Merge main and preserve tracking and Windows test guidance

chore: resolve conflicts with main
fix(tracking): review 7 - rescan on cleanup, non-finite Health values
2026-10-18 09:01:17 +02:00 · 2026-10-18 00:06:01 +00:00 · 2026-10-17 22:10:01 +00:00 · 2026-09-29 20:29:56 +10:00 · 2026-09-29 20:20:23 +10:00 · 2026-09-29 20:15:24 +10:00
62 changed files with 3095 additions and 4332 deletions
@@ -1,53 +0,0 @@
-name: PC host libraries
-on:
-  pull_request:
-    paths: ["desktop/**", "ui/**", "tests/**", "mac/frame-mac-view/**", "scripts/macview-bench.py", ".github/workflows/pc-host.yml"]
-  workflow_dispatch:
-jobs:
-  linux:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Native libraries
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libglib2.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-pipewire libpipewire-0.3-modules libspa-0.2-modules
-          python3 desktop/build.py
-      - name: Tests (real x264, fake capture consent/input)
-        env:
-          FRAME_PC_REQUIRE_NATIVE: "1"
-        run: python3 -m unittest discover -s tests -p 'test_pc*.py' -v
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pc-host-${{ matrix.os }}
-          path: desktop/bundle
-  windows:
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: msys2/setup-msys2@v2
-        with:
-          msystem: UCRT64
-          update: true
-          install: >-
-            mingw-w64-ucrt-x86_64-gcc
-            mingw-w64-ucrt-x86_64-pkgconf
-            mingw-w64-ucrt-x86_64-python
-            mingw-w64-ucrt-x86_64-gstreamer
-            mingw-w64-ucrt-x86_64-gst-plugins-base
-            mingw-w64-ucrt-x86_64-gst-plugins-good
-            mingw-w64-ucrt-x86_64-gst-plugins-bad
-            mingw-w64-ucrt-x86_64-gst-plugins-ugly
-      - name: Native build and tests (x264; WGC and MF need a desktop/GPU)
-        shell: msys2 {0}
-        run: |
-          python desktop/build.py
-          FRAME_PC_REQUIRE_NATIVE=1 python -m unittest discover -s tests -p 'test_pc*.py' -v
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pc-host-windows
-          path: desktop/bundle
@@ -3,14 +3,14 @@ name: release
 # Pushing a v* tag builds Frame Control for macOS, Windows and Linux and attaches
 # the installers to that tag's GitHub release (created as a draft if missing).
 # Pull requests that change how the installers are built (the Electron app, the
-# native PC helpers, macOS helper, or this workflow) build the same installers as
+# macOS helper it compiles, or this workflow) build the same installers as
 # artifacts. ui/, scripts/, frame/ and apk-catalog/ are copied in as they are and
 # are tested by the checks workflow; run this one by hand to package them early.
 on:
  push:
    tags: ["v*"]
  pull_request:
-    paths: ["app/**", "desktop/**", "mac/frame-mac-view/**", ".github/workflows/release.yml"]
+    paths: ["app/**", "mac/frame-mac-view/**", ".github/workflows/release.yml"]
  workflow_dispatch:

 # A newer push to the same pull request supersedes a build still in progress.
@@ -69,62 +69,18 @@ jobs:
          - os: ubuntu-latest
            script: dist:linux
            files: app/dist/*.AppImage app/dist/*.deb
-          - os: ubuntu-24.04-arm
-            script: dist:linux:arm64
-            files: app/dist/*.AppImage app/dist/*.deb
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "24"
-      - name: Linux streaming libraries
-        if: runner.os == 'Linux'
-        shell: bash
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libglib2.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-pipewire libpipewire-0.3-modules libspa-0.2-modules
-          arch=x64; if [ "$(uname -m)" = aarch64 ]; then arch=arm64; fi
-          python3 desktop/build.py --out "app/build/desktop/linux-$arch"
-      - uses: msys2/setup-msys2@v2
-        if: runner.os == 'Windows'
-        with:
-          msystem: UCRT64
-          update: true
-          install: >-
-            mingw-w64-ucrt-x86_64-gcc
-            mingw-w64-ucrt-x86_64-pkgconf
-            mingw-w64-ucrt-x86_64-python
-            mingw-w64-ucrt-x86_64-gstreamer
-            mingw-w64-ucrt-x86_64-gst-plugins-base
-            mingw-w64-ucrt-x86_64-gst-plugins-good
-            mingw-w64-ucrt-x86_64-gst-plugins-bad
-            mingw-w64-ucrt-x86_64-gst-plugins-ugly
-      - name: Windows streaming libraries
-        if: runner.os == 'Windows'
-        shell: msys2 {0}
-        run: python desktop/build.py --out app/build/desktop/win-x64
      - name: Build
        working-directory: app
        shell: bash
        run: npm ci && npm run ${{ matrix.script }}
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: "false"
-      - name: Test the bundled Python with the native PC libraries
-        if: runner.os != 'macOS'
-        shell: bash
-        run: |
-          if [ "$RUNNER_OS" = Windows ]; then
-            platform=win; arch=x64
-            python="$PWD/app/build/deps/win-x64/python/python.exe"
-            native="$(cygpath -w "$PWD/app/build/desktop/win-x64")"
-          else
-            platform=linux; arch=x64
-            if [ "$(uname -m)" = aarch64 ]; then arch=arm64; fi
-            python="$PWD/app/build/deps/linux-$arch/python/bin/python3"
-            native="$PWD/app/build/desktop/linux-$arch"
-          fi
-          FRAME_PC_NATIVE="$native" FRAME_PC_REQUIRE_NATIVE=1 "$python" -m unittest discover -s tests -p 'test_pc*.py' -v
      # The installer, not just the unpacked build: its 7-Zip payload once dropped
      # the OpenXR layer's arm64 library without any error. Install it silently
      # and compare every installed file with the unpacked build.
@@ -7,15 +7,5 @@ compat-db/.lakebed/
 tests/smoke/results/
 mac/bin/

-# Shared desktop streaming controller build products
-desktop/controller.dll
-desktop/controller.dylib
-desktop/controller.so
-desktop/*.obj
-desktop/*.lib
-desktop/*.exp
-desktop/bundle/
-app/build/desktop/
-
 # Downloaded at build time (frame/kdeconnect/fetch.py, app/build/fetch-deps.js)
 frame/kdeconnect/packages/
@@ -189,7 +189,7 @@ entry to `~/.ssh/config` and keys at `~/.ssh/id_ed25519_frame` and

