.element('ccRunningList').innerHTML,'');
-  g.click(999);await flush();
-  assert.equal(g.apiCalls.length,2,'an id that was not listed is ignored');
-});
-test('force quit shows errors, refuses duplicates and offline use, and ignores a switched headset', async t => {
-  const pending=deferred();
-  const f=quitPage({quit:()=>pending.promise});t.after(()=>f.ui.destroy());
-  await f.element('ccRunningCheck').onclick();
-  f.click(620);f.click(620);await flush();
-  assert.equal(f.asked.length,1);
-  assert.match(f.element('ccRunningList').innerHTML,/disabled/);
-  pending.reject(Error("That game isn't running any more"));await flush();
-  assert.equal(f.element('ccRunningResult').textContent,"Couldn’t force quit Portal <2>: That game isn't running any more");
-  assert.doesNotMatch(f.element('ccRunningList').innerHTML,/disabled/);
-  // A switch while quitting: the old answer is dropped and the list cleared.
-  const late=deferred(),g=quitPage({quit:()=>late.promise});t.after(()=>g.ui.destroy());
-  await g.element('ccRunningCheck').onclick();g.click(620);await flush();
-  g.context={online:true,generation:2,device:'frame-b'};g.ui.reset();
-  late.resolve({message:'Quit Portal 2'});await flush();
-  assert.equal(g.element('ccRunningResult').textContent,'');
-  assert.equal(g.element('ccRunningList').innerHTML,'');
-  const h=quitPage();t.after(()=>h.ui.destroy());h.context={online:false,generation:1,device:'frame-a'};
-  await h.element('ccRunningCheck').onclick();
-  assert.equal(h.apiCalls.length,0);
-  assert.match(h.element('ccRunningResult').textContent,/Connect to the Frame/);
-  const controller=cc.createController({api:async()=>assert.fail('no request'),getContext:()=>({online:true,generation:1})});
-  await assert.rejects(controller.forceQuit({appid:'620; reboot'}),/Choose a running game/);
-});
-test('the Control Center finds force quit by what a stuck game looks like', () => {
-  const item=cc.catalog.find(i=>i.id==='forcequit');
-  for(const q of ['frozen game','hung','not responding','kill','stuck app'])assert.ok(cc.matches(item,q,'all'),q);
-  assert.ok(cc.matches(item,'','apps'));
+  assert.equal(vm.runInContext('PAGES[4]',context),'devices');
+  assert.equal(vm.runInContext('PAGES[5]',context),'control');
 });
@@ -45,13 +45,6 @@ class Device(harness.FrameTestCase):
        self.assertRegex(out['message'], r'^copied via Klipper \(\d+ chars\)$')
        self.assertEqual(state()['clipboard'], [text])

-    def test_clipboard_comes_back_from_klipper(self):
-        text = 'from the headset: 世界 🎧\n\nwith trailing newlines\n\n'
-        ok('POST', '/api/clipboard', {'text': text})
-        out = ok('POST', '/api/clipboard', {'read': True})
-        self.assertEqual(out['text'], text)
-        self.assertRegex(out['message'], r"^Copied \d+ characters from the headset's clipboard$")
-
    def test_flatpak_install_and_remove(self):
        # Installs run as background jobs (server.start_job); uninstall answers at once.
        job = finished(ok('POST', '/api/flatpak', {'id': 'org.videolan.VLC', 'action': 'install'}))
@@ -1,55 +0,0 @@
-"""Backup and recovery kit through the server against the fake Frame: a Proton game's save
-goes to this computer and back, Steam's sign-in token never leaves the headset."""
-import json
-import shutil
-import tarfile
-import unittest
-from pathlib import Path
-
-import harness
-from harness import api, finished, ok, ssh
-
-harness.require()
-
-SAVE = '.local/share/Steam/steamapps/compatdata/620980/pfx/drive_c/users/steamuser/AppData/LocalLow/Beat Games/Beat Saber/PlayerData.dat'
-
-
-class Backup(harness.FrameTestCase):
-    def test_saves_round_trip_and_secrets_stay(self):
-        ssh(f"mkdir -p ~/'{Path(SAVE).parent}' && printf 'level 7' > ~/'{SAVE}' && "
-            "mkdir -p ~/.steam && printf SECRET > ~/.steam/steam.token")
-        job = finished(ok('POST', '/api/backup', {'action': 'backup', 'kinds': ['saves', 'settings']}), 120)
-        self.assertIsNone(job['error'], job)
-        folder = Path(job['result']['path'])
-        self.addCleanup(shutil.rmtree, str(folder), True)
-        manifest = json.loads((folder / 'manifest.json').read_text())
-        self.assertEqual(manifest['headset']['build'], '20260922.6101926')
-        saves = next(p for p in manifest['parts'] if p['id'] == 'saves:620980')
-        self.assertEqual(saves['label'], 'Beat Saber saves')
-        self.assertEqual([f['path'] for f in saves['files']], [SAVE])
-        for part in manifest['parts']:
-            with tarfile.open(str(folder / part['archive'])) as tar:
-                self.assertFalse([m.name for m in tar if 'steam.token' in m.name])
-        self.assertEqual(ssh('cat ~/.steam/steam.token'), 'SECRET')  # read-only on the headset
-
-        ssh(f"rm ~/'{SAVE}'")
-        name = folder.name
-        plan = {p['id']: p for p in ok('POST', '/api/backup', {'action': 'plan', 'name': name})['parts']}
-        self.assertEqual((plan['saves:620980']['status'], plan['saves:620980']['new']), ('ok', 1))
-        status, out, _ = api('POST', '/api/backup', {'action': 'restore', 'name': name, 'parts': ['saves:620980']})
-        self.assertEqual(status, 400, out)  # not confirmed
-        job = finished(ok('POST', '/api/backup', {'action': 'restore', 'name': name, 'parts': ['saves:620980'],
-                                                  'confirm': True}), 120)
-        self.assertIsNone(job['error'], job)
-        self.assertEqual(ssh(f"cat ~/'{SAVE}'"), 'level 7')
-
-    def test_bad_names_and_session(self):
-        status, out, _ = api('POST', '/api/backup', {'action': 'plan', 'name': '../../etc'})
-        self.assertEqual(status, 400, out)
-        state = ok('POST', '/api/backup', {'action': 'session'})
-        self.assertIn(state['mode'], ('game', 'desktop', 'unknown'))
-        self.assertIsNone(state['selector'])  # the fake has no session switch command
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -1,82 +0,0 @@
-"""Force quit (ui/frame_running.py) through the server's HTTP API, against games the
-fake Steam client really runs under its stand-in reaper (fakesteam.REAPER)."""
-import os
-import unittest
-
-import harness
-from harness import api, install_title, launches, ok, ssh, state, wait_for
-
-harness.require()
-
-
-class Running(harness.FrameTestCase):
-    def script_title(self, name, body):
-        folder = self.path(name)
-        os.makedirs(folder)
-        with open(os.path.join(folder, 'run.sh'), 'w') as f:
-            f.write('#!/bin/sh\n' + body)
-        os.chmod(os.path.join(folder, 'run.sh'), 0o755)
-        plan, job = install_title(folder)
-        self.assertIsNone(job['error'], job)
-        return plan['id'], plan['name']
-
-    def running(self, match):
-        return next((g for g in ok('GET', '/api/running')['running'] if match(g)), None)
-
-    def launch_title(self, gid):
-        ok('POST', '/api/titles', {'action': 'launch', 'id': gid})
-        game = wait_for(lambda: self.running(lambda g: g.get('title') == gid), 20, f'{gid} to be running')
-        # The fake's reset doesn't stop programs: don't leave one running for the next test.
-        self.addCleanup(ssh, f"pkill -KILL -f '[d]evkit-game/{gid}/' || true", check=False)
-        return game
-
-    def assert_steam_alive(self, pid):
-        self.assertEqual(ssh(f'kill -0 {pid} && echo alive').strip(), 'alive')
-
-    def test_nothing_running(self):
-        self.assertEqual(ok('GET', '/api/running'), {'running': [], 'message': 'Nothing is running on the Frame'})
-        status, out, _ = api('POST', '/api/running', {'action': 'quit', 'appid': '620'})
-        self.assertEqual(status, 409, out)
-
-    def test_sigterm_quits_a_sideloaded_game(self):
-        gid, name = self.script_title('Hang Game', 'sleep 600 &\nwait\n')
-        steam = ssh('cat ~/.steam/steam.pid').strip()
-        game = self.launch_title(gid)
-        self.assertEqual((game['kind'], game['name']), ('devkit', name))
-        self.assertGreaterEqual(game['processes'], 3)          # reaper, run.sh, sleep
-        out = ok('POST', '/api/running', {'action': 'quit', 'appid': str(game['appid'])})
-        self.assertEqual(out['method'], 'term', out)
-        self.assertEqual(out['message'], f'Force quit {name}')
-        # Steam was asked first, with the shortcut's game id.
-        self.assertEqual(state()['steam']['last_terminate'], game['gameid'])
-        self.assertIsNone(self.running(lambda g: g['appid'] == game['appid']))
-        self.assertEqual(ssh("pgrep -fc '[s]leep 600' || true").strip(), '0')
-        self.assert_steam_alive(steam)
-        done = wait_for(lambda: launches('devkit')[-1].get('exit') is not None and launches('devkit')[-1],
-                        10, 'the reaper to report the exit')
-        self.assertIsNotNone(done['exit'])
-
-    def test_sigkill_when_it_ignores_sigterm(self):
-        gid, name = self.script_title('Stuck Game', "trap '' TERM\nsleep 600 &\nwait\n")
-        steam = ssh('cat ~/.steam/steam.pid').strip()
-        game = self.launch_title(gid)
-        out = ok('POST', '/api/running', {'action': 'quit', 'appid': str(game['appid'])})
-        self.assertEqual(out['method'], 'kill', out)
-        self.assertEqual(out['message'], f'Force quit {name} (it had to be killed)')
-        self.assertIsNone(self.running(lambda g: g['appid'] == game['appid']))
-        self.assertEqual(ssh("pgrep -fc '[s]leep 600' || true").strip(), '0')
-        self.assert_steam_alive(steam)
-
-    def test_steam_game_quits_through_steam(self):
-        ok('POST', '/api/launch', {'appid': 620980})
-        game = wait_for(lambda: self.running(lambda g: g['appid'] == 620980), 20, 'the Steam game to be running')
-        self.assertEqual((game['kind'], game['gameid']), ('steam', '620980'))
-        out = ok('POST', '/api/running', {'action': 'quit', 'appid': '620980'})
-        self.assertEqual(out['method'], 'steam', out)
-        self.assertEqual(state()['steam']['last_terminate'], '620980')
-        self.assertEqual(launches('rungameid')[-1]['exit'], 'terminated')
-        self.assertEqual(ok('GET', '/api/running')['running'], [])
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -1,9 +1,7 @@
 #!/usr/bin/env python3
 """Stub for qdbus6: records Klipper setClipboardContents calls, the way
 Frame Control sends text to the headset desktop's clipboard (server.PASTE,
-verified 2026-09-25), and answers getClipboardContents with the last one
-(server.COPY). Printing the string and a newline is how qdbus prints a
-returned QString; getClipboardContents itself is a guess, not seen on a headset."""
+verified 2026-09-25)."""
 import os
 import sys

@@ -17,10 +15,5 @@ if args[:3] == ['org.kde.klipper', '/klipper', 'org.kde.klipper.klipper.setClipb
        sys.exit('Could not connect to D-Bus server')
    with fs.update() as s:
        s['clipboard'].append(args[3])
-elif args == ['org.kde.klipper', '/klipper', 'org.kde.klipper.klipper.getClipboardContents']:
-    if not os.environ.get('DBUS_SESSION_BUS_ADDRESS'):
-        sys.exit('Could not connect to D-Bus server')
-    clips = fs.read()['clipboard']
-    sys.stdout.buffer.write((clips[-1] if clips else '').encode() + b'\n')
 else:
    sys.exit(f'qdbus6 stub: unsupported {args}')
@@ -79,12 +79,6 @@ function build(steam) {
        return s ? { strShortcutExe: s.exe, strShortcutStartDir: s.start_dir, bShortcutIsVR: !!s.vr } : null;
      },
    },
-    // Guess: the running list as Steam's client code and plugin loaders read it
-    // (SteamUIStore.RunningApps of app overviews); not seen on the Frame. fakesteam
-    // passes the ids of launches that haven't exited.
-    SteamUIStore: {
-      get RunningApps() { return (steam.running || []).map(id => allApps().find(a => a.appid === id) || { appid: id }); },
-    },
    appStore: {
      get allApps() { return allApps(); },
      GetAppOverviewByAppID(id) { return allApps().find(a => a.appid === Number(id)) || null; },
@@ -115,8 +109,7 @@ function build(steam) {
          if (s?.artwork) delete s.artwork[type];
        },
        // Container fallback in frame_android.stop performs the simulated stop.
-        // fakesteam ends pid-less launches for the ids in `terminated`.
-        TerminateApp(gameid) { steam.last_terminate = gameid; (steam.terminated ||= []).push(String(gameid)); },
+        TerminateApp(gameid) { steam.last_terminate = gameid; },
        RemoveShortcut(id) {
          steam.shortcuts = steam.shortcuts.filter(s => s.appid !== Number(id));
          delete steam.compat_tools[String(id)];
@@ -47,12 +47,6 @@ COMPAT_LOG = fs.STEAM_ROOT + '/logs/compat_log.txt'
 DEVTOOLS_PORT = 8080
 TARGET_ID = 'F0CA11ED5EA4ED0000000000000000AB'
 GAME_LOGS = '/var/log/fakeframe'
-# Steam starts a game under its reaper, `reaper SteamLaunch AppId=<id> -- <command>`,
-# which stays the game's parent until it ends (guess for the Frame: that's how Steam
-# launches on Linux desktops and the Steam Deck; docs/steam-games.md). The fake's
-# reaper is bash with that command line: it waits for the game and exits with its status.
-REAPER = fs.STEAM_ROOT + '/ubuntu12_32/reaper'
-REAPER_SH = 'while [ "$1" != "--" ]; do shift; done; shift; "$@" & wait $!'

 # The 403 text /register returned while Steam wasn't on "Pair new host"
 # (docs/ssh.md, verified 2026-09-26). approve-ssh-key passes the Steam
@@ -111,24 +105,11 @@ class JS:
                self._start()
            self.next += 1
            with fs.update() as state:
-                # What Steam counts as running: launches that started and haven't exited.
-                running = sorted({l['appid'] for l in state['launches']
-                                  if l.get('started') and l.get('appid') and l.get('exit') is None})
-                self.proc.stdin.write(json.dumps({'id': self.next, 'expression': expression, 'awaitPromise': await_promise,
-                                                  'steam': dict(state['steam'], running=running)}) + '\n')
+                self.proc.stdin.write(json.dumps({'id': self.next, 'expression': expression,
+                                                  'awaitPromise': await_promise, 'steam': state['steam']}) + '\n')
                self.proc.stdin.flush()
                reply = json.loads(self.proc.stdout.readline())
-                steam = reply['steam']
-                steam.pop('running', None)
-                for gid in map(int, steam.pop('terminated', [])):
-                    appid = gid >> 32 if gid >= 1 << 32 else gid
-                    # Guess: TerminateApp ends a launch the fake didn't really run (a Steam
-                    # game, a Proton title). A real process it leaves alone, so Frame
-                    # Control's own fallback (SIGTERM, SIGKILL) is what the e2e tests see.
-                    for l in state['launches']:
-                        if l.get('appid') == appid and l.get('exit') is None and not l.get('pid'):
-                            l['exit'] = 'terminated'
-                state['steam'] = steam
+                state['steam'] = reply['steam']
            return reply['result']


@@ -272,10 +253,8 @@ def add_launch(record):
        os.makedirs(GAME_LOGS, exist_ok=True)
        with open(f'{GAME_LOGS}/{label}.log', 'ab') as log:
            try:
-                argv = [REAPER, '-c', REAPER_SH, 'reaper', 'SteamLaunch', f"AppId={record['appid']}", '--', path]
-                proc = subprocess.Popen(argv, executable='/bin/bash', cwd=cwd if os.path.isdir(cwd) else HOME,
-                                        env={**os.environ, **env}, stdin=subprocess.DEVNULL, stdout=log, stderr=log,
-                                        start_new_session=True)
+                proc = subprocess.Popen([path], cwd=cwd if os.path.isdir(cwd) else HOME, env={**os.environ, **env},
+                                        stdin=subprocess.DEVNULL, stdout=log, stderr=log, start_new_session=True)
                record['pid'] = proc.pid
            except OSError as e:
                record.update(pid=None, exec_error=str(e))
@@ -23,7 +23,7 @@ function page({ mode = "abs", rect = { left: 0, top: 0, width: 640, height: 360
  const sent = [];
  const canvas = { width: 1280, height: 720, getBoundingClientRect: () => rect };
  const env = {
-    devGen: 0, ctrl, $: () => canvas, ctrlMode: () => mode, ctrlShow: () => {}, toast: () => {},
+    ctrl, $: () => canvas, ctrlMode: () => mode, ctrlShow: () => {}, toast: () => {},
    ctrlTarget: () => (mode !== "abs" ? { ok: true } : target.panel ? { ok: true, panel: target.panel } : { why: "gone" }),
    api: api || (async (path, body) => { sent.push(...body.events); return { state: "ready", sent: true }; }),
    requestAnimationFrame: cb => { setTimeout(cb, 0); return 1; },
@@ -8,7 +8,7 @@ const fail = msg => { console.log("FAIL " + msg); process.exit(1); };
 function page(api) {
  const pad = { state: "ready", queue: [], sending: false };
  const shown = [];
-  const fns = new Function("pad", "api", "padShow", "devGen", code + "; return { padSend, padFlush };")(pad, api, s => { shown.push(s); pad.state = s.state; }, 0);
+  const fns = new Function("pad", "api", "padShow", code + "; return { padSend, padFlush };")(pad, api, s => { shown.push(s); pad.state = s.state; });
  return { pad, shown, ...fns };
 }

@@ -19,13 +19,13 @@ function grab(name) {
  fail(`unbalanced ${name}`);
 }
 const names = ["esc", "storeName", "storeHue", "storeInitial", "storeText", "storeOpenSource", "sourcePage", "storeImage",
-               "GLYPH_VR", "GLYPH_APP", "RUNS", "storeRuns", "storeKind", "storeArt", "storeIcon", "sourceMark", "currentOffer", "detailBadges", "renderAppDetail", "renderAppDetailBody",
-               "updateInstall", "openStoreApp", "loadOfferDetails", "installStoreApp"];
+               "storeArt", "storeIcon", "sourceMark", "currentOffer", "detailBadges", "renderAppDetail", "renderAppDetailBody",
+               "updateInstall", "openStoreApp", "loadOfferDetails"];
 const code = names.map(grab).join("");

 // A fake page: elements by id. The install panel's elements exist only while
 // #detailBody holds the real app page, as in the browser.
-function page(api = async () => ({}), androidApps = []) {
+function page(api = async () => ({})) {
  const els = { appDetail: { open: false, scrollTop: 0, showModal() { this.open = true; } } };
  const inPage = id => ["detailInstall", "detailInstallNote", "detailProgress", "detailOffers"].includes(id);
  const $ = id => inPage(id) && !(els.detailBody?.innerHTML || "").includes(`id="${id}"`) ? null
@@ -34,10 +34,8 @@ function page(api = async () => ({}), androidApps = []) {
  const document = { activeElement: null, querySelector: () => null };
  const console = { error() {} };
  const calls = [];
-  const fns = new Function("$", "sourceState", "document", "console", "api", "androidApps", "runJob", "loadAndroid", "act", "window", "devGen", code + "; return { renderAppDetail, openStoreApp };")(
-    $, sourceState, document, console, (...a) => { calls.push(a); return api(...a); }, androidApps,
-    async (title, key, work) => work(), () => {}, async (title, work) => work(),
-    { open() { fail("an in-app installation opened an external page"); } }, 0);
+  const fns = new Function("$", "sourceState", "document", "console", "api", code + "; return { renderAppDetail, openStoreApp };")(
+    $, sourceState, document, console, (...a) => { calls.push(a); return api(...a); });
  return { els, sourceState, calls, ...fns };
 }

@@ -56,14 +54,6 @@ const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid
  if (html.includes('role="alert"')) fail("a good listing showed the error state");
 }