 This is a first public test, so reports are really useful, especially from
 Windows and Linux. The quickest way is **Report a problem** in the app (the
-speech-bubble button at the top, or **Help → Report a Problem…**). It adds
+warning-sign button at the top, or **Help → Report a Problem…**). It adds
 diagnostics with personal details removed, shows you exactly what's included,
 and sends it privately to the maintainer; nothing is published. Without the app,
 use the [feedback form](https://frame-control.pages.dev/feedback/). Please include:
@@ -218,12 +218,12 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
 | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
-| [PC in the headset](docs/pc-in-headset.md) | Windows and Linux host implementation and test coverage |
 | [Mac in the headset](docs/mac-in-headset.md) | Mac windows and screens as panels in the Frame, with laser and keyboard input |
 | [VR mods and custom songs](docs/mods.md) | UEVR for Unreal games from Frame Control (install, play in VR, remove), the per-game table, Beat Saber blockers |
 | [SSH](docs/ssh.md) · [Streaming](docs/streaming.md) · [Files](docs/file-transfer.md) · [Panels](docs/panels.md) · [Tailscale](docs/tailscale.md) | Topic notes |
 | [Frame Control for iPhone](docs/iphone.md) | The iPhone and iPad app, how it runs the server on the Frame, pairing |
 | [Recovery and OS images](docs/recovery-and-images.md) | Where to download the Frame's OS, what's inside, testing without the headset |
+| [Eye tracking and heart rate](docs/tracking.md) | Our OpenXR → OSC bridge, BlueZ heart-rate panel and optional local session log; SlimeVR feasibility notes |
 | [AI agents and assistant](docs/agents.md) | Key-free MCP tools, human approvals, and an opt-in assistant panel |
 | [Testing](docs/testing.md) | Unit tests, end-to-end tests against a fake Frame in Docker, the headset smoke test and a Windows test VM |
 | [Open questions](docs/open-questions.md) | What's still unchecked |
@@ -11,9 +11,8 @@
    "icon": "env -u ELECTRON_RUN_AS_NODE electron build/make-icon.js",
    "dist": "sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --publish never",
    "dist:dir": "sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --dir",
-    "dist:linux": "node build/fetch-deps.js linux x64 && electron-builder --linux --x64 --publish never",
-    "dist:win": "node build/fetch-deps.js win x64 && electron-builder --win --x64 --publish never",
-    "dist:linux:arm64": "node build/fetch-deps.js linux arm64 && electron-builder --linux --arm64 --publish never"
+    "dist:linux": "node build/fetch-deps.js linux x64 arm64 && electron-builder --linux --x64 --arm64 --publish never",
+    "dist:win": "node build/fetch-deps.js win x64 && electron-builder --win --x64 --publish never"
  },
  "devDependencies": {
    "electron": "^44.4.5",
@@ -185,16 +184,7 @@
        "entry": {
          "StartupWMClass": "frame-control"
        }
-      },
-      "extraResources": [
-        {
-          "from": "build/desktop/${os}-${arch}",
-          "to": "desktop/bundle",
-          "filter": [
-            "**/*"
-          ]
-        }
-      ]
+      }
    },
    "deb": {
      "depends": [
@@ -207,16 +197,7 @@
        "zip"
      ],
      "icon": "build/icon.png",
-      "artifactName": "Frame-Control-win-${arch}.${ext}",
-      "extraResources": [
-        {
-          "from": "build/desktop/${os}-${arch}",
-          "to": "desktop/bundle",
-          "filter": [
-            "**/*"
-          ]
-        }
-      ]
+      "artifactName": "Frame-Control-win-${arch}.${ext}"
    },
    "nsis": {
      "oneClick": false,
@@ -1,311 +0,0 @@
-{
- "label": "pc-agent-frame-arm64-hairpin",
- "date": "2026-09-28T22:36:19",
- "commit": "c5fc552+dirty",
- "config": {
-  "quality": "balanced",
-  "mode": "separate",
-  "net": "none",
-  "delay_ms": 0,
-  "buffer_ms": 250,
-  "host": "frame",
-  "usb": false,
-  "ssh_opts": [],
-  "encoder": "",
-  "duration_s": 10.0,
-  "browser_flags": []
- },
- "frame_build": "20260925.6191901",
- "mac": "26.5.2",
- "host_platform": "Linux aarch64, SteamOS Frame, BUILD_ID 20260925.6191901 (synthetic host only)",
- "source": "",
- "pc_host": true,
- "headset": "0:03.056203 [Info] - 1 - leaving standby",
- "scenarios": [
-  {
-   "scenario": "test",
-   "frames_sent": 351,
-   "frames_drawn": 351,
-   "frames_shown": 324,
-   "duration_s": 10.1,
-   "stages_ms": {
-    "capture": {
-     "p50": 0.1,
-     "p95": 0.2,
-     "p99": 0.5,
-     "n": 351
-    },
-    "queue": {
-     "p50": 0.1,
-     "p95": 0.3,
-     "p99": 0.4,
-     "n": 351
-    },
-    "encode": {
-     "p50": 2.0,
-     "p95": 2.9,
-     "p99": 3.5,
-     "n": 351
-    },
-    "socket": {
-     "p50": 0.1,
-     "p95": 0.4,
-     "p99": 0.6,
-     "n": 351
-    },
-    "network": {
-     "p50": 11.6,
-     "p95": 75.7,
-     "p99": 130.1,
-     "n": 351
-    },
-    "decode": {
-     "p50": 0.7,
-     "p95": 2.1,
-     "p99": 4.1,
-     "n": 351
-    },
-    "draw": {
-     "p50": 0.4,
-     "p95": 0.8,
-     "p99": 1.1,
-     "n": 351
-    },
-    "present": {
-     "p50": 0.8,
-     "p95": 18.1,
-     "p99": 24.9,
-     "n": 324
-    },
-    "content": {
-     "p50": 15.1,
-     "p95": 80.3,
-     "p99": 134.2,
-     "n": 351
-    },
-    "content_shown": {
-     "p50": 21.0,
-     "p95": 71.8,
-     "p99": 146.3,
-     "n": 324
-    }
-   },
-   "fps": 34.8,
-   "fps_shown": 32.0,
-   "late_pct": 53.41,
-   "stall_max": 226.8,
-   "stalls_over_100ms": 7,
-   "mbps": 0.26,
-   "keyframes": 6,
-   "size": "1280x720",
-   "captured": 607,
-   "viewer_never_drawn": 0,
-   "input_ms": {
-    "p50": 43.3,
-    "p95": 98.4,
-    "p99": 110.1,
-    "n": 18
-   },
-   "input_shown_ms": {
-    "p50": 54.7,
-    "p95": 98.9,
-    "p99": 114.0,
-    "n": 18
-   },
-   "input_parts_ms": {
-    "uplink": {
-     "p50": 17.1,
-     "p95": 48.3,
-     "p99": 53.1,
-     "n": 18
-    },
-    "mac": {
-     "p50": 12.5,
-     "p95": 32.9,
-     "p99": 35.7,
-     "n": 18
-    },
-    "back": {
-     "p50": 16.8,
-     "p95": 50.0,
-     "p99": 55.9,
-     "n": 18
-    }
-   },
-   "inputs": {
-    "asked": 18,
-    "sent": 18,
-    "seen": 18
-   },
-   "timeline": [
-    {
-     "t": 0,
-     "fps": 38,
-     "mbps": 0.3,
-     "content_p50": 14.8,
-     "content_p95": 25.3,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 1,
-     "fps": 33,
-     "mbps": 0.24,
-     "content_p50": 15.6,
-     "content_p95": 103.5,
-     "bitrate": 3845448,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 2,
-     "fps": 39,
-     "mbps": 0.28,
-     "content_p50": 15.6,
-     "content_p95": 29.9,
-     "bitrate": 5283790,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 3,
-     "fps": 25,
-     "mbps": 0.21,
-     "content_p50": 17.8,
-     "content_p95": 175.9,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 4,
-     "fps": 34,
-     "mbps": 0.22,
-     "content_p50": 15.4,
-     "content_p95": 69.8,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 5,
-     "fps": 38,
-     "mbps": 0.29,
-     "content_p50": 17.7,
-     "content_p95": 68.7,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 6,
-     "fps": 38,
-     "mbps": 0.26,
-     "content_p50": 15.0,
-     "content_p95": 18.2,
-     "bitrate": 3091280,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 7,
-     "fps": 30,
-     "mbps": 0.22,
-     "content_p50": 19.2,
-     "content_p95": 111.0,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 8,
-     "fps": 35,
-     "mbps": 0.26,
-     "content_p50": 13.4,
-     "content_p95": 102.6,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 9,
-     "fps": 38,
-     "mbps": 0.28,
-     "content_p50": 12.3,
-     "content_p95": 20.9,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 10,
-     "fps": 3,
-     "mbps": 0.02,
-     "content_p50": 20.9,
-     "content_p95": 24.7,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    }
-   ],
-   "adapt": [],
-   "content_p50": 15.1,
-   "content_p95": 80.3,
-   "input_p50": 43.3,
-   "input_p95": 98.4,
-   "grades": {
-    "input_replies": "local",
-    "content_p50": "local",
-    "content_p95": "acceptable",
-    "input_p50": "local",
-    "input_p95": "acceptable",
-    "fps": "bad",
-    "late_pct": "bad",
-    "stall_max": "acceptable"
-   },
-   "controller": {
-    "target": 3442081,
-    "ceiling": 5529600,
-    "tier": 0,
-    "fps": 60,
-    "scale": 1.0,
-    "baseRtt": 13.334,
-    "inFlight": 1,
-    "slack": 71.738,
-    "adapt": true
-   },
-   "events": [
-    {
-     "t": 3.77,
-     "e": "target 2764800 bit/s; tier 0"
-    },
-    {
-     "t": 7.42,
-     "e": "target 1725204 bit/s; tier 0"
-    }
-   ],
-   "source_fps": 60.1,
-   "cpu": {
-    "host": "not sampled"
-   },
-   "viewer": "h264 software; ANGLE (Mesa, zink Vulkan 1.4(Turnip Adreno (TM) 750 (MESA_TURNIP)), OpenGL 4.6); raf 71 Hz",
-   "show_s": 1.88,
-   "panel": "valve.steam.desktopgame.2001932457",
-   "src": "test",
-   "route": "network"
-  }
- ],
- "proof": "Synthetic x264 PC agent runs on the Frame itself, forwarded via Mac and back. Not Windows/Linux desktop capture or laser input."
-}
@@ -1,302 +0,0 @@
-{
- "label": "pc-agent-frame-arm64-final",
- "date": "2026-09-28T22:55:27",
- "commit": "cd20243",
- "config": {
-  "quality": "balanced",
-  "mode": "native",
-  "net": "none",
-  "delay_ms": 0,
-  "buffer_ms": 250,
-  "host": "frame",
-  "usb": false,
-  "ssh_opts": [],
-  "encoder": "",
-  "duration_s": 10.0,
-  "browser_flags": []
- },
- "frame_build": "20260925.6191901",
- "mac": "26.5.2",
- "host_platform": "Linux aarch64, SteamOS Frame, BUILD_ID 20260925.6191901 (synthetic host only)",
- "source": "",
- "pc_host": true,
- "headset": "0:03.056203 [Info] - 1 - leaving standby",
- "scenarios": [
-  {
-   "scenario": "test",
-   "frames_sent": 400,
-   "frames_drawn": 400,
-   "frames_shown": 339,
-   "duration_s": 10.2,
-   "stages_ms": {
-    "capture": {
-     "p50": 0.1,
-     "p95": 0.1,
-     "p99": 0.2,
-     "n": 400
-    },
-    "queue": {
-     "p50": 0.1,
-     "p95": 0.2,
-     "p99": 0.4,
-     "n": 400
-    },
-    "encode": {
-     "p50": 2.0,
-     "p95": 2.7,
-     "p99": 3.1,
-     "n": 400
-    },
-    "socket": {
-     "p50": 0.1,
-     "p95": 0.3,
-     "p99": 0.4,
-     "n": 400
-    },
-    "network": {
-     "p50": 11.8,
-     "p95": 25.2,
-     "p99": 37.8,
-     "n": 400
-    },
-    "decode": {
-     "p50": 0.7,
-     "p95": 1.5,
-     "p99": 2.0,
-     "n": 400
-    },
-    "draw": {
-     "p50": 0.3,
-     "p95": 0.7,
-     "p99": 1.0,
-     "n": 400
-    },
-    "present": {
-     "p50": 0.8,
-     "p95": 19.3,
-     "p99": 26.8,
-     "n": 339
-    },
-    "content": {
-     "p50": 15.1,
-     "p95": 28.6,
-     "p99": 41.3,
-     "n": 400
-    },
-    "content_shown": {
-     "p50": 17.6,
-     "p95": 39.0,
-     "p99": 47.2,
-     "n": 339
-    }
-   },
-   "fps": 39.3,
-   "fps_shown": 33.4,
-   "late_pct": 50.25,
-   "stall_max": 69.3,
-   "stalls_over_100ms": 0,
-   "mbps": 0.35,
-   "keyframes": 6,
-   "size": "1280x720",
-   "captured": 612,
-   "viewer_never_drawn": 0,
-   "input_ms": {
-    "p50": 76.6,
-    "p95": 98.2,
-    "p99": 127.8,
-    "n": 19
-   },
-   "input_shown_ms": {
-    "p50": 80.5,
-    "p95": 107.8,
-    "p99": 128.1,
-    "n": 16
-   },
-   "input_parts_ms": {
-    "uplink": {
-     "p50": 36.5,
-     "p95": 57.6,
-     "p99": 83.2,
-     "n": 19
-    },
-    "mac": {
-     "p50": 14.6,
-     "p95": 31.3,
-     "p99": 31.7,
-     "n": 19
-    },
-    "back": {
-     "p50": 15.1,
-     "p95": 32.8,
-     "p99": 36.2,
-     "n": 19
-    }
-   },
-   "inputs": {
-    "asked": 19,
-    "sent": 19,
-    "seen": 19
-   },
-   "timeline": [
-    {
-     "t": 0,
-     "fps": 40,
-     "mbps": 0.34,
-     "content_p50": 11.7,
-     "content_p95": 27.4,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 1,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 11.9,
-     "content_p95": 28.2,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 2,
-     "fps": 41,
-     "mbps": 0.35,
-     "content_p50": 11.4,
-     "content_p95": 16.6,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 3,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 12.7,
-     "content_p95": 28.0,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 4,
-     "fps": 38,
-     "mbps": 0.33,
-     "content_p50": 15.3,
-     "content_p95": 30.0,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 5,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 16.7,
-     "content_p95": 28.5,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 6,
-     "fps": 41,
-     "mbps": 0.38,
-     "content_p50": 15.9,
-     "content_p95": 29.4,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 7,
-     "fps": 41,
-     "mbps": 0.31,
-     "content_p50": 15.6,
-     "content_p95": 28.2,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 8,
-     "fps": 38,
-     "mbps": 0.38,
-     "content_p50": 15.5,
-     "content_p95": 25.9,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 9,
-     "fps": 38,
-     "mbps": 0.29,
-     "content_p50": 16.7,
-     "content_p95": 28.8,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 10,
-     "fps": 6,
-     "mbps": 0.03,
-     "content_p50": 17.6,
-     "content_p95": 23.1,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    }
-   ],
-   "adapt": [],
-   "content_p50": 15.1,
-   "content_p95": 28.6,
-   "input_p50": 76.6,
-   "input_p95": 98.2,
-   "grades": {
-    "input_replies": "local",
-    "content_p50": "local",
-    "content_p95": "local",
-    "input_p50": "acceptable",
-    "input_p95": "acceptable",
-    "fps": "bad",
-    "late_pct": "bad",
-    "stall_max": "local"
-   },
-   "controller": {
-    "target": 5529600,
-    "ceiling": 5529600,
-    "tier": 0,
-    "fps": 60,
-    "scale": 1.0,
-    "baseRtt": 12.332,
-    "inFlight": 0,
-    "slack": 74.12,
-    "adapt": true
-   },
-   "events": [],
-   "source_fps": 60.0,
-   "cpu": {
-    "host": "not sampled"
-   },
-   "viewer": "h264 software; ANGLE (Mesa, zink Vulkan 1.4(Turnip Adreno (TM) 750 (MESA_TURNIP)), OpenGL 4.6); raf 72 Hz",
-   "show_s": 1.75,
-   "panel": "valve.steam.desktopgame.2001932457",
-   "src": "test",
-   "route": "network"
-  }
- ],
- "proof": "Synthetic x264 PC agent runs on the Frame itself, forwarded via Mac and back. Not Windows/Linux desktop capture or laser input."
-}
@@ -1,16 +0,0 @@
-#!/usr/bin/env python3
-"""Build the common controller for the Python PC host (a C11 compiler needed)."""
-import os
-from pathlib import Path
-import subprocess
-import sys
-
-root = Path(__file__).resolve().parent
-suffix = '.dll' if sys.platform == 'win32' else '.dylib' if sys.platform == 'darwin' else '.so'
-out = root / ('controller' + suffix)
-if sys.platform == 'win32' and os.environ.get('CC', 'cl') == 'cl':
-    cmd = ['cl', '/nologo', '/O2', '/LD', '/std:c11', str(root / 'controller.c'), '/link', '/OUT:' + str(out)]
-else:
-    cmd = [os.environ.get('CC', 'cc'), '-O2', '-std=c11', '-shared', '-fPIC', str(root / 'controller.c'), '-o', str(out)]
-subprocess.run(cmd, cwd=root, check=True)
-print(out)
@@ -1,118 +0,0 @@
-#!/usr/bin/env python3
-"""Build our native PC adapter and bundle its ordinary shared libraries.
-
-Run on the target architecture after installing GStreamer development packages.
-No GStreamer executable or desktop streaming application is shipped or invoked.
-Linux libc, display/GPU drivers and the portal service remain platform pieces.
-"""
-import argparse
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import subprocess
-import sys
-
-ROOT = Path(__file__).resolve().parent
-
-
-def output(*args):
-    return subprocess.check_output(args, text=True).strip()
-
-
-def build(destination):
-    win = sys.platform == 'win32'
-    destination.mkdir(parents=True, exist_ok=True)
-    modules = ['gstreamer-1.0', 'gstreamer-app-1.0', 'gstreamer-video-1.0']
-    if not win:
-        modules += ['gio-unix-2.0']
-    import shlex
-    flags = shlex.split(output('pkg-config', '--cflags', '--libs', *modules))
-    lib = destination / ('pc-host.dll' if win else 'pc-host.so')
-    cmd = [os.environ.get('CC', 'gcc' if win else 'cc'), '-std=c11', '-O2', '-shared', '-Wall', '-Wextra']
-    if not win:
-        cmd += ['-fPIC', '-Wl,-rpath,$ORIGIN/lib']
-    subprocess.run(cmd + [str(ROOT / f) for f in ('controller.c', 'capture.c', 'portal.c')] + flags + ['-o', str(lib)], check=True)
-    prefix = Path(output('pkg-config', '--variable=prefix', 'gstreamer-1.0'))
-    plugin_dir = Path(output('pkg-config', '--variable=pluginsdir', 'gstreamer-1.0'))
-    plugins_out, libs_out = destination / 'lib' / 'gstreamer-1.0', destination / ('bin' if win else 'lib')
-    plugins_out.mkdir(parents=True, exist_ok=True)
-    libs_out.mkdir(parents=True, exist_ok=True)
-    names = ['coreelements', 'videotestsrc', 'videoconvertscale', 'app', 'jpeg', 'videoparsersbad', 'x264']
-    names += ['d3d11', 'mediafoundation'] if win else ['pipewire', 'va']
-    pending = [lib]
-    for name in names:
-        matches = list(plugin_dir.glob('*gst' + name + ('.dll' if win else '.so')))
-        if not matches:
-            raise SystemExit('Missing GStreamer library: ' + name)
-        for source in matches:
-            target = plugins_out / source.name
-            shutil.copy2(source, target)
-            pending.append(source)
-    if not win:
-        # PipeWire dynamically loads support and protocol modules. ldd cannot
-        # discover those; bundle them with a private client-only config instead
-        # of accidentally loading a different distro's client modules/config.
-        libdir = plugin_dir.parent
-        for relative in ('pipewire-0.3/libpipewire-module-protocol-native.so',
-                         'pipewire-0.3/libpipewire-module-client-node.so',
-                         'pipewire-0.3/libpipewire-module-adapter.so',
-                         'spa-0.2/support/libspa-support.so',
-                         'spa-0.2/support/libspa-dbus.so',
-                         'spa-0.2/videoconvert/libspa-videoconvert.so'):
-            source = libdir / relative
-            if not source.is_file():
-                raise SystemExit('Missing PipeWire runtime library: ' + str(source))
-            target = destination / 'lib' / relative
-            target.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(source, target)
-            pending.append(source)
-        config = destination / 'share' / 'pipewire'
-        config.mkdir(parents=True, exist_ok=True)
-        (config / 'client.conf').write_text(
-            'context.spa-libs = { support.* = support/libspa-support video.* = videoconvert/libspa-videoconvert }\n'
-            'context.modules = [\n'
-            '  { name = libpipewire-module-protocol-native }\n'
-            '  { name = libpipewire-module-client-node }\n'
-            '  { name = libpipewire-module-adapter }\n'
-            ']\n')
-    copied = set()
-    while pending:
-        binary = pending.pop()
-        if win:
-            imported = re.findall(r'DLL Name:\s*(\S+)', output('objdump', '-p', str(binary)))
-            dependencies = [prefix / 'bin' / name for name in imported]
-        else:
-            dependencies = [Path(p) for p in re.findall(r'=>\s+(/\S+)', output('ldd', str(binary)))]
-        for dep in dependencies:
-            if not dep.is_file() or dep.name in copied:
-                continue
-            if not win and re.match(r'lib(c|m|dl|rt|pthread|resolv)\.so', dep.name):
-                continue
-            shutil.copy2(dep, libs_out / dep.name)
-            copied.add(dep.name)
-            pending.append(dep)
-    # License texts and package provenance accompany the dynamically linked
-    # libraries. Distribution builders keep the upstream package/source URLs.
-    licenses = destination / 'licenses'
-    licenses.mkdir(exist_ok=True)
-    if win:
-        source = prefix / 'share' / 'licenses'
-        if source.exists():
-            shutil.copytree(source, licenses, dirs_exist_ok=True)
-        packages = output('pacman', '-Q') if shutil.which('pacman') else 'See MSYS2 build log'
-    else:
-        packages = output('dpkg-query', '-W', '-f=${Package} ${Version}\n') if shutil.which('dpkg-query') else ''
-        # Debian copyright files contain licenses and source homepage details.
-        for path in Path('/usr/share/doc').glob('*/copyright'):
-            shutil.copy2(path, licenses / (path.parent.name + '.copyright'))
-    (destination / 'libraries.json').write_text(json.dumps(dict(gstreamer=output('pkg-config', '--modversion', 'gstreamer-1.0'),
-        libraries=sorted(copied), packages=packages), indent=2))
-    print(lib)
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--out', type=Path, default=ROOT / 'bundle')
-    build(parser.parse_args().out.resolve())
@@ -1,125 +0,0 @@
-/* Frame Control's capture/encode adapter. GStreamer is a bundled library;
- * capture uses WGC on Windows and the consented PipeWire fd on Linux. */
-#include "controller.h"
-#include <gst/gst.h>
-#include <gst/app/gstappsink.h>
-#include <gst/video/video-event.h>
-#include <string.h>
-
-typedef int (*Gate)(int stage, int64_t pts, int64_t capture, int64_t arrived);
-typedef struct {
-    GstElement *pipeline, *encoder, *sink, *raw_queue;
-    Gate gate;
-    GstSample *sample;
-    GstMapInfo map;
-    int mapped;
-    char error[512];
-} Capture;
-typedef struct { const unsigned char *data; int size, key, width, height; int64_t pts; } Encoded;
-FC_API int64_t fc_now(void) {return g_get_monotonic_time();}
-FC_API void fc_gst_init(void) {gst_init(NULL,NULL);}
-FC_API int fc_has_element(const char *name) {
-    GstElementFactory *f=gst_element_factory_find(name);
-    if(!f)return 0;gst_object_unref(f);return 1;
-}
-static GstPadProbeReturn probe(GstPad *pad,GstPadProbeInfo *info,gpointer data) {
-    Capture *c=data; GstBuffer *b=GST_PAD_PROBE_INFO_BUFFER(info);
-    if(!b)return GST_PAD_PROBE_OK;
-    int64_t now=fc_now(), cap=now;
-    GstClock *clock=gst_element_get_clock(c->pipeline);
-    if(clock && GST_BUFFER_PTS_IS_VALID(b)) {
-        GstClockTime current=gst_clock_get_time(clock),origin=gst_element_get_base_time(c->pipeline);
-        if(current>=origin && current-origin>=GST_BUFFER_PTS(b))
-            cap-= (int64_t)((current-origin-GST_BUFFER_PTS(b))/1000);
-    }
-    if(clock)gst_object_unref(clock);
-    int stage=GPOINTER_TO_INT(g_object_get_data(G_OBJECT(pad),"stage"));
-    if(stage==1) return c->gate(stage,(int64_t)GST_BUFFER_PTS(b),cap,now)>0 ? GST_PAD_PROBE_OK : GST_PAD_PROBE_DROP;
-    int phase=0;
-    for(;;) {
-        /* While congested, prefer a newer raw picture queued upstream. If
-         * nothing changed, retain this last picture until the gate opens;
-         * an idle window must not stay stale after a dropped final update. */
-        guint queued=0;
-        if(phase && c->raw_queue)g_object_get(c->raw_queue,"current-level-buffers",&queued,NULL);
-        if(queued)return GST_PAD_PROBE_DROP;
-        int decision=c->gate(phase,(int64_t)GST_BUFFER_PTS(b),cap,now);
-        if(decision)return decision>0 ? GST_PAD_PROBE_OK : GST_PAD_PROBE_DROP;
-        phase=2;g_usleep(2000);
-    }
-}
-FC_API Capture *fc_capture_open(const char *pipeline,Gate gate,char *error,int capacity) {
-    GError *e=NULL;Capture *c=g_new0(Capture,1);c->gate=gate;
-    c->pipeline=gst_parse_launch(pipeline,&e);
-    if(e || !c->pipeline) {
-        g_strlcpy(error,e?e->message:"No pipeline",capacity);
-        if(e)g_error_free(e);if(c->pipeline)gst_object_unref(c->pipeline);g_free(c);return NULL;
-    }
-    c->encoder=gst_bin_get_by_name(GST_BIN(c->pipeline),"enc");
-    c->sink=gst_bin_get_by_name(GST_BIN(c->pipeline),"out");
-    GstElement *raw=gst_bin_get_by_name(GST_BIN(c->pipeline),"gate");
-    if(!c->encoder || !c->sink || !raw) {
-        g_strlcpy(error,"Pipeline is missing enc, out or gate",capacity);
-        if(raw)gst_object_unref(raw);if(c->encoder)gst_object_unref(c->encoder);
-        if(c->sink)gst_object_unref(c->sink);gst_object_unref(c->pipeline);g_free(c);return NULL;
-    }
-    c->raw_queue=gst_bin_get_by_name(GST_BIN(c->pipeline),"raw_queue");
-    GstPad *p=gst_element_get_static_pad(raw,"src");
-    g_object_set_data(G_OBJECT(p),"stage",GINT_TO_POINTER(0));
-    gst_pad_add_probe(p,GST_PAD_PROBE_TYPE_BUFFER,probe,c,NULL);gst_object_unref(p);gst_object_unref(raw);
-    p=gst_element_get_static_pad(c->encoder,"sink");
-    g_object_set_data(G_OBJECT(p),"stage",GINT_TO_POINTER(1));
-    gst_pad_add_probe(p,GST_PAD_PROBE_TYPE_BUFFER,probe,c,NULL);gst_object_unref(p);
-    gst_element_set_state(c->pipeline,GST_STATE_PLAYING);
-    return c;
-}
-FC_API int fc_capture_pull(Capture *c,Encoded *out) {
-    if(c->mapped) {gst_buffer_unmap(gst_sample_get_buffer(c->sample),&c->map);c->mapped=0;}
-    if(c->sample){gst_sample_unref(c->sample);c->sample=NULL;}
-    GstBus *bus=gst_element_get_bus(c->pipeline);
-    GstMessage *m=gst_bus_pop_filtered(bus,GST_MESSAGE_ERROR);gst_object_unref(bus);
-    if(m) {
-        if(GST_MESSAGE_TYPE(m)==GST_MESSAGE_ERROR) {
-            GError *e=NULL;char *debug=NULL;gst_message_parse_error(m,&e,&debug);
-            g_strlcpy(c->error,e->message,sizeof(c->error));g_error_free(e);g_free(debug);
-        } else g_strlcpy(c->error,"The capture source closed",sizeof(c->error));
-        gst_message_unref(m);return -1;
-    }
-    c->sample=gst_app_sink_try_pull_sample(GST_APP_SINK(c->sink),100*GST_MSECOND);
-    if(!c->sample) {
-        if(gst_app_sink_is_eos(GST_APP_SINK(c->sink))) {
-            g_strlcpy(c->error,"The capture source closed",sizeof(c->error));return -1;
-        }
-        return 0;
-    }
-    GstBuffer *b=gst_sample_get_buffer(c->sample);
-    if(!gst_buffer_map(b,&c->map,GST_MAP_READ))return 0;
-    c->mapped=1;out->data=c->map.data;out->size=(int)c->map.size;
-    out->key=!GST_BUFFER_FLAG_IS_SET(b,GST_BUFFER_FLAG_DELTA_UNIT);out->pts=(int64_t)GST_BUFFER_PTS(b);
-    const GstStructure *s=gst_caps_get_structure(gst_sample_get_caps(c->sample),0);
-    gst_structure_get_int(s,"width",&out->width);gst_structure_get_int(s,"height",&out->height);return 1;
-}
-FC_API const char *fc_capture_error(Capture *c) {return c->error;}
-FC_API void fc_capture_bitrate(Capture *c,int bps) {
-    g_object_set(c->encoder,"bitrate",(guint)MAX(1,bps/1000),NULL);
-}
-FC_API void fc_capture_test(Capture *c,uint32_t input) {
-    GstElement *source=gst_bin_get_by_name(GST_BIN(c->pipeline),"source");
-    if(source) {
-        /* Each benchmark click visibly changes the ball, before injection is
-         * timestamped. This is a response, not merely a protocol input echo. */
-        guint color=0xff000000u | ((input*2654435761u)&0x00ffffffu);
-        g_object_set(source,"foreground-color",color,NULL);gst_object_unref(source);
-    }
-}
-FC_API void fc_capture_key(Capture *c) {
-    GstPad *p=gst_element_get_static_pad(c->encoder,"src");
-    gst_pad_send_event(p,gst_video_event_new_upstream_force_key_unit(GST_CLOCK_TIME_NONE,TRUE,0));gst_object_unref(p);
-}
-FC_API void fc_capture_close(Capture *c) {
-    gst_element_set_state(c->pipeline,GST_STATE_NULL);
-    if(c->mapped)gst_buffer_unmap(gst_sample_get_buffer(c->sample),&c->map);
-    if(c->sample)gst_sample_unref(c->sample);
-    if(c->raw_queue)gst_object_unref(c->raw_queue);
-    gst_object_unref(c->sink);gst_object_unref(c->encoder);gst_object_unref(c->pipeline);g_free(c);
-}
@@ -1,127 +0,0 @@
-/* Extracted from the Mac agent's RateController. Same gate, demand protection,
- * bitrate recovery and tier hysteresis for every host. Bounded sample buffers. */
-#include "controller.h"
-#include <stdlib.h>
-#include <string.h>
-#define CAP 1024
-#define MIN(a,b) ((a)<(b)?(a):(b))
-#define MAX(a,b) ((a)>(b)?(a):(b))
-typedef struct { int64_t t, v; uint32_t seq; } Sample;
-typedef struct { Sample a[CAP]; int n; } Samples;
-struct FCController {
-    int max_fps, enabled, ceiling, target, tier, frame_bytes, held, signal, saw_ack;
-    int64_t decrease, increase, below, above, slack;
-    Samples flight, rtts, acked, sent, captures;
-};
-static const int fps[] = {60,45,30,30,30}, scale[] = {100,100,100,75,50};
-static const double floors[] = {.45,.28,.16,.08,0};
-static void remove_first(Samples *s, int n) {
-    s->n -= n; memmove(s->a, s->a+n, (size_t)s->n*sizeof(Sample));
-}
-static void add(Samples *s, Sample v, int cap) {
-    if (s->n >= cap) remove_first(s, 1);
-    s->a[s->n++] = v;
-}
-static void expire(Samples *s, int64_t oldest) {
-    int n=0; while(n<s->n && s->a[n].t<oldest) n++;
-    remove_first(s,n);
-}
-static int64_t base(FCController *c) {
-    int64_t v=0;
-    for(int i=0;i<c->rtts.n;i++) if(!i || c->rtts.a[i].v<v) v=c->rtts.a[i].v;
-    return v;
-}
-static int compare(const void *a, const void *b) {
-    int64_t x=*(const int64_t*)a, y=*(const int64_t*)b;
-    return (x>y)-(x<y);
-}
-static int64_t quantile(Samples *s,int64_t since,int numerator,int denominator) {
-    int64_t a[CAP]; int n=0;
-    for(int i=0;i<s->n;i++) if(s->a[i].t>since) a[n++]=s->a[i].v;
-    if(!n) return 0;
-    qsort(a,(size_t)n,sizeof(int64_t),compare);
-    return a[n*numerator/denominator];
-}
-static int rate(Samples *s) {
-    int64_t total=0; for(int i=0;i<s->n;i++) total+=s->a[i].v;
-    return (int)MIN(total*16,2147483647);
-}
-FCController *fc_new(int max_fps,int enabled) {
-    FCController *c=calloc(1,sizeof(*c));
-    if(c) {c->max_fps=MAX(1,max_fps);c->enabled=enabled;c->slack=40000;}
-    return c;
-}
-void fc_free(FCController *c) {free(c);}
-void fc_ceiling(FCController *c,int bps) {
-    if(!c->target || c->target>bps) c->target=bps;
-    c->ceiling=bps;
-}
-int fc_gate(FCController *c,int64_t now,int counts) {
-    if(!c->enabled || !c->saw_ack) return 1;
-    expire(&c->flight,now-2000000);
-    if(!c->flight.n) return 1;
-    int64_t interval=1000000/MIN(c->max_fps,fps[c->tier]);
-    int window=MAX(3,(int)((base(c)+c->slack)/interval)+1);
-    if(c->flight.n<window && now-c->flight.a[0].t<=base(c)+c->slack) return 1;
-    if(counts) c->held++;
-    return 0;
-}
-void fc_capture(FCController *c,int64_t now) {add(&c->captures,(Sample){now,0,0},256);}
-void fc_sent(FCController *c,uint32_t seq,int bytes,int64_t now) {
-    Sample s={now,bytes,seq};add(&c->flight,s,512);add(&c->sent,s,CAP);
-}
-int fc_ack(FCController *c,uint32_t seq,int64_t now) {
-    c->saw_ack=1;
-    for(int i=0;i<c->flight.n;i++) if(c->flight.a[i].seq==seq) {
-        Sample s=c->flight.a[i];remove_first(&c->flight,i+1);
-        add(&c->rtts,(Sample){now,now-s.t,0},CAP);
-        add(&c->acked,(Sample){now,s.v,0},CAP);return 1;
-    }
-    return 0;
-}
-int fc_update(FCController *c,int64_t now) {
-    expire(&c->rtts,now-10000000);expire(&c->acked,now-500000);
-    expire(&c->sent,now-500000);expire(&c->flight,now-2000000);
-    expire(&c->captures,now-1000000);
-    if(!c->enabled || c->ceiling<=0) return 0;
-    int64_t baseline=base(c), spread=quantile(&c->rtts,now-2000000,9,10);
-    int64_t jitter=spread ? spread-baseline : 0;
-    c->slack=1000000/MIN(c->max_fps,fps[c->tier])+MIN(MAX(jitter*3/2,25000),80000);
-    int64_t recent=quantile(&c->rtts,now-300000,1,2);
-    int64_t queue=recent ? recent-baseline : 0;
-    int64_t age=c->flight.n ? now-c->flight.a[0].t : 0;
-    int delivered=rate(&c->acked),sending=rate(&c->sent);
-    if(c->sent.n) c->frame_bytes=sending/16/c->sent.n;
-    int demand=(int)MIN((int64_t)MIN(c->captures.n,MIN(c->max_fps,fps[c->tier]))*c->frame_bytes*8,2147483647);
-    int signal=(sending>=c->target/2 && queue>40000)||c->held>=3||age>baseline+100000;
-    int congested=signal && c->signal;c->signal=signal;c->held=0;
-    if(congested && now-c->decrease>300000) {
-        int next=MAX(300000,MIN((int64_t)c->target*4/5,MAX((int64_t)delivered*9/10,c->target/2)));
-        if(demand>0 && (int64_t)demand*2<=(int64_t)c->target*5/4) next=MAX(next,MIN(c->target,(int64_t)demand*2));
-        c->target=next;c->decrease=now;
-    } else if(!congested && now-c->decrease>1000000 && now-c->increase>250000 && c->target<c->ceiling &&
-              (sending>(int64_t)c->target*6/10 || now-c->decrease>3000000)) {
-        c->target=MIN(c->ceiling,(int64_t)(c->target*1.1)+50000);c->increase=now;
-    }
-    double share=(double)c->target/MAX(c->ceiling,1);
-    if(c->tier<4 && share<floors[c->tier] && sending>=(int64_t)c->target*7/10) {
-        if(!c->below)c->below=now;
-        if(now-c->below>500000) {
-            for(c->tier=0;c->tier<4 && share<floors[c->tier];c->tier++) {}
-            c->below=0;
-        }
-    } else c->below=0;
-    if(c->tier>0 && share>floors[c->tier-1]*1.25) {
-        if(!c->above)c->above=now;
-        if(now-c->above>2000000) {c->tier--;c->above=0;}
-    } else c->above=0;
-    return c->target;
-}
-int64_t fc_value(FCController *c,int field) {
-    switch(field) {
-    case 0:return c->target;case 1:return c->ceiling;case 2:return c->tier;
-    case 3:return MIN(c->max_fps,fps[c->tier]);case 4:return scale[c->tier];
-    case 5:return base(c);case 6:return c->flight.n;case 7:return c->slack;
-    default:return 0;
-    }
-}
@@ -1,29 +0,0 @@
-/* Shared latency controller. Times are monotonic host microseconds.
- * Callers serialize access. Capture is gated BEFORE encoding: dropping an
- * encoded inter frame would break the decoder's reference chain. */
-#ifndef FRAME_CONTROLLER_H
-#define FRAME_CONTROLLER_H
-#include <stdint.h>
-#ifdef _WIN32
-#define FC_API __declspec(dllexport)
-#else
-#define FC_API
-#endif
-#ifdef __cplusplus
-extern "C" {
-#endif
-typedef struct FCController FCController;
-FC_API FCController *fc_new(int fps, int enabled);
-FC_API void fc_free(FCController *c);
-FC_API void fc_ceiling(FCController *c, int bps);
-FC_API int fc_gate(FCController *c, int64_t now, int counts);
-FC_API void fc_capture(FCController *c, int64_t now);
-FC_API void fc_sent(FCController *c, uint32_t seq, int bytes, int64_t now);
-FC_API int fc_ack(FCController *c, uint32_t seq, int64_t now);
-FC_API int fc_update(FCController *c, int64_t now);
-/* target, ceiling, tier, fps, scale percent, baseline us, in flight, slack us */
-FC_API int64_t fc_value(FCController *c, int field);
-#ifdef __cplusplus
-}
-#endif
-#endif
@@ -1,147 +0,0 @@
-/* xdg-desktop-portal RemoteDesktop + ScreenCast, one consented session per
- * panel. PipeWire receives the portal fd, never the unrestricted daemon fd.
- * Input uses only the devices granted in Start's response. */
-#ifndef _WIN32
-#include "controller.h"
-#include <gio/gio.h>
-#include <gio/gunixfdlist.h>
-#include <unistd.h>
-#include <string.h>
-#define BUS "org.freedesktop.portal.Desktop"
-#define PATH "/org/freedesktop/portal/desktop"
-#define RD "org.freedesktop.portal.RemoteDesktop"
-#define SC "org.freedesktop.portal.ScreenCast"
-typedef struct {
-    GDBusConnection *bus;
-    GMainContext *context;
-    char *session;
-    int fd;
-    unsigned node, devices;
-    int width,height;
-} Portal;
-typedef struct {GVariant *result;int done;unsigned code;} Response;
-static void response(GDBusConnection *c,const char *sender,const char *path,const char *iface,
-                     const char *signal,GVariant *params,gpointer data) {
-    (void)c;(void)sender;(void)path;(void)iface;(void)signal;
-    Response *r=data;g_variant_get(params,"(u@a{sv})",&r->code,&r->result);r->done=1;
-}
-static void option(GVariantBuilder *b,const char *key,GVariant *v) {g_variant_builder_add(b,"{sv}",key,v);}
-static GVariant *request(Portal *p,const char *iface,const char *method,GVariant *args,
-                         const char *token,char *error,int capacity) {
-    char *sender=g_strdup(g_dbus_connection_get_unique_name(p->bus)+1);
-    for(char *c=sender;*c;c++)if(*c=='.')*c='_';
-    char *path=g_strdup_printf(PATH "/request/%s/%s",sender,token);g_free(sender);
-    Response r={0};GError *e=NULL;
-    guint sub=g_dbus_connection_signal_subscribe(p->bus,BUS,"org.freedesktop.portal.Request","Response",
-                                                 path,NULL,G_DBUS_SIGNAL_FLAGS_NONE,response,&r,NULL);
-    GVariant *reply=g_dbus_connection_call_sync(p->bus,BUS,PATH,iface,method,args,G_VARIANT_TYPE("(o)"),
-                                               G_DBUS_CALL_FLAGS_NONE,10000,NULL,&e);
-    if(reply)g_variant_unref(reply);
-    int64_t deadline=g_get_monotonic_time()+120000000;
-    while(!e && !r.done && g_get_monotonic_time()<deadline) {
-        while(g_main_context_iteration(p->context,FALSE)) {}
-        g_usleep(10000);
-    }
-    if(!r.done) {
-        GVariant *closed=g_dbus_connection_call_sync(p->bus,BUS,path,"org.freedesktop.portal.Request","Close",
-                                NULL,NULL,G_DBUS_CALL_FLAGS_NONE,2000,NULL,NULL);
-        if(closed)g_variant_unref(closed);
-    }
-    g_dbus_connection_signal_unsubscribe(p->bus,sub);g_free(path);
-    if(e || !r.done || r.code) {
-        g_strlcpy(error,e?e->message:!r.done?"Screen sharing request timed out":"Screen sharing was cancelled or refused",capacity);
-        if(e)g_error_free(e);if(r.result)g_variant_unref(r.result);return NULL;
-    }
-    return r.result;
-}
-FC_API void fc_portal_close(Portal *p) {
-    if(!p)return;
-    if(p->session && p->bus) {
-        GVariant *r=g_dbus_connection_call_sync(p->bus,BUS,p->session,"org.freedesktop.portal.Session","Close",
-                                                NULL,NULL,G_DBUS_CALL_FLAGS_NONE,2000,NULL,NULL);
-        if(r)g_variant_unref(r);
-    }
-    if(p->fd>=0){close(p->fd);p->fd=-1;}
-    g_free(p->session);if(p->bus)g_object_unref(p->bus);
-    if(p->context)g_main_context_unref(p->context);g_free(p);
-}
-/* Each pipeline gets a fresh restricted PipeWire connection. A dup of a
- * previously consumed protocol socket is not a new connection.
- * Ownership: the Portal owns p->fd for its whole life and is its only closer.
- * pipewiresrc never takes the fd it is given: its core connects with
- * pw_context_connect_fd(ctx, fcntl(fd, F_DUPFD_CLOEXEC, 3), ...) and that
- * duplicate is what PipeWire closes on teardown (src/gst/gstpipewirecore.c,
- * unchanged from 0.3.19 through 1.x). So closing p->fd here is not a double
- * close; not closing it would leak one socket per pipeline reopen. The
- * caller closes the previous pipeline before asking for a new fd. */
-FC_API int fc_portal_refresh(Portal *p,char *error,int capacity) {
-    GVariantBuilder b;g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    GUnixFDList *fds=NULL;GError *e=NULL;
-    GVariant *r=g_dbus_connection_call_with_unix_fd_list_sync(p->bus,BUS,PATH,SC,"OpenPipeWireRemote",
-         g_variant_new("(oa{sv})",p->session,&b),G_VARIANT_TYPE("(h)"),G_DBUS_CALL_FLAGS_NONE,10000,NULL,&fds,NULL,&e);
-    if(!r){g_strlcpy(error,e->message,capacity);g_error_free(e);return -1;}
-    int handle;g_variant_get(r,"(h)",&handle);g_variant_unref(r);
-    int fd=g_unix_fd_list_get(fds,handle,&e);g_object_unref(fds);
-    if(fd<0){g_strlcpy(error,e->message,capacity);g_error_free(e);return -1;}
-    if(p->fd>=0)close(p->fd);
-    p->fd=fd;return fd;
-}
-FC_API Portal *fc_portal_select(char *error,int capacity) {
-    Portal *p=g_new0(Portal,1);p->fd=-1;p->context=g_main_context_new();
-    g_main_context_push_thread_default(p->context);
-    GError *e=NULL;GVariant *r=NULL;
-    p->bus=g_bus_get_sync(G_BUS_TYPE_SESSION,NULL,&e);
-    if(!p->bus) {g_strlcpy(error,e->message,capacity);g_error_free(e);goto fail;}
-    GVariantBuilder b;char token[64],session[64];
-    g_snprintf(session,sizeof(session),"fc_%u",g_random_int());
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());
-    g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"session_handle_token",g_variant_new_string(session));
-    r=request(p,RD,"CreateSession",g_variant_new("(a{sv})",&b),token,error,capacity);if(!r)goto fail;
-    g_variant_lookup(r,"session_handle","s",&p->session);g_variant_unref(r);r=NULL;
-    if(!p->session){g_strlcpy(error,"Portal did not return a session",capacity);goto fail;}
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"types",g_variant_new_uint32(3));
-    r=request(p,RD,"SelectDevices",g_variant_new("(oa{sv})",p->session,&b),token,error,capacity);if(!r)goto fail;g_variant_unref(r);
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"types",g_variant_new_uint32(3));
-    option(&b,"multiple",g_variant_new_boolean(FALSE));option(&b,"cursor_mode",g_variant_new_uint32(2));
-    r=request(p,SC,"SelectSources",g_variant_new("(oa{sv})",p->session,&b),token,error,capacity);if(!r)goto fail;g_variant_unref(r);
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));
-    r=request(p,RD,"Start",g_variant_new("(osa{sv})",p->session,"",&b),token,error,capacity);if(!r)goto fail;
-    g_variant_lookup(r,"devices","u",&p->devices);
-    GVariant *streams=g_variant_lookup_value(r,"streams",G_VARIANT_TYPE("a(ua{sv})"));
-    if(streams && g_variant_n_children(streams)>0) {
-        GVariant *entry=g_variant_get_child_value(streams,0),*props=NULL;
-        g_variant_get(entry,"(u@a{sv})",&p->node,&props);
-        g_variant_lookup(props,"size","(ii)",&p->width,&p->height);
-        g_variant_unref(props);g_variant_unref(entry);
-    }
-    if(streams)g_variant_unref(streams);g_variant_unref(r);r=NULL;
-    if(!p->node || p->width<=0 || p->height<=0) {g_strlcpy(error,"Portal returned no stream size",capacity);goto fail;}
-    if(fc_portal_refresh(p,error,capacity)<0)goto fail;
-    g_main_context_pop_thread_default(p->context);return p;
-fail:
-    g_main_context_pop_thread_default(p->context);fc_portal_close(p);return NULL;
-}
-FC_API int fc_portal_value(Portal *p,int field) {
-    switch(field){case 0:return p->fd;case 1:return (int)p->node;case 2:return p->width;
-                 case 3:return p->height;case 4:return (int)p->devices;default:return 0;}
-}
-FC_API int fc_portal_input(Portal *p,int type,double x,double y,int code,int down) {
-    const char *method=NULL;GVariant *args=NULL;GVariantBuilder b;g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    if(type==0 && (p->devices&2)) {
-        method="NotifyPointerMotionAbsolute";args=g_variant_new("(oa{sv}udd)",p->session,&b,p->node,x,y);
-    } else if(type==1 && (p->devices&2)) {
-        method="NotifyPointerButton";args=g_variant_new("(oa{sv}iu)",p->session,&b,code,(guint)down);
-    } else if(type==2 && (p->devices&2)) {
-        method="NotifyPointerAxis";args=g_variant_new("(oa{sv}dd)",p->session,&b,x,y);
-    } else if(type==3 && (p->devices&1)) {
-        method="NotifyKeyboardKeysym";args=g_variant_new("(oa{sv}iu)",p->session,&b,code,(guint)down);
-    } else return 0;
-    GError *e=NULL;GVariant *r=g_dbus_connection_call_sync(p->bus,BUS,PATH,RD,method,args,NULL,
-                                                       G_DBUS_CALL_FLAGS_NONE,2000,NULL,&e);
-    if(e)g_error_free(e);if(r)g_variant_unref(r);return r!=NULL;
-}
-#endif
@@ -97,7 +97,7 @@ replies, screenshots and approval payloads are not sent to analytics.