-// A catalogue listing that is already installed offers its management page.
-{
-  const p = page(undefined, [{ package: offer.package }]);
-  p.sourceState.detail = { app: { name: offer.name, offers: [{ ...offer }] }, choice: 0 };
-  if (p.renderAppDetail() !== true) fail("an installed listing reported a render failure");
-  if (p.els.detailInstall.textContent !== "View installed app") fail("installed listing offered another install");
-}
-
 // A listing that can't render (no offer to show) gets a clear message, not an empty dialog.
 {
  const p = page();
@@ -78,7 +68,7 @@ const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid
 {
  const p = page(async () => { throw new Error("offline"); });
  p.sourceState.apps = [{ name: "Broken", offers: [] }];
-  await p.openStoreApp(0, true);
+  await p.openStoreApp(0);
  if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('role="alert"')) fail("broken listing didn't open with the error");
  if (p.calls.length) fail("asked for details of a listing that couldn't render");
 }
@@ -100,18 +90,4 @@ const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid
  if (!p.els.detailBody.innerHTML.includes('id="detailTitle">Open Brush<')) fail("page lost after a failed details request");
  if (!p.els.detailInstallNote.textContent.includes("couldn't be refreshed")) fail("no note after a failed details request");
 }
-// The featured Install starts a new or failed job, while a job already running or
-// installed opens its details without another install or a launch command.
-for (const [job, expected] of [[null, 1], [{ done: false }, 0],
-    [{ done: true, result: { package: offer.package } }, 0], [{ done: true, error: "offline" }, 1]]) {
-  const p = page(async path => path === "/api/sources/install" ? { package: offer.package } : {});
-  p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }];
-  if (job) p.sourceState.jobs.set(`${offer.source}:${offer.id}`, job);
-  await p.openStoreApp(0, true);
-  if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('id="detailInstall"')) fail("hero installation didn't open details");
-  const installs = p.calls.filter(([path]) => path === "/api/sources/install");
-  if (installs.length !== expected) fail(`expected ${expected} installation requests, got ${installs.length}`);
-  if (installs.some(([, body]) => body.source !== offer.source || body.id !== offer.id)) fail("installed a different offer");
-  if (p.calls.some(([path]) => path === "/api/android")) fail("hero Install launched an already installed app");
-}
 console.log("ok");
@@ -1,219 +0,0 @@
-// Production standalone scripts with deterministic DOM/network boundaries. No browser/headset.
-const test = require('node:test');
-const assert = require('node:assert/strict');
-const fs = require('node:fs');
-const path = require('node:path');
-const vm = require('node:vm');
-const root = process.env.STANDALONE_SOURCE_ROOT || path.resolve(__dirname, '..');
-const read = name => fs.readFileSync(path.join(root, 'ui', name), 'utf8');
-const script = html => html.match(/<script>([\s\S]*?)<\/script>/)[1];
-const tick = async () => { for (let i = 0; i < 16; i++) await Promise.resolve(); };
-
-function fixture(html) {
-  const elements = new Map(), events = new Map(), requests = [];
-  const document = {
-    activeElement: null,
-    getElementById: id => element(id),
-    querySelector: selector => selector === 'main' ? element('main') : document.querySelectorAll(selector)[0],
-    querySelectorAll: selector => [...elements.values()].flatMap(el => el.children).filter(el => el.matches(selector)),
-    addEventListener: (name, fn) => { if (!events.has(name)) events.set(name, []); events.get(name).push(fn); },
-  };
-  class Element {
-    constructor(id, attrs = '', text = '') {
-      this.id = id; this.dataset = {}; this.children = []; this.hidden = false; this.open = false;
-      this.isConnected = true; this.value = ''; this.checked = false; this.disabled = /\bdisabled\b/.test(attrs);
-      this.textContent = text; this.attrs = {}; this.listeners = new Map();
-      for (const [, key, value] of attrs.matchAll(/([\w-]+)="([^"]*)"/g)) {
-        this.attrs[key] = value;
-        if (key.startsWith('data-')) this.dataset[key.slice(5).replace(/-([a-z])/g, (_, c) => c.toUpperCase())] = value;
-      }
-      for (const [, key] of attrs.matchAll(/\bdata-([\w-]+)(?=\s|$)/g)) if (!Object.hasOwn(this.dataset, key)) this.dataset[key] = '';
-    }
-    matches(s) {
-      if (s === 'button:not(:disabled)') return this.tag === 'button' && !this.disabled;
-      if (s.startsWith('#')) return this.id === s.slice(1);
-      const data = s.match(/\[data-([\w-]+)(?:="([^"]*)")?\]/);
-      if (data) return Object.hasOwn(this.dataset, data[1]) && (data[2] === undefined || this.dataset[data[1]] === data[2]);
-      return false;
-    }
-    set innerHTML(value) {
-      this.html = value;
-      for (const child of this.children) { child.isConnected = false; if (document.activeElement === child) document.activeElement = null; }
-      this.children = [...value.matchAll(/<(button|h2)\b([^>]*)>([\s\S]*?)<\/\1>/g)].map(([, tag, attrs, text]) => {
-        const child = new Element((attrs.match(/\bid="([^"]+)"/) || [])[1], attrs, text);
-        child.tag = tag; child.parent = this; return child;
-      });
-    }
-    get innerHTML() { return this.html || ''; }
-    querySelectorAll(s) { return this.children.filter(el => el.matches(s)); }
-    querySelector(s) { return this.querySelectorAll(s)[0] || null; }
-    contains(el) { return el === this || this.children.includes(el); }
-    closest(s) { return this.matches(s) ? this : this.parent?.closest(s) || null; }
-    setAttribute(k, v) { this.attrs[k] = v; }
-    append(el) { el.parent = this; }
-    focus() { if (!this.disabled && this.isConnected) document.activeElement = this; }
-    showModal() { this.open = true; this.modalOpened = true; }
-    close() { this.open = false; this.onclose?.(); }
-    addEventListener(name, fn) { this.listeners.set(name, fn); }
-    reset() {}
-  }
-  function element(id) {
-    const dynamic = [...elements.values()].flatMap(el => el.children).find(el => el.id === id);
-    if (dynamic) return dynamic;
-    if (!elements.has(id)) elements.set(id, new Element(id));
-    return elements.get(id);
-  }
-  element('detail').hidden = element('kbd').hidden = true;
-  document.body = element('body');
-  // The sheet is stable; its contents are replaced by the production redraw.
-  element('detail').contains = el => el === element('detail') || element('sheet').contains(el);
-  const context = {document, location: {search: '', hash: ''}, URLSearchParams,
-    window: {addEventListener: (name, fn) => events.set(name, [fn])},
-    setTimeout: () => 1, clearTimeout() {}, Event: class {},
-    fetch: (url, options) => new Promise((resolve, reject) => requests.push({url, options, resolve, reject})),
-  };
-  vm.createContext(context);
-  vm.runInContext(script(html).replace('__FRAME_KEY__', JSON.stringify('ios +&?key/#')), context);
-  const run = code => vm.runInContext(code, context);
-  const answer = async (index, data, ok = true) => { (typeof index === 'number' ? requests[index] : index).resolve({ok, json: async () => data}); await tick(); };
-  return {element, document, context, requests, run, answer, events};
-}
-
-test('Assistant Back encodes the injected key for the same-origin workspace only', () => {
-  const html = read('assistant.html'), f = fixture(html);
-  const back = f.element('back');
-  const fallback = html.match(/<a[^>]*href="([^"]*)"[^>]*>Back to Frame Control/)[1];
-  const destination = new URL(back.href || fallback, 'http://127.0.0.1:8123/assistant#confirm=private');
-  assert.equal(destination.origin, 'http://127.0.0.1:8123');
-  assert.equal(destination.pathname, '/');
-  assert.equal(destination.hash, '');
-  assert.equal(destination.searchParams.get('key'), 'ios +&?key/#');
-  const index = fs.readFileSync(path.join(__dirname, '../ui/index.html'), 'utf8');
-  const expression = index.match(/const UI_KEY = ([^;]+);/)[1];
-  assert.equal(vm.runInNewContext(expression, {URLSearchParams, location: {search: destination.search}}), 'ios +&?key/#');
-  for (const [, href] of html.matchAll(/href="(https?:[^\"]+)"/g)) assert.ok(!href.includes('key='));
-  assert.match(html, /referrerpolicy="no-referrer"/);
-});
-
-test('installed read failure is persistent, retry recovers, and cached entries are marked stale', async () => {
-  const f = fixture(read('store.html'));
-  f.run('st.view = "installed"; render()');
-  assert.doesNotMatch(f.element('content').innerHTML, /Nothing installed yet/);
-  f.requests[0].reject(Error('offline')); await tick();
-  assert.equal(f.run('st.installedState'), 'error');
-  assert.match(f.element('content').innerHTML, /data-retry-installed/);
-  assert.doesNotMatch(f.element('content').innerHTML, /Nothing installed yet/);
-  const retry = f.element('content').querySelector('[data-retry-installed]');
-  for (const listener of f.events.get('click')) listener({target: retry});
-  assert.equal(f.requests[1].url, '/api/android');
-  await f.answer(1, {apps: [{package: 'cached.app', label: 'Cached app'}]});
-  assert.equal(f.run('st.installedState'), 'ready');
-  const failed = f.run('loadInstalled()');
-  assert.match(f.element('content').innerHTML, /last (?:known|read)|stale/i);
-  f.requests[2].reject(Error('refresh failed')); await failed;
-  assert.match(f.element('content').innerHTML, /Cached app/);
-  assert.match(f.element('content').innerHTML, /last (?:known|read)|stale/i);
-  assert.match(f.element('content').innerHTML, /data-retry-installed/);
-  const empty = f.run('loadInstalled()'); await f.answer(3, {apps: []}); await empty;
-  assert.match(f.element('content').innerHTML, /Nothing installed yet/);
-  assert.doesNotMatch(f.element('content').innerHTML, /data-retry-installed/);
-});
-
-test('newest installed read wins over older success and failure without pruning cached data', async () => {
-  const f = fixture(read('store.html'));
-  f.run('st.needsData.add("new.app"); st.jobs.set("data:new.app", {done: false})');
-  const newer = f.run('loadInstalled()'); await f.answer(1, {apps: [{package: 'new.app', label: 'New app'}]}); await newer;
-  await f.answer(0, {apps: []});
-  assert.equal(f.run('st.installed.has("new.app")'), true);
-  assert.equal(f.run('st.needsData.has("new.app")'), true);
-  const old = f.run('loadInstalled()'), newest = f.run('loadInstalled()');
-  await f.answer(4, {apps: []}); await newest; // bootstrap's catalogue search is request 2
-  f.requests[3].reject(Error('late failure')); await old;
-  assert.equal(f.run('st.installedState'), 'ready');
-  assert.equal(f.run('st.installedError'), '');
-  assert.equal(f.run('st.installed.size'), 0);
-});
-
-test('an old success cannot mask the newest failure, and malformed data is not successful empty', async () => {
-  const f = fixture(read('store.html'));
-  f.run('st.view = "installed"');
-  const newest = f.run('loadInstalled()'); f.requests[1].reject(Error('latest offline')); await newest;
-  await f.answer(0, {apps: []});
-  assert.equal(f.run('st.installedState'), 'error');
-  assert.equal(f.run('st.installedError'), 'latest offline');
-  assert.doesNotMatch(f.element('content').innerHTML, /Nothing installed yet/);
-  const malformed = f.run('loadInstalled()'); await f.answer(2, {}); await malformed;
-  assert.equal(f.run('st.installedState'), 'error');
-  assert.match(f.element('content').innerHTML, /data-retry-installed/);
-});
-
-test('catalogue details distinguish unknown and stale installed state', async () => {
-  const f = fixture(read('store.html'));
-  f.context.app = {name: 'Example', package: 'example.app', detailed: true, offers: [{source: 'test', id: 'example'}]};
-  f.run('openDetail(app)');
-  assert.doesNotMatch(f.element('sheet').innerHTML, /data-act="install"/);
-  f.requests[0].reject(Error('offline')); await tick();
-  assert.doesNotMatch(f.element('sheet').innerHTML, /data-act="install"/);
-  const loaded = f.run('loadInstalled()'); await f.answer(f.requests.at(-1), {apps: []}); await loaded;
-  assert.match(f.element('sheet').innerHTML, /data-act="install"/);
-});
-
-test('named native Store dialog enters, contains and restores focus across async redraws', async () => {
-  const html = read('store.html');
-  assert.match(html.match(/<[^>]*id="detail"[^>]*>/)[0], /<dialog\b[^>]*aria-labelledby="detailTitle"/);
-  const f = fixture(html);
-  await f.answer(0, {apps: []});
-  f.context.app = {name: 'Example', offers: [{source: 'test', id: 'example'}]};
-  f.run('st.view = "games"; st.apps = [app]; st.loading = false; render()');
-  const opener = f.element('content').querySelector('[data-i="0"]'); opener.focus();
-  f.run('openDetail(app)');
-  assert.equal(f.element('detail').modalOpened, true);
-  assert.equal(f.element('toast').parent, f.element('detail'));
-  assert.equal(f.document.activeElement.id, 'detailTitle');
-  const install = f.element('sheet').querySelector('[data-act="install"]'); install.focus();
-  await f.answer(2, {description: 'Details arrived'}); // request 1 is bootstrap search
-  assert.equal(f.document.activeElement.dataset.act, 'install');
-  assert.notEqual(f.document.activeElement, install);
-  const close = f.element('sheet').querySelector('[data-act="close"]'); close.focus();
-  f.run('st.jobs.set("test:example", {done: false, stage: "Downloading", percent: 20}); drawDetail(); render()');
-  assert.equal(f.document.activeElement.dataset.act, 'close');
-  const keydown = f.element('detail').onkeydown || f.element('detail').listeners.get('keydown');
-  const event = {key: 'Tab', shiftKey: false, preventDefault() {this.prevented = true;}};
-  keydown(event);
-  assert.equal(event.prevented, true);
-  assert.equal(f.document.activeElement.dataset.act, 'close'); // only remaining action
-  f.run('st.jobs.delete("test:example"); drawDetail()');
-  const first = f.element('sheet').querySelector('[data-act="install"]'); first.focus();
-  const reverse = {key: 'Tab', shiftKey: true, preventDefault() {this.prevented = true;}}; keydown(reverse);
-  assert.equal(reverse.prevented, true); assert.equal(f.document.activeElement.dataset.act, 'close');
-  first.focus(); f.run('st.jobs.set("test:example", {done: false}); drawDetail()');
-  assert.equal(f.document.activeElement.dataset.act, 'close'); // focused action disappeared
-  f.run('closeDetail()');
-  assert.equal(f.element('detail').open, false);
-  assert.equal(f.element('toast').parent, f.document.body);
-  assert.equal(f.document.activeElement.dataset.i, '0');
-  assert.notEqual(f.document.activeElement, opener); // render replaced the background card
-});
-
-test('dialog Retry recovers installed knowledge without losing focus, and cancel restores its opener', async () => {
-  const f = fixture(read('store.html'));
-  f.context.app = {name: 'Example', detailed: true, offers: [{source: 'test', id: 'example'}]};
-  f.run('st.view = "games"; st.apps = [app]; render()');
-  const opener = f.element('content').querySelector('[data-i="0"]'); opener.focus();
-  f.run('openDetail(app)');
-  f.requests[0].reject(Error('offline')); await tick();
-  await f.answer(1, {apps: [f.context.app], sources: []});
-  const retry = f.element('sheet').querySelector('[data-retry-installed]'); retry.focus();
-  for (const listener of f.events.get('click')) listener({target: retry});
-  assert.equal(f.document.activeElement.dataset.act, 'close');
-  await f.answer(f.requests.at(-1), {apps: []});
-  assert.equal(f.document.activeElement.dataset.act, 'close');
-  assert.match(f.element('sheet').innerHTML, /data-act="install"/);
-  const cancel = {preventDefault() {this.prevented = true;}};
-  f.element('detail').oncancel(cancel);
-  assert.equal(cancel.prevented, true); assert.equal(f.element('detail').open, false);
-  assert.equal(f.document.activeElement.dataset.i, '0');
-  // Removing the app while details are open falls back to Search on close.
-  f.run('openDetail(app); st.apps = []; render(); closeDetail()');
-  assert.equal(f.document.activeElement, f.element('q'));
-});
@@ -1,177 +0,0 @@
-"""Local APK/OBB backups: inspect as a unit, verify the target, and finish setup."""
-import sandbox  # noqa: F401
-import io
-from pathlib import Path
-import sys
-import tempfile
-import unittest
-from unittest.mock import patch
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'ui'))
-import frame_android_import as backup
-import server
-from apk_fixtures import apk, manifest
-
-PKG = 'com.Armature.VR4'
-META = {'package': PKG, 'label': PKG, 'version': '', 'version_code': 210,
-        'instance': 2800000001, 'shortcut': 123, 'game_id': 456}
-
-
-class BackupTests(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.TemporaryDirectory()
-        self.addCleanup(self.tmp.cleanup)
-        self.root = Path(self.tmp.name)
-        self.apk = self.root / 'VR4-Android-Shipping-arm64.apk'
-        self.apk.write_bytes(apk({'AndroidManifest.xml': manifest(PKG, 0x7f010000, 0x7f010001, 26)}))
-        self.obb = [self.root / f'{kind}.203.{PKG}.obb' for kind in ('main', 'patch')]
-        for p in self.obb:
-            p.write_bytes(b'game data')
-
-    def test_desktop_apk_finds_matching_siblings_but_browser_requires_selection(self):
-        (self.root / 'main.1.org.other.game.obb').write_bytes(b'other game')
-        with patch.object(backup.android, 'ssh') as ssh:
-            desktop = backup.inspect([str(self.apk)], discover=True)
-            browser = backup.inspect([str(self.apk)])
-            selected = backup.inspect([str(self.apk), *map(str, self.obb)])
-        ssh.assert_not_called()
-        self.assertEqual(desktop['obb'], self.obb)
-        self.assertEqual(browser['obb'], [])
-        self.assertEqual(backup.public(selected)['obb'][0]['name'], self.obb[0].name)
-        self.assertEqual(backup.public(selected)['package'], PKG)
-        self.assertNotIn(str(self.root), str(backup.public(selected)))
-
-    def test_wrong_data_empty_data_duplicate_names_and_multiple_apks_fail_before_install(self):
-        other = self.root / 'main.203.org.other.game.obb'
-        other.write_bytes(b'other game')
-        with self.assertRaisesRegex(backup.android.FrameError, 'does not belong'):
-            backup.inspect([str(self.apk), str(other)])
-        self.obb[0].write_bytes(b'')
-        with self.assertRaisesRegex(backup.android.FrameError, 'nonempty'):
-            backup.inspect([str(self.apk), str(self.obb[0])])
-        second = self.root / 'another.apk'
-        second.write_bytes(self.apk.read_bytes())
-        with self.assertRaisesRegex(backup.android.FrameError, 'one game at a time'):
-            backup.inspect([str(self.apk), str(second)])
-        self.obb[0].write_bytes(b'data')
-        folder = self.root / 'copy'
-        folder.mkdir()
-        duplicate = folder / self.obb[0].name
-        duplicate.write_bytes(b'data')
-        with self.assertRaisesRegex(backup.android.FrameError, 'unique names'):
-            backup.inspect([str(self.apk), str(self.obb[0]), str(duplicate)])
-
-    def test_obb_only_repairs_existing_game_and_requests_apk_when_not_installed(self):
-        with patch.object(backup.android, 'read_meta', return_value=None):
-            with self.assertRaisesRegex(backup.android.FrameError, 'Add its APK'):
-                backup.inspect(list(map(str, self.obb)))
-        with patch.object(backup.android, 'read_meta', return_value=META):
-            plan = backup.inspect(list(map(str, self.obb)))
-        self.assertIsNone(plan['apk'])
-        self.assertEqual(plan['checked']['version_code'], 210)
-
-    def test_apk_and_both_data_files_install_launch_verify_copy_close_in_order(self):
-        plan = backup.inspect([str(self.apk), *map(str, self.obb)])
-        order = []
-        def added(pkg, checked, files, *args, **kwargs):
-            order.append('copy-close')
-            self.assertEqual(pkg, PKG)
-            self.assertEqual(files, self.obb)
-            return {'closed': True, 'message': 'copied', 'app': META, 'needs_game_data': False}
-        with patch.object(backup.quest, '_running', side_effect=[False, False, True]), \
-                patch.object(backup.android, 'read_meta', return_value=None), \
-                patch.object(backup.android, 'install', side_effect=lambda *a, **k: order.append('install') or META), \
-                patch.object(backup.android, 'launch', side_effect=lambda *a: order.append('launch')), \
-                patch.object(backup.quest, '_wait_ready', side_effect=lambda *a: order.append('ready')), \
-                patch.object(backup.quest, '_check_android_package', side_effect=lambda *a: order.append('verify')), \
-                patch.object(backup.quest, 'add_game_data', side_effect=added):
-            result = backup.install(plan)
-        self.assertEqual(order, ['install', 'launch', 'ready', 'verify', 'copy-close'])
-        self.assertIn('2 game-data files', result['message'])
-        self.assertIn('Ready to open', result['message'])
-
-    def test_copy_failure_closes_game_and_keeps_retry_instruction(self):
-        plan = backup.inspect([str(self.apk), *map(str, self.obb)])
-        with patch.object(backup.quest, '_running', side_effect=[False, True]), \
-                patch.object(backup.android, 'read_meta', return_value=None), \
-                patch.object(backup.android, 'install', return_value=META), \
-                patch.object(backup.quest, '_wait_ready'), patch.object(backup.quest, '_check_android_package'), \
-                patch.object(backup.quest, 'add_game_data', side_effect=backup.android.FrameError('transfer failed')), \
-                patch.object(backup.quest, '_close', return_value=(True, None)) as close:
-            with self.assertRaisesRegex(backup.android.FrameError, 'installed, but.*Import the same backup again'):
-                backup.install(plan)
-        close.assert_called_once_with(PKG)
-
-    def test_changed_files_are_rejected_before_frame_access(self):
-        plan = backup.inspect([str(self.apk), *map(str, self.obb)])
-        self.obb[0].write_bytes(b'changed contents')
-        with patch.object(backup.android, 'ssh') as ssh:
-            with self.assertRaisesRegex(backup.android.FrameError, 'backup changed'):
-                backup.install(plan)
-        ssh.assert_not_called()
-
-    def test_running_game_and_newer_installed_version_are_not_replaced(self):
-        plan = backup.inspect([str(self.apk), *map(str, self.obb)])
-        newer = {**META, 'version_code': plan['checked']['version_code'] + 1}
-        for running, existing, message in [(True, None, 'Close'), (False, newer, 'newer')]:
-            with self.subTest(running=running), \
-                    patch.object(backup.quest, '_running', return_value=running), \
-                    patch.object(backup.android, 'read_meta', return_value=existing), \
-                    patch.object(backup.android, 'install') as install:
-                with self.assertRaisesRegex(backup.android.FrameError, message):
-                    backup.install(plan)
-                install.assert_not_called()
-
-    def test_apk_without_data_installs_without_launching(self):
-        plan = backup.inspect([str(self.apk)])
-        with patch.object(backup.quest, '_running', return_value=False), \
-                patch.object(backup.android, 'read_meta', return_value=None), \
-                patch.object(backup.android, 'install', return_value=META), \
-                patch.object(backup.android, 'launch') as launch:
-            result = backup.install(plan)
-        launch.assert_not_called()
-        self.assertFalse(result['needs_game_data'])
-
-
-class StagingTests(unittest.TestCase):
-    setUp = BackupTests.setUp
-    def tearDown(self):
-        for entry in server._android_backups.values():
-            server._discard_android_backup(entry)
-        server._android_backups.clear()
-
-    def test_uploaded_batch_is_inspected_together_and_cancel_removes_all_uploads(self):
-        token = server.android_backup({'action': 'begin'})['token']
-        for path in [self.apk, *self.obb]:
-            class Request:
-                headers = {'X-Filename': path.name, 'X-Mode': 'android-backup',
-                           'X-Android-Backup': token, 'Content-Length': str(path.stat().st_size)}
-                rfile = io.BytesIO(path.read_bytes())
-            server.Handler.upload(Request())
-        read = server.android_backup({'action': 'inspect', 'token': token})
-        self.assertEqual(len(read['plan']['obb']), 2)
-        folders = list(server._android_backups[token]['dirs'])
-        server.android_backup({'action': 'discard', 'token': token})
-        self.assertTrue(all(not Path(p).exists() for p in folders))
-        self.assertTrue(self.apk.exists())
-
-    def test_headset_change_refuses_import_and_pc_folder_is_left_to_title_importer(self):
-        class Link:
-            device = 'a'
-            def active_device(self):
-                return {'id': self.device}
-        link = Link()
-        with patch.object(server, 'LINK', link):
-            read = server.android_backup({'action': 'inspect', 'paths': [str(self.apk)]})
-            link.device = 'b'
-            with self.assertRaisesRegex(server.Failure, 'headset changed'):
-                server.android_backup({'action': 'install', 'token': read['token']})
-        pc = self.root / 'pc'
-        pc.mkdir()
-        (pc / 'game.exe').write_bytes(b'program')
-        self.assertEqual(server.android_backup({'action': 'inspect', 'paths': [str(pc)], 'probe': True}),
-                         {'android': False})
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -19,9 +19,7 @@ class ArtworkTests(unittest.TestCase):
    def setUp(self):
        with _images._lock:
            _images._urls.clear()
-            _images._tokens.clear()
            _images._cache.clear()
-            _images._dns.clear()

    def test_only_registered_source_images_are_fetchable(self):
        with patch.object(_images, 'fetch') as fetch:
@@ -73,13 +71,9 @@ class ArtworkTests(unittest.TestCase):
            _images.remember('https://example.com/a.png', PNG[:8] + b'x' * _images.MAX_IMAGE)

    def test_handles_are_bounded(self):
-        with patch.object(_images, 'MAX_TOKENS', 50):
-            first = _images.register('https://example.com/0.png')
-            for i in range(1, 60):
-                _images.register('https://example.com/%d.png' % i)
-            self.assertEqual((len(_images._urls), len(_images._tokens)), (50, 50))
-            self.assertNotEqual(_images.register('https://example.com/0.png'), first)  # forgotten, so a new handle
-            self.assertEqual(_images.register('https://example.com/59.png'), _images.register('https://example.com/59.png'))
+        for i in range(4100):
+            _images.register('https://example.com/%d.png' % i)
+        self.assertEqual(len(_images._urls),4096)

    def test_plain_language_verdict_is_evidence_based(self):
        self.assertEqual(search.verdict({})['label'], 'Not yet checked on the Frame')
@@ -122,7 +122,7 @@ class SearchTests(SettingsTest):
                    break
                time.sleep(.01)
            self.assertTrue(arrived[1]['event'].wait(2))
-        self.assertEqual(arrived[1]['query'][:2], ('second', 50))
+        self.assertEqual(arrived[1]['query'], ('second', 50))

    def test_set_enabled_does_not_hold_search_lock_in_source(self):
        free = []
@@ -1,291 +0,0 @@
-"""Copying new screenshots and clips to the computer on their own (ui/frame_autosync.py).
-
-The headset is a fake: lists of shots and clips, and save/export functions that
-record what they were asked to copy. No SSH, no headset.
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import errno
-import json
-import shutil
-import sys
-import tempfile
-import threading
-import unittest
-from pathlib import Path
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "ui"))
-import frame_autosync as fa  # noqa: E402
-
-NOW = 1_800_000_000.0
-GB = 1024**3
-
-
-def shot(n, t, saved=False):
-    return {"id": f"1/620/20261020{n:06d}_1.jpg", "time": t, "saved": saved}
-
-
-def clip(n, t, idle=600, kind="clip", saved=False):
-    return {"id": f"1/clips/clip_620_{n}/video/bg", "kind": kind, "time": t, "idle": idle, "saved": saved}
-
-
-class FakeFrame:
-    def __init__(self):
-        self.shots, self.clips = [], []
-        self.saved, self.exported, self.calls = [], [], []
-        self.device, self.busy, self.down = "frame-a", False, False
-        self.save_error = self.export_error = None
-
-    def list_shots(self):
-        self.calls.append("list_shots")
-        if self.down:
-            raise RuntimeError("ssh: connect to host frame port 22: Connection timed out")
-        return {"shots": list(self.shots)}
-
-    def list_clips(self):
-        self.calls.append("list_clips")
-        if self.down:
-            raise RuntimeError("ssh: connect to host frame port 22: Connection timed out")
-        return {"clips": list(self.clips)}
-
-    def save_shots(self, device, ids):
-        self.calls.append("save_shots")
-        if self.save_error:
-            raise self.save_error
-        self.saved.append((device, list(ids)))
-        for s in self.shots:
-            if s["id"] in ids:
-                s["saved"] = True
-
-    def export_clip(self, device, clip_id):
-        self.calls.append("export_clip")
-        if self.export_error:
-            raise self.export_error
-        self.exported.append((device, clip_id))
-        for c in self.clips:
-            if c["id"] == clip_id:
-                c["saved"] = True
-
-
-class AutoSyncTest(unittest.TestCase):
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        self.addCleanup(shutil.rmtree, self.dir, ignore_errors=True)
-        self.frame = FakeFrame()
-        self.now = [NOW]
-        self.free = [100 * GB]
-        self.sync = self.make()
-
-    def make(self):
-        f = self.frame
-        return fa.AutoSync(f.list_shots, f.save_shots, f.list_clips, f.export_clip,
-                           lambda: f.device, lambda: f.busy,
-                           offline=lambda e: "The Frame isn't answering." if "timed out" in str(e) else None,
-                           shots_folder=self.dir / "Pictures", clips_folder=self.dir / "Videos",
-                           path=self.dir / "auto-sync.json", clock=lambda: self.now[0],
-                           space=lambda folder: self.free[0])
-
-    def test_off_by_default_and_does_nothing(self):
-        self.frame.shots = [shot(1, NOW + 10)]
-        self.frame.clips = [clip(1, NOW + 10)]
-        s = self.sync.state()
-        self.assertFalse(s["screenshots"] or s["clips"])
-        self.assertEqual(self.sync.tick(), fa.INTERVAL)
-        self.assertEqual(self.frame.calls, [])  # not even a listing
-        self.assertFalse((self.dir / "auto-sync.json").exists())
-
-    def test_settings_persist(self):
-        self.sync.update({"screenshots": True})
-        again = self.make().state()
-        self.assertTrue(again["screenshots"])
-        self.assertFalse(again["clips"])
-        self.assertEqual(again["since"], NOW)
-        saved = json.loads((self.dir / "auto-sync.json").read_text())
-        self.assertEqual((saved["screenshots"], saved["clips"]), (True, False))
-
-    def test_only_what_is_newer_than_turning_it_on(self):
-        self.frame.shots = [shot(1, NOW - 3600), shot(2, NOW + 5), shot(3, NOW + 50, saved=True)]
-        self.frame.clips = [clip(1, NOW - 3600), clip(2, NOW + 5)]
-        self.sync.update({"screenshots": True, "clips": True})
-        self.assertEqual(self.sync.tick(), fa.INTERVAL)
-        self.assertEqual(self.frame.saved, [("frame-a", [shot(2, 0)["id"]])])
-        self.assertEqual(self.frame.exported, [("frame-a", clip(2, 0)["id"])])
-        s = self.sync.state()
-        self.assertEqual((s["copied"], s["copied_time"], s["checked"], s["error"]), (2, NOW, NOW, None))
-
-    def test_watermark_moves_when_turned_off_and_on_again(self):
-        self.sync.update({"screenshots": True})
-        self.now[0] += 1000
-        self.sync.update({"clips": True})  # already on: the watermark stays
-        self.assertEqual(self.sync.state()["since"], NOW)
-        self.sync.update({"screenshots": False, "clips": False})
-        self.sync.update({"screenshots": True})
-        self.assertEqual(self.sync.state()["since"], NOW + 1000)
-
-    def test_copy_everything_now_once(self):
-        self.frame.shots = [shot(1, NOW - 3600), shot(2, NOW - 60)]
-        self.frame.clips = [clip(1, NOW - 3600), clip(2, NOW - 60, kind="background")]
-        self.sync.copy_all()  # works with the toggles off too
-        self.assertTrue(self.sync.state()["pending"])
-        self.sync.tick()
-        self.assertEqual(self.frame.saved, [("frame-a", [shot(1, 0)["id"], shot(2, 0)["id"]])])
-        self.assertEqual(self.frame.exported, [("frame-a", clip(1, 0)["id"])])  # never the background recording
-        self.assertFalse(self.sync.state()["pending"])
-        self.frame.calls.clear()
-        self.sync.tick()
-        self.assertEqual(self.frame.calls, [])  # off again afterwards
-
-    def test_not_copied_again_after_deleting_it_here(self):
-        self.sync.update({"screenshots": True, "clips": True})
-        self.frame.shots = [shot(1, NOW + 5)]
-        self.frame.clips = [clip(1, NOW + 5)]
-        self.sync.tick()
-        for s in self.frame.shots + self.frame.clips:
-            s["saved"] = False  # the person deleted the files
-        self.frame.saved.clear()
-        self.frame.exported.clear()
-        self.make().tick()  # remembered across restarts too
-        self.assertEqual((self.frame.saved, self.frame.exported), ([], []))
-
-    def test_saved_by_hand_counts_as_copied(self):
-        self.sync.update({"screenshots": True})
-        self.frame.shots = [shot(1, NOW + 5, saved=True)]
-        self.sync.tick()
-        self.frame.shots[0]["saved"] = False
-        self.sync.tick()
-        self.assertEqual(self.frame.saved, [])
-
-    def test_remembered_per_headset(self):
-        self.sync.update({"screenshots": True})
-        self.frame.shots = [shot(1, NOW + 5)]
-        self.sync.tick()
-        self.frame.device = "frame-b"
-        self.frame.shots = [shot(1, NOW + 5)]  # the same name on another headset
-        self.sync.tick()
-        self.assertEqual([d for d, _ in self.frame.saved], ["frame-a", "frame-b"])
-
-    def test_clip_still_being_recorded_waits(self):
-        self.sync.update({"clips": True})
-        self.frame.clips = [clip(1, NOW + 5, idle=4), clip(2, NOW + 6, idle=None)]
-        self.sync.tick()
-        self.assertEqual(self.frame.exported, [])
-        self.assertEqual(self.sync.state()["waiting"], 2)
-        self.frame.clips[0]["idle"] = fa.SETTLE + 1
-        self.sync.tick()
-        self.assertEqual(self.frame.exported, [("frame-a", clip(1, 0)["id"])])
-        self.assertEqual(self.sync.state()["waiting"], 1)
-
-    def test_no_headset_no_work(self):
-        self.sync.update({"screenshots": True, "clips": True})
-        self.frame.device = None
-        self.assertEqual(self.sync.tick(), fa.INTERVAL)
-        self.assertEqual(self.frame.calls, [])
-
-    def test_waits_for_other_work(self):
-        self.sync.update({"screenshots": True, "clips": True})
-        self.frame.shots = [shot(1, NOW + 5)]
-        self.frame.busy = True
-        self.assertEqual(self.sync.tick(), fa.BUSY_WAIT)
-        self.assertEqual(self.frame.calls, [])
-        self.frame.busy = False
-        self.sync.tick()
-        self.assertEqual(len(self.frame.saved), 1)
-
-    def test_stops_between_items_when_other_work_starts(self):
-        self.sync.update({"clips": True})
-        self.frame.clips = [clip(1, NOW + 5), clip(2, NOW + 6)]
-        export = self.frame.export_clip
-
-        def then_busy(device, clip_id):
-            export(device, clip_id)
-            self.frame.busy = True  # an install started meanwhile
-        self.frame.export_clip = then_busy
-        sync = self.make()
-        self.assertEqual(sync.tick(), fa.BUSY_WAIT)
-        self.assertEqual(len(self.frame.exported), 1)
-
-    def test_backs_off_while_unreachable(self):
-        self.sync.update({"screenshots": True})
-        self.frame.down = True
-        waits = [self.sync.tick() for _ in range(6)]
-        self.assertEqual(waits[:4], [120, 240, 480, 900])
-        self.assertEqual(waits[-1], fa.MAX_BACKOFF)
-        self.assertEqual(self.sync.state()["error"], "The Frame isn't answering.")
-        self.frame.down = False
-        self.assertEqual(self.sync.tick(), fa.INTERVAL)
-        self.assertIsNone(self.sync.state()["error"])
-        self.frame.down = True
-        self.assertEqual(self.sync.tick(), 120)  # starts over after a good look
-
-    def test_pauses_when_this_computer_is_nearly_full(self):
-        self.sync.update({"screenshots": True})
-        self.frame.shots = [shot(1, NOW + 5)]
-        self.free[0] = 10 * 1024**2
-        self.sync.tick()
-        s = self.sync.state()
-        self.assertIn("out of space", s["paused"])
-        self.assertEqual(self.frame.saved, [])
-        self.free[0] = 100 * GB
-        self.frame.calls.clear()
-        self.sync.tick()
-        self.assertEqual(self.frame.calls, [])  # stays paused, also after a restart
-        self.assertTrue(self.make().state()["paused"])
-        self.sync.resume()
-        self.sync.tick()
-        self.assertEqual(len(self.frame.saved), 1)
-        self.assertIsNone(self.sync.state()["paused"])
-
-    def test_pauses_when_a_copy_runs_out_of_space(self):
-        self.sync.update({"screenshots": True, "clips": True})
-        self.frame.clips = [clip(1, NOW + 5)]
-        self.frame.export_error = RuntimeError("Not enough free space on this computer: it needs 900 MB")
-        self.sync.tick()
-        self.assertIn("ran out of space", self.sync.state()["paused"])
-        self.sync.resume()
-        self.frame.export_error = None
-        self.frame.shots = [shot(1, NOW + 5)]
-        self.frame.save_error = OSError(errno.ENOSPC, "No space left on device")
-        self.sync.tick()
-        self.assertTrue(self.sync.state()["paused"])
-
-    def test_space_on_the_frame_is_not_a_pause(self):
-        self.sync.update({"clips": True})
-        self.frame.clips = [clip(1, NOW + 5)]
-        self.frame.export_error = RuntimeError("Not enough free space on the Frame to export it: it needs 900 MB")
-        self.sync.tick()
-        s = self.sync.state()
-        self.assertIsNone(s["paused"])
-        self.assertIn("Not enough free space on the Frame", s["error"])
-
-    def test_an_item_that_keeps_failing_is_left_alone(self):
-        self.sync.update({"clips": True})
-        self.frame.clips = [clip(1, NOW + 5)]
-        self.frame.export_error = RuntimeError("ffmpeg couldn't join the recording")
-        for _ in range(fa.TRIES + 2):
-            self.sync.tick()
-        self.assertEqual(self.frame.calls.count("export_clip"), fa.TRIES)
-
-    def test_worker_stops(self):
-        stop = threading.Event()
-        t = threading.Thread(target=self.sync.run, args=(stop,), daemon=True)
-        t.start()
-        stop.set()
-        self.sync.update({})  # wakes it
-        t.join(5)
-        self.assertFalse(t.is_alive())
-
-
-class Server(unittest.TestCase):
-    def test_route_and_settings(self):
-        import server
-        self.assertIn("/api/autosync", server.POST)
-        with self.assertRaises(server.Failure):
-            server.auto_sync({"action": "explode"})
-        state = server.auto_sync({"action": "settings", "screenshots": "yes"})  # not a bool: ignored
-        self.assertFalse(state["screenshots"])
-        if server.LINK is None:
-            with self.assertRaises(server.Failure):
-                server.auto_sync({"action": "now"})  # nothing connected
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,450 +0,0 @@
-"""Backup and recovery kit (ui/frame_backup.py, ui/frame_backup_remote.py) against a folder laid
-out like the Frame's home. The headset-side script runs for real, locally; only SSH is faked."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import io
-import json
-import os
-from pathlib import Path
-import shlex
-import subprocess
-import sys
-import tarfile
-import tempfile
-import unittest
-from unittest.mock import patch
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / 'ui'))
-import frame_android as android  # noqa: E402
-import frame_backup as backup  # noqa: E402
-import frame_backup_remote as remote  # noqa: E402
-import server  # noqa: E402
-
-STEAM = '.local/share/Steam'
-USER = STEAM + '/steamapps/compatdata/%s/pfx/drive_c/users/steamuser'
-SECRETS = ['.steam/steam.token', STEAM + '/config/config.vdf', STEAM + '/config/loginusers.vdf',
-           STEAM + '/ssfn123456', '.ssh/id_ed25519', '.ssh/authorized_keys',
-           USER % 1234 + '/AppData/Roaming/Launcher/session.token',
-           USER % 1234 + '/AppData/Roaming/Launcher/.ssh/id_rsa',
-           '.config/cliproxyapi/secrets.env', '.local/share/keyrings/login.keyring']
-
-
-def write(home, rel, data=b'x'):
-    path = Path(home) / rel
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_bytes(data if isinstance(data, bytes) else data.encode())
-    return path
-
-
-def manifest(home, appid, name):
-    write(home, '%s/steamapps/appmanifest_%s.acf' % (STEAM, appid),
-          '"AppState"\n{\n\t"appid"\t\t"%s"\n\t"name"\t\t"%s"\n}\n' % (appid, name))
-
-
-def frame_home(home):
-    """A Frame before a reset: one Proton game, a Linux game, settings and secrets."""
-    manifest(home, 1234, 'Test Game')
-    write(home, USER % 1234 + '/AppData/Roaming/Studio/Game/save1.dat', b'save one')
-    write(home, USER % 1234 + '/Documents/My Games/Game/profile.sav', b'profile')
-    write(home, USER % 1234 + '/AppData/Local/Temp/junk.tmp', b'junk')
-    write(home, USER % 1234 + '/AppData/Local/Microsoft/Windows/x.db', b'wine')
-    write(home, USER % 999 + '/AppData/Local/Temp/only-cache', b'c')        # no saves: no part
-    write(home, STEAM + '/steamapps/compatdata/2800000001/internal/org.example/x', b'android')
-    write(home, STEAM + '/userdata/555/config/localconfig.vdf', b'local')
-    write(home, STEAM + '/userdata/555/config/shortcuts.vdf', b'shortcuts')
-    write(home, STEAM + '/userdata/555/241100/remote/controller_config/1234/layout.vdf', b'layout')
-    write(home, STEAM + '/userdata/555/1234/remote/cloud.sav', b'cloud')    # Steam Cloud's own
-    write(home, STEAM + '/userdata/555/760/remote/1234/screenshots/a.jpg', b'shot')
-    write(home, '.config/kdeglobals', b'[General]')
-    write(home, '.config/openvr/config/steamvr.vrsettings', b'{}')
-    write(home, '.config/unity3d/Company/LinuxGame/prefs', b'prefs')
-    write(home, '.bashrc', b'# mine')
-    for rel in SECRETS:
-        write(home, rel, b'SECRET')
-
-
-class Remote(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.TemporaryDirectory()
-        self.home = Path(self.tmp.name)
-        patcher = patch.object(remote, 'HOME', self.home)
-        patcher.start()
-        self.addCleanup(patcher.stop)
-        self.addCleanup(self.tmp.cleanup)
-
-    def files(self, part):
-        return [rel for rel, _ in remote.part_files(part)[0]]
-
-    def test_plan_picks_saves_and_settings_and_never_secrets(self):
-        frame_home(self.home)
-        plan = remote.plan()
-        ids = [p['id'] for p in plan['parts']]
-        self.assertEqual(ids, ['saves:1234', 'saves:linux', 'settings:steam', 'settings:system'])
-        self.assertEqual(plan['parts'][0]['label'], 'Test Game saves')
-        saves = self.files('saves:1234')
-        self.assertEqual(sorted(saves), [USER % 1234 + '/AppData/Roaming/Studio/Game/save1.dat',
-                                         USER % 1234 + '/Documents/My Games/Game/profile.sav'])
-        steam = self.files('settings:steam')
-        self.assertIn(STEAM + '/userdata/555/241100/remote/controller_config/1234/layout.vdf', steam)
-        self.assertIn(STEAM + '/userdata/555/config/localconfig.vdf', steam)
-        self.assertFalse([f for f in steam if '/1234/remote/' in f or '/760/' in f])
-        everything = sum((self.files(i) for i in ids), [])
-        for rel in SECRETS + ['.bashrc']:
-            self.assertNotIn(rel, everything)
-        self.assertFalse([f for f in everything if remote.is_secret(f)])
-        self.assertTrue(any('steam.token' in x for x in plan['excluded']))
-        # The controller layout goes back; localconfig.vdf and shortcuts.vdf are for reference.
-        steam_part = plan['parts'][2]
-        self.assertEqual((steam_part['files'], steam_part['restorable']), (3, 1))
-
-    def test_secret_names(self):
-        for rel in SECRETS + ['a/b/ID_RSA.pub', 'x/kwalletd/k', 'x/cert.PEM']:
-            self.assertTrue(remote.is_secret(rel), rel)
-        for rel in ['saves/game.sav', 'Documents/tokens-collected.txt', 'config/localconfig.vdf']:
-            self.assertFalse(remote.is_secret(rel), rel)
-
-    @unittest.skipIf(os.name == 'nt', 'symlinks need privileges on Windows')
-    def test_links_are_never_followed(self):
-        frame_home(self.home)
-        outside = write(self.home, 'elsewhere/private.txt', b'p')
-        base = self.home / (USER % 1234) / 'Documents'
-        os.symlink(str(outside.parent), str(base / 'linked-dir'))
-        os.symlink(str(outside), str(base / 'linked-file'))
-        self.assertFalse([f for f in self.files('saves:1234') if 'linked' in f])
-
-    def test_big_files_are_listed_as_skipped(self):
-        frame_home(self.home)
-        with patch.object(remote, 'MAX_FILE', 3):
-            files, skipped = remote.part_files('saves:1234')
-        self.assertEqual(files, [])
-        self.assertEqual({s['reason'] for s in skipped}, {'over 2 GiB'})
-
-    def test_pack_holds_exactly_the_planned_files(self):
-        frame_home(self.home)
-        out = io.BytesIO()
-        remote.pack('saves:1234', out)
-        out.seek(0)
-        with tarfile.open(fileobj=out, mode='r:gz') as archive:
-            names = sorted(m.name for m in archive)
-        self.assertEqual(names, sorted(self.files('saves:1234')))
-        with self.assertRaises(ValueError):
-            remote.pack('saves:../../etc', io.BytesIO())
-
-    def archive(self, members):
-        out = io.BytesIO()
-        with tarfile.open(fileobj=out, mode='w:gz') as tar:
-            for name, data in members:
-                info = tarfile.TarInfo(name)
-                info.size = len(data)
-                tar.addfile(info, io.BytesIO(data))
-        out.seek(0)
-        return out
-
-    def test_check_after_a_reset(self):
-        save = USER % 1234 + '/AppData/Roaming/Studio/Game/save1.dat'
-        ask = {'parts': [{'id': 'saves:1234', 'files': [save]},
-                         {'id': 'settings:steam', 'files': [STEAM + '/userdata/555/241100/remote/controller_config/1/a.vdf']},
-                         {'id': 'settings:system', 'files': ['.config/openvr/config/steamvr.vrsettings']},
-                         {'id': 'saves:../x', 'files': []}]}
-        states = lambda: [p['status'] for p in remote.check(ask)['parts']]  # noqa: E731
-        self.assertEqual(states(), ['not_installed', 'no_account', 'reference', 'unknown'])
-        manifest(self.home, 1234, 'Test Game')
-        (self.home / STEAM / 'userdata/555').mkdir(parents=True)
-        self.assertEqual(states()[:2], ['no_prefix', 'ok'])
-        (self.home / (USER % 1234)).mkdir(parents=True)
-        result = remote.check(ask)['parts'][0]
-        self.assertEqual((result['status'], result['new'], result['replace']), ('ok', 1, 0))
-        write(self.home, save, b'newer')
-        self.assertEqual(remote.check(ask)['parts'][0]['replace'], 1)
-
-    def test_restore_replaces_only_its_files_and_keeps_the_old_ones(self):
-        manifest(self.home, 1234, 'Test Game')
-        save = USER % 1234 + '/AppData/Roaming/Studio/Game/save1.dat'
-        write(self.home, save, b'played since')
-        other = write(self.home, USER % 1234 + '/AppData/Roaming/Studio/Game/other.dat', b'untouched')
-        bashrc = write(self.home, '.bashrc', b'# mine')
-        source = self.archive([(save, b'from backup'), (USER % 1234 + '/Documents/new.sav', b'new'),
-                               ('.bashrc', b'# replaced?')])
-        result = remote.restore('saves:1234', '20261023-120000', source)
-        self.assertEqual((result['written'], result['replaced']), (2, 1))
-        self.assertEqual(result['held'], {'reference': 1})
-        self.assertEqual((self.home / save).read_bytes(), b'from backup')
-        self.assertEqual(other.read_bytes(), b'untouched')
-        self.assertEqual(bashrc.read_bytes(), b'# mine')
-        kept = self.home / remote.PREVIOUS / '20261023-120000' / save
-        self.assertEqual(kept.read_bytes(), b'played since')
-        self.assertFalse([p for p in (self.home / save).parent.iterdir() if p.name.endswith('.part')])
-
-    def test_unsafe_archives_write_nothing(self):
-        manifest(self.home, 1234, 'Test Game')
-        (self.home / (USER % 1234)).mkdir(parents=True)
-        good = (USER % 1234 + '/Documents/a.sav', b'a')
-        for bad in ('../escape', '/etc/passwd', USER % 1234 + '/Documents/../../../../../../x',
-                    USER % 1234 + '/Documents/a.sav'):
-            with self.assertRaises(ValueError, msg=bad):
-                remote.restore('saves:1234', '20261023-120000', self.archive([good, (bad, b'evil')]))
-            self.assertFalse((self.home / good[0]).exists(), bad)
-        link = io.BytesIO()
-        with tarfile.open(fileobj=link, mode='w:gz') as tar:
-            info = tarfile.TarInfo(USER % 1234 + '/Documents/l')
-            info.type, info.linkname = tarfile.SYMTYPE, '/etc/passwd'
-            tar.addfile(info)
-        link.seek(0)
-        with self.assertRaises(ValueError):
-            remote.restore('saves:1234', '20261023-120000', link)
-        with self.assertRaises(ValueError):
-            remote.restore('saves:1234', '../stamp', self.archive([good]))
-
-    def test_restore_refuses_secrets_and_other_games(self):
-        manifest(self.home, 1234, 'Test Game')
-        (self.home / (USER % 1234)).mkdir(parents=True)
-        result = remote.restore('saves:1234', '20261023-120000', self.archive([
-            (USER % 1234 + '/AppData/Roaming/L/auth.token', b't'), (USER % 5678 + '/Documents/x.sav', b'x')]))
-        self.assertEqual(result['written'], 0)
-        self.assertEqual(result['held'], {'refused': 1, 'reference': 1})
-
-    def test_session_reads_the_mode(self):
-        conf = write(self.home, 'zz-steamos-autologin.conf', '[Autologin]\nSession=plasma-steamos-wayland-oneshot.desktop\n')
-        running = set()
-        with patch.object(remote, 'SDDM_CONFS', (str(conf),)), \
-                patch.object(remote, '_running', side_effect=lambda n, full=False: n in running), \
-                patch.object(remote.shutil, 'which', side_effect=lambda n: '/usr/bin/' + n if n == 'steamos-session-select' else None):
-            state = remote.session()
-            self.assertEqual((state['mode'], state['selector']), ('desktop', 'steamos-session-select'))
-            self.assertEqual(state['configured'], 'plasma-steamos-wayland-oneshot.desktop')
-            running.update({'gamescope', 'plasmashell'})  # the nested desktop panel
-            self.assertEqual(remote.session()['mode'], 'game')
-            running.clear()
-            running.add('gamescope-wl')  # gamescope's process name on the Frame, with no desktop panel open
-            self.assertEqual(remote.session()['mode'], 'game')
-            running.clear()
-            running.add('start-gamescope-session')
-            self.assertEqual(remote.session()['mode'], 'game')
-
-
-def fake_ssh(home, os_release):
-    """Runs the headset-side command locally, as the Frame's python3 would."""
-    def run(command, src=None, dst=None, timeout=None):
-        argv = shlex.split(command)
-        assert argv[:2] == ['python3', '-c'], argv
-        data = src if isinstance(src, bytes) else src.read() if src is not None else b''
-        env = dict(os.environ, FRAME_BACKUP_HOME=str(home), FRAME_BACKUP_OS_RELEASE=str(os_release))
-        r = subprocess.run([sys.executable, *argv[1:]], input=data, capture_output=True, env=env)
-        if r.returncode:
-            raise backup.BackupError(r.stderr.decode(errors='replace'))
-        if dst is not None:
-            dst.write(r.stdout)
-            return None
-        return r.stdout
-    return run
-
-
-class Local(unittest.TestCase):
-    def setUp(self):
-        self.tmp = tempfile.TemporaryDirectory()
-        self.addCleanup(self.tmp.cleanup)
-        base = Path(self.tmp.name)
-        self.home, self.store = base / 'frame', base / 'backups'
-        self.release = write(base, 'os-release', 'ID=steamos\nVERSION_ID=0.4.1\nBUILD_ID=20260925.6191901\n')
-        frame_home(self.home)
-        for p in (patch.dict(os.environ, FRAME_BACKUP_DIR=str(self.store)),
-                  patch.object(backup, '_ssh', side_effect=fake_ssh(self.home, self.release))):
-            p.start()
-            self.addCleanup(p.stop)
-
-    def android_backup(self, package, destination):
-        write(Path(destination).parent, Path(destination).name, b'android archive ' + package.encode())
-        return {'package': package, 'instance': android.instance_id(package), 'files': 3, 'bytes': 42,
-                'path': str(destination), 'sha256': backup._sha256(destination)}
-
-    def make(self):
-        apps = [{'package': 'org.example.open', 'label': 'Open app', 'running': True},
-                {'package': 'org.example.game', 'label': 'Game', 'running': False}]
-        with patch.object(android, 'list_apps', return_value=apps), \
-                patch.object(android, 'backup_data', side_effect=self.android_backup) as data, \
-                patch.object(backup.time, 'strftime', side_effect=lambda f: '2026-10-23-120000' if f == '%Y-%m-%d-%H%M%S'
-                             else '2026-10-23T12:00:00+0100'):
-            result = backup.backup(headset='My Frame')
-        data.assert_called_once()
-        return result
-
-    def test_backup_writes_a_manifest_with_checksums(self):
-        result = self.make()
-        folder = backup.backup_path('2026-10-23-120000')  # resolved: macOS's temp folder is a link
-        self.assertEqual(result['path'], str(folder))
-        self.assertEqual(sorted(p.name for p in self.store.iterdir()), ['2026-10-23-120000'])  # no .partial left
-        m = json.loads((folder / 'manifest.json').read_text())
-        self.assertEqual(m['headset'], {'name': 'My Frame', 'build': '20260925.6191901', 'version': '0.4.1'})
-        self.assertEqual([p['id'] for p in m['parts']],
-                         ['saves:1234', 'saves:linux', 'settings:steam', 'settings:system', 'android:org.example.game'])
-        for part in m['parts']:
-            self.assertEqual(backup._sha256(folder / part['archive']), part['sha256'])
-        saves = m['parts'][0]
-        self.assertEqual(saves['archive'], 'saves/saves-1234.tar.gz')
-        self.assertEqual(sum(f['bytes'] for f in saves['files']), saves['bytes'])
-        self.assertEqual(saves['files'][0]['sha256'], __import__('hashlib').sha256(b'save one').hexdigest())
-        self.assertEqual([s['id'] for s in m['skipped']], ['android:org.example.open'])
-        for part in m['parts'][:-1]:
-            with tarfile.open(str(folder / part['archive'])) as tar:
-                for member in tar:
-                    self.assertFalse(remote.is_secret(member.name), member.name)
-                    self.assertNotEqual(tar.extractfile(member).read(), b'SECRET', member.name)
-
-    def test_a_failed_backup_leaves_nothing_behind(self):
-        with patch.object(backup, 'inspect_archive', side_effect=backup.BackupError('cut off')), \
-                patch.object(android, 'list_apps', return_value=[]):
-            with self.assertRaises(backup.BackupError):
-                backup.backup(kinds=['saves'])
-        self.assertEqual(list(self.store.iterdir()), [])
-
-    def test_backup_names_cannot_leave_the_folder(self):
-        for name in ('../2026-10-23-120000', '2026-10-23-120000/..', '..', '/etc', 'C:\\x', '',
-                     '2026-10-23-120000/../../x', '2026-10-23-12000', None, 5):
-            with self.assertRaises(backup.BackupError, msg=repr(name)):
-                backup.backup_path(name)
-        self.assertEqual(backup.backup_path('2026-10-23-120000'), (self.store / '2026-10-23-120000').resolve())
-
-    def test_manifest_entries_cannot_point_outside_the_backup(self):
-        self.make()
-        path = self.store / '2026-10-23-120000' / 'manifest.json'
-        m = json.loads(path.read_text())
-        for archive in ('../../secret.tar.gz', '/etc/passwd', 'saves/saves-5678.tar.gz'):
-            m['parts'][0]['archive'] = archive
-            path.write_text(json.dumps(m))
-            with self.assertRaises(backup.BackupError, msg=archive):
-                backup.read_manifest('2026-10-23-120000')
-
-    def reset(self):
-        """A factory reset: the home folder is empty again."""
-        import shutil
-        shutil.rmtree(str(self.home))
-        self.home.mkdir()
-
-    def test_restore_after_a_reset_skips_what_is_not_back_yet(self):
-        self.make()
-        self.reset()
-        manifest(self.home, 1234, 'Test Game')
-        (self.home / (USER % 1234)).mkdir(parents=True)  # started once
-        with patch.object(android, 'list_apps', return_value=[]):
-            plan = {p['id']: p for p in backup.restore_plan('2026-10-23-120000')['parts']}
-            self.assertEqual(plan['saves:1234']['status'], 'ok')
-            self.assertEqual(plan['settings:steam']['status'], 'no_account')
-            self.assertEqual(plan['android:org.example.game']['status'], 'not_installed')
-            with self.assertRaises(backup.BackupError):
-                backup.restore('2026-10-23-120000', ['saves:1234'])  # not confirmed
-            self.assertFalse((self.home / (USER % 1234) / 'AppData').exists())
-            result = backup.restore('2026-10-23-120000', ['saves:1234', 'settings:steam', 'android:org.example.game'],
-                                    confirmed=True)
-        self.assertEqual([r['id'] for r in result['restored']], ['saves:1234'])
-        self.assertEqual({s['id'] for s in result['skipped']}, {'settings:steam', 'android:org.example.game'})
-        self.assertEqual((self.home / (USER % 1234) / 'AppData/Roaming/Studio/Game/save1.dat').read_bytes(), b'save one')
-
-    def test_android_data_goes_back_through_the_existing_helper(self):
-        self.make()
-        apps = [{'package': 'org.example.game', 'label': 'Game', 'running': False}]
-        with patch.object(android, 'list_apps', return_value=apps), \
-                patch.object(android, 'restore_data', return_value={'restored': True}) as restore:
-            result = backup.restore('2026-10-23-120000', ['android:org.example.game'], confirmed=True)
-        restore.assert_called_once_with('org.example.game', str(backup.backup_path('2026-10-23-120000') /
-                                                                 'android' / 'org.example.game.tar.gz'))
-        self.assertEqual(len(result['restored']), 1)
-        apps[0]['running'] = True
-        with patch.object(android, 'list_apps', return_value=apps), patch.object(android, 'restore_data') as restore:
-            result = backup.restore('2026-10-23-120000', ['android:org.example.game'], confirmed=True)
-        restore.assert_not_called()
-        self.assertEqual(result['skipped'][0]['reason'], 'Close the app first')
-
-    def test_a_damaged_archive_is_skipped(self):
-        self.make()
-        with open(str(self.store / '2026-10-23-120000/saves/saves-1234.tar.gz'), 'ab') as f:
-            f.write(b'tampered')
-        with patch.object(android, 'list_apps', return_value=[]):
-            result = backup.restore('2026-10-23-120000', ['saves:1234'], confirmed=True)
-        self.assertEqual(result['restored'], [])
-        self.assertIn('checksum', result['skipped'][0]['reason'])
-
-    def test_list_backups(self):
-        self.make()
-        (self.store / '.2026-10-23-130000.partial').mkdir()
-        (self.store / 'notes').mkdir()
-        listed = backup.list_backups()['backups']
-        self.assertEqual([b['name'] for b in listed], ['2026-10-23-120000'])
-        self.assertEqual(listed[0]['build'], '20260925.6191901')
-
-
-class Ssh(unittest.TestCase):
-    def test_bytes_go_as_input_and_files_as_stdin(self):
-        done = subprocess.CompletedProcess([], 0, b'{}', b'')
-        with patch.object(backup.frame_host, 'run_ssh', return_value=done) as run:
-            backup._ssh('true', src=b'{"parts": []}')
-            self.assertEqual(run.call_args.kwargs['input'], b'{"parts": []}')
-            self.assertNotIn('stdin', run.call_args.kwargs)
-            with tempfile.TemporaryFile() as f:
-                backup._ssh('true', src=f)
-                self.assertIs(run.call_args.kwargs['stdin'], f)
-            backup._ssh('true')
-            self.assertIs(run.call_args.kwargs['stdin'], subprocess.DEVNULL)
-            self.assertEqual(run.call_args.args[0][-1], 'true')
-        with patch.object(backup.frame_host, 'run_ssh',
-                          return_value=subprocess.CompletedProcess([], 1, b'', b'Permission denied')):
-            with self.assertRaisesRegex(backup.BackupError, 'Permission denied'):
-                backup._ssh('true')
-
-
-class GameMode(unittest.TestCase):
-    def test_command_is_only_ever_the_session_switch(self):
-        self.assertEqual(backup.session_command('steamos-session-select'), 'steamos-session-select gamescope')
-        self.assertEqual(backup.session_command('holo-session-select'), 'holo-session-select gamescope')
-        for bad in (None, '', 'rm -rf ~', '/tmp/steamos-session-select', 'steamos-session-select; reboot'):
-            with self.assertRaises(backup.BackupError):
-                backup.session_command(bad)
-
-    def test_switch_needs_confirmation_and_desktop_mode(self):
-        with patch.object(backup, '_ssh') as ssh:
-            with self.assertRaises(backup.BackupError):
-                backup.return_to_game_mode()
-            ssh.assert_not_called()
-        with patch.object(backup, 'session_status', return_value={'mode': 'game', 'selector': 'steamos-session-select'}), \
-                patch.object(backup, '_ssh') as ssh:
-            self.assertFalse(backup.return_to_game_mode(confirmed=True)['switched'])
-            ssh.assert_not_called()
-        with patch.object(backup, 'session_status', return_value={'mode': 'unknown', 'selector': 'steamos-session-select'}), \
-                patch.object(backup, '_ssh') as ssh:
-            with self.assertRaisesRegex(backup.BackupError, 'nothing was changed'):
-                backup.return_to_game_mode(confirmed=True)
-            ssh.assert_not_called()
-        with patch.object(backup, 'session_status', return_value={'mode': 'desktop', 'selector': 'steamos-session-select'}), \
-                patch.object(backup, '_ssh') as ssh:
-            self.assertTrue(backup.return_to_game_mode(confirmed=True)['switched'])
-            ssh.assert_called_once_with('steamos-session-select gamescope', timeout=60)
-            ssh.side_effect = backup.BackupError('the headset took too long to answer')  # the session restarted
-            self.assertTrue(backup.return_to_game_mode(confirmed=True)['switched'])
-            ssh.side_effect = backup.BackupError('Interactive authentication required')
-            with self.assertRaisesRegex(backup.BackupError, 'manual steps'):
-                backup.return_to_game_mode(confirmed=True)
-        with patch.object(backup, 'session_status', return_value={'mode': 'desktop', 'selector': None}), \
-                patch.object(backup, '_ssh') as ssh:
-            with self.assertRaises(backup.BackupError):
-                backup.return_to_game_mode(confirmed=True)
-            ssh.assert_not_called()
-
-
-class Endpoint(unittest.TestCase):
-    def test_guards_run_before_the_headset(self):
-        with patch.object(backup, '_ssh') as ssh, patch.object(server, 'start_job') as job:
-            for body in ({'action': 'plan', 'name': '../x'}, {'action': 'open', 'name': '..'},
-                         {'action': 'restore', 'name': '2026-10-23-120000', 'parts': ['saves:1234']},
-                         {'action': 'restore', 'name': '2026-10-23-120000', 'parts': ['saves:x'], 'confirm': True},
-                         {'action': 'gamemode'}, {'action': 'backup', 'kinds': ['ssh-keys']}, {'action': 'nope'}):
-                with self.assertRaises(server.Failure, msg=body) as caught:
-                    server.backup_action(body)
-                self.assertEqual(caught.exception.status, 400)
-            ssh.assert_not_called()
-            job.assert_not_called()
-            with patch.object(server, 'LOCAL', True):
-                with self.assertRaises(server.Failure):
-                    server.backup_action({'action': 'list'})
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -1,14 +0,0 @@
-"""Exercise the production preference bootstrap across separate web origins."""
-import shutil
-import subprocess
-import unittest
-from pathlib import Path
-
-
-@unittest.skipUnless(shutil.which('node'), 'Node exercises the shared page behavior')
-class ClientPreferences(unittest.TestCase):
-    def test_behavior(self):
-        root = Path(__file__).resolve().parents[1]
-        result = subprocess.run(['node', '--test', str(root / 'tests/client_preferences.cjs')],
-                                capture_output=True, text=True)
-        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
@@ -1,241 +0,0 @@
-"""The clipboard both ways: the headset's read script, the server's answers, and the
-writer for this computer's clipboard on each platform. No headset: SSH and every
-clipboard program are mocked, and the read script runs against stub pgrep and qdbus6."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import base64
-import os
-import shutil
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / "ui"))
-import frame_host  # noqa: E402
-import server  # noqa: E402
-
-TEXT = "héllo, 世界 🎧\nsecond line\n\n"  # accents, CJK, an emoji outside the BMP, trailing newlines
-
-
-def b64(text):
-    return base64.b64encode(text.encode()).decode()
-
-
-class ReadCommand(unittest.TestCase):
-    def test_reads_klipper_on_the_desktop_bus(self):
-        self.assertIn("org.kde.klipper.klipper.getClipboardContents", server.COPY)
-        self.assertIn("DBUS_SESSION_BUS_ADDRESS=$bus qdbus6 org.kde.klipper /klipper", server.COPY)
-        self.assertIn(server.DESKTOP_CLOSED, server.COPY)
-        self.assertIn(server.CLIPBOARD_TOO_BIG, server.COPY)
-        self.assertIn(f"-gt {server.CLIPBOARD_LIMIT + 1} ]", server.COPY)  # the limit, plus qdbus6's newline
-        self.assertIn("base64 -w 0", server.COPY)
-
-    def test_command_carries_the_script_intact(self):
-        encoded = server.COPY_CMD.split("echo ", 1)[1].split(" |", 1)[0]
-        self.assertEqual(base64.b64decode(encoded).decode(), server.COPY)
-        self.assertNotIn("'", server.COPY_CMD)
-
-    def test_send_still_uses_the_same_bus(self):
-        self.assertIn(server.DESKTOP_BUS, server.PASTE)
-        self.assertIn(server.DESKTOP_BUS, server.COPY)
-        self.assertIn("setClipboardContents", server.PASTE)
-
-
-@unittest.skipUnless(sys.platform.startswith("linux") and shutil.which("bash") and shutil.which("base64"),
-                     "the script reads /proc, as on the Frame")
-class ReadScript(unittest.TestCase):
-    """server.COPY for real, with plasmashell's pid and Klipper stubbed."""
-
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp(prefix="frame-clip-"))
-        self.addCleanup(shutil.rmtree, self.dir, True)
-        self.clip = self.dir / "clip"
-        # A process whose environment holds the desktop's bus address, standing in for plasmashell.
-        self.plasma = subprocess.Popen(["sleep", "60"], env={**os.environ, "DBUS_SESSION_BUS_ADDRESS": "unix:path=/fake"})
-        self.addCleanup(self.plasma.wait)
-        self.addCleanup(self.plasma.kill)
-        (self.dir / "pgrep").write_text(f'#!/bin/sh\n[ -e "{self.dir}/closed" ] || echo {self.plasma.pid}\n')
-        (self.dir / "qdbus6").write_text(
-            '#!/bin/sh\n[ "$DBUS_SESSION_BUS_ADDRESS" = unix:path=/fake ] || exit 1\n'
-            f'[ "$3" = org.kde.klipper.klipper.getClipboardContents ] || exit 1\ncat "{self.clip}"; echo\n')
-        for name in ("pgrep", "qdbus6"):