 ## Assistant panel

-Open **Settings** (the gear in the header) **→ Open assistant settings**, or `http://127.0.0.1:47810/assistant`.
+Open **Tools → Open assistant**, or `http://127.0.0.1:47810/assistant`.
 To put the same page in the headset, with the HTTP server still running:

 ```sh
@@ -3,9 +3,8 @@
 Frame Control can manage more than one Steam Frame, and each headset can be
 reached at more than one address: a LAN IP at home, another at the office, its
 mDNS name (`frame.local`), its Tailscale IP or MagicDNS name. The **Devices**
-tab (key 5) lists them. The connection pill in the header says whether the one in
-use is connected and how (Tailscale, or the network's name); click it to add,
-edit or reorder that headset's addresses, or to see each step of connecting.
+tab (key 5) lists them, and the connection pill in the header shows what the
+app is doing to reach the one in use, step by step, as it happens.

 The code is in three modules, all stdlib-only Python on your computer:

@@ -58,7 +57,7 @@ and ranks them:
 5. addresses that only ever worked on other networks;
 6. Tailscale addresses while Tailscale is off.

-Your order (on the Devices tab, or in the pill's dialog) breaks ties. The best-ranked address that answers
+Your order on the Devices tab breaks ties. The best-ranked address that answers
 wins; one that answers first waits up to 0.35 s for a better-ranked one that is
 still trying. If SSH to the winner fails in a way another address could fix
 (a different device answered there, or the link dropped), the next one that
@@ -73,16 +72,6 @@ status --json`, including the Mac app's own CLI) with buttons to add their
 MagicDNS name or IP. **Find on this network** asks mDNS for SteamOS devkit
 services and checks `ALIAS.local` and `frame.local`.

-**The pill's dialog** lists the same addresses, with what each one answered, and
-can add, edit, reorder and remove them without leaving the page you're on. When
-the headset reports a LAN IP on the same network as this computer and that IP
-isn't saved, it offers to add it. The offer puts the address first in the list,
-so on that network it wins over the Tailscale name; away from home the Tailscale
-name still leads. A new or edited address is tested straight away. While
-connected, **Reconnect** applies your changes now rather than at the next
-connection: it tries the addresses again, ranked as above, and the best-ranked
-one that answers promptly wins. It doesn't pick a particular address.
-
 ## Networks

 A network is told apart by its default gateway: the router's IP address plus its
@@ -58,7 +58,7 @@ not been verified and is not guaranteed.

 ## Casting

-**Cast to this screen** (Home → **Right now**) starts the existing headset Live view and requests full
+**Cast headset view** starts the existing headset Live view and requests full
 screen where supported. Show that screen to people in the room, or use the
 computer/phone's own screen mirroring. It creates no new stream transport,
 public URL or LAN server. iPhone uses the inline viewer if full screen is not
@@ -17,21 +17,15 @@ python3 ui/server.py         # anywhere: then open http://127.0.0.1:47810

 ## Features

-The window has six tabs: **Home** (what the headset's doing and what you'd do
-next, the headset view, screenshots, family and comfort, the keyboard and
-trackpad, and VR performance, folded away), **Games** (installed games,
-sideloaded titles, getting games), **Android** (apps, the catalogue, display
-settings, reports), **Tools** (in the headset: your computer's windows, the media
-player and the panel switcher; then sending files and text, Flatpaks, remote and
-power), **Devices** (your headsets and their addresses), and **Control** (the
-searchable Control Center, metrics, supported settings and headset guidance).
-Keys 1–6 switch between them. The gear in the header (key 7) opens **Settings**:
-privacy and updates, library artwork and the assistant. The battery chip opens
-the headset's details: storage, memory, temperature, Wi-Fi, uptime and SteamOS
-build. Files can be dropped anywhere in the window. A
-connection pill in the header always shows which headset and whether it's
-connected, and how (Tailscale, or the network's name). Click it to add, edit or
-reorder the headset's addresses, or to see each step of connecting. When the Frame can't be
+The window has six tabs: **Home** (headset view, status, screenshots),
+**Games** (installed games, sideloaded titles, getting games), **Android** (apps,
+the catalogue, display settings, reports), **Tools** (sending files and text,
+Flatpaks, remote and power), **Devices** (your headsets and their addresses),
+and **Control** (the searchable Control Center, metrics, supported settings and
+headset guidance). Keys 1–6 switch between them. Files can be dropped anywhere in the window. A
+connection pill in the header always shows which headset, which network this
+computer is on, the address in use or being tried, and each step of connecting
+as it happens; click it for the whole timeline. When the Frame can't be
 reached, a banner says why in plain words, what was tried, and counts down to
 the next try, filling everything in once it answers. Flatpak and Android installs run in the background; the bottom bar
 counts them while they run.
@@ -245,5 +239,5 @@ Control implementations. MCP wraps this HTTP API without API keys. Changes
 require a separate user approval; power also retains its password prompt. The
 assistant uses a user-chosen endpoint and sends nothing until the user opts in
 for a message. Screenshot context is separately opt-in. Model replies cannot
-operate the headset. Settings → Open assistant settings opens the page; the linked guide
+operate the headset. Tools → Open assistant opens the page; the linked guide
 covers putting it in a Chromium panel on the Frame.
@@ -20,6 +20,15 @@ SteamVR  (vrserver, vrcompositor, vrdashboard)       ← renders the room + pane
 Lepton (Android 11, podman container "lepton-dev") ← its own panel, app 3056000
 ```

+## Tracking additions (verified 2026-09-28)
+
+On SteamOS 0.4.1, build `20260925.6191901`, SteamVR exposes combined gaze
+through `XR_EXT_eye_gaze_interaction` in a headless OpenXR 1.0 session. Our
+reader obtained valid tracked samples and sent OSC to a configured loopback
+receiver. BlueZ LE discovery works; GTK4/GI can render our heart-rate panel.
+No BLE strap or SlimeVR trackers were attached. See [tracking](tracking.md)
+for the evidence, privacy defaults and untested integration boundaries.
+
 ## Facts worth knowing

 | Fact | Where it matters |
@@ -114,8 +114,8 @@ don't.

 ## Family and comfort

-The shared Home card sets session limits, breaks and check-ins; **Cast to this
-screen** is in Home's **Right now** card. **Enable / test notifications** requests iOS notification
+The shared Home card sets session limits, breaks and check-ins, and offers
+**Cast headset view**. **Enable / test notifications** requests iOS notification
 permission and sends a local test. These are local notifications, not APNs push;
 iOS background suspension can interrupt phone alerts. The headset timer still
 runs. See [the behavior and verification limits](family-comfort.md).
@@ -125,7 +125,7 @@ a limit on the number of floating panels.
  separate from Frame Control. Public reports describe some Proton support;
  Windows-only does not by itself prove a Frame app cannot run. Local status
  and sources are in [VR utilities](vr-utilities.md).
- **Our performance HUD:** Home → VR performance (unfold it) → Open HUD in
+- **Our performance HUD:** Home → VR comfort and performance → Open HUD in
  headset creates its own gamescope panel using built-in tools. It needs no
  third-party overlay app. [Metrics and verification](vr-utilities.md).