-            (self.dir / name).chmod(0o755)
-
-    def run_script(self):
-        def local_ssh(remote, **kw):
-            r = subprocess.run(["bash", "-c", server.COPY], capture_output=True, text=True,
-                               env={**os.environ, "PATH": f"{self.dir}:{os.environ['PATH']}"})
-            if r.returncode:
-                raise server.Failure(r.stderr.strip())
-            return r.stdout
-        with mock.patch.object(server, "ssh", local_ssh):
-            return server.headset_clipboard()
-
-    def test_unicode_and_newlines_come_back_exactly(self):
-        self.clip.write_bytes(TEXT.encode())
-        self.assertEqual(self.run_script(), TEXT)
-
-    def test_empty(self):
-        self.clip.write_bytes(b"")
-        with self.assertRaises(server.Failure) as cm:
-            self.run_script()
-        self.assertEqual(cm.exception.status, 400)
-        self.assertIn("empty", str(cm.exception))
-
-    def test_too_big_is_refused_on_the_headset(self):
-        self.clip.write_bytes(b"x" * (server.CLIPBOARD_LIMIT + 1))
-        with self.assertRaises(server.Failure) as cm:
-            self.run_script()
-        self.assertEqual(cm.exception.status, 413)
-        self.assertIn("1 MB", str(cm.exception))
-        self.clip.write_bytes(b"x" * server.CLIPBOARD_LIMIT)
-        self.assertEqual(len(self.run_script()), server.CLIPBOARD_LIMIT)
-
-    def test_desktop_closed(self):
-        (self.dir / "closed").touch()
-        with self.assertRaises(server.Failure) as cm:
-            self.run_script()
-        self.assertEqual(cm.exception.status, 409)
-
-
-class HeadsetClipboard(unittest.TestCase):
-    def read(self, out=None, error=None):
-        def fake_ssh(remote, **kw):
-            self.assertEqual(remote, server.COPY_CMD)
-            self.assertNotIn("stdin", kw)
-            if error:
-                raise server.Failure(error)
-            return out
-        with mock.patch.object(server, "ssh", fake_ssh):
-            return server.headset_clipboard()
-
-    def test_drops_only_qdbus6s_newline(self):
-        self.assertEqual(self.read(b64(TEXT + "\n") + "\n"), TEXT)
-        self.assertEqual(self.read(b64("one line\n")), "one line")
-
-    def test_empty_and_images_say_so(self):
-        for out, words in ((b64("\n"), "empty"), ("", "empty"), (b64("▨ 640x480 32bpp\n"), "image")):
-            with self.assertRaises(server.Failure) as cm:
-                self.read(out)
-            self.assertEqual(cm.exception.status, 400)
-            self.assertIn(words, str(cm.exception))
-
-    def test_unreadable_output_is_a_fault(self):
-        for out in ("not base64!", base64.b64encode(b"\xff\xfe\n").decode()):
-            with self.assertRaises(server.Failure) as cm:
-                self.read(out)
-            self.assertEqual(cm.exception.status, 502)
-
-    def test_failures(self):
-        for error, status in (("The headset's desktop isn't open (plasmashell is not running).", 409),
-                              ("The headset's clipboard holds too much to copy (over 1 MB).", 413),
-                              ("Klipper call failed (bus: none)", 502)):
-            with self.assertRaises(server.Failure) as cm:
-                self.read(error=error)
-            self.assertEqual(cm.exception.status, status, error)
-
-
-class ClipboardRequests(unittest.TestCase):
-    def test_read_returns_the_text_for_the_page(self):
-        with mock.patch.object(server, "headset_clipboard", return_value=TEXT):
-            out = server.clipboard({"read": True})
-        self.assertEqual(out["text"], TEXT)
-        self.assertNotIn(TEXT, out["message"])
-
-    def test_to_computer_sets_this_computers_clipboard(self):
-        with mock.patch.object(server, "headset_clipboard", return_value=TEXT), \
-                mock.patch.object(frame_host, "set_clipboard_text") as put:
-            out = server.clipboard({"toComputer": True})
-        put.assert_called_once_with(TEXT)
-        self.assertNotIn("text", out)
-        self.assertEqual(out["message"], f"Copied {len(TEXT)} characters from the headset to this computer's clipboard")
-
-    def test_to_computer_without_a_clipboard_program(self):
-        with mock.patch.object(server, "headset_clipboard", return_value=TEXT), \
-                mock.patch.object(frame_host, "set_clipboard_text", side_effect=frame_host.HostError("Can't set the clipboard")):
-            with self.assertRaises(server.Failure) as cm:
-                server.clipboard({"toComputer": True})
-        self.assertEqual(cm.exception.status, 500)
-
-    def test_to_computer_refused_when_the_server_runs_on_the_headset(self):
-        with mock.patch.object(server, "LOCAL", True), mock.patch.object(server, "headset_clipboard") as read:
-            with self.assertRaises(server.Failure) as cm:
-                server.clipboard({"toComputer": True})
-        self.assertEqual(cm.exception.status, 400)
-        read.assert_not_called()
-
-    def test_flags_must_be_true(self):
-        # Anything else is a send, and an empty one is refused before SSH.
-        with mock.patch.object(server, "ssh") as ssh:
-            for body in ({"read": "yes"}, {"toComputer": 1}):
-                with self.assertRaises(server.Failure):
-                    server.clipboard(body)
-        ssh.assert_not_called()
-
-
-class SetClipboardText(unittest.TestCase):
-    def put(self, platform, have, text=TEXT, fail=()):
-        runs = []
-
-        def run(cmd, **kw):
-            runs.append((cmd, kw))
-            if cmd[0] in fail:
-                if fail[cmd[0]] == "timeout":
-                    raise subprocess.TimeoutExpired(cmd, 10)
-                return subprocess.CompletedProcess(cmd, 1)
-            return subprocess.CompletedProcess(cmd, 0)
-        flags = {"MAC": platform == "mac", "WINDOWS": platform == "windows", "LINUX": platform == "linux"}
-        with mock.patch.multiple(frame_host, **flags), \
-                mock.patch.object(frame_host.shutil, "which", lambda name: f"/bin/{name}" if name in have else None), \
-                mock.patch.object(frame_host.subprocess, "run", run):
-            frame_host.set_clipboard_text(text)
-        for _, kw in runs:
-            # Nothing captured or logged, and no pipes left for a clipboard daemon to hold open.
-            self.assertEqual((kw["stdout"], kw["stderr"]), (subprocess.DEVNULL, subprocess.DEVNULL))
-        return runs
-
-    def test_mac_pbcopy_in_utf8(self):
-        [(cmd, kw)] = self.put("mac", {"pbcopy"})
-        self.assertEqual(cmd, ["pbcopy"])
-        self.assertEqual(kw["input"], TEXT.encode("utf-8"))
-        self.assertEqual(kw["env"]["LC_CTYPE"], "UTF-8")
-
-    def test_windows_powershell_gets_base64_utf8(self):
-        [(cmd, kw)] = self.put("windows", {"powershell.exe", "clip.exe"})
-        self.assertEqual(cmd[0], "powershell.exe")
-        self.assertIn("Set-Clipboard", cmd[-1])
-        self.assertIn("FromBase64String", cmd[-1])
-        self.assertEqual(base64.b64decode(kw["input"]).decode("utf-8"), TEXT)
-
-    def test_windows_clip_fallback_gets_utf16_with_a_bom(self):
-        runs = self.put("windows", {"powershell.exe", "clip.exe"}, fail={"powershell.exe": 1})
-        self.assertEqual([c[0] for c, _ in runs], ["powershell.exe", "clip.exe"])
-        data = runs[1][1]["input"]
-        self.assertEqual(data[:2], b"\xff\xfe")
-        self.assertEqual(data[2:].decode("utf-16-le"), TEXT)
-
-    def test_linux_tries_wayland_then_x11(self):
-        [(cmd, kw)] = self.put("linux", {"wl-copy", "xclip", "xsel"})
-        self.assertEqual(cmd, ["wl-copy"])
-        self.assertEqual(kw["input"], TEXT.encode())
-        runs = self.put("linux", {"wl-copy", "xclip", "xsel"}, fail={"wl-copy": 1, "xclip": "timeout"})
-        self.assertEqual([c for c, _ in runs], [["wl-copy"], ["xclip", "-selection", "clipboard", "-in"],
-                                                ["xsel", "--clipboard", "--input"]])
-        [(cmd, _)] = self.put("linux", {"xsel"})
-        self.assertEqual(cmd[0], "xsel")
-
-    def test_nothing_to_set_it_with(self):
-        with self.assertRaises(frame_host.HostError) as cm:
-            self.put("linux", set())
-        self.assertIn("wl-clipboard", str(cm.exception))
-        with self.assertRaises(frame_host.HostError):
-            self.put("linux", {"wl-copy"}, fail={"wl-copy": 1})
-        with self.assertRaises(frame_host.HostError):
-            self.put("mac", set())
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,591 +0,0 @@
-"""Recordings of the headset view and Steam clip exports (ui/frame_clips.py), without a headset.
-
-Steam's recordings are fixture trees in the layout frame_clips.py describes. The
-recording's shell runs for real under bash with a stand-in ffmpeg, so Stop, the time
-limit and the clean-up are the real script's behaviour. With ffmpeg installed here, a
-65-second DASH recording is made in Steam's file naming and exported for real.
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import json
-import os
-import shlex
-import shutil
-import subprocess
-import sys
-import tempfile
-import threading
-import time
-import unittest
-from pathlib import Path
-from unittest import mock
-
-sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "ui"))
-import frame_clips as clips  # noqa: E402
-
-POSIX = os.name != "nt" and shutil.which("bash")
-
-
-def write(path, data=b"x"):
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_bytes(data)
-    return path
-
-
-def session(folder, streams=(0, 1), chunks=3, mpd=None, first=1, pad=5):
-    """A session folder as Steam writes it: init + numbered chunks per stream."""
-    for n in streams:
-        write(folder / f"init-stream{n}.m4s", f"init{n};".encode())
-        for c in range(first, first + chunks):
-            write(folder / f"chunk-stream{n}-{c:0{pad}d}.m4s", f"s{n}c{c};".encode())
-    if mpd is not None:
-        write(folder / "session.mpd", mpd.encode())
-    return folder
-
-
-class Ids(unittest.TestCase):
-    def test_good_ids(self):
-        for cid in ("123/video/bg_620_20261020_201950",
-                    "123/clips/clip_620_20261020_202134/video/bg_620_20261020_201950",
-                    "9/clips/a/b/c/d"):
-            self.assertEqual(clips.parse_id(cid)[0], cid.split("/")[0])
-        self.assertEqual(clips.export_name("123/clips/clip_620_20261020_202134/video/bg_620_1"),
-                         "clip_620_20261020_202134.mp4")
-
-    def test_no_traversal_or_shell_from_ids(self):
-        for cid in ("", None, 5, "123", "123/video", "123/other/bg", "abc/video/bg", "/123/video/bg",
-                    "123/video/..", "123/video/.", "123/video/bg/../../../../.ssh", "123/video/.hidden",
-                    "123/video/bg;rm -rf ~", "123/video/bg$(id)", "123/video/bg name", "123/video/bg\n",
-                    "123/video/%2e%2e", "123\\video\\bg", "123/video//bg", "123/clips/a/b/c/d/e",
-                    "123/video/" + "a" * 101, "1234567890123/video/bg"):
-            with self.subTest(cid=cid), self.assertRaises(ValueError):
-                clips.parse_id(cid)
-            with self.subTest(cid=cid), self.assertRaises(ValueError):
-                clips.export_name(cid)
-
-    def test_export_paths_checked_before_delete(self):
-        good = f"{clips.WORK}/export-0123456789abcdef/clip_620.mp4"
-        self.assertEqual(clips.remove_command(good), f'rm -rf "$HOME"/{clips.WORK}/export-0123456789abcdef')
-        for bad in (None, "", "/etc/passwd", f"{clips.WORK}/export-0123456789abcdef/../../x.mp4",
-                    f"{clips.WORK}/export-xyz/clip.mp4", f"{clips.WORK}/../export-0123456789abcdef/a.mp4",
-                    f"{clips.WORK}/export-0123456789abcdef/a.mp4; rm -rf ~", ".ssh/export-0123456789abcdef/a.mp4"):
-            with self.subTest(bad=bad), self.assertRaises(ValueError):
-                clips.remove_command(bad)
-
-    def test_recording_names_checked(self):
-        for fn in (clips.finish_command, clips.cleanup_command, lambda n: clips.record_command(n, True)):
-            for bad in ("rec-1", "rec-20261020-201950; rm -rf ~", "../rec-20261020-201950", "*"):
-                with self.subTest(bad=bad), self.assertRaises(ValueError):
-                    fn(bad)
-
-
-class Sessions(unittest.TestCase):
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        self.addCleanup(shutil.rmtree, self.dir, ignore_errors=True)
-
-    def test_chunks_in_number_order_whatever_the_padding(self):
-        s = self.dir / "s"
-        write(s / "init-stream0.m4s")
-        for c in (10, 2, 1, 100, 9):
-            write(s / f"chunk-stream0-{c}.m4s")
-        write(s / "chunk-stream0-00003.m4s")
-        got = clips.read_session(s)
-        self.assertEqual([os.path.basename(p) for p in got[0]],
-                         ["init-stream0.m4s", "chunk-stream0-1.m4s", "chunk-stream0-2.m4s", "chunk-stream0-00003.m4s",
-                          "chunk-stream0-9.m4s", "chunk-stream0-10.m4s", "chunk-stream0-100.m4s"])
-        self.assertEqual(clips.chunk_gaps(got[0]), 100 - 6)
-
-    def test_unplayable_streams_and_strangers_left_out(self):
-        s = self.dir / "s"
-        session(s, streams=(0,), chunks=2)
-        write(s / "init-stream1.m4s")                 # no chunks
-        write(s / "chunk-stream2-00001.m4s")          # no init
-        write(s / "chunk-stream0-00001.m4s.part")     # not a chunk
-        write(s / "thumbnail.jpg")
-        (s / "chunk-stream0-00009.m4s").mkdir()       # a folder, not a file
-        if POSIX:
-            os.symlink("/etc/passwd", s / "chunk-stream0-00005.m4s")  # links aren't followed
-        got = clips.read_session(s)
-        self.assertEqual(list(got), [0])
-        self.assertEqual(len(got[0]), 3)
-
-    def test_manifest_duration(self):
-        for text, want in (('mediaPresentationDuration="PT1M23.4S"', 83.4), ('mediaPresentationDuration="PT2H"', 7200),
-                           ('mediaPresentationDuration="PT0H3M0.000S"', 180), ('mediaPresentationDuration="P1DT1S"', 86401),
-                           ('mediaPresentationDuration="PT"', None), ('nothing here', None), (None, None)):
-            self.assertEqual(clips.mpd_duration(text), want, text)
-
-    def test_listing_a_fixture_tree(self):
-        ud = self.dir / "userdata"
-        gr = ud / "123" / "gamerecordings"
-        session(gr / "clips" / "clip_620_20261020_202134" / "video" / "bg_620_20261020_201950", chunks=40,
-                mpd='<MPD mediaPresentationDuration="PT1M20.0S">')
-        write(gr / "clips" / "clip_620_20261020_202134" / "thumbnail.jpg")
-        session(gr / "video" / "bg_1172470_20261021_090000", streams=(0,), chunks=2)
-        session(gr / "video" / "odd-name", chunks=1)                   # no stamp: time from the files
-        (gr / "video" / "empty").mkdir()
-        session(gr / "video" / ".hidden", chunks=1)                    # not a name an id can carry
-        session(gr / "timelines" / "x", chunks=1)                      # not clips/ or video/
-        session(ud / "notanaccount" / "gamerecordings" / "video" / "bg_1_20260101_000000", chunks=1)
-        session(gr / "video" / "a" / "b" / "c" / "d" / "e", chunks=1)  # deeper than ids go
-        if POSIX:
-            os.symlink(gr, gr / "video" / "loop")                      # links aren't followed
-        for f in (gr / "video" / "odd-name").iterdir():
-            os.utime(f, (1e9, 1e9))  # 2001: older than the others
-        got = clips.list_recordings(ud)
-        self.assertEqual([c["id"] for c in got], ["123/video/bg_1172470_20261021_090000",
-                                                  "123/clips/clip_620_20261020_202134/video/bg_620_20261020_201950",
-                                                  "123/video/odd-name"])  # newest first
-        self.assertEqual(got[-1]["time"], 1e9)
-        by = {c["id"]: c for c in got}
-        clip = by["123/clips/clip_620_20261020_202134/video/bg_620_20261020_201950"]
-        self.assertEqual((clip["kind"], clip["appid"], clip["streams"], clip["chunks"], clip["gaps"], clip["duration"]),
-                         ("clip", "620", 2, 80, 0, 80.0))
-        self.assertEqual(clip["file"], "clip_620_20261020_202134.mp4")
-        self.assertEqual(clip["time"], time.mktime((2026, 10, 20, 20, 21, 34, 0, 0, -1)))
-        self.assertEqual(clip["size"], sum(f.stat().st_size for f in
-                                           (gr / "clips" / "clip_620_20261020_202134" / "video" / "bg_620_20261020_201950").iterdir()
-                                           if f.suffix == ".m4s"))
-        bg = by["123/video/bg_1172470_20261021_090000"]
-        self.assertEqual((bg["kind"], bg["appid"], bg["streams"], bg["duration"]), ("background", "1172470", 1, None))
-        self.assertIsNone(by["123/video/odd-name"]["appid"])
-        # How long since Steam last wrote to it: auto-sync waits for a clip still being recorded.
-        self.assertLess(clip["idle"], 60)
-        self.assertGreater(by["123/video/odd-name"]["idle"], 10**8)
-        self.assertEqual(clips.list_recordings(self.dir / "missing"), [])
-
-    def test_listing_marks_what_is_already_here(self):
-        here = self.dir / "here"
-        write(here / "clip_620_20261020_202134.mp4")
-        frame = lambda args, timeout: {"clips": [{"id": "1/clips/clip_620_20261020_202134/video/bg"},
-                                                 {"id": "1/video/bg_620_20261020_201950"}]}
-        got = clips.list_clips(frame, folder=here)
-        self.assertEqual([c["saved"] for c in got["clips"]], [True, False])
-        self.assertEqual(got["folder"], str(here))
-
-
-class Export(unittest.TestCase):
-    """The Frame's half of an export, against a fixture tree, with ffmpeg stood in."""
-
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        self.addCleanup(shutil.rmtree, self.dir, ignore_errors=True)
-        self.ud = self.dir / "home" / clips.STEAM_USERDATA
-        self.home = self.dir / "home"
-        self.cid = "123/clips/clip_620_20261020_202134/video/bg_620_20261020_201950"
-        session(self.ud / "123" / "gamerecordings" / "clips" / "clip_620_20261020_202134" / "video" /
-                "bg_620_20261020_201950", chunks=12)
-
-    def fake_ffmpeg(self, seen, rc=0):
-        def run(cmd, **kw):
-            ins = [cmd[i + 1] for i, a in enumerate(cmd) if a == "-i"]
-            seen.append({"cmd": cmd, "inputs": {Path(i).name: Path(i).read_bytes() for i in ins}})
-            if rc == 0:
-                Path(cmd[-1]).write_bytes(b"mp4")
-            return subprocess.CompletedProcess(cmd, rc, "", "Invalid data found" if rc else "")
-        return run
-
-    def test_streams_stitched_in_order_and_copied_not_reencoded(self):
-        seen = []
-        with mock.patch.object(clips.subprocess, "run", self.fake_ffmpeg(seen)):
-            got = clips.export(self.ud, self.cid, home=self.home)
-        self.assertRegex(got["path"], clips.EXPORT_PATH)
-        self.assertTrue(got["path"].endswith("/clip_620_20261020_202134.mp4"))
-        self.assertEqual(got["size"], 3)
-        cmd = seen[0]["cmd"]
-        self.assertEqual(cmd[cmd.index("-c") + 1], "copy")
-        self.assertEqual([cmd[i + 1] for i, a in enumerate(cmd) if a == "-map"], ["0", "1"])
-        for n in (0, 1):
-            self.assertEqual(seen[0]["inputs"][f"stream{n}.mp4"],
-                             f"init{n};".encode() + b"".join(f"s{n}c{c};".encode() for c in range(1, 13)))
-        out = self.home / got["path"]
-        self.assertEqual(sorted(p.name for p in out.parent.iterdir()), [out.name])  # stream files gone
-
-    def test_failed_join_leaves_nothing_behind(self):
-        with mock.patch.object(clips.subprocess, "run", self.fake_ffmpeg([], rc=1)):
-            with self.assertRaisesRegex(clips.ClipError, "Invalid data"):
-                clips.export(self.ud, self.cid, home=self.home)
-        self.assertEqual(list((self.home / clips.WORK).glob("export-*")), [])
-
-    def test_bad_or_missing_ids(self):
-        with self.assertRaises(ValueError):
-            clips.export(self.ud, "123/video/../../../../etc", home=self.home)
-        with self.assertRaises(ClipErrorOrOSError):
-            clips.export(self.ud, "123/video/nothing_here", home=self.home)
-
-    @unittest.skipUnless(POSIX, "symlinks")
-    def test_a_linked_account_cannot_reach_outside_userdata(self):
-        outside = session(self.dir / "elsewhere" / "gamerecordings" / "video" / "bg_1_20260101_000000", chunks=1)
-        os.symlink(self.dir / "elsewhere", self.ud / "456")
-        self.assertIsNotNone(outside)
-        with self.assertRaises(ValueError):
-            clips.export(self.ud, "456/video/bg_1_20260101_000000", home=self.home)
-
-    def test_no_space_on_the_frame(self):
-        full = mock.Mock(free=10)
-        with mock.patch.object(clips.shutil, "disk_usage", return_value=full):
-            with self.assertRaisesRegex(clips.ClipError, "Not enough free space on the Frame"):
-                clips.export(self.ud, self.cid, home=self.home)
-
-    def test_old_exports_swept(self):
-        work = self.home / clips.WORK
-        old, new = work / "export-aaaaaaaaaaaaaaaa", work / "export-bbbbbbbbbbbbbbbb"
-        write(old / "x.mp4"), write(new / "y.mp4")
-        os.utime(old, (time.time() - 7 * 3600,) * 2)
-        with mock.patch.object(clips.subprocess, "run", self.fake_ffmpeg([])):
-            clips.export(self.ud, self.cid, home=self.home)
-        self.assertFalse(old.exists())
-        self.assertTrue(new.exists())
-
-    def test_main_prints_json(self):
-        with mock.patch.object(clips.Path, "home", return_value=self.home), \
-                mock.patch("sys.stdout", new_callable=lambda: __import__("io").StringIO()) as out:
-            self.assertEqual(clips.main(["list"]), 0)
-            self.assertEqual(json.loads(out.getvalue())["clips"][0]["id"], self.cid)
-        with mock.patch("sys.stdout", new_callable=lambda: __import__("io").StringIO()) as out:
-            self.assertEqual(clips.main(["export", "../../x"]), 1)
-            self.assertEqual(json.loads(out.getvalue()), {"error": "bad clip id"})
-
-
-ClipErrorOrOSError = (clips.ClipError, OSError)
-
-
-class ComputerSide(unittest.TestCase):
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        self.addCleanup(shutil.rmtree, self.dir, ignore_errors=True)
-
-    def test_export_copies_then_deletes_on_the_frame(self):
-        path = f"{clips.WORK}/export-0123456789abcdef/clip_620.mp4"
-        calls = []
-        frame = lambda args, timeout: calls.append(("frame", args)) or {"path": path, "size": 3}
-        run = lambda cmd, timeout: calls.append(("run", cmd))
-        fetch = lambda remote, local: calls.append(("fetch", remote)) or Path(local).write_bytes(b"mp4")
-        got = clips.export_clip("1/clips/clip_620/video/bg", frame, run, fetch, folder=self.dir)
-        self.assertEqual(got["message"], "Saved clip_620.mp4 to ~/Videos/SteamFrame")
-        self.assertEqual((self.dir / "clip_620.mp4").read_bytes(), b"mp4")
-        self.assertEqual([c[0] for c in calls], ["frame", "fetch", "run"])
-        self.assertEqual(calls[2][1], clips.remove_command(path))
-        self.assertEqual([p.name for p in self.dir.iterdir()], ["clip_620.mp4"])
-
-    def test_failed_copy_leaves_no_partial_file_and_still_cleans_up(self):
-        path = f"{clips.WORK}/export-0123456789abcdef/clip_620.mp4"
-        ran = []
-
-        def fetch(remote, local):
-            Path(local).write_bytes(b"half")
-            raise RuntimeError("connection lost")
-        with self.assertRaisesRegex(RuntimeError, "connection lost"):
-            clips.export_clip("1/clips/clip_620/video/bg", lambda a, t: {"path": path, "size": 4},
-                              lambda cmd, timeout: ran.append(cmd), fetch, folder=self.dir)
-        self.assertEqual(list(self.dir.iterdir()), [])
-        self.assertEqual(ran, [clips.remove_command(path)])
-
-    def test_bad_id_never_reaches_the_frame(self):
-        never = mock.Mock(side_effect=AssertionError("reached the Frame"))
-        with self.assertRaises(ValueError):
-            clips.export_clip("1/video/../../.ssh", never, never, never, folder=self.dir)
-
-    def test_unexpected_path_from_the_frame_refused(self):
-        never = mock.Mock(side_effect=AssertionError("deleted or copied"))
-        with self.assertRaises(ValueError):
-            clips.export_clip("1/video/bg", lambda a, t: {"path": ".ssh/id_ed25519", "size": 1}, never, never,
-                              folder=self.dir)
-
-
-class Commands(unittest.TestCase):
-    def test_record_command_with_and_without_sound(self):
-        with_sound = shlex.split(clips.record_command("rec-20261020-201950", True))
-        self.assertEqual(with_sound[:2], ["bash", "-c"])
-        script = with_sound[2]
-        self.assertIn(f"-f v4l2 -video_size 1920x1080 -i {clips.STREAM_DEVICE}", script)
-        self.assertIn("-c:v libx264", script)
-        self.assertNotIn("v4l2m2m", script)  # the hardware encoder crashes ffmpeg
-        self.assertIn(f"-f pulse -i {clips.AUDIO_SOURCE}", script)
-        self.assertIn("-map 1:a:0", script)
-        self.assertIn("-c:a aac", script)
-        self.assertIn(f"-t {clips.MAX_SECONDS} ", script)
-        self.assertIn('"$d/rec-20261020-201950.mkv"', script)
-        self.assertEqual(script.count("-use_wallclock_as_timestamps 1"), 2)
-        quiet = shlex.split(clips.record_command("rec-20261020-201950", False))[2]
-        self.assertNotIn("pulse", quiet)
-        self.assertNotIn("-c:a", quiet)
-        self.assertEqual(quiet.count("-use_wallclock_as_timestamps 1"), 1)
-        with self.assertRaises(ValueError):
-            clips.record_command("rec-20261020-201950", True, max_seconds=clips.MAX_SECONDS + 1)
-
-    def test_probe_checks_device_space_and_sound(self):
-        probe = clips.probe_command()
-        self.assertIn(f"[ -e {clips.STREAM_DEVICE} ]", probe)
-        self.assertIn(f"-ge {clips.NEED_KB} ]", probe)
-        self.assertIn(f"timeout 5 ffmpeg -hide_banner -loglevel error -nostdin -f pulse -i {clips.AUDIO_SOURCE}", probe)
-        self.assertIn("echo audio=1; else echo audio=0", probe)
-        self.assertIn(f'd="$HOME/{clips.WORK}"', probe)
-
-    def test_finish_remuxes_without_reencoding(self):
-        cmd = clips.finish_command("rec-20261020-201950")
-        self.assertIn("-i rec-20261020-201950.mkv -map 0 -c copy -movflags +faststart rec-20261020-201950.mp4", cmd)
-        self.assertNotIn("libx264", cmd)
-        self.assertEqual(clips.cleanup_command("rec-20261020-201950"), f'rm -f "$HOME/{clips.WORK}/rec-20261020-201950".*')
-
-    def test_stitch_command(self):
-        self.assertEqual(clips.stitch_command(["a.mp4", "b.mp4"], "out.mp4"),
-                         ["ffmpeg", "-hide_banner", "-loglevel", "error", "-nostdin", "-y", "-i", "a.mp4", "-i", "b.mp4",
-                          "-map", "0", "-map", "1", "-c", "copy", "-movflags", "+faststart", "out.mp4"])
-
-
-# A stand-in for ffmpeg on the Frame: records how it was run, writes its output file,
-# and finishes the file when q arrives on stdin. Like SteamOS's ffmpeg n7.0 (seen on a
-# Frame), it catches SIGTERM and SIGINT and carries on, exiting only after more than
-# three. FAKE_FFMPEG_RUN makes the recording end by itself after that many seconds (the
-# time limit); FAKE_FFMPEG_DEAF makes it ignore q too, so only SIGKILL ends it.
-FAKE_FFMPEG = r'''#!/usr/bin/env python3
-import json, os, signal, sys, time
-home = os.environ["HOME"]
-with open(os.path.join(home, "ffmpeg-calls.jsonl"), "a") as f:
-    f.write(json.dumps(sys.argv[1:]) + "\n")
-out = sys.argv[-1]
-if "-c" in sys.argv and sys.argv[sys.argv.index("-c") + 1] == "copy":   # the remux after a recording
-    src = sys.argv[sys.argv.index("-i") + 1]
-    open(out, "wb").write(open(src, "rb").read() + b"+mp4")
-    sys.exit(0)
-import threading
-stop, signals = [], []
-def caught(*a):
-    signals.append(1)
-    if len(signals) > 3:
-        os._exit(255)  # "Received > 3 system signals, hard exiting"
-signal.signal(signal.SIGTERM, caught)
-signal.signal(signal.SIGINT, caught)
-def keys():
-    while True:
-        ch = os.read(0, 1)
-        if not ch:
-            return
-        if ch == b"q" and not os.environ.get("FAKE_FFMPEG_DEAF"):
-            stop.append("q")
-threading.Thread(target=keys, daemon=True).start()
-f = open(out, "wb")
-f.write(b"v"); f.flush()
-with open(os.path.join(home, "ffmpeg.pid.tmp"), "w") as p:
-    p.write(str(os.getpid()))
-os.replace(os.path.join(home, "ffmpeg.pid.tmp"), os.path.join(home, "ffmpeg.pid"))
-end = time.time() + float(os.environ.get("FAKE_FFMPEG_RUN", "60"))
-while not stop and time.time() < end:
-    f.write(b"v"); f.flush(); time.sleep(0.05)
-f.close()
-open(os.path.join(home, "ffmpeg-ended"), "w").write(stop[0] if stop else "limit")
-sys.exit(255 if stop else 0)
-'''
-
-
-@unittest.skipUnless(POSIX, "the recording's shell is bash on the Frame")
-class Recording(unittest.TestCase):
-    """The Recorder with the real record/finish/cleanup shell, run locally under bash."""
-
-    def setUp(self):
-        self.dir = Path(tempfile.mkdtemp())
-        self.addCleanup(shutil.rmtree, self.dir, ignore_errors=True)
-        self.frame = self.dir / "frame"           # the Frame's home
-        (self.frame / clips.WORK).mkdir(parents=True)
-        bin_dir = self.dir / "bin"
-        write(bin_dir / "ffmpeg", FAKE_FFMPEG.encode()).chmod(0o755)
-        self.env = {**os.environ, "HOME": str(self.frame), "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}"}
-        self.here = self.dir / "Videos"
-        self.channels, self.released, self.ran = [], [], []
-        self.audio = "audio=1"
-
-    def open_channel(self, command, stderr):
-        proc = subprocess.Popen(shlex.split(command), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=stderr,
-                                env=self.env)
-        self.channels.append(proc)
-        self.addCleanup(lambda: proc.poll() is None and proc.kill())
-        return proc
-
-    def run_cmd(self, command, timeout):
-        self.ran.append(command)
-        if command == clips.probe_command():
-            return self.audio + "\n"  # needs /dev/video99, so answered here
-        r = subprocess.run(["bash", "-c", command], capture_output=True, text=True, env=self.env, timeout=timeout)
-        if r.returncode:
-            raise RuntimeError(r.stderr.strip() or f"exit {r.returncode}")
-        return r.stdout
-
-    def fetch(self, remote, local):
-        shutil.copyfile(self.frame / remote, local)
-
-    def recorder(self):
-        rec = clips.Recorder(self.open_channel, self.run_cmd, self.fetch,
-                             lambda fn: threading.Thread(target=fn, daemon=True).start(),
-                             release=self.released.append, folder=self.here)
-        start = rec.start
-
-        def started():
-            # "started" means ffmpeg was launched; wait until it's running, as it would be by a person's Stop.
-            pid = self.frame / "ffmpeg.pid"
-            for f in (pid, self.frame / "ffmpeg-ended"):
-                f.unlink(missing_ok=True)
-            got = start()
-            for _ in range(200):
-                if pid.exists() or (self.frame / "ffmpeg-ended").exists():
-                    break
-                time.sleep(0.02)
-            return got
-        rec.start = started
-        return rec
-
-    def wait_for(self, rec, states, timeout=20):
-        end = time.time() + timeout
-        while time.time() < end:
-            s = rec.status()
-            if s["state"] in states:
-                return s
-            time.sleep(0.05)
-        self.fail(f"still {rec.status()}")
-
-    def ffmpeg_calls(self):
-        return [json.loads(line) for line in (self.frame / "ffmpeg-calls.jsonl").read_text().splitlines()]
-
-    def test_stop_finishes_the_file_and_copies_it_here(self):
-        rec = self.recorder()
-        started = rec.start()
-        self.assertEqual((started["state"], started["audio"], started["message"]), ("recording", True, "Recording"))
-        self.assertIn("pulse", self.ffmpeg_calls()[0])
-        time.sleep(0.3)
-        self.assertEqual(rec.stop()["state"], "stopping")
-        done = self.wait_for(rec, ("saved", "failed"))
-        self.assertEqual(done["state"], "saved", done)
-        self.assertEqual((self.frame / "ffmpeg-ended").read_text(), "q")  # asked to finish, not killed
-        saved = Path(done["file"])
-        self.assertEqual(saved.parent, self.here)
-        self.assertRegex(saved.name, r"^rec-\d{8}-\d{6}\.mp4$")
-        self.assertTrue(saved.read_bytes().endswith(b"+mp4"))
-        self.assertEqual([p.name for p in self.here.iterdir()], [saved.name])          # no .incoming- left
-        self.assertEqual(list((self.frame / clips.WORK).iterdir()), [])                 # cleaned on the Frame
-        self.assertIsNotNone(self.channels[0].poll())                                   # the channel has gone
-        self.assertEqual(self.released, self.channels)
-        self.assertEqual(self.ran[-1], clips.cleanup_command(saved.stem))
-
-    def test_channel_closing_stops_ffmpeg_on_the_frame(self):
-        # The computer's ssh going away closes the channel just as Stop does.
-        rec = self.recorder()
-        rec.start()
-        pid = int((self.frame / "ffmpeg.pid").read_text())
-        self.channels[0].stdin.close()
-        self.wait_for(rec, ("saved", "failed"))
-        self.assertEqual((self.frame / "ffmpeg-ended").read_text(), "q")
-        with self.assertRaises(ProcessLookupError):
-            for _ in range(100):
-                os.kill(pid, 0)
-                time.sleep(0.05)
-
-    def test_an_ffmpeg_that_ignores_q_is_killed_not_left_recording(self):
-        self.env["FAKE_FFMPEG_DEAF"] = "1"
-        rec = self.recorder()
-        rec.start()
-        pid = int((self.frame / "ffmpeg.pid").read_text())
-        rec.stop()
-        self.wait_for(rec, ("saved", "failed"), timeout=30)
-        self.assertFalse((self.frame / "ffmpeg-ended").exists())  # it never finished by itself
-        with self.assertRaises(ProcessLookupError):
-            for _ in range(100):
-                os.kill(pid, 0)
-                time.sleep(0.05)
-
-    def test_time_limit_saves_on_its_own(self):
-        self.env["FAKE_FFMPEG_RUN"] = "0.3"
-        rec = self.recorder()
-        rec.start()
-        done = self.wait_for(rec, ("saved", "failed"))
-        self.assertEqual(done["state"], "saved", done)
-        self.assertEqual((self.frame / "ffmpeg-ended").read_text(), "limit")
-        with self.assertRaisesRegex(clips.ClipError, "Not recording"):
-            rec.stop()
-
-    def test_no_sound_records_video_and_says_so(self):
-        self.audio = "audio=0"
-        rec = self.recorder()
-        started = rec.start()
-        self.assertFalse(started["audio"])
-        self.assertIn("without sound", started["message"])
-        self.assertNotIn("pulse", self.ffmpeg_calls()[0])
-        rec.stop()
-        done = self.wait_for(rec, ("saved", "failed"))
-        self.assertIn("(no sound)", done["message"])
-
-    def test_one_at_a_time(self):
-        rec = self.recorder()
-        with self.assertRaisesRegex(clips.ClipError, "Not recording"):
-            rec.stop()
-        rec.start()
-        with self.assertRaises(clips.ClipError) as e:
-            rec.start()
-        self.assertEqual(e.exception.status, 409)
-        rec.stop()
-        self.wait_for(rec, ("saved",))
-        rec.start()  # a new one once the last is saved
-        rec.stop()
-        self.wait_for(rec, ("saved",))
-
-    def test_failed_start_reports_why(self):
-        rec = clips.Recorder(lambda cmd, err: subprocess.Popen(["bash", "-c", "echo 'no v4l2 here' >&2; exit 1"],
-                                                               stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=err),
-                             lambda cmd, t: "audio=1", self.fetch, lambda fn: fn(), release=self.released.append,
-                             folder=self.here)
-        with self.assertRaisesRegex(clips.ClipError, "no v4l2 here"):
-            rec.start()
-        self.assertEqual(rec.status()["state"], "failed")
-        self.assertEqual(len(self.released), 1)
-
-    def test_failed_probe_reports_why(self):
-        def run(cmd, timeout):
-            raise clips.ClipError("No headset view device (/dev/video99). Is SteamVR running?")
-        rec = clips.Recorder(mock.Mock(side_effect=AssertionError("recorded anyway")), run, self.fetch,
-                             lambda fn: fn(), folder=self.here)
-        with self.assertRaisesRegex(clips.ClipError, "Is SteamVR running"):
-            rec.start()
-        self.assertEqual(rec.status()["state"], "failed")
-
-    def test_empty_recording_is_an_error_not_a_file(self):
-        self.env["FAKE_FFMPEG_RUN"] = "0"
-        rec = self.recorder()
-        with mock.patch.object(clips, "finish_command", lambda name: f"echo 'The recording is empty' >&2; exit 1"):
-            rec.start()
-            done = self.wait_for(rec, ("saved", "failed"))
-        self.assertEqual(done["state"], "failed")
-        self.assertIn("The recording is empty", done["error"])
-        self.assertFalse(self.here.exists() and any(self.here.iterdir()))
-        self.assertEqual(list((self.frame / clips.WORK).iterdir()), [])
-
-
-@unittest.skipUnless(shutil.which("ffmpeg") and shutil.which("ffprobe"), "needs ffmpeg and ffprobe")
-class RealFfmpeg(unittest.TestCase):
-    """A 65 s recording in Steam's DASH naming (ffmpeg's own dash muxer names files the same
-    way), stitched by the real ffmpeg: longer than the 60 s Steam's own export manages."""
-
-    def test_export_of_a_long_recording(self):
-        d = Path(tempfile.mkdtemp())
-        self.addCleanup(shutil.rmtree, d, ignore_errors=True)
-        ud = d / "home" / clips.STEAM_USERDATA
-        folder = ud / "123" / "gamerecordings" / "video" / "bg_620_20261020_201950"
-        folder.mkdir(parents=True)
-        r = subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "error", "-f", "lavfi", "-i", "testsrc=size=64x64:rate=10",
-                            "-f", "lavfi", "-i", "sine=frequency=440:sample_rate=8000", "-t", "65",
-                            "-c:v", "libx264", "-preset", "ultrafast", "-g", "20", "-c:a", "aac",
-                            "-seg_duration", "2", "-use_template", "1", "-use_timeline", "0",
-                            "-f", "dash", str(folder / "session.mpd")], capture_output=True, text=True)
-        if r.returncode != 0 or not (folder / "chunk-stream0-00001.m4s").exists():
-            self.skipTest("this ffmpeg can't write DASH with libx264: " + r.stderr[-300:])
-        listed = clips.list_recordings(ud)
-        self.assertEqual(len(listed), 1)
-        self.assertGreater(listed[0]["chunks"], 30)
-        got = clips.export(ud, listed[0]["id"], home=d / "home")
-        out = d / "home" / got["path"]
-        probe = json.loads(subprocess.run(["ffprobe", "-v", "error", "-show_streams", "-show_format", "-of", "json", str(out)],
-                                          capture_output=True, text=True, check=True).stdout)
-        self.assertEqual(sorted(s["codec_type"] for s in probe["streams"]), ["audio", "video"])
-        self.assertGreater(float(probe["format"]["duration"]), 64)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -56,48 +56,6 @@ const log = ()=>{}, toast = ()=>{};
  assert.equal($('sessionMinutes').disabled,false);
  assert.equal($('sessionCancel').disabled,true);
 })().catch(e=>{console.error(e);process.exitCode=1;});
-'''
-        result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True)
-        self.assertEqual(result.returncode, 0, result.stderr)
-
-    def test_a_finished_session_leaves_the_defaults(self):
-        """A one-minute test session that has ended mustn't fill the form with 1 / 0 / 0."""
-        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
-        code = page[page.index('let comfortBusy ='):page.index('async function pollComfort()')]
-        setup = r'''
-const assert = require('node:assert/strict');
-const elements = new Map();
-const $ = id => {
-  // The form's own defaults, as in the page's HTML.
-  const value = {sessionMinutes:'30', breakMinutes:'20', stillMinutes:'30'}[id] || '';
-  if (!elements.has(id)) elements.set(id, {textContent:'', hidden:true, disabled:false, value, defaultValue:value,
-    checked:true, defaultChecked:true, type: /Alert$/.test(id) ? 'checkbox' : 'number'});
-  return elements.get(id);
-};
-const window = {frameApp:{notify:async()=>{}}};
-const log = ()=>{}, toast = ()=>{};
-'''
-        checks = r'''
-renderComfort({id:'old', active:false, time:100, options:{minutes:1,breakMinutes:0,stillMinutes:0,batteryAlert:false,heatAlert:false},
-  events:[{id:'old:1',kind:'finished',time:90,message:'Session ended'}]});
-assert.equal($('sessionMinutes').value, '30');
-assert.equal($('breakMinutes').value, '20');
-assert.equal($('batteryAlert').checked, true);
-assert.match($('comfortEvents').textContent, /Session ended/);
-assert.notEqual($('comfortEvents').textContent, 'Session ended');  // it carries a time
-renderComfort({id:'new', active:true, time:200, remaining:600, options:{minutes:45,breakMinutes:15,stillMinutes:20,batteryAlert:true,heatAlert:false}, events:[]});
-assert.equal($('sessionMinutes').value, 45);  // a running session shows its own settings
-assert.equal($('heatAlert').checked, false);
-// The page stays open while that session ends: the next one starts from the defaults again.
-renderComfort({id:'new', active:false, time:900, options:{minutes:45,breakMinutes:15,stillMinutes:20,batteryAlert:true,heatAlert:false},
-  events:[{id:'new:1',kind:'finished',time:899,message:'Session ended'}]});
-assert.equal($('sessionMinutes').value, '30');
-assert.equal($('breakMinutes').value, '20');
-assert.equal($('heatAlert').checked, true);
-renderComfort({id:'new', active:false, time:905, options:{minutes:45}, events:[]});
-$('sessionMinutes').value = '50';  // what's typed for the next session
-renderComfort({id:'new', active:false, time:910, options:{minutes:45}, events:[]});
-assert.equal($('sessionMinutes').value, '50');  // later polls leave it alone
 '''
        result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True)
        self.assertEqual(result.returncode, 0, result.stderr)
@@ -63,20 +63,6 @@ class Coverage(unittest.TestCase):
        self.assertIn('*.js', ui['filter'])
        self.assertIn('*.css', ui['filter'])

-    def test_bundle_runs_the_server_on_its_own(self):
-        # The iPhone app and scripts/store-on-frame.sh start ui/server.py from this bundle alone.
-        import io, tarfile, tempfile
-        spec = importlib.util.spec_from_file_location('frame_bundle_run', ROOT / 'ios/scripts/make_frame_bundle.py')
-        bundle = importlib.util.module_from_spec(spec)
-        spec.loader.exec_module(bundle)
-        with tempfile.TemporaryDirectory() as tmp, tarfile.open(fileobj=io.BytesIO(bundle.build()), mode='r:gz') as tar:
-            tar.extractall(tmp)
-            result = subprocess.run([sys.executable, '-I', '-B', '-c',
-                                     'import sys; sys.path.insert(0, "ui"); import server, apk_sources.search; '
-                                     'apk_sources.search.modules()[1] and sys.exit("source modules failed: %r" % apk_sources.search.modules()[1])'],
-                                    cwd=tmp, capture_output=True, text=True, timeout=60)
-        self.assertEqual(result.returncode, 0, result.stderr[-2000:])
-
    def test_status_exposes_kernel_thermal_trips_without_guessing_thresholds(self):
        # Run the real aggregator with every external probe stubbed.
        names = ('read', 'process_names', 'performance', 'os_release', 'battery', 'power_source',
@@ -323,29 +323,6 @@ class Pins(Base):