@@ -1,199 +0,0 @@
-# PC in the headset
-
-Windows and Linux hosts use **Tools → PC in the headset**. The host shares a
-window or screen, and the existing Frame viewer makes it a SteamVR panel.
-Move it with the dashboard's Float in World, Move and Size controls.
-
-**Inferred / not yet verified on a desktop host:** the Windows and Linux
-capture and input paths below. This work was developed on a Mac with no
-Windows or Linux desktop VM. A native build or test-pattern test in CI does
-not establish that desktop capture, a permission dialog, hardware encoding
-or laser input works. Keep this feature in the draft/testing stage until
-those paths have been tried on real hosts.
-
-## Own implementation, platform APIs and bundled libraries
-
-Frame Control owns the host agent, input routing, authentication, streaming
-protocol, panel launcher and adaptation. It does not launch or require
-Sunshine, OBS or another desktop-streaming app. GStreamer and its codec
-plugins are ordinary libraries bundled with the Windows and Linux app;
-users do not install a GStreamer application. The shared library build keeps
-license texts and package provenance alongside the libraries. Linux also
-bundles the PipeWire client’s dynamically loaded SPA/protocol modules and a
-private client configuration; it does not change the desktop’s configuration.
-
-First-party alternatives considered (**documented**): Valve Remote Play
-streams a game/desktop, rather than providing this per-window panel protocol;
-Windows Remote Desktop opens a remote session; Linux's desktop portal is the
-consent mechanism for sharing the current desktop. The chosen paths are:
-
-| Host | Capture | Encoding | Input |
-|---|---|---|---|
-| Windows | Windows.Graphics.Capture, through `d3d11screencapturesrc capture-api=wgc`; HWND or HMONITOR | Hardware Media Foundation (`mfh264enc`), low latency, no B-frames | `SendInput`, with source bounds and per-monitor DPI awareness |
-| Linux | RemoteDesktop + ScreenCast portal, then the returned PipeWire fd/node | VA-API (`vah264enc`) where registered; x264 otherwise | RemoteDesktop portal notifications, using only granted pointer/keyboard devices |
-
-API choices are **documented**, not device verification:
-[Windows capture](https://learn.microsoft.com/en-us/windows/uwp/audio-video-camera/screen-capture),
-[GStreamer WGC](https://gstreamer.freedesktop.org/documentation/d3d11/d3d11screencapturesrc.html),
-[Media Foundation encoder](https://gstreamer.freedesktop.org/documentation/mediafoundation/mfh264enc.html),
-[ScreenCast portal](https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.ScreenCast.html),
-[RemoteDesktop portal](https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.RemoteDesktop.html).
-
-Windows needs a WGC-capable Windows 10/11 desktop and an available hardware
-Media Foundation H.264 encoder. Elevated windows and the secure desktop
-cannot be driven by an ordinary Frame Control process. If Windows refuses
-to focus a selected window, input is refused rather than sent to the app
-covering it; bring the selected window forward, then Stop and Show again. Minimized/closed
-windows may stop producing frames. Protected content is not supported.
-
-On Linux, press **Choose a window or screen…** and approve the desktop's
-sharing dialog. Choose another source to add another panel. Stop releases
-that source's portal session; sharing it again asks for consent again.
-A desktop must implement both ScreenCast and RemoteDesktop for this path;
-a ScreenCast-only compositor cannot provide laser input through this API.
-Cancelling or denying a dialog is reported on the card. No portal permission
-is bypassed, and Frame Control does not open `/dev/uinput` or the unrestricted
-PipeWire daemon on the host.
-
-The host's own keyboard still works. Input from the viewer uses normalized
-picture coordinates, maps through the selected source's bounds, and releases
-held buttons/keys on blur, disconnect and Stop. Linux requires the pointer
-and keyboard grants. **Untested:** desktop-specific consent, mixed-DPI
-Windows input alignment, multi-monitor layouts, hardware encoder behavior,
-window resize/minimize, and non-US keyboard layouts.
-
-## Shared pieces
-
- `ui/frame_macview.py` owns the SSH tunnel, reconnect supervision, quality
-  presets and panel launch for all hosts. `ui/frame_pcview.py` selects the PC
-  helper; `/api/macview` remains the compatible endpoint.
- `ui/mac-view.html` is the one viewer. The 17-byte big-endian frame header,
-  Annex-B H.264/JPEG payloads, `hello`/`ack` reconnect handshake, clock sync,
-  `rx`/`fd` timing reports and input messages are unchanged.
- `desktop/controller.c` is the rate controller shared by the Mac Swift
-  binding and the PC Python binding. Capture is gated **before** encoding;
-  encoded reference frames are never discarded. A bounded raw-frame queue
-  keeps the newest picture, including the last update of an idle window,
-  until the gate opens. A native one-frame-source test covers that case.
-  It keeps the Mac's bitrate demand protection and tier hysteresis.
- PC records use the existing `Stats.swift` JSON schema, with bounded
-  4096-frame/512-input storage in `ui/frame_stream_stats.py`. The benchmark's
-  analysis, targets and network shaping are shared, not reimplemented.
-  Capture timestamps describe the native pipeline's source time; they do
-  not prove the time at which the host compositor displayed the pixels.
- Mac virtual-display separation remains Mac-only. Windows WGC and the
-  Linux portal share the selected window directly.
-
-PC capture follows the shared frame-rate and resolution tiers. x264 updates
-bitrate while running. Hardware encoders are drained and reopened when the
-budget changes materially, at most once a second, because their live property
-support varies. Reopening starts a new keyframe and retains the consented
-portal session. **Untested:** hardware reconfiguration latency and whether a
-particular desktop permits reconnecting its PipeWire stream this way.
-
-## Build and measure
-
-Packaged Windows/Linux builds include `desktop/bundle/pc-host` and its shared
-libraries. Source checkouts build them with `python3 desktop/build.py` after
-installing GStreamer development packages (see the `PC host libraries` CI
-workflow). The feature reports a missing bundle; it does not download or
-install a streaming app on first use.
-
-The existing benchmark now accepts a PC host:
-
-```sh
-python3 scripts/macview-bench.py run --pc --scenario test --label pc-test
-# Linux: select a real source in the desktop's sharing dialog
-python3 scripts/macview-bench.py run --pc --scenario capture --source choose --label linux-window
-# Windows: use the HWND/monitor source ID shown by the host's /windows or /displays
-python3 scripts/macview-bench.py run --pc --scenario capture --source window:12345 --label windows-window
-```
-
-The synthetic PC pattern uses bundled x264 so headless CI can verify the
-wire protocol without claiming that a GPU was exercised. The `capture`
-scenario measures the selected real source without injecting input or
-assuming that it animates at 60 fps. Mac-only Chrome/virtual-display typing
-and scrolling automation is not run on PC hosts. Results retain the same
-latency stages and record `host_platform`, `pc_host` and `source`. CPU sampling
-on PC hosts is explicitly unavailable. `--net` and `--delay` still use the
-same bounded shaping relay, without administrator privileges.
-
-## Evidence
-
- **Verified, Mac, 2026-09-28:** the final full unit/integration suite ran
-  183 tests successfully, including the real Mac helper's H.264, ticket, timing
-  and input-echo tests. The native PC test class was skipped locally because
-  its libraries were absent; the PC adapter and shared-controller tests passed.
- **Verified, real Frame, 2026-09-28, BUILD_ID 20260925.6191901:** the base
-  helper's synthetic source created panel `valve.steam.desktopgame.2001639889`,
-  and the shared Chromium viewer decoded H.264. It recorded 286 frames over
-  the short probe, with a two-second summary of 19.5 fps shown and total
-  latency p50/p95 83/156.5 ms. This establishes the existing viewer/transport
-  route, not Windows/Linux capture, input or a latency target. The probe's
-  helper, tunnel and viewer were stopped afterward.
- **Verified in CI:** native library builds and real x264 protocol tests passed
-  on Windows, Ubuntu x64 and Ubuntu ARM64 in
-  [run 36422214445](https://github.com/saphid/frame-control/actions/runs/36422214445).
-  All four installer builds passed in
-  [run 36422214425](https://github.com/saphid/frame-control/actions/runs/36422214425).
-  These are build/synthetic tests, not desktop-host verification. No VM was used.
- **Verified, real Frame, same build/date:** the ARM64 PC agent and its
-  bundled libraries ran from a temporary user directory, using x264's moving
-  test pattern. Traffic travelled Frame → Mac SSH relay → Frame viewer.
-  The shared bench recorded 351 drawn frames, content p50/p95 15.1/80.3 ms,
-  and 34.8 fps. The frame-rate and late-frame targets failed. This checks the
-  new agent and real viewer together; it is not a representative PC link.
-  The helper exited 0, its viewer/tunnels stopped, and its directory was removed.
-  [Raw benchmark result](../bench/results/2026-09-28-c5fc552-dirty-pc-agent-frame-arm64-hairpin.json).
-  This first probe's input echo measured message receipt to the next capture,
-  not a visible pattern response; later builds make test clicks change its color.
- **Verified, Mac:** all 600 states in a 60-second congestion/recovery trace
-  matched the original Swift controller. `tests/test_pc_controller.py` retains
-  the original trace digest as a regression check.
- **Verified, real Frame, agent at `cd20243`:** the repeated synthetic
-  probe drew 400 frames at 39.3 fps, content p50/p95 15.1/28.6 ms, and synthetic
-  input-to-drawn p50 76.6 ms. Test clicks now change the pattern color before
-  injection is timestamped. The frame-rate/late-frame targets still failed;
-  this remains a Frame-hosted x264 test through a Mac relay, not a desktop or
-  physical-laser measurement. Helper exit 0 and cleanup succeeded.
-  [Latest device probe result](../bench/results/2026-09-28-cd20243-pc-agent-frame-arm64-final.json).
- **Untested:** real Windows WGC → Media Foundation → Frame; real Linux
-  portal → PipeWire → VA-API/x264 → Frame; physical laser input on either.
-  No benchmark numbers for those desktop paths are claimed.
-
-## Independent review availability
-
-A direct read-only review was attempted with
-`devin -p --model swe-2-max --permission-mode auto --prompt-file …`. The first
-attempt exited 0 after rejecting a tool that needed interactive permission;
-it did not inspect the diff. A full inline-diff attempt returned no output
-for 15 minutes and was terminated (shell exit 143). A smaller inline native
-code review returned no output within 300 seconds (process exit -15).
-SWE-2 Max was requested; no completed review or findings were received, so
-independent review is **unverified**, not a passed check. The PR remains draft.
-
-## Device follow-up, 2026-09-29
-
-**Verified, read-only, SteamOS BUILD_ID 20260925.6191901:** the Frame was
-reachable, charging (44% initially, 63% at the end), and SteamVR reported
-activity level 3 (standby). No Plasma desktop was running. Introspection of
-the active `org.freedesktop.portal.Desktop` service exposed ScreenCast with
-source types 3, but no RemoteDesktop interface. **Inferred:** this gamescope
-session cannot provide this feature's required consented input path; a
-ScreenCast-only session is insufficient.
-
-**Blocked, not a device execution result:** the shared `/tmp/frame-test.lock`
-was held by another thread. Ten lock-acquisition attempts over five minutes
-all failed, after earlier preparation-time attempts also found it occupied.
-The current `a992f6d` ARM64 CI bundle was downloaded to the Mac, but nothing
-was installed, launched or stopped on the Frame. No new screenshots or
-current-revision device timings were obtained. The lock was not removed and
-no global settings were changed. The earlier synthetic results above remain
-valid only for their named revisions; standby visibility, physical laser
-input and worn-headset performance remain unverified.
-
-**Verified, Mac:** a fresh full suite ran 309 tests successfully, with one
-native-PC class skipped. Current-revision CI passed
-[native hosts](https://github.com/saphid/frame-control/actions/runs/36504546909),
-[installers](https://github.com/saphid/frame-control/actions/runs/36504546800)
-and [general checks](https://github.com/saphid/frame-control/actions/runs/36504546887).
@@ -132,8 +132,8 @@ runs.

 ## Report a problem

-**Report a problem** is the speech-bubble button in the header, also in the
-Settings page (**Privacy & updates**) and under **Help → Report a Problem…**. It sends the report
+**Report a problem** is the warning-sign button in the header, also in the
+Privacy panel and under **Help → Report a Problem…**. It sends the report
 privately to Frame Control's PostHog project as a `problem_report` event, the
 same way as the analytics above, so only the maintainer can read it and
 nothing is published. It works whatever the analytics settings are, because
@@ -65,8 +65,6 @@ flow, not evidence of an anonymous download API. It is not implemented here.
 - `search()` raises a user-readable `SourceError` with the browse URL (zero
  limit returns no rows). It does not invent app results or report a false
  “no matching games”. The aggregate search UI should surface this source error.
-  In the app, Discover doesn't link to it; the **Sources** dialog lists SideQuest
-  with a link to its website instead of an on/off switch.
 - `details()` accepts a numeric listing id and returns its canonical page link,
  `downloadable: False`, empty versions/tags/headsets and the `images` shape
  `{icon: None, banner: None, screenshots: []}`. Name is explicitly a listing id;
@@ -187,16 +187,12 @@ refuses ids with a hyphen (`missing/invalid arguments`), which the fake had
 accepted. The fake now refuses them the same way, and Frame Control makes ids
 Steam accepts.

-## PC panel host tests
+## Tracking protocols and fake BlueZ

-`tests/test_pcview.py` checks source-bound tickets, reconnect/Stop revocation,
-input release, source-coordinate mapping and use of the existing panel
-launcher. The `PC host libraries` workflow builds the bundled native adapter
-on Windows, Ubuntu x64 and Ubuntu ARM64, then runs a real x264 synthetic
-stream through the HTTP/WebSocket agent. `FRAME_PC_REQUIRE_NATIVE=1` makes a
-missing native bundle fail CI instead of skipping. These tests do not grant a
-portal dialog, capture a desktop, exercise a hardware encoder or validate
-laser alignment. See [PC host evidence](pc-in-headset.md#evidence).
+`tests/test_tracking.py` exercises our gaze conversion, OSC sender, HRS parser
+and BlueZ lifecycle with an in-memory fake object tree. It runs in the normal
+unit suite without Bluetooth, GTK or OpenXR. Real Frame results and the absent
+strap/tracker boundaries are recorded in [tracking](tracking.md).

 ## Windows test VM

@@ -0,0 +1,329 @@
+# Eye tracking and heart rate
+
+Frame Control's own tools run on the Frame, using OpenXR and BlueZ. No
+VRCFaceTracking, LunaHR, Pulsoid or other tracking app is required. This is a
+command-line first version; it does not add a desktop app tab.
+
+## What was checked
+
+**Verified 2026-09-28**, on a real aarch64 Frame running SteamOS 0.4.1,
+BUILD_ID `20260925.6191901`:
+
+| Check | Result |
+|---|---|
+| OpenXR gaze | SteamVR advertises `XR_EXT_eye_gaze_interaction`, `XR_MND_headless` and `XR_KHR_convert_timespec_time`. `supportsEyeGazeInteraction=1`. A headless session reached FOCUSED and produced 269 valid, tracked orientations in the first ten-second probe. |
+| Our gaze → OSC bridge | A separate ten-second run produced 280 valid samples and 280 correctly padded 44-byte `/tracking/eye/CenterPitchYaw` messages at an explicitly configured loopback receiver. Only counters and packet-layout checks were retained. |
+| Bluetooth stack | BlueZ active, adapter powered, central/peripheral roles available. LE discovery started and stopped successfully. No pairing or adapter power settings changed. |
+| Our heart-rate panel | GTK4/GI runs on the stock image. A **synthetic 72 BPM** notification displayed in our X11 window, tagged `STEAM_GAME=2000000027`. Window capture checked; no real heart-rate measurement was taken. |
+| SlimeVR, separate feasibility check | Native aarch64 server v21.1.0 ran with an isolated Temurin 21 JRE, created its driver sockets and accepted a local TCP connection on port 21110. Driver v6.0.0 loaded with all shared libraries resolved; `HmdDriverFactory("IServerTrackedDeviceProvider_004")` returned a non-null provider and error 0. |
+
+![Our heart-rate panel on the Frame, showing synthetic 72 BPM](img/heart-rate-panel.png)
+
+The image is a capture of our own Frame window using a fake notification,
+not a real sensor reading.
+
+**Untested:** a real BLE strap's notifications, physical fit/contact behaviour,
+end-to-end heart-rate display/OSC/log with a strap, avatar response in VRChat,
+gaze accuracy/calibration, coexistence with every immersive app, in-headset
+panel placement, SlimeVR tracker/calibration data and the SlimeVR driver running
+inside SteamVR. No trackers or strap are attached. The driver was loaded in a
+separate process; it was **not registered or activated in SteamVR**. Steam and
+SteamVR were not stopped or restarted.
+
+**Verified blocker resolved:** importing `tkinter` fails because `libtk8.6.so`
+is absent. The panel uses the installed GTK4/GI bindings instead. The Frame's
+OpenXR headers advertise a newer API version than the runtime accepts; our
+reader requests OpenXR 1.0 explicitly.
+
+## Install our tools
+
+From this checkout on your computer, while the Frame is awake:
+
+```sh
+python3 scripts/tracking-on-frame.py install
+```
+
+This copies our Python code and compiles our small C OpenXR reader into
+`~/.local/share/frame-control/tracking/` on the Frame. It uses the Frame's
+existing compiler, OpenXR headers/loader, Python, dbus-python, GI and GTK4.
+Nothing is downloaded, and no sudo, driver registration, system setting,
+service or autostart is added. `FRAME_ALIAS` can select another SSH alias.
+The desktop app/server keeps its existing stdlib-only dependency set.
+
+## Eye tracking → OSC
+
+Start with a ten-second capability/data-availability check:
+
+```sh
+python3 scripts/tracking-on-frame.py gaze --seconds 10
+```
+
+This prints support, session-state numbers and sample counters. It opens no
+OSC socket and prints no gaze coordinates. Exit 0 means at least one valid
+sample, 3 means no valid sample was observed, and 1 means an API/runtime error.
+If there are no valid samples, wake/wear the headset and check its tracking
+setup; a successful capability check alone does not prove usable gaze.
+
+To send to VRChat running **on the Frame**, explicitly enable OSC in VRChat
+and choose its local UDP endpoint:
+
+```sh
+python3 scripts/tracking-on-frame.py gaze --seconds 3600 --osc 127.0.0.1 9000
+```
+
+For a receiver on another computer, replace `127.0.0.1` with that computer's
+IP address and choose its listening port. Addresses are IP literals (IPv4 or
+IPv6); there is no discovery or default destination. Loopback here always
+means **the Frame**, not the computer running the SSH command. OSC uses
+unencrypted UDP: configure only a receiver you intend to receive this data.
+
+**Documented:** [VRChat's eye OSC interface](https://docs.vrchat.com/docs/osc-eye-tracking)
+accepts `/tracking/eye/CenterPitchYaw` with two floats in degrees, positive down
+and right. We locate OpenXR's combined gaze pose relative to VIEW (the head),
+rotate its -Z forward vector and convert that direction to these angles.
+Only active, orientation-valid **and tracked** samples are sent, at up to
+30 Hz. No eyelid/blink, individual-eye or face values are invented. We do not
+send neutral gaze on tracking loss; VRChat's documented timeout restores its
+automatic eye behaviour after input stops.
+
+**Privacy:** gaze is personal data. It stays in process memory and a private
+pipe between our reader and bridge. There is no gaze log option, telemetry,
+OSC receiver or raw gaze on stdout/stderr. Only an explicit `--osc IP PORT`
+opens an output socket. Runtime diagnostics and validity counters are not
+measurements. Stop with Ctrl-C or let `--seconds` expire (maximum 24 hours).
+A lost headless session ends the run; it does not silently reconnect.
+
+## BLE heart rate → our panel, OSC and optional log
+
+First discover/pair your strap in SteamOS's Bluetooth settings. Select that
+strap's Bluetooth address explicitly; our tool does not scan for or connect
+to arbitrary nearby devices.
+
+```sh
+python3 scripts/tracking-on-frame.py heart \
+  --device AA:BB:CC:DD:EE:FF --panel --seconds 3600
+```
+
+This uses BlueZ's standard Heart Rate Service (`180d`) and Heart Rate
+Measurement (`2a37`) notifications. It finds the characteristic only beneath
+the selected device's HRS service. The reader handles 8- and 16-bit BPM,
+contact flags and optional energy/RR fields; energy and RR intervals are
+validated for length but discarded. Zero BPM, reported loss of skin contact,
+malformed packets and readings older than five seconds are not shown as a
+current measurement. A disconnect stops the run; reconnect and start again.
+This is a social/fitness readout, not a medical monitor.
+
+The panel is our GTK4 window on gamescope's X display. Use SteamVR's panel
+controls to float/dock it (see [panels](panels.md)). **Stop**, closing the panel,
+Ctrl-C, SSH hangup or the duration limit ends our subscription. A connection
+that was already open when we started is preserved; a connection we opened
+is disconnected on exit. No Bluetooth power or pairing state is changed.
+
+Add either output explicitly:
+
+```sh
+python3 scripts/tracking-on-frame.py heart \
+  --device AA:BB:CC:DD:EE:FF --panel --seconds 3600 \
+  --osc 127.0.0.1 9000 --address /avatar/parameters/HeartRate \
+  --log /home/steamos/heart-session.csv
+```
+
+The OSC value is integer BPM. `HeartRate` is a chosen avatar parameter, **not a
+built-in VRChat heart-rate feature**; your avatar/receiver must define the
+matching parameter. `--address` can select another literal OSC path. The local
+panel works without OSC, a log or an avatar integration.
+
+The optional CSV contains only `unix_seconds,bpm`. It is created privately
+(mode 0600), refuses existing files/symlinks, and lives **on the Frame** at the
+path you specify. Nothing is logged by default, and heart-rate values are not
+printed to the terminal. Delete your session file when you no longer need it.
+
+### Checking heart rate against a reference
+
+`scripts/heart-check.py` runs on your computer. `listen` shows our OSC
+readings live as they arrive, so you can watch them next to another device:
+
+```sh
+python3 scripts/heart-check.py listen --port 9000 --out ours.csv
+```
+
+Point the Frame at it with `--osc <your computer's IP> 9000`. `compare` lines
+up two recordings by time and reports the mean difference, bias, the share
+within ±5 BPM and the delay between them. It passes when the mean difference
+is at most 5 BPM, at least 80% of reference readings are matched and nothing
+was shown while the sensor reported lost skin contact:
+
+```sh
+python3 scripts/heart-check.py compare ours.csv reference.csv
+python3 scripts/heart-check.py compare ours.csv ~/Downloads/export.zip
+```
+
+The reference can be a CSV (`time,bpm[,flags]`, time in unix seconds or ISO
+8601) or an Apple Health export (`export.zip` or `export.xml`). Only heart-rate
+records within the recording's time range are read. Everything stays on your
+computer.
+
+`scripts/heart-test-strap.swift` turns a Mac into a synthetic strap. It
+advertises the standard Heart Rate Service and sends a fixed, known sequence
+(8-bit and 16-bit values and a skin-contact loss), printing each sent value, so
+`compare` can check that the Frame shows exactly what was sent. It needs
+Bluetooth permission for the process that runs it. **Untested on 2026-09-29:**
+it compiled, but on this Mac, launched from an agent session, macOS never
+delivered a Bluetooth state and no permission prompt appeared, so it never
+advertised.
+
+## Pulse from the eye cameras (experimental)
+
+The Frame has no heart-rate sensor. **Verified 2026-09-29** (SteamOS 0.4.1,
+build `20260925.6191901`): its sensors are an ambient light/proximity sensor
+(`vcnl4000`), a hall sensor (`als31300`), two passthrough cameras
+(`arcimx616`), two tracking cameras (`og01a1b`) and two IR eye cameras
+(`og0ve10`). There is no optical heart-rate (PPG) sensor.
+
+The experiment asks whether the eye cameras can see a pulse anyway. With each
+heartbeat, the blood volume in the skin around the eye changes slightly and
+its IR reflectance changes with it. This is camera-based photoplethysmography;
+near-IR works, though the signal is weaker than in green light.
+
+```sh
+python3 scripts/tracking-on-frame.py pulse --seconds 60 --show
+```
+
+How it works:
+
+- **Capture (verified).** SteamVR ships `eyetracking --calib N`, which saves
+  both eye cameras for N seconds as 400×400 8-bit IR PNGs with a monotonic
+  timestamp per frame, at about 90 fps per eye. SteamVR's live eye tracker,
+  part of `steamvr.service`, gets its frames from the DSP and stops its
+  cameras when the headset is off. Unworn captures ran alongside it: its PID
+  and log were unchanged and our OpenXR gaze session still started
+  afterwards. **Untested:** whether the capture and the live tracker coexist
+  while the headset is worn and tracking.
+- **Privacy.** Each image is reduced to a 16×16 grid of patch averages as
+  soon as it is complete, then deleted. Three worker processes do this beside
+  the capture. If more than 900 images (about five seconds) ever wait, we stop
+  reading them and delete them undecoded until the capture ends, and report
+  an error. The capture directory is removed on exit, even after errors. No image is kept or leaves the Frame. The estimate
+  is printed only with `--show`, and sent or saved only with `--osc` or
+  `--log`, as for the strap.
+- **Estimate.** Patch traces are averaged down to 15 Hz and turned into
+  relative change. A 2-second moving median removes drift and blinks.
+  Patches with frequent spikes (the eyeball and eyelid) are dropped, as are
+  dark or saturated ones. The 20% of patches with the clearest rhythm between
+  42 and 180 BPM are combined in the frequency domain. Output is an overall
+  estimate plus one estimate per second over 15-second windows. A result
+  counts as **clear** only when the top patches agree and the combined signal
+  stands out from the noise. Otherwise the command exits 3 and sends no OSC.
+  `--log` still records the per-second estimates, so a comparison shows how
+  far off an unclear result was.
+  The thresholds are provisional until checked on real wearers.
+
+**Verified on the Frame, unworn, 2026-09-29:** captures of 3,600-5,400 eye
+frames never had more than 8 images on disk, finished a few seconds after the
+capture ended and left no capture directory. **The estimator alone gave a
+false "clear" pulse.** With nobody wearing the headset, five runs reported a
+steady, self-consistent rhythm (90, 90, 93, 94 and 96 BPM; patch agreement
+100%, signal/noise 0.63-0.70), and earlier runs reported 127-129 BPM at lower
+signal/noise. It is a periodic camera or illumination artifact, and its
+frequency drifts between runs. A wearer-less scene cannot contain a pulse, so
+the signal/noise gate cannot tell this artifact from one. Because of that,
+`pulse` reads the Frame's proximity sensor (`vcnl4000`) before and after the
+capture. It reads about 3 unworn (**verified**). If either reading is below 20
+the result is never called clear, nothing is sent over OSC, and the command
+exits 3. **Inferred, unmeasured:** that a worn reading is well above 20; the
+cut-off is provisional until someone wears the headset. If the sensor can't be
+read, the guard is skipped. Confirming a real pulse also needs a reference
+(below).
+
+**Do not interrupt the capture. Verified on the Frame, 2026-09-29:** sending
+SIGTERM to `eyetracking --calib` left the DSP service's eye camera (OV6211)
+stuck "streaming": its log had no "Stopping streaming" line, and every later
+request failed with "Failed to start streaming". Head tracking kept working.
+Clearing it needs the DSP service restarted or the Frame rebooted, so `pulse`
+never signals the tool. After Ctrl-C or a failure it keeps deleting images
+until the tool ends by itself (at most the `--seconds` plus a few seconds),
+and only kills a tool that overruns by 30 s, with a warning that the eye
+cameras may need a reboot. So an interrupted run can take a while to return.
+
+**Verified on synthetic data** (unit tests): a 0.3% brightness pulse in a
+third of the patches, with noise, drift, blinks and eye movement, is
+recovered within 1.5 BPM at 58, 72 and 115 BPM; noise and blinks alone are
+not reported as a pulse. **Not yet verified:** whether a real wearer's eye
+images contain a usable pulse, and how accurate it is. That needs someone
+wearing the headset and a reference, as below.
+
+### Comparing with an Apple Watch
+
+1. On the watch, start a workout (for example **Other**) so it measures heart
+   rate every few seconds rather than occasionally.
+2. Put the Frame on, sit still and look ahead. Run:
+
+   ```sh
+   python3 scripts/tracking-on-frame.py pulse --seconds 120 --show \
+     --log /home/steamos/pulse.csv
+   ```
+
+   The per-second estimates print at the end. Compare them with what the
+   watch showed.
+3. End the workout. On the iPhone, open Health → your picture → **Export All
+   Health Data**, and AirDrop `export.zip` to the Mac.
+4. On the Mac:
+
+   ```sh
+   scp frame:pulse.csv . && ssh frame rm pulse.csv
+   python3 scripts/heart-check.py compare pulse.csv ~/Downloads/export.zip
+   ```
+
+This first version analyses after the capture ends, because the method must
+prove itself before a live panel is worth building. The Apple Watch is a
+reference, not ground truth: in workouts it is typically within a few BPM of
+a chest strap when you are still.
+
+## SlimeVR: feasibility only
+
+SlimeVR is an independent application stack. Neither of our features installs,
+launches or depends on it. Users who want it can follow
+[SlimeVR's setup documentation](https://docs.slimevr.dev/server/index.html).
+The consented upstream releases tested were
+[server v21.1.0](https://github.com/SlimeVR/SlimeVR-Server/releases/tag/v21.1.0)
+and [driver v6.0.0](https://github.com/SlimeVR/SlimeVR-OpenVR-Driver/releases/tag/v6.0.0),
+under SlimeVR's MIT/Apache-2.0 licensing.
+
+**Verified layout, read-only:** the Frame's registered runtime is `/opt/steamvr`;
+its native driver is `drivers/cv/bin/linuxarm64/driver_cv.so`, with a
+`drivers/cv/driver.vrdrivermanifest`. Frame controller manifests/resources are
+under `drivers/frame_controller/`. Configuration is under
+`~/.config/openvr/config/`, not the Steam client's config directory. The
+SlimeVR release also uses `slimevr/bin/linuxarm64/driver_slimevr.so` plus its
+manifest. Nothing in those installed SteamVR directories was changed.
+
+**Inferred:** the matching ABI/layout and standalone factory success make
+SteamVR integration plausible. They do not prove successful driver `Init`,
+server/driver IPC, tracking, or calibration. That needs a separate integration
+check with hardware and an agreed SteamVR restart. No Java executable was on
+PATH for this check, so an isolated JRE was used. SlimeVR's server opens LAN
+listeners; our temporary server was stopped and the temporary downloads,
+configuration and logs were removed. It is not left installed or running.
+
+## Tests and remaining checks
+
+```sh
+python3 -m unittest discover -s tests
+```
+
+`tests/test_tracking.py` covers HRS packet parsing, contact/staleness, OSC
+padding/types and a real loopback socket, quaternion signs, opt-in networking,
+private/exclusive logging and a fake BlueZ object tree. The fake checks service
+ownership, notification routing, delayed GATT discovery and connection cleanup.
+It does not pretend to be a physical strap or a real OpenXR runtime.
+
+Before calling hardware support complete, attach a strap and check BPM against
+its own display/reference, loss of contact, disconnect/reconnect, Stop, OSC and
+CSV together. Check avatar eyes while looking up/down/left/right in a supported
+VRChat session. No third-party tracking app is needed for either test.
+
+Independent review attempt: `devin -p --model swe-2-max` with the frozen diff,
+contribution standards and read-only instructions returned no output for ten
+minutes. It was terminated with exit 143. No completed review or actual model
+identity was returned; hardware checks and independent review remain follow-up
+work before making the draft ready.
@@ -94,7 +94,7 @@ A new shortcut is rolled back if artwork fails; failure is never reported as
 an installed app with a blank tile.

 Artwork preference is **SteamGridDB → source images → generated fallback**.
-Set the optional free key in Frame Control's **Settings → Library artwork**, or
+Set the optional free key in Frame Control's **Library artwork settings**, or
 `STEAMGRIDDB_API_KEY` (`FRAME_STEAMGRIDDB_API_KEY` also works). Environment
 settings override the saved key. Without a key there are no provider calls or
 warnings. Saved keys stay in host app data, mode 0600 on POSIX, and are never
@@ -11,7 +11,7 @@ checks below. The PR stays draft.

 ## Our performance HUD

-On **Home → VR performance** (folded until you open it), the app shows a timestamped sample
+On **Home → VR comfort and performance**, the app shows a timestamped sample
 with each status refresh (30 seconds, or Refresh). **Open HUD in headset**
 starts our text HUD as a gamescope panel, refreshed every two seconds. In the
 SteamVR dashboard, select **Frame Control HUD**, then Float in World or dock
@@ -26,7 +26,7 @@ it twice reuses the existing process.
 | Compositor CPU | OpenVR compositor render CPU milliseconds, not game CPU time. |
 | System CPU | `/proc/stat` busy-time delta across the sample, with guest time counted once and iowait treated as idle. |
 | GPU clock | `3d00000.gpu/cur_freq`, converted from Hz to MHz; frequency is not load. |
-| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. In the headset HUD only: the app shows them once, in the battery menu at the top. |
+| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. |

 OpenVR uses background application mode, which does not start SteamVR or keep
 it running. This mode also returned live timing in a read-only device probe.
@@ -6,7 +6,7 @@ is required.** Chromium and immersive WebXR are not in this playback path.