 class Registry(Base):
-    def test_replaced_registry_is_read_even_when_timestamp_and_size_match(self):
-        d = self.reg.add_device('frame', name='First')
-        before = self.reg.path.stat()
-        other = fd.Registry(self.reg.path)
-        other.update_device(d['id'], name='Other')
-        os.utime(self.reg.path, ns=(before.st_atime_ns, before.st_mtime_ns))
-        self.assertEqual(self.reg.path.stat().st_size, before.st_size)
-        self.assertEqual(self.reg.get(d['id'])['name'], 'Other')
-
-    def test_an_address_added_first_wins_on_its_own_network(self):
-        # The page's "Add 192.168.x.x" offer: the headset is reached over Tailscale, which has
-        # worked here before. The LAN address has to go ahead of it to be used at home.
-        d = self.reg.add_device("frame-4", hosts=["frame.tail1234.ts.net"])
-        self.reg.record_success(d["id"], "frame.tail1234.ts.net", "n-home", 6.0)
-        self.reg.add_address(d["id"], "192.168.1.40", kind="lan", first=True)
-        self.reg.record_success(d["id"], "192.168.1.40", "n-home", 1.0)  # Test now found it
-        addrs = self.reg.get(d["id"])["addresses"]
-        self.assertEqual([a["host"] for a in addrs], ["192.168.1.40", "frame.tail1234.ts.net"])
-        at_home = [a["host"] for a, _ in fd.order_addresses(addrs, "n-home", True)]
-        self.assertEqual(at_home[0], "192.168.1.40")
-        away = [a["host"] for a, _ in fd.order_addresses(addrs, "n-cafe", True)]
-        self.assertEqual(away[0], "frame.tail1234.ts.net")  # elsewhere Tailscale still leads
-
    def test_address_editing(self):
        d = self.reg.add_device("frame-3", hosts=["192.168.1.40"])
        a = self.reg.add_address(d["id"], "frame-3.local", label="mDNS")
@@ -1,398 +0,0 @@
-"""Force quit (ui/frame_running.py and /api/running) without a headset: running-game
-detection, which processes may be signalled, SIGTERM-then-SIGKILL, and the Android path.
-
-Run: python3 -m unittest discover -s tests
-"""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-import json
-import os
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / "ui"))
-
-import frame_running  # noqa: E402
-import test_server  # noqa: E402  (not `from … import`, or unittest runs ServerGuards twice)
-
-ME, OTHER = 1000, 0
-HOME = frame_running.HOME
-REAPER = f"{HOME}/.local/share/Steam/ubuntu12_32/reaper"
-
-
-def proc(ppid, comm, argv=None, uid=ME, start=None, state="S"):
-    return {"ppid": ppid, "comm": comm, "argv": argv if argv is not None else [comm], "uid": uid,
-            "start": start or 1000 + ppid, "state": state}
-
-
-def frame():
-    """A Frame's processes, as Steam on Linux launches games: Steam's reaper with
-    AppId= is the parent of the game (Portal 2 here, appid 620)."""
-    return {
-        1: proc(0, "systemd", uid=OTHER),
-        200: proc(1, "sshd", uid=OTHER),
-        201: proc(200, "sshd-session"),
-        202: proc(201, "bash"),
-        203: proc(202, "python3", ["python3", "-", "quit", "620"]),        # this helper
-        300: proc(1, "systemd", ["/usr/lib/systemd/systemd", "--user"]),
-        301: proc(300, "gamescope-session"),
-        302: proc(301, "gamescope"),
-        303: proc(302, "steam", [f"{HOME}/.local/share/Steam/ubuntu12_32/steam", "-cef-enable-debugging"]),
-        304: proc(303, "steamwebhelper"),
-        305: proc(300, "vrserver"),
-        306: proc(300, "plasmashell"),
-        307: proc(300, "pipewire"),
-        400: proc(303, "reaper", [REAPER, "SteamLaunch", "AppId=620", "--", "steam-launch-wrapper", "--", "portal2.sh"]),
-        401: proc(400, "steam-launch-wr", ["steam-launch-wrapper", "--", "portal2.sh"]),
-        402: proc(401, "portal2.sh", ["/bin/sh", "portal2.sh"]),
-        403: proc(402, "portal2_linux", ["./portal2_linux", "-game", "portal2"]),
-        404: proc(403, "steam", ["steam"]),                                 # a child named like Steam: left alone
-        405: proc(404, "crashhandler"),                                     # and so is anything under it
-        # Another game, and processes that only look like launches.
-        500: proc(303, "reaper", [REAPER, "SteamLaunch", "AppId=999", "--", "other"]),
-        501: proc(500, "other"),
-        600: proc(1, "reaper", [REAPER, "SteamLaunch", "AppId=620", "--", "x"], uid=OTHER),
-        601: proc(300, "bash", ["bash", "-c", "echo reaper SteamLaunch AppId=620"]),
-        602: proc(300, "fakereaper", ["/tmp/notreaper", "SteamLaunch", "AppId=620"]),
-    }
-
-
-class Parsing(unittest.TestCase):
-    def test_launch_appid(self):
-        cases = [
-            ([REAPER, "SteamLaunch", "AppId=620", "--", "game"], 620),
-            (["reaper", "SteamLaunch", "AppId=3346865537", "--", "lepton-app.sh"], 3346865537),
-            ([REAPER, "AppId=620", "--", "game"], None),                       # no SteamLaunch
-            ([REAPER, "SteamLaunch", "--", "game", "AppId=620"], None),         # the game's own arguments
-            (["/usr/bin/steam", "SteamLaunch", "AppId=620"], None),             # not the reaper
-            (["/tmp/reaper-ish", "SteamLaunch", "AppId=620"], None),
-            ([REAPER, "SteamLaunch", "AppId=62x0"], None),
-            ([REAPER, "SteamLaunch", "AppId=12345678901"], None),               # more than 10 digits
-            ([], None),
-        ]
-        for argv, want in cases:
-            with self.subTest(argv=argv):
-                self.assertEqual(frame_running.launch_appid(argv), want)
-
-    def test_reapers_are_this_users_live_launches(self):
-        procs = frame()
-        procs[700] = proc(303, "reaper", [REAPER, "SteamLaunch", "AppId=777"], state="Z")
-        self.assertEqual(frame_running.reapers(procs, ME), {620: [400], 999: [500]})
-
-    def test_steamvr_is_never_a_game(self):
-        procs = frame()
-        procs[710] = proc(303, "reaper", [REAPER, "SteamLaunch", "AppId=250820", "--", "vrstartup"])
-        procs[711] = proc(710, "vrcompositor-launcher")
-        self.assertNotIn(250820, frame_running.reapers(procs, ME))
-        found = frame_running.running(procs, ME, steam=lambda ids: ([250820], {}),
-                                      android=dict, containers=set)
-        self.assertNotIn(250820, [a["appid"] for a in found])
-
-    def test_gameid(self):
-        self.assertEqual(frame_running.gameid(620), "620")
-        # A non-Steam shortcut: (appid << 32) | 0x02000000, as steam_shortcuts.py stop sends.
-        self.assertEqual(frame_running.gameid(3346865537), str((3346865537 << 32) | 0x02000000))
-
-    def test_snapshot_reads_proc(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            os.makedirs(f"{tmp}/42")
-            os.makedirs(f"{tmp}/self")
-            fields = " ".join(["S", "7"] + ["0"] * 17 + ["123456"])
-            Path(f"{tmp}/42/stat").write_text(f"42 (my (game) x) {fields} 0 0\n")
-            Path(f"{tmp}/42/cmdline").write_bytes(b"reaper\0SteamLaunch\0AppId=5\0--\0g\0")
-            os.makedirs(f"{tmp}/43")                       # vanished between listdir and read
-            got = frame_running.snapshot(tmp)
-        self.assertEqual(list(got), [42])
-        self.assertEqual(got[42]["comm"], "my (game) x")
-        self.assertEqual((got[42]["ppid"], got[42]["start"], got[42]["state"]), (7, 123456, "S"))
-        self.assertEqual(got[42]["argv"], ["reaper", "SteamLaunch", "AppId=5", "--", "g"])
-
-
-class Detection(unittest.TestCase):
-    def run_list(self, procs, steam=(None, {}), android=None, containers=()):
-        return frame_running.running(procs, ME, steam=lambda ids: steam, android=lambda: android or {},
-                                     containers=lambda: set(containers))
-
-    def test_steam_game_named_by_steam(self):
-        got = self.run_list(frame(), steam=([620], {620: "Portal 2", 999: "Other"}))
-        self.assertEqual([(a["appid"], a["kind"], a["name"]) for a in got],
-                         [(620, "steam", "Portal 2"), (999, "steam", "Other")])
-        self.assertEqual(got[0]["gameid"], "620")
-        self.assertEqual(got[0]["processes"], 6)
-
-    def test_without_steam_the_manifest_names_it(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            os.makedirs(f"{tmp}/steamapps")
-            Path(f"{tmp}/steamapps/appmanifest_620.acf").write_text('"AppState"\n{\n\t"appid"\t"620"\n\t"name"\t"Portal 2"\n}')
-            with mock.patch.object(frame_running, "STEAM", tmp):
-                got = self.run_list(frame())
-        self.assertEqual([(a["appid"], a["name"]) for a in got], [(620, "Portal 2"), (999, "App 999")])
-
-    def test_nothing_running(self):
-        procs = {pid: p for pid, p in frame().items() if pid < 400}
-        self.assertEqual(self.run_list(procs), [])
-
-    def test_steam_only_listing_counts(self):
-        # Steam says it's running but no reaper was found: listed, with no processes.
-        got = self.run_list({1: proc(0, "systemd", uid=OTHER)}, steam=([620], {620: "Portal 2"}))
-        self.assertEqual(got, [{"appid": 620, "gameid": "620", "processes": 0, "kind": "steam", "name": "Portal 2"}])
-
-    def test_devkit_title_and_shortcut(self):
-        sid, other = 0x80001234, 0x80005678
-        procs = {1: proc(0, "systemd", uid=OTHER),
-                 10: proc(1, "reaper", [REAPER, "SteamLaunch", f"AppId={sid}", "--", f'"{HOME}/devkit-game/Cool_Game/run.sh"']),
-                 11: proc(10, "run.sh", ["/bin/sh", f"{HOME}/devkit-game/Cool_Game/run.sh"]),
-                 20: proc(1, "reaper", [REAPER, "SteamLaunch", f"AppId={other}", "--", "/usr/bin/flatpak", "run", "x"])}
-        got = self.run_list(procs)
-        self.assertEqual([(a["kind"], a.get("title"), a["name"]) for a in got],
-                         [("devkit", "Cool_Game", "Cool_Game"), ("shortcut", None, f"Shortcut {other}")])
-        self.assertEqual(got[0]["gameid"], str((sid << 32) | 0x02000000))
-
-    def test_android_app_from_its_container(self):
-        meta = {"package": "org.example.game", "label": "Example", "shortcut": 3346865537, "instance": 2812345678}
-        apps = {3346865537: meta, 2812345678: meta}
-        got = self.run_list({1: proc(0, "systemd", uid=OTHER)}, android=apps,
-                            containers={"lepton-steamlaunch-2812345678"})
-        self.assertEqual(got, [{"appid": 3346865537, "gameid": str((3346865537 << 32) | 0x02000000), "processes": 0,
-                                "kind": "android", "package": "org.example.game", "name": "Example"}])
-        # Its container stopped: not running.
-        self.assertEqual(self.run_list({1: proc(0, "systemd", uid=OTHER)}, android=apps, containers=()), [])
-
-    def test_android_meta_reads_shortcut_and_instance(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            os.makedirs(f"{tmp}/org.example.game")
-            Path(f"{tmp}/org.example.game/meta.json").write_text(json.dumps(
-                {"package": "org.example.game", "shortcut": 3346865537, "instance": 2812345678}))
-            os.makedirs(f"{tmp}/broken")
-            Path(f"{tmp}/broken/meta.json").write_text("{")
-            with mock.patch.object(frame_running, "ANDROID", tmp):
-                self.assertEqual(sorted(frame_running.android_apps()), [2812345678, 3346865537])
-
-
-class World:
-    """Processes that react to signals: kill() removes them, unless they ignore it."""
-
-    def __init__(self, procs, ignore=(), unkillable=()):
-        self.procs, self.ignore, self.unkillable = dict(procs), set(ignore), set(unkillable)
-        self.sent, self.now = [], 0.0
-
-    def scan(self):
-        return dict(self.procs)
-
-    def kill(self, pid, sig):
-        if pid not in self.procs:
-            raise ProcessLookupError
-        self.sent.append((pid, sig))
-        if pid in self.unkillable or (sig == frame_running.SIGTERM and pid in self.ignore):
-            return
-        self.procs.pop(pid)
-        # A reaper exits once its last child has.
-        for rid, p in list(self.procs.items()):
-            if p["comm"] == "reaper" and not any(c["ppid"] == rid for c in self.procs.values()):
-                self.procs.pop(rid)
-
-    def sleep(self, seconds):
-        self.now += seconds
-
-    def escalate(self, appid=620):
-        return frame_running.escalate(appid, me=203, uid=ME, scan=self.scan, kill=self.kill,
-                                      sleep=self.sleep, clock=lambda: self.now)
-
-
-class Escalation(unittest.TestCase):
-    GAME = {401, 402, 403}
-
-    def assert_only_game(self, world, allowed=GAME | {400}):
-        signalled = {pid for pid, _ in world.sent}
-        self.assertTrue(signalled, "nothing was signalled")
-        self.assertLessEqual(signalled, allowed)
-        protected = frame_running.protected(frame(), 203, ME)
-        for pid in (1, 200, 201, 202, 203, 300, 301, 302, 303, 304, 305, 306, 307, 404, 405, 500, 501, 600, 601, 602):
-            self.assertNotIn(pid, signalled)
-        self.assertTrue({1, 201, 202, 203, 302, 303, 304, 305, 306, 307, 404, 600}.issubset(protected))
-
-    def test_sigterm_ends_it(self):
-        world = World(frame())
-        self.assertEqual(world.escalate(), "term")
-        self.assert_only_game(world)
-        self.assertEqual({pid for pid, sig in world.sent}, self.GAME)
-        self.assertTrue(all(sig == frame_running.SIGTERM for _, sig in world.sent))
-        # Deepest first, and the reaper isn't signalled while its children are alive.
-        self.assertEqual([pid for pid, _ in world.sent], [403, 402, 401])
-        self.assertNotIn(400, world.procs)
-        self.assertIn(404, world.procs)         # the "steam" child under the game is never touched
-
-    def test_sigkill_after_a_grace_period(self):
-        world = World(frame(), ignore={403})
-        self.assertEqual(world.escalate(), "kill")
-        self.assert_only_game(world)
-        self.assertIn((403, frame_running.SIGTERM), world.sent)
-        self.assertIn((403, frame_running.SIGKILL), world.sent)
-        self.assertGreaterEqual(world.now, frame_running.TERM_WAIT)
-        kills = [pid for pid, sig in world.sent if sig == frame_running.SIGKILL]
-        self.assertEqual(kills[0], 403)
-
-    def test_survivor_is_an_error(self):
-        world = World(frame(), unkillable={403})
-        with self.assertRaisesRegex(frame_running.Fail, "still running after SIGKILL"):
-            world.escalate()
-        self.assert_only_game(world)
-
-    def test_reused_pid_is_not_signalled(self):
-        world = World(frame(), ignore={402, 403})
-        real_scan = world.scan
-
-        def scan():
-            procs = real_scan()
-            if world.sent and 402 in procs:     # 402 exits and its pid goes to an unrelated program
-                procs[402] = proc(300, "editor", start=99999)
-                world.procs[402] = procs[402]
-            return procs
-        world.scan = scan
-        world.escalate()
-        self.assertNotIn((402, frame_running.SIGKILL), world.sent)
-
-    def test_nothing_left(self):
-        world = World({pid: p for pid, p in frame().items() if pid < 400})
-        self.assertEqual(world.escalate(), "gone")
-        self.assertEqual(world.sent, [])
-
-    def test_lingering_reaper_alone(self):
-        procs = {pid: p for pid, p in frame().items() if pid not in self.GAME and pid not in (404, 405)}
-        world = World(procs)
-        self.assertEqual(world.escalate(), "term")
-        self.assertEqual(world.sent, [(400, frame_running.SIGTERM)])
-
-    def test_protected_never_signalled_even_as_the_root(self):
-        # A reaper whose only children are protected: nothing to signal but the reaper itself.
-        procs = frame()
-        procs[402]["comm"] = "gamescope"
-        world = World(procs)
-        world.escalate()
-        self.assertNotIn(402, {pid for pid, _ in world.sent})
-        self.assertNotIn(403, {pid for pid, _ in world.sent})
-
-
-class Quit(unittest.TestCase):
-    def setUp(self):
-        self.page = mock.MagicMock()
-        patches = [mock.patch.object(frame_running, "Page", return_value=self.page),
-                   mock.patch.object(frame_running, "running", return_value=[
-                       {"appid": 620, "gameid": "620", "name": "Portal 2", "kind": "steam", "processes": 4}]),
-                   mock.patch.object(frame_running.os, "getuid", return_value=ME, create=True)]  # none on Windows
-        for p in patches:
-            p.start()
-            self.addCleanup(p.stop)
-
-    def test_steam_terminate_first(self):
-        scans = iter([frame(), {}])
-        self.page.eval.return_value = {"running": [], "names": {}}
-        with mock.patch.object(frame_running, "snapshot", side_effect=lambda: next(scans)), \
-             mock.patch.object(frame_running, "escalate") as escalate:
-            out = frame_running.quit_game(620, sleep=lambda s: None)
-        self.assertEqual(out["method"], "steam")
-        self.page.eval.assert_any_call('SteamClient.Apps.TerminateApp("620", false)')
-        escalate.assert_not_called()
-
-    def test_signals_when_steam_leaves_it_running(self):
-        now = [0.0]
-        with mock.patch.object(frame_running, "snapshot", return_value=frame()), \
-             mock.patch.object(frame_running, "escalate", return_value="kill") as escalate:
-            out = frame_running.quit_game(620, sleep=lambda s: now.__setitem__(0, now[0] + s), clock=lambda: now[0])
-        escalate.assert_called_once_with(620)
-        self.assertGreaterEqual(now[0], frame_running.STEAM_WAIT)
-        self.assertEqual(out["message"], "Force quit Portal 2 (it had to be killed)")
-
-    def test_without_steam_goes_straight_to_signals(self):
-        frame_running.Page.side_effect = frame_running.Fail("no SharedJSContext page")
-        with mock.patch.object(frame_running, "snapshot", return_value=frame()), \
-             mock.patch.object(frame_running, "escalate", return_value="term") as escalate:
-            out = frame_running.quit_game(620, sleep=self.fail)
-        escalate.assert_called_once_with(620)
-        self.assertEqual(out["method"], "term")
-
-    def test_not_running(self):
-        frame_running.running.return_value = []
-        with mock.patch.object(frame_running, "escalate") as escalate:
-            self.assertEqual(frame_running.quit_game(620)["method"], "gone")
-        escalate.assert_not_called()
-        self.page.eval.assert_not_called()
-
-
-class Script(unittest.TestCase):
-    def test_server_sends_it_with_frame_steam_inside(self):
-        import server
-        with mock.patch.object(server, "ssh", return_value='{"running": []}') as ssh:
-            self.assertEqual(server.running_games(), {"running": [], "message": "Nothing is running on the Frame"})
-        source = ssh.call_args.kwargs["stdin"]
-        self.assertEqual(ssh.call_args.args[0], "python3 - list")
-        # The same script runs as `python3 -`: frame_steam resolves, and bad usage is one JSON error.
-        r = subprocess.run([sys.executable, "-I", "-", "bogus"], input=source, capture_output=True, text=True,
-                           cwd=tempfile.gettempdir(), timeout=30)
-        self.assertEqual(r.returncode, 1, r.stderr)
-        self.assertEqual(json.loads(r.stdout), {"error": "usage: list | quit APPID"})
-
-
-class Server(unittest.TestCase):
-    def setUp(self):
-        import server
-        self.server = server
-
-    def quit(self, listed, quit_result=None, stop_error=None):
-        calls = []
-
-        def frame(*args, timeout=40):
-            calls.append(args)
-            return {"running": listed} if args == ("list",) else quit_result
-        with mock.patch.object(self.server, "running_frame", side_effect=frame), \
-             mock.patch.object(self.server, "ensure_master"), \
-             mock.patch.object(self.server.frame_android, "stop", side_effect=stop_error) as stop:
-            out = self.server.force_quit({"action": "quit", "appid": "3346865537"})
-        return out, calls, stop
-
-    def test_android_app_stops_its_container_first(self):
-        app = {"appid": 3346865537, "kind": "android", "package": "org.example.game", "name": "Example"}
-        out, calls, stop = self.quit([app], {"name": "Example", "method": "gone", "message": "That game isn't running"})
-        stop.assert_called_once_with("org.example.game")
-        self.assertEqual(calls, [("list",), ("quit", "3346865537")])
-        self.assertEqual(out["message"], "Stopped Example")
-
-    def test_android_stop_failure_falls_back_to_processes(self):
-        app = {"appid": 3346865537, "kind": "android", "package": "org.example.game", "name": "Example"}
-        err = self.server.frame_android.FrameError("podman failed")
-        out, calls, _ = self.quit([app], {"name": "Example", "method": "term", "message": "Force quit Example"}, err)
-        self.assertEqual(calls[-1], ("quit", "3346865537"))
-        self.assertEqual(out["message"], "Force quit Example")
-
-    def test_other_games_skip_the_android_path(self):
-        app = {"appid": 3346865537, "kind": "devkit", "title": "Cool_Game", "name": "Cool_Game"}
-        out, _, stop = self.quit([app], {"name": "Cool_Game", "method": "steam", "message": "Quit Cool_Game"})
-        stop.assert_not_called()
-        self.assertEqual(out["message"], "Quit Cool_Game")
-
-    def test_not_running_is_a_conflict(self):
-        with self.assertRaises(self.server.Failure) as cm:
-            self.quit([])
-        self.assertEqual(cm.exception.status, 409)
-
-
-class Routes(test_server.ServerGuards):
-    """Validation runs before any SSH."""
-
-    def test_input_validation(self):
-        for body in ({"action": "quit", "appid": "620; reboot"}, {"action": "quit", "appid": ""},
-                     {"action": "kill", "appid": "620"}, {"appid": "620"}, {"action": "quit", "appid": "12345678901"}):
-            status, payload = self.post("/api/running", body)
-            self.assertEqual(status, 400, f"{body} -> {payload}")
-
-    def test_routes_need_custom_header(self):
-        self.assertEqual(self.request("GET", "/api/running")[0], 403)
-        self.assertEqual(self.request("POST", "/api/running", {"action": "quit", "appid": "620"})[0], 403)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -141,9 +141,6 @@ def wait_for_idle_resolvers(timeout=10):
 class ArtworkTests(unittest.TestCase):
    def setUp(self):
        wait_for_idle_resolvers()
-        from apk_sources import _images
-        _images._dns.clear()  # each test answers lookups its own way
-        self.addCleanup(_images._dns.clear)