 ## Use it

-In **Tools → Media player** (or **Play a video or photo** on Home), send a file, choose its layout and press
+In **Tools → Media in the headset**, send a file, choose its layout and press
 **Play**. **Theatre** gives it a larger screen and an 85% black surround.
 **Stop** removes both. Refresh reads the library and the player's state.
 The screen follows your head; it isn't a saved world-space panel.
@@ -0,0 +1,135 @@
+/* Frame Control's OpenXR gaze source. No values on stdout/stderr or disk.
+ * The Python bridge supplies a private pipe with --fd; standalone probes only
+ * report counters. Uses a headless session, never submits frames or takes focus. */
+#define XR_USE_TIMESPEC
+#include <time.h>
+#include <openxr/openxr.h>
+#include <openxr/openxr_platform.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+static volatile sig_atomic_t stopped;
+static void stop(int sig) { (void)sig; stopped = 1; }
+#define CHECK(call) do { result = (call); if (XR_FAILED(result)) { \
+    fprintf(stderr, "%s failed (%d)\n", #call, result); goto cleanup; } } while (0)
+
+int main(int argc, char **argv) {
+    int seconds = 10, fd = -1, running = 0, rc = 1;
+    unsigned active = 0, valid = 0, samples = 0;
+    for (int i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "--seconds") && i+1 < argc) seconds = atoi(argv[++i]);
+        else if (!strcmp(argv[i], "--fd") && i+1 < argc) fd = atoi(argv[++i]);
+        else { fprintf(stderr, "usage: gaze [--seconds 1..86400] [--fd private-pipe]\n"); return 2; }
+    }
+    if (seconds < 1 || seconds > 86400 || (fd != -1 && fd < 3)) return 2;
+    FILE *out = fd == -1 ? NULL : fdopen(fd, "w");
+    if (fd != -1 && !out) return 2;
+    signal(SIGINT, stop); signal(SIGTERM, stop); signal(SIGHUP, stop); signal(SIGPIPE, SIG_IGN);
+    XrResult result;
+    XrInstance instance = XR_NULL_HANDLE;
+    XrSession session = XR_NULL_HANDLE;
+    XrActionSet set = XR_NULL_HANDLE;
+    XrSpace gaze = XR_NULL_HANDLE, view = XR_NULL_HANDLE;
+    const char *extensions[] = {"XR_EXT_eye_gaze_interaction", "XR_MND_headless", "XR_KHR_convert_timespec_time"};
+    XrInstanceCreateInfo create = {.type = XR_TYPE_INSTANCE_CREATE_INFO};
+    strcpy(create.applicationInfo.applicationName, "Frame Control gaze");
+    create.applicationInfo.apiVersion = XR_MAKE_VERSION(1, 0, 0);
+    create.enabledExtensionCount = 3; create.enabledExtensionNames = extensions;
+    CHECK(xrCreateInstance(&create, &instance));
+    XrSystemGetInfo get = {.type = XR_TYPE_SYSTEM_GET_INFO, .formFactor = XR_FORM_FACTOR_HEAD_MOUNTED_DISPLAY};
+    XrSystemId system;
+    CHECK(xrGetSystem(instance, &get, &system));
+    XrSystemEyeGazeInteractionPropertiesEXT eye = {.type = XR_TYPE_SYSTEM_EYE_GAZE_INTERACTION_PROPERTIES_EXT};
+    XrSystemProperties props = {.type = XR_TYPE_SYSTEM_PROPERTIES, .next = &eye};
+    CHECK(xrGetSystemProperties(instance, system, &props));
+    printf("supportsEyeGazeInteraction=%u\n", eye.supportsEyeGazeInteraction);
+    if (!eye.supportsEyeGazeInteraction) goto cleanup;
+    XrSessionCreateInfo sc = {.type = XR_TYPE_SESSION_CREATE_INFO, .systemId = system};
+    CHECK(xrCreateSession(instance, &sc, &session));
+    XrActionSetCreateInfo asc = {.type = XR_TYPE_ACTION_SET_CREATE_INFO};
+    strcpy(asc.actionSetName, "gaze"); strcpy(asc.localizedActionSetName, "Gaze");
+    CHECK(xrCreateActionSet(instance, &asc, &set));
+    XrActionCreateInfo ac = {.type = XR_TYPE_ACTION_CREATE_INFO, .actionType = XR_ACTION_TYPE_POSE_INPUT};
+    strcpy(ac.actionName, "gaze_pose"); strcpy(ac.localizedActionName, "Gaze pose");
+    XrAction action;
+    CHECK(xrCreateAction(set, &ac, &action));
+    XrPath profile, input;
+    CHECK(xrStringToPath(instance, "/interaction_profiles/ext/eye_gaze_interaction", &profile));
+    CHECK(xrStringToPath(instance, "/user/eyes_ext/input/gaze_ext/pose", &input));
+    XrActionSuggestedBinding binding = {action, input};
+    XrInteractionProfileSuggestedBinding suggested = {.type = XR_TYPE_INTERACTION_PROFILE_SUGGESTED_BINDING,
+        .interactionProfile = profile, .countSuggestedBindings = 1, .suggestedBindings = &binding};
+    CHECK(xrSuggestInteractionProfileBindings(instance, &suggested));
+    XrSessionActionSetsAttachInfo attach = {.type = XR_TYPE_SESSION_ACTION_SETS_ATTACH_INFO, .countActionSets = 1, .actionSets = &set};
+    CHECK(xrAttachSessionActionSets(session, &attach));
+    XrActionSpaceCreateInfo space = {.type = XR_TYPE_ACTION_SPACE_CREATE_INFO, .action = action, .poseInActionSpace.orientation.w = 1};
+    CHECK(xrCreateActionSpace(session, &space, &gaze));
+    XrReferenceSpaceCreateInfo ref = {.type = XR_TYPE_REFERENCE_SPACE_CREATE_INFO, .referenceSpaceType = XR_REFERENCE_SPACE_TYPE_VIEW,
+        .poseInReferenceSpace.orientation.w = 1};
+    CHECK(xrCreateReferenceSpace(session, &ref, &view));
+    PFN_xrConvertTimespecTimeToTimeKHR convert;
+    CHECK(xrGetInstanceProcAddr(instance, "xrConvertTimespecTimeToTimeKHR", (PFN_xrVoidFunction *)&convert));
+    struct timespec start, now;
+    clock_gettime(CLOCK_MONOTONIC, &start);
+    while (!stopped) {
+        clock_gettime(CLOCK_MONOTONIC, &now);
+        if (now.tv_sec - start.tv_sec >= seconds) break;
+        XrEventDataBuffer event = {.type = XR_TYPE_EVENT_DATA_BUFFER};
+        while ((result = xrPollEvent(instance, &event)) == XR_SUCCESS) {
+            if (event.type == XR_TYPE_EVENT_DATA_SESSION_STATE_CHANGED) {
+                XrSessionState state = ((XrEventDataSessionStateChanged *)&event)->state;
+                printf("sessionState=%d\n", state); fflush(stdout);
+                if (state == XR_SESSION_STATE_READY && !running) {
+                    XrSessionBeginInfo begin = {.type = XR_TYPE_SESSION_BEGIN_INFO, .primaryViewConfigurationType = XR_VIEW_CONFIGURATION_TYPE_PRIMARY_STEREO};
+                    CHECK(xrBeginSession(session, &begin)); running = 1;
+                } else if (state == XR_SESSION_STATE_STOPPING) {
+                    CHECK(xrEndSession(session)); running = 0; stopped = 1;
+                } else if (state == XR_SESSION_STATE_EXITING || state == XR_SESSION_STATE_LOSS_PENDING) stopped = 1;
+            } else if (event.type == XR_TYPE_EVENT_DATA_INSTANCE_LOSS_PENDING) stopped = 1;
+            event.type = XR_TYPE_EVENT_DATA_BUFFER;
+        }
+        if (XR_FAILED(result)) goto cleanup;
+        if (running && !stopped) {
+            XrActiveActionSet activeSet = {set, XR_NULL_PATH};
+            XrActionsSyncInfo sync = {.type = XR_TYPE_ACTIONS_SYNC_INFO, .countActiveActionSets = 1, .activeActionSets = &activeSet};
+            CHECK(xrSyncActions(session, &sync));
+            if (result != XR_SUCCESS) {
+                struct timespec delay = {.tv_nsec = 33333333};
+                nanosleep(&delay, NULL);
+                continue; /* No stale gaze when the runtime denies focus. */
+            }
+            XrActionStateGetInfo ag = {.type = XR_TYPE_ACTION_STATE_GET_INFO, .action = action};
+            XrActionStatePose pose = {.type = XR_TYPE_ACTION_STATE_POSE};
+            CHECK(xrGetActionStatePose(session, &ag, &pose));
+            samples++;
+            if (pose.isActive) {
+                active++;
+                XrTime time; CHECK(convert(instance, &now, &time));
+                XrSpaceLocation location = {.type = XR_TYPE_SPACE_LOCATION};
+                CHECK(xrLocateSpace(gaze, view, time, &location));
+                XrSpaceLocationFlags needed = XR_SPACE_LOCATION_ORIENTATION_VALID_BIT | XR_SPACE_LOCATION_ORIENTATION_TRACKED_BIT;
+                if ((location.locationFlags & needed) == needed) {
+                    valid++;
+                    if (out) {
+                        XrQuaternionf q = location.pose.orientation;
+                        if (fprintf(out, "%g %g %g %g\n", q.x, q.y, q.z, q.w) < 0 || fflush(out)) goto cleanup;
+                    }
+                }
+            }
+        }
+        struct timespec delay = {.tv_nsec = 33333333}; nanosleep(&delay, NULL);
+    }
+    printf("samples=%u active=%u valid=%u\n", samples, active, valid);
+    rc = valid ? 0 : 3; /* Distinguish a working session from observed gaze. */
+cleanup:
+    if (view) xrDestroySpace(view);
+    if (gaze) xrDestroySpace(gaze);
+    if (session) xrDestroySession(session);
+    if (set) xrDestroyActionSet(set);
+    if (instance) xrDestroyInstance(instance);
+    if (out) fclose(out);
+    return rc;
+}
@@ -0,0 +1,481 @@
+"""Experimental pulse estimate from the Frame's IR eye-tracking cameras.
+
+Skin brightens and darkens very slightly with each heartbeat as blood volume
+changes (photoplethysmography). The eye cameras film the skin around each eye
+under steady IR light at about 90 frames per second, so that rhythm may be
+visible in the average brightness of small patches of skin.
+
+Capture uses SteamVR's own `eyetracking --calib` mode, which writes PNG pairs
+to /tmp. Each image is reduced to a grid of patch averages the moment it is
+complete, then deleted; the capture directory is removed on exit. No image
+leaves the Frame or outlives the run. This is an experiment, not a medical
+measurement.
+"""
+from array import array
+import bisect
+import cmath
+import json
+import math
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import time
+
+ET_DIR = Path("/opt/steamvr/tools/eyetracking")
+ET_BIN = ET_DIR / "bin/linuxarm64/eyetracking"
+ET_WEIGHTS = ET_DIR / "resources/et_dsp_20250610_03136.weights"
+GRID = 16        # 16 × 16 patches of 25 × 25 pixels on the 400 × 400 image
+RATE = 15.0      # analysis sample rate, Hz; the band of interest ends at 3 Hz
+LOW, HIGH = 42.0, 180.0  # BPM search band
+# The Frame's proximity sensor (vcnl4000) reads about 3 with nobody wearing it.
+# A worn reading has not been measured yet, so the cut-off is provisional.
+IIO = Path("/sys/bus/iio/devices")
+WORN_MIN = 20.0
+WINDOW = 15.0    # seconds per windowed estimate
+
+
+# ---------------------------------------------------------------- capture ---
+
+def grid_means(pixels, width, height, stride, channels, grid=GRID):
+    """Average of channel 0 in each of grid × grid equal patches."""
+    bw, bh = width // grid, height // grid
+    sums = [0] * (grid * grid)
+    for y in range(bh * grid):
+        start = y * stride
+        row = pixels[start:start + width * channels:channels]
+        base = (y // bh) * grid
+        for bx in range(grid):
+            sums[base + bx] += sum(row[bx * bw:(bx + 1) * bw])
+    area = bw * bh
+    return [s / area for s in sums]
+
+
+def load_grid(path):
+    import gi
+    gi.require_version("GdkPixbuf", "2.0")
+    from gi.repository import GdkPixbuf
+    image = GdkPixbuf.Pixbuf.new_from_file(str(path))
+    return grid_means(image.read_pixel_bytes().get_data(), image.get_width(), image.get_height(),
+                      image.get_rowstride(), image.get_n_channels())
+
+
+def reduce_file(loader, path):
+    """Reduce one image to its patch grid and delete it, whatever happens."""
+    try:
+        return loader(path)
+    finally:
+        os.unlink(path)
+
+
+class Capture:
+    """Run SteamVR's eye-camera capture and reduce frames as they arrive."""
+    NAME = re.compile(r"^(left|right)_(\d+)\.png$")
+    # Only SteamVR's own capture directories are read and removed.
+    PREFIX = "/tmp/etcalib_"
+    # Printed by the capture tool; its output is only flushed when it exits.
+    WRITING = re.compile(r"Writing capture to: (\S+)")
+    # About five seconds of frames (~65 MB in RAM-backed /tmp). If reduction
+    # falls further behind than this, the capture stops rather than letting
+    # eye images pile up.
+    MAX_BACKLOG = 900
+
+    def __init__(self, seconds, runner=subprocess.Popen, loader=load_grid, workers=3):
+        self.seconds, self.runner, self.loader, self.workers = seconds, runner, loader, workers
+        self.grids = {"left": {}, "right": {}}
+        self.directory = None
+        self.pool = None
+        self.submitted = set()
+        self.futures = {}
+        self.new = set()  # every capture directory that appeared during our run
+        self.before = None  # capture directories that existed before the run
+        self.log = None
+
+    def candidates(self):
+        parent, stem = os.path.split(self.PREFIX)
+        return {Path(entry.path) for entry in os.scandir(parent)
+                if entry.name.startswith(stem) and entry.is_dir(follow_symlinks=False)}
+
+    def run(self):
+        # The capture tool's output goes to a private temporary file, read for
+        # failure messages. It is block-buffered, so the capture directory is
+        # found by watching for a new one rather than waiting for its name.
+        import tempfile
+        self.before = before = self.candidates()
+        process = None
+        with tempfile.TemporaryFile("w+") as log:
+            self.log = log
+            try:
+                if self.workers:
+                    # SteamVR pins its eye tracker to cores 0-1; decoding runs beside it.
+                    import concurrent.futures
+                    import multiprocessing
+                    self.pool = concurrent.futures.ProcessPoolExecutor(
+                        self.workers, mp_context=multiprocessing.get_context("fork"))
+                process = self.runner([str(ET_BIN), "-b", "CDSP", "-w", str(ET_WEIGHTS), "--calib", str(self.seconds)],
+                                      cwd=str(ET_BIN.parent), stdout=log, stderr=subprocess.STDOUT)
+                deadline = time.monotonic() + self.seconds + 30
+                while True:
+                    # Checked on every poll: a second capture directory means
+                    # we can't tell which images are ours, so stop.
+                    self.new |= self.candidates() - before
+                    if len(self.new) > 1:
+                        raise RuntimeError("another eye-camera capture is running")
+                    if not self.directory and self.new:
+                        self.directory = next(iter(self.new))
+                    finished = process.poll() is not None
+                    self.reduce(final=finished)
+                    if finished:
+                        break
+                    if time.monotonic() > deadline:
+                        raise RuntimeError("eye-camera capture did not finish")
+                    time.sleep(0.02)
+                log.seek(0)
+                text = log.read()
+                if process.returncode or not self.directory:
+                    reason = "cameras unavailable" if "Failed to" in text else f"exit {process.returncode}"
+                    raise RuntimeError(f"eye-camera capture failed ({reason})")
+                named = self.written(log)
+                if named and named != self.directory:
+                    raise RuntimeError("the capture wrote somewhere else; not using those images")
+                return self.frames()
+            finally:
+                # Each step runs even if an earlier one failed: eye images must
+                # be removed whatever else went wrong.
+                # Ctrl-C and SIGTERM (raised as KeyboardInterrupt) are held
+                # until the images are gone, then re-raised.
+                interrupted, failed = None, None
+                for step in (lambda: self.finish(process),
+                             lambda: self.pool and self.pool.shutdown(wait=True, cancel_futures=True),
+                             self.adopt_reported):
+                    try:
+                        step()
+                    except BaseException as error:
+                        if isinstance(error, Exception):
+                            failed = failed or error
+                        else:
+                            interrupted = interrupted or error
+                self.log = None
+                self.remove()
+                if interrupted:
+                    raise interrupted
+                if failed:
+                    raise RuntimeError(f"the eye-camera capture did not stop cleanly: {failed}")
+
+    def finish(self, process):
+        """Let the capture tool end by itself, deleting its images meanwhile.
+
+        Never signal it: stopping the tool early leaves the headset's eye
+        camera stuck streaming until the DSP service restarts (verified on the
+        Frame with SIGTERM). Its run is bounded by `seconds`, so waiting is
+        short. Only if it overruns by a wide margin is it killed."""
+        if not process:
+            return
+        interrupted = None
+        give_up = time.monotonic() + self.seconds + 30
+        while True:
+            try:
+                if process.poll() is not None:
+                    break
+                self.discard()
+                if time.monotonic() > give_up:
+                    process.kill()
+                    process.wait()
+                    raise RuntimeError("the eye-camera capture had to be killed; "
+                                       "the eye cameras may need a reboot to stream again")
+                time.sleep(0.05)
+            except KeyboardInterrupt as error:  # keep cleaning up until it ends
+                interrupted = interrupted or error
+        if interrupted:
+            raise interrupted
+
+    def discard(self):
+        """Delete the eye images written so far, without reading them."""
+        if self.before is not None:
+            self.new |= self.candidates() - self.before
+        for directory in self.new | ({self.directory} if self.directory else set()):
+            if str(directory).startswith(self.PREFIX) and directory.is_dir() and not directory.is_symlink():
+                for entry in os.scandir(directory):
+                    if self.NAME.match(entry.name):
+                        try:
+                            os.unlink(entry.path)
+                        except OSError:
+                            pass
+
+    def adopt_reported(self):
+        """The directory the tool reported is ours by its own account."""
+        named = self.written(self.log)
+        if named and str(named).startswith(self.PREFIX):
+            self.new.add(named)
+
+    def written(self, log):
+        """The directory the capture tool reported, once its output is flushed."""
+        log.seek(0)
+        match = self.WRITING.search(log.read())
+        return Path(match.group(1)) if match else None
+
+    def reduce(self, final=False):
+        """Reduce and delete every complete image; an image is complete once a
+        later one of the same eye exists, or the capture has ended."""
+        if not self.directory or not self.directory.is_dir():
+            return
+        pending = {"left": [], "right": []}
+        for entry in os.scandir(self.directory):
+            match = self.NAME.match(entry.name)
+            if match:
+                pending[match.group(1)].append((int(match.group(2)), entry.path))
+        if sum(len(files) for files in pending.values()) > self.MAX_BACKLOG:
+            raise RuntimeError("eye-image processing fell behind; capture abandoned")
+        for eye, files in pending.items():