    def test_source_inputs_and_url(self):
        from apk_sources import _images
@@ -1,175 +0,0 @@
-"""iPhone packaging and Foundation contracts; no headset, downloads or Xcode build."""
-import sandbox  # noqa: F401
-import fnmatch
-import importlib.util
-import io
-import json
-from pathlib import Path
-import shutil
-import subprocess
-import sys
-import tarfile
-import tempfile
-import unittest
-
-ROOT = Path(__file__).resolve().parents[1]
-
-
-class BundleContracts(unittest.TestCase):
-    @classmethod
-    def setUpClass(cls):
-        spec = importlib.util.spec_from_file_location("ios_bundle_contract", ROOT / "ios/scripts/make_frame_bundle.py")
-        cls.bundle = importlib.util.module_from_spec(spec)
-        spec.loader.exec_module(cls.bundle)
-        cls.tmp = tempfile.TemporaryDirectory()
-        cls.root = Path(cls.tmp.name)
-        with tarfile.open(fileobj=io.BytesIO(cls.bundle.build()), mode="r:gz") as archive:
-            archive.extractall(cls.root)
-
-    @classmethod
-    def tearDownClass(cls):
-        cls.tmp.cleanup()
-
-    def test_required_resources_ship_to_both_clients(self):
-        resources = ["frame/android/library_artwork.js", "frame/openxr-compat/XrApiLayer_FRAME_compat.json",
-                     "frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz"]
-        config = json.loads((ROOT / "app/package.json").read_text())
-        for resource in resources:
-            with self.subTest(resource=resource):
-                self.assertTrue((self.root / resource).is_file(), resource)
-                # Match the desktop's real resource filters as well as the phone archive.
-                packaged = False
-                for entry in config["build"]["extraResources"]:
-                    source = entry["from"].removeprefix("../")
-                    if Path(resource).is_relative_to(source):
-                        relative = str(Path(resource).relative_to(source))
-                        packaged |= any(fnmatch.fnmatch(relative, pattern) for pattern in entry.get("filter", ["**/*"]))
-                self.assertTrue(packaged, "desktop resource contract: " + resource)
-
-    def test_extracted_runtime_can_render_and_load_xr_layer(self):
-        result = subprocess.run([sys.executable, "-I", "-B", "-c", """
-import sys, zipfile
-from unittest.mock import patch
-sys.path.insert(0, 'ui')
-import frame_android as android
-with patch.object(android, 'ssh', return_value='rendered') as ssh:
-    assert android.shortcut_tool('render', '/synthetic/app') == 'rendered'
-    assert 'ART_RENDERER = ' in ssh.call_args.kwargs['input']
-    assert len(ssh.call_args.kwargs['input']) > 1000
-with zipfile.ZipFile('synthetic.apk', 'w') as apk:
-    apk.writestr('lib/arm64-v8a/libopenxr_loader.so', b'synthetic loader')
-files = android.xr_compat_files('synthetic.apk')
-assert set(files) == set(android.XR_COMPAT_FILES)
-assert files['lib/arm64-v8a/libXrApiLayer_FRAME_compat.so'].startswith(b'\\x7fELF')
-"""], cwd=self.root, capture_output=True, text=True, timeout=30)
-        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-
-
-class NativeContracts(unittest.TestCase):
-    @unittest.skipUnless(sys.platform == "darwin" and shutil.which("swiftc"), "macOS Swift compiles actual Foundation production sources")
-    def test_foundation_contracts(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            main = Path(tmp) / "main.swift"
-            main.write_text("import XCTest\nlet suite = XCTestSuite(forTestCaseClass: NativeSessionTests.self)\nsuite.run()\nexit(suite.testRun!.hasSucceeded ? 0 : 1)\n")
-            executable = Path(tmp) / "native-contracts"
-            developer = subprocess.check_output(["xcode-select", "-p"], text=True).strip()
-            frameworks = str(Path(developer) / "Platforms/MacOSX.platform/Developer/Library/Frameworks")
-            libraries = str(Path(developer) / "Platforms/MacOSX.platform/Developer/usr/lib")
-            shared = str(Path(developer).parent / "SharedFrameworks")
-            result = subprocess.run(["swiftc", "-I", libraries, "-L", libraries, "-F", frameworks, "-Xlinker", "-rpath", "-Xlinker", frameworks,
-                                     "-Xlinker", "-rpath", "-Xlinker", libraries,
-                                     "-Xlinker", "-rpath", "-Xlinker", shared,
-                                     "-D", "NATIVE_CONTRACT_STANDALONE",
-                                     str(ROOT / "ios/FrameControl/App/NativeSessionState.swift"),
-                                     str(ROOT / "ios/FrameControlTests/NativeSessionTests.swift"),
-                                     str(main), "-o", str(executable)], capture_output=True, text=True, timeout=60)
-            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-            result = subprocess.run([str(executable)], capture_output=True, text=True, timeout=30)
-            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-            self.assertIn("Executed 5 tests", result.stdout + result.stderr)
-
-    @unittest.skipUnless(sys.platform == "darwin" and shutil.which("swiftc"), "macOS exercises the production finder with controlled probes")
-    def test_finder_ignores_late_probes_after_edit_and_stop(self):
-        harness = r'''import Foundation
-actor Probes {
-    var pending: [String: CheckedContinuation<Bool, Never>] = [:]
-    func probe(_ host: String) async -> Bool {
-        await withCheckedContinuation { pending[host] = $0 }
-    }
-    func has(_ host: String) -> Bool { pending[host] != nil }
-    func answer(_ host: String) { pending.removeValue(forKey: host)!.resume(returning: true) }
-}
-@main struct FinderContracts {
-    @MainActor static func wait(_ condition: () async -> Bool) async {
-        for _ in 0..<100 {
-            if await condition() { return }
-            try! await Task.sleep(nanoseconds: 5_000_000)
-        }
-        fatalError("controlled callback did not run")
-    }
-    @MainActor static func main() async {
-        let probes = Probes()
-        let finder = FrameFinder(probe: { await probes.probe($0) }, discoveryEnabled: false)
-        finder.start(fallback: "old.local")
-        await wait { await probes.has("old.local") }
-        finder.start(fallback: "100.100.100.2:2222", manual: true)
-        await wait { await probes.has("100.100.100.2:2222") }
-        await probes.answer("old.local")
-        // Let the cancelled task return its deliberately late successful answer.
-        try! await Task.sleep(nanoseconds: 20_000_000)
-        precondition(finder.found == nil, "A stale probe replaced the edited target")
-        await probes.answer("100.100.100.2:2222")
-        await wait { finder.found != nil }
-        precondition(finder.found?.host == "100.100.100.2:2222")
-        finder.start(fallback: "stopped.local", manual: true)
-        await wait { await probes.has("stopped.local") }
-        finder.stop()
-        await probes.answer("stopped.local")
-        try! await Task.sleep(nanoseconds: 20_000_000)
-        precondition(finder.found == nil, "A stopped search published a result")
-        print("Production FrameFinder: stale and cancelled probes ignored; manual target retained")
-    }
-}
-'''
-        with tempfile.TemporaryDirectory() as tmp:
-            main = Path(tmp) / "FinderContracts.swift"
-            main.write_text(harness)
-            executable = Path(tmp) / "finder-contracts"
-            result = subprocess.run(["swiftc", "-parse-as-library",
-                                     str(ROOT / "ios/FrameControl/App/NativeSessionState.swift"),
-                                     str(ROOT / "ios/FrameControl/SSH/FrameFinder.swift"),
-                                     str(main), "-o", str(executable)], capture_output=True, text=True, timeout=60)
-            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-            result = subprocess.run([str(executable)], capture_output=True, text=True, timeout=15)
-            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-
-    @unittest.skipUnless(shutil.which("node"), "Node executes the unmodified production bridge script")
-    def test_bridge_preferences_and_document_acknowledgement(self):
-        source = (ROOT / "ios/FrameControl/Web/WebShell.swift").read_text()
-        bridge = source.split('static let bridge = """', 1)[1].split('"""', 1)[0]
-        script = r'''const vm = require('node:vm');
-const assert = require('node:assert/strict');
-const calls = [];
-const window = {webkit: {messageHandlers: {frameApp: {postMessage: body => {calls.push(body); return Promise.resolve(true)}}}}};
-vm.runInNewContext(process.argv[1], {window, crypto: {randomUUID: () => 'document-42'}});
-assert.equal(window.__frameInstallLink({}), false);
-window.frameApp.preferences.read();
-window.frameApp.preferences.write('mvSeparate', '0');
-assert.equal(JSON.stringify(calls), JSON.stringify([
-  {name: 'preferencesRead', arg: null}, {name: 'preferencesWrite', arg: {key: 'mvSeparate', value: '0'}}
-]));
-const received = [];
-window.frameApp.onInstallLink(req => received.push(req));
-assert.equal(calls.at(-1).name, 'installLinkReady');
-assert.equal(calls.at(-1).arg, 'document-42');
-assert.equal(window.__frameInstallLink({target: 'a'}), true);
-assert.equal(received[0].target, 'a');
-window.frameApp.onInstallLink(() => {throw new Error('callback failed')});
-assert.throws(() => window.__frameInstallLink({}), /callback failed/);
-'''
-        result = subprocess.run(["node", "-e", script, bridge], capture_output=True, text=True, timeout=15)
-        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -897,47 +897,6 @@ class Connecting(unittest.TestCase):
        self.assertEqual(self.routes, [])
        self.assertTrue(all("ControlPath=none" in c for c in self.calls() if "-G" not in c))

-    def test_a_test_started_earlier_cant_overwrite_a_newer_one(self):
-        d = self.device("nothing.invalid")
-        entered = {1: threading.Event(), 2: threading.Event()}
-        release = {1: threading.Event(), 2: threading.Event()}
-        calls = []
-
-        def probe(host, port, update=None):
-            calls.append(host)
-            n = len(calls)
-            entered[n].set()
-            release[n].wait(10)
-            return {"state": "refused", "detail": f"test {n}", "ip": None, "rtt_ms": None}
-
-        tests = [threading.Thread(target=self.link.test, args=(d["id"],), daemon=True) for _ in range(2)]
-        with mock.patch.object(fl, "probe", probe):
-            try:
-                tests[0].start()
-                self.assertTrue(entered[1].wait(5), "the first test never probed")
-                tests[1].start()
-                self.assertTrue(entered[2].wait(5), "the second test never probed")
-                # The first finishes while the second is still probing: it mustn't show its
-                # rows or mark the second done.
-                release[1].set()
-                tests[0].join(10)
-                self.assertFalse(tests[0].is_alive())
-                running = self.link.snapshot()["tests"][d["id"]]
-                self.assertFalse(running["done"])
-                self.assertEqual(running["rows"][0]["detail"], "Waiting")
-                release[2].set()
-                tests[1].join(10)
-                self.assertFalse(tests[1].is_alive())
-            finally:
-                for e in release.values():
-                    e.set()
-                for t in tests:
-                    if t.ident:  # started
-                        t.join(10)
-        result = self.link.snapshot()["tests"][d["id"]]
-        self.assertTrue(result["done"])
-        self.assertEqual(result["rows"][0]["detail"], "test 2")
-
    def test_switching_to_a_headset_that_never_answers_stops_using_the_last_one(self):
        self.device("localhost")
        self.hosts({"localhost": "ok"})
@@ -56,19 +56,18 @@ class LinkUI(unittest.TestCase):
        r = subprocess.run(["node", "-e", script], capture_output=True, text=True)
        self.assertEqual(r.returncode, 0, r.stderr)

-    def test_the_pill_keeps_the_failure_detail_in_its_tooltip(self):
-        # The connection redesign keeps the state and retry countdown in the pill,
-        # with the full failure explanation in its tooltip and details dialog.
+    def test_the_pill_leads_with_the_reason(self):
+        # The header pill cut off "Offline: checking the headset's identity failed · retry in…":
+        # the reason comes first, in a few words, and only the countdown gets cut.
        self.run_page(r'''
  link.s = changed;
  renderPill();
-  assert.match($('conn').innerHTML, /<b>Office Frame<\/b><span>Offline<span class="via"> · retrying in 12 s<\/span>/);
-  assert.ok($('conn').title.includes(changed.error.message));
+  assert.match($('conn').innerHTML, /<b>Office Frame<\/b><span>SSH identity changed · retry in 12 s<\/span>/);
+  assert.equal($('conn').title, 'Office Frame is offline: SSH identity changed · retry in 12 s. Click for details.');
  // Without a short reason: the stage that failed.
  link.s = {...changed, retry_at: null, error: {stage: 'identity', message: 'Something.'}};
  renderPill();
-  assert.match($('conn').innerHTML, /<span>Offline<\/span>/);
-  assert.ok($('conn').title.includes('Something.'));
+  assert.match($('conn').innerHTML, /<span>Checking the headset&#39;s identity failed<\/span>/);
 ''')

    def test_the_banner_never_doubles_a_full_stop(self):
@@ -84,10 +84,7 @@ class Helpers(unittest.TestCase):
    @unittest.skipUnless(shutil.which("bash"), "needs bash")
    @unittest.skipIf(os.name == "nt", "Windows' bash.exe is WSL's launcher, and runners have no distribution")
    def test_launch_script_parses(self):
-        bash = str(Path(os.environ.get("ProgramFiles", "C:/Program Files")) / "Git/bin/bash.exe") if sys.platform == "win32" else "bash"
-        if sys.platform == "win32" and not Path(bash).exists():
-            self.skipTest("Git Bash is not installed (WSL bash is not a local shell)")
-        r = subprocess.run([bash, "-n"], input=frame_macview.LAUNCH.encode("utf-8"), capture_output=True)
+        r = subprocess.run(["bash", "-n"], input=frame_macview.LAUNCH, text=True, capture_output=True)
        self.assertEqual(r.returncode, 0, r.stderr)

    def test_show_checks_the_source_before_anything_else(self):
@@ -1,141 +0,0 @@
-"""The page's inline scripts share one global scope, so a second top-level function or
-variable with a name already used replaces the first everywhere, silently."""
-import html.parser
-import json
-import pathlib
-import shutil
-import subprocess
-import unittest
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-
-# Compiles the scripts as one strict-mode block. There, functions are block scoped like let
-# and const, so V8 itself rejects a name declared twice in the shared scope (however it's
-# indented or declared: function, class, let, const, destructuring), while helpers with the
-# same name inside different functions stay legal. var is the exception (declaring one twice
-# is allowed), so the page doesn't use var at all: Node's own copy of the acorn parser finds
-# real var declarations, not the word in comments, strings or CSS var().
-DUPLICATES = r'''
-const vm = require('vm');
-const scripts = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-try { new vm.Script('"use strict"; {\n' + scripts.join('\n;\n') + '\n}'); console.log('ok'); }
-catch (e) { console.log(e.message); }
-'''
-VARS = r'''
-const scripts = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-let acorn, walk;
-try {
-  acorn = require('internal/deps/acorn/acorn/dist/acorn');
-  walk = require('internal/deps/acorn/acorn-walk/dist/walk');
-} catch { console.log('no parser'); process.exit(0); }
-for (const code of scripts) {
-  let found = null;
-  try {
-    walk.simple(acorn.parse(code, { ecmaVersion: 'latest' }), {
-      VariableDeclaration(n) { if (n.kind === 'var' && !found) found = code.slice(n.start, n.end).slice(0, 40); },
-    });
-  } catch (e) { console.log(e.message); process.exit(0); }
-  if (found) { console.log('declares with var: ' + found); process.exit(0); }
-}
-console.log('ok');
-'''
-
-
-def node(script, scripts, *flags):
-    r = subprocess.run(['node', *flags, '-e', script], input=json.dumps(scripts), capture_output=True, text=True)
-    return r.stdout.strip() or r.stderr.strip()
-
-
-def check(scripts):
-    """'ok', or V8's message for the first name declared twice."""
-    return node(DUPLICATES, scripts)
-
-
-def check_vars(scripts):
-    """'ok', or the first var declaration. Skips where Node doesn't include acorn."""
-    out = node(VARS, scripts, '--expose-internals')
-    if out == 'no parser':
-        raise unittest.SkipTest("this Node doesn't include acorn")
-    return out
-
-
-class ClassicScripts(html.parser.HTMLParser):
-    """The page's inline classic scripts: no src, and no type other than a JavaScript one (a
-    module has its own scope, and JSON data isn't code). The types a browser runs as script:
-    https://mimesniff.spec.whatwg.org/#javascript-mime-type"""
-    JS = {'', 'application/ecmascript', 'application/javascript', 'application/x-ecmascript',
-          'application/x-javascript', 'text/ecmascript', 'text/javascript', 'text/javascript1.0',
-          'text/javascript1.1', 'text/javascript1.2', 'text/javascript1.3', 'text/javascript1.4',
-          'text/javascript1.5', 'text/jscript', 'text/livescript', 'text/x-ecmascript', 'text/x-javascript'}
-
-    def __init__(self):
-        super().__init__()
-        self.scripts, self.current = [], None
-
-    def handle_starttag(self, tag, attrs):
-        if tag == 'script':
-            a = dict(attrs)
-            inline = 'src' not in a and (a.get('type') or '').strip().lower() in self.JS
-            self.current = [] if inline else None
-
-    def handle_data(self, data):
-        if self.current is not None:
-            self.current.append(data)
-
-    def handle_endtag(self, tag):
-        if tag == 'script' and self.current is not None:
-            self.scripts.append(''.join(self.current))
-        if tag == 'script':
-            self.current = None
-
-
-def classic_scripts(page):
-    p = ClassicScripts()
-    p.feed(page)
-    return p.scripts
-
-
-@unittest.skipUnless(shutil.which('node'), 'Node parses the page scripts')
-class PageScripts(unittest.TestCase):
-    def test_no_top_level_name_is_declared_twice(self):
-        scripts = classic_scripts((ROOT / 'ui/index.html').read_text(encoding='utf-8'))
-        self.assertGreaterEqual(len(scripts), 2)
-        self.assertEqual(check(scripts), 'ok')
-
-    def test_the_page_declares_nothing_with_var(self):
-        scripts = classic_scripts((ROOT / 'ui/index.html').read_text(encoding='utf-8'))
-        self.assertEqual(check_vars(scripts), 'ok')
-
-    def test_the_check_finds_what_it_should(self):
-        twice = {
-            'indented function': ['function loadPanels() {}', '  async function loadPanels() {}'],
-            'class': ['class Panel {}', 'class Panel {}'],
-            'destructured': ['const { a, b } = {};', 'let [b] = [];'],
-            'later declarator': ['let x = 1;', 'const y = 2, x = 3;'],
-            'function and const': ['function f() {}', 'const f = 1;'],
-        }
-        for what, scripts in twice.items():
-            with self.subTest(what):
-                self.assertIn('already been declared', check(scripts))
-        helpers = ['function a() { function help() {} }', 'function b() { const help = 1; }']
-        self.assertEqual(check(helpers), 'ok')
-
-    def test_the_var_check_finds_what_it_should(self):
-        # var: legal to declare twice, so not allowed at all; however it's written.
-        for code in ['var x = 1;', 'var/*c*/x = 1;', 'var {x} = {x: 1};', 'function f() { var y; }']:
-            with self.subTest(code):
-                self.assertIn('declares with var', check_vars([code]))
-        # The word var elsewhere is fine.
-        text = ['// var x\nconst a = "var y", b = `var ${a}`, c = "color: var(--blue)", d = {}.var;']
-        self.assertEqual(check_vars(text), 'ok')
-
-    def test_only_inline_classic_scripts_are_checked(self):
-        page = ('<script>let a;</script><script type="module">export const m = 1;</script>'
-                '<script type="application/json">{"b": 1}</script><script src = "x.js"></script>'
-                '<script data-src="y" type="text/javascript">let c;</script>'
-                '<script type="text/ecmascript">let d;</script><script type=" Application/X-JavaScript ">let e;</script>')
-        self.assertEqual(classic_scripts(page), ['let a;', 'let c;', 'let d;', 'let e;'])
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -1,58 +0,0 @@
-"""The page calls showPage() while its first script is still running, before names declared
-later (in that script or the second one) exist. Touching one of them there throws, and the
-rest of the page's setup never runs: opening Frame Control at #games did exactly that."""
-import json
-import pathlib
-import re
-import shutil
-import subprocess
-import unittest
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadPanels', 'loadPanelSwitcher', 'loadBackups', 'loadTitles', 'showAndroidTab',
-         'loadAndroid', 'loadDisplays', 'setGameSource', 'requestAnimationFrame']
-
-RUN = r'''
-const vm = require('vm');
-const {code, hashes} = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-const failures = [];
-for (const hash of hashes) {
-  const context = vm.createContext({
-    location: {hash}, document: {querySelectorAll: () => [], title: ''}, live: false,
-  });
-  try { vm.runInContext(code, context); }
-  catch (e) { failures.push(`${hash}: ${e.message}`); }
-}
-console.log(JSON.stringify(failures));
-'''
-
-
-@unittest.skipUnless(shutil.which('node'), 'Node runs the page code')
-class PageStartup(unittest.TestCase):
-    def test_opening_any_page_or_section_at_startup_runs(self):
-        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
-        first, second = re.findall(r'<script>(.*?)</script>', page, re.S)[:2]
-        # The routing tables and the workspace helpers showPage uses, up to showPage itself.
-        start = first.index('function showPage(')
-        tables = first[first.index('const PAGES ='):start]
-        show = first[start:first.index('\n}\n', start) + 3]
-        # Everything declared after the startup call is still uninitialised when it runs.
-        call = re.search(r'^showPage\(\);', first, re.M).end()
-        later = re.findall(r'^(?:const|let)\s+(\w+)', first[call:] + second, re.M)
-        later = [n for n in dict.fromkeys(later) if n not in STUBS and n not in ('PAGES', 'SECTION_PAGE', 'page')]
-        self.assertIn('link', later)  # the name that broke #games
-        stubs = ''.join(f'function {n}() {{ return {{ classList: {{ toggle() {{}} }}, scrollIntoView() {{}} }}; }}\n'
-                        for n in STUBS if n != '$')
-        node = '{ classList: { toggle() {} }, scrollIntoView() {}, append() {}, prepend() {}, setAttribute() {}, removeAttribute() {} }'
-        code = (f'const $ = id => id === "nowhere" ? null : {node};\nconst gm = {{src: "owned"}};\n' + stubs + tables + show +
-                'showPage();\n' + ''.join(f'let {n};\n' for n in later))
-        hashes = ['', '#home', '#games', '#android', '#tools', '#settings', '#devices', '#control', '#nowhere']
-        hashes += ['#' + k for k in re.findall(r'(\w+): ?"', tables[:tables.index('const workspace')])]
-        r = subprocess.run(['node', '-e', RUN], input=json.dumps({'code': code, 'hashes': hashes}),
-                           capture_output=True, text=True)
-        self.assertEqual(r.returncode, 0, r.stderr)
-        self.assertEqual(json.loads(r.stdout), [])
-
-
-if __name__ == '__main__':
-    unittest.main()
Author	SHA1	Message	Date
SAPHID	342bf78b05	Merge main and preserve tracking and Windows test guidance	2026-10-18 00:06:01 +00:00
SAPHID	b51fab9872	chore: resolve conflicts with main	2026-10-17 22:10:01 +00:00
saphidandClaude Sonnet 5.5	8fb00b263c	fix(tracking): review 7 - rescan on cleanup, non-finite Health values Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-29 20:29:56 +10:00
saphidandClaude Sonnet 5.5	4937caf310	fix(tracking): don't call an unworn eye-camera artifact a pulse Unworn Frame runs gave a steady 'clear' 90-96 BPM. pulse now reads the proximity sensor and refuses to report when the headset is not worn. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-29 20:20:23 +10:00
saphidandClaude Sonnet 5.5	128e7a4c94	fix(tracking): never signal the eye-camera capture; finish cleanup exhaustively Terminating eyetracking --calib left the DSP eye camera stuck streaming on the Frame. Capture now lets the bounded run end by itself, deleting images meanwhile, and only kills as a last resort. Also hardens Ctrl-C cleanup and heart-check error handling. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-29 20:15:24 +10:00
saphidandClaude Opus 5.5	1a439f05c2	fix(tracking): make eye-image cleanup exhaustive and confirm capture ownership Follow-up review findings: remove() now tries every capture directory and reports any it could not delete; each cleanup step runs even if an earlier one fails; the directory the capture tool reports (once its output is flushed) must match the one we reduced, and is always removed. heart-check keeps readings with an unrecognised flag and reports unreadable references without a traceback. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 13:07:33 +10:00
saphidandClaude Opus 5.5	016d2b8c2d	fix(tracking): address independent review of the pulse experiment - Watch for a second capture directory on every poll; stop and remove every directory that appeared, and fail loudly if an eye image can't be deleted. - Start the worker pool inside the cleanup block. - Flat patches no longer rank first (zero-power SNR is 0, not infinity). - Align eyes to the truly nearest frame. - Keep patch grids as float arrays (a 300 s run no longer needs ~0.4 GB). - heart-check: tolerate unusual flags, close the Health archive, give a clear error when export.xml is missing, and build the lookup index once. Found by a SWE-2 Max read-only review. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 12:59:13 +10:00
saphidandClaude Opus 5.5	42ec68ed51	fix(tracking): reduce eye images while capturing, with a backlog cap The capture tool's stdout is block-buffered, so waiting for its directory name left every image on disk until the capture ended (3,554 PNGs in a 20 s run on the Frame). Detect the new capture directory instead, decode in three worker processes, and stop the capture if more than 900 images wait. On the Frame a 30 s run now peaks at 7 images on disk. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 12:44:51 +10:00
saphidandClaude Opus 5.5	fa49fab5bf	feat(tracking): experimental eye-camera pulse estimate and heart-rate comparison tool Adds 'pulse', which captures the IR eye cameras through SteamVR's own eyetracking --calib mode, reduces each image to patch averages and deletes it immediately, then estimates pulse from skin brightness. Adds heart-check.py to show OSC readings live and compare recordings with an Apple Health export or CSV, and a synthetic Mac BLE strap for relay tests. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 12:15:05 +10:00
saphid	ce9e476ec7	feat(tracking): add local OpenXR OSC and BlueZ heart-rate tools	2026-09-28 22:33:02 +10:00