+            files.sort()
+            ready = files if final else files[:-1]
+            for index, path in ready:
+                if path in self.submitted:
+                    continue
+                self.submitted.add(path)
+                if self.pool:
+                    self.futures[(eye, index)] = self.pool.submit(reduce_file, self.loader, path)
+                else:
+                    self.grids[eye][index] = array("f", reduce_file(self.loader, path))
+        for key, future in list(self.futures.items()):
+            if final or future.done():
+                self.grids[key[0]][key[1]] = array("f", future.result())
+                del self.futures[key]
+
+    def frames(self):
+        """[(monotonic seconds, eye, grid)] joined with the capture metadata."""
+        meta = json.loads((self.directory / "meta.json").read_text())
+        frames = []
+        for pair in meta["frames"]:
+            for eye in ("left", "right"):
+                info = pair.get(eye) or {}
+                match = self.NAME.match(Path(info.get("fname", "")).name)
+                grid = self.grids[eye].get(int(match.group(2))) if match else None
+                if info.get("valid") and grid is not None:
+                    frames.append((float(info["tsMono"]), eye, grid))
+        return frames
+
+    def remove(self):
+        """Remove every capture directory that appeared during the run. Eye
+        images must not outlive it, so a failure to delete is an error."""
+        left = []
+        if self.before is not None:
+            try:
+                self.new |= self.candidates() - self.before  # even if interrupted before the first poll
+            except OSError:
+                pass
+        for directory in self.new | ({self.directory} if self.directory else set()):
+            if str(directory).startswith(self.PREFIX) and directory.is_dir() and not directory.is_symlink():
+                try:
+                    shutil.rmtree(directory)
+                except OSError:
+                    left.append(str(directory))
+        if left:
+            raise RuntimeError("could not delete eye images in " + ", ".join(sorted(left)))
+
+
+# --------------------------------------------------------------- analysis ---
+
+def fft(values):
+    """In-place iterative radix-2 FFT of a list whose length is a power of 2."""
+    n = len(values)
+    a = list(values)
+    j = 0
+    for i in range(1, n):
+        bit = n >> 1
+        while j & bit:
+            j ^= bit
+            bit >>= 1
+        j |= bit
+        if i < j:
+            a[i], a[j] = a[j], a[i]
+    size = 2
+    while size <= n:
+        step = cmath.exp(-2j * math.pi / size)
+        half = size // 2
+        for start in range(0, n, size):
+            w = 1
+            for k in range(start, start + half):
+                t = w * a[k + half]
+                a[k + half] = a[k] - t
+                a[k] += t
+                w *= step
+        size *= 2
+    return a
+
+
+def resample(times, values, rate=RATE):
+    """Average samples into 1/rate bins from the first sample; empty bins are
+    filled from the previous bin."""
+    if not times:
+        return []
+    start = times[0]
+    count = int((times[-1] - start) * rate) + 1
+    sums, counts = [0.0] * count, [0] * count
+    for t, v in zip(times, values):
+        i = min(int((t - start) * rate), count - 1)
+        sums[i] += v
+        counts[i] += 1
+    out, last = [], None
+    for s, c in zip(sums, counts):
+        last = s / c if c else last
+        out.append(last)
+    first = next(v for v in out if v is not None)
+    return [first if v is None else v for v in out]
+
+
+def clean(signal, rate=RATE):
+    """Relative change with slow drift removed; None if the patch is mostly
+    blinks or eye movement. Spikes (blinks, saccades) become gaps at the
+    local level rather than clipped steps, which would add false rhythm."""
+    mean = sum(signal) / len(signal)
+    x = [v / mean - 1 for v in signal]
+    half = int(rate)  # 2-second centred moving median removes drift and blinks
+    trend = []
+    for i in range(len(x)):
+        chunk = sorted(x[max(0, i - half):i + half + 1])
+        trend.append(chunk[len(chunk) // 2])
+    residual = [v - m for v, m in zip(x, trend)]
+    mad = sorted(abs(v) for v in residual)[len(residual) // 2] or 1e-9
+    limit = 4 * 1.4826 * mad
+    spikes = sum(1 for v in residual if abs(v) > limit)
+    if spikes > 0.05 * len(residual):
+        return None
+    return [v if abs(v) <= limit else 0.0 for v in residual]
+
+
+def spectrum(signal, rate=RATE):
+    """[(bpm, power)] within the search band, Hann-windowed and zero-padded."""
+    n = len(signal)
+    size = 1
+    while size < max(n * 4, 256):
+        size *= 2
+    window = [0.5 - 0.5 * math.cos(2 * math.pi * i / (n - 1)) for i in range(n)] if n > 1 else [1.0]
+    padded = [s * w for s, w in zip(signal, window)] + [0.0] * (size - n)
+    result = fft(padded)
+    out = []
+    for k in range(size // 2):
+        bpm = k * rate / size * 60
+        if LOW <= bpm <= HIGH:
+            out.append((bpm, abs(result[k]) ** 2))
+    return out
+
+
+def peak(spec):
+    """Peak BPM with parabolic interpolation between spectral bins."""
+    i = max(range(len(spec)), key=lambda k: spec[k][1])
+    if 0 < i < len(spec) - 1:
+        a, b, c = spec[i - 1][1], spec[i][1], spec[i + 1][1]
+        denominator = a - 2 * b + c
+        offset = 0.5 * (a - c) / denominator if denominator else 0.0
+        return spec[i][0] + offset * (spec[1][0] - spec[0][0])
+    return spec[i][0]
+
+
+def snr(spec, bpm, width=4.0):
+    """Power near the pulse and its first harmonic against the rest of the band."""
+    near = sum(p for f, p in spec if abs(f - bpm) <= width or abs(f - 2 * bpm) <= width)
+    rest = sum(p for f, p in spec) - near
+    if near <= 0:
+        return 0.0
+    return near / rest if rest > 0 else float("inf")
+
+
+def normalised(spec):
+    total = sum(p for _, p in spec) or 1.0
+    return [p / total for _, p in spec]
+
+
+def usable(values):
+    """Patches that are neither dark nor saturated for the whole recording."""
+    mean = sum(values) / len(values)
+    return 8 <= mean <= 245
+
+
+def estimate(times, patches, rate=RATE, share=0.2, window=WINDOW):
+    """Estimate pulse from patch brightness traces.
+
+    times: monotonic seconds per frame. patches: {name: [brightness per frame]}.
+    Selects the share of usable patches with the clearest periodic signal,
+    combines their spectra and reports the overall and windowed estimates.
+    """
+    cleaned = {}
+    for name, values in patches.items():
+        if usable(values):
+            signal = clean(resample(times, values, rate), rate)
+            if signal is not None and any(signal):  # flat patches carry no rhythm
+                cleaned[name] = signal
+    if not cleaned or len(next(iter(cleaned.values()))) < rate * 8:
+        raise ValueError("need at least 8 seconds of usable eye-camera frames")
+    quality = []
+    for name, signal in cleaned.items():
+        spec = spectrum(signal, rate)
+        own = peak(spec)
+        quality.append((snr(spec, own), name, own, spec))
+    quality.sort(reverse=True)
+    chosen = quality[:max(4, int(len(quality) * share))]
+    combined = [sum(values) for values in zip(*(normalised(spec) for _, _, _, spec in chosen))]
+    bins = [f for f, _ in chosen[0][3]]
+    bpm = peak(list(zip(bins, combined)))
+    top = chosen[:8]
+    agree = sum(1 for _, _, own, _ in top if abs(own - bpm) <= 5) / len(top)
+    series = []
+    samples = int(window * rate)
+    length = len(next(iter(cleaned.values())))
+    for end in range(samples, length + 1, int(rate)):
+        specs = [spectrum(cleaned[name][end - samples:end], rate) for _, name, _, _ in chosen]
+        total = [sum(values) for values in zip(*(normalised(s) for s in specs))]
+        window_bins = [f for f, _ in specs[0]]
+        series.append((times[0] + end / rate, peak(list(zip(window_bins, total)))))
+    return {
+        "bpm": bpm,
+        "agreement": agree,
+        "patches": len(chosen),
+        "usable": len(cleaned),
+        "snr": snr(list(zip(bins, combined)), bpm),
+        "series": series,
+    }
+
+
+def analyse(frames):
+    """Estimate from Capture.frames(); both eyes' patches are analysed together
+    on a shared time base, each sample taken from that eye's nearest frame."""
+    times = sorted({t for t, _, _ in frames})
+    patches = {}
+    for eye in ("left", "right"):
+        eye_frames = sorted((t, grid) for t, e, grid in frames if e == eye)
+        if not eye_frames:
+            continue
+        eye_times = [t for t, _ in eye_frames]
+        nearest = []
+        for t in times:
+            i = bisect.bisect_left(eye_times, t)
+            if i == len(eye_times) or (i > 0 and t - eye_times[i - 1] <= eye_times[i] - t):
+                i -= 1
+            nearest.append(i)
+        for k in range(len(eye_frames[0][1])):
+            patches[f"{eye}{k}"] = [eye_frames[i][1][k] for i in nearest]
+    return estimate(times, patches)
+
+
+def proximity(root=None):
+    """The headset's proximity reading, or None if it can't be read."""
+    try:
+        for device in sorted(Path(root or IIO).glob("iio:device*")):
+            if (device / "name").read_text().strip() == "vcnl4000":
+                return float((device / "in_proximity_raw").read_text())
+    except (OSError, ValueError):
+        pass
+    return None
+
+
+def worn(reading):
+    """False only when the sensor says the headset is not on a face."""
+    return reading is None or reading >= WORN_MIN
+
+
+def reliable(result):
+    """Whether the estimate is clear enough to show as a reading. Thresholds
+    are provisional until checked against a reference on a real wearer."""
+    return result["agreement"] >= 0.75 and result["snr"] >= 0.5
@@ -0,0 +1,438 @@
+#!/usr/bin/env python3
+"""Frame-local tracking tools. No network destination or data log by default."""
+import argparse
+import math
+import os
+from pathlib import Path
+import signal
+import socket
+import struct
+import subprocess
+import time
+
+
+class TrackingError(RuntimeError):
+    """A safe, actionable status message containing no sensor data."""
+
+
+HRS = "0000180d-0000-1000-8000-00805f9b34fb"
+MEASUREMENT = "00002a37-0000-1000-8000-00805f9b34fb"
+DEVICE = "org.bluez.Device1"
+SERVICE = "org.bluez.GattService1"
+CHARACTERISTIC = "org.bluez.GattCharacteristic1"
+
+
+def heart_rate(data):
+    """Validate the Bluetooth HRS measurement, returning BPM/contact only.
+
+    Energy and RR intervals are checked for length but never retained.
+    None means contact is supported and the strap reports no skin contact.
+    """
+    data = bytes(data)
+    if len(data) < 2 or data[0] & 0xe0:
+        raise ValueError("invalid HRS measurement")
+    flags = data[0]
+    size = 2 if flags & 1 else 1
+    end = 1 + size + (2 if flags & 8 else 0)
+    if len(data) < end:
+        raise ValueError("truncated HRS measurement")
+    extra = len(data) - end
+    if (flags & 16 and (extra < 2 or extra % 2)) or (not flags & 16 and extra):
+        raise ValueError("invalid HRS optional fields")
+    if flags & 4 and not flags & 2:
+        return None
+    bpm = int.from_bytes(data[1:1 + size], "little")
+    return bpm if bpm else None
+
+
+def gaze_angles(quaternion):
+    """OpenXR head-relative -Z forward → VRChat degrees, down/right positive."""
+    if len(quaternion) != 4 or not all(math.isfinite(v) for v in quaternion):
+        raise ValueError("invalid gaze orientation")
+    norm = math.sqrt(sum(v * v for v in quaternion))
+    if not 0.9 < norm < 1.1:
+        raise ValueError("invalid gaze orientation")
+    x, y, z, w = (v / norm for v in quaternion)
+    # Rotate OpenXR's forward vector (0, 0, -1) into VIEW space.
+    dx, dy, dz = -2 * (x*z + w*y), 2 * (w*x - y*z), 2 * (x*x + y*y) - 1
+    return math.degrees(math.atan2(-dy, math.hypot(dx, dz))), math.degrees(math.atan2(dx, -dz))
+
+
+def osc_message(address, values):
+    if not address.startswith("/") or any(c.isspace() or c in '\0#*,?[]{}' for c in address):
+        raise ValueError("OSC address must be a literal path")
+    def string(value):
+        encoded = value.encode("utf-8") + b"\0"
+        return encoded + b"\0" * (-len(encoded) % 4)
+    tags, payload = ",", b""
+    for value in values:
+        if type(value) is int:
+            tags += "i"
+            payload += struct.pack(">i", value)
+        else:
+            if not math.isfinite(value):
+                raise ValueError("OSC value must be finite")
+            tags += "f"
+            payload += struct.pack(">f", value)
+    return string(address) + string(tags) + payload
+
+
+class Osc:
+    def __init__(self, endpoint=None):
+        self.sock = None
+        self.target = None
+        if endpoint:
+            import ipaddress
+            address = ipaddress.ip_address(endpoint[0])
+            port = int(endpoint[1])
+            if address.is_unspecified or address.is_multicast or not 1 <= port <= 65535:
+                raise ValueError("OSC needs a unicast IP address and port 1..65535")
+            self.sock = socket.socket(socket.AF_INET6 if address.version == 6 else socket.AF_INET, socket.SOCK_DGRAM)
+            self.target = (str(address), port)
+
+    def send(self, address, values):
+        if self.sock:
+            self.sock.sendto(osc_message(address, values), self.target)
+
+    def close(self):
+        if self.sock:
+            self.sock.close()
+
+
+class HeartSession:
+    def __init__(self, osc, address, log=None, clock=time.monotonic):
+        self.osc, self.address, self.clock = osc, address, clock
+        self.bpm, self.updated = None, None
+        self.log = None
+        if log:
+            # Exclusive creation refuses existing files and symlinks; mode is
+            # private even with a permissive process umask.
+            fd = os.open(log, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+            self.log = os.fdopen(fd, "w")
+            self.log.write("unix_seconds,bpm\n")
+
+    def notification(self, data):
+        self.bpm = heart_rate(data)
+        self.updated = self.clock()
+        if self.bpm is not None:
+            self.osc.send(self.address, [self.bpm])
+            if self.log:
+                self.log.write(f"{time.time():.3f},{self.bpm}\n")
+                self.log.flush()
+
+    def current(self):
+        if self.updated is None or self.clock() - self.updated > 5:
+            return None
+        return self.bpm
+
+    def close(self):
+        if self.log:
+            self.log.close()
+
+
+class BluezHeart:
+    """One explicitly selected, already discovered strap; no ambient scan."""
+    def __init__(self, bus, interface, address, on_value):
+        self.bus, self.interface, self.on_value = bus, interface, on_value
+        self.device = self.characteristic = None
+        self.connected_here = False
+        self.notifying = False
+        self.match = None
+        objects = self.objects()
+        matches = [path for path, interfaces in objects.items()
+                   if str(interfaces.get(DEVICE, {}).get("Address", "")).upper() == address.upper()]
+        if len(matches) != 1:
+            raise TrackingError("Strap not found uniquely in BlueZ; pair/discover it in SteamOS Bluetooth settings first")
+        self.device = matches[0]
+        self.match = bus.add_signal_receiver(self.changed, signal_name="PropertiesChanged",
+                                            dbus_interface="org.freedesktop.DBus.Properties",
+                                            bus_name="org.bluez", path_keyword="path")
+        try:
+            if not objects[self.device][DEVICE].get("Connected"):
+                self.call(self.device, DEVICE).Connect(timeout=20)
+                self.connected_here = True
+        except Exception:
+            self.close()
+            raise
+
+    def objects(self):
+        return self.call("/", "org.freedesktop.DBus.ObjectManager").GetManagedObjects()
+
+    def call(self, path, kind):
+        return self.interface(self.bus.get_object("org.bluez", path), kind)
+
+    def subscribe(self):
+        objects = self.objects()
+        if not objects.get(self.device, {}).get(DEVICE, {}).get("ServicesResolved"):
+            return False
+        services = {p for p, obj in objects.items() if str(obj.get(SERVICE, {}).get("UUID", "")).lower() == HRS
+                    and obj[SERVICE].get("Device") == self.device}
+        for path, obj in objects.items():
+            props = obj.get(CHARACTERISTIC, {})
+            if props.get("Service") in services and str(props.get("UUID", "")).lower() == MEASUREMENT:
+                if "notify" not in props.get("Flags", []):
+                    raise TrackingError("Heart-rate characteristic does not support notifications")
+                self.characteristic = path
+                self.call(path, CHARACTERISTIC).StartNotify()
+                self.notifying = True
+                return True
+        raise TrackingError("Selected device has no standard Heart Rate Service measurement")
+
+    def changed(self, kind, changes, invalidated, path=None):
+        if kind == CHARACTERISTIC and path == self.characteristic and "Value" in changes:
+            self.on_value(changes["Value"])
+        elif kind == DEVICE and path == self.device and "Connected" in changes and not changes["Connected"]:
+            self.on_value(None)
+
+    def close(self):
+        try:
+            if self.notifying:
+                self.call(self.characteristic, CHARACTERISTIC).StopNotify()
+        finally:
+            if self.match:
+                self.match.remove()
+            if self.connected_here:
+                self.call(self.device, DEVICE).Disconnect()
+
+
+def run_gaze(args, osc):
+    binary = Path(__file__).with_name("gaze")
+    command = [str(binary), "--seconds", str(args.seconds)]
+    if not args.osc:
+        return subprocess.call(command)
+    read_fd, write_fd = os.pipe()
+    process = None
+    try:
+        process = subprocess.Popen(command + ["--fd", str(write_fd)], pass_fds=(write_fd,))
+        os.close(write_fd)
+        write_fd = None
+        with os.fdopen(read_fd) as source:
+            read_fd = None
+            for line in source:
+                try:
+                    angles = gaze_angles([float(v) for v in line.split()])
+                except ValueError:
+                    continue
+                osc.send("/tracking/eye/CenterPitchYaw", angles)
+        return process.wait()
+    finally:
+        if read_fd is not None:
+            os.close(read_fd)
+        if write_fd is not None:
+            os.close(write_fd)
+        if process and process.poll() is None:
+            process.terminate()
+            try:
+                process.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                process.kill()
+                process.wait()
+
+
+class HeartPanel:
+    """Our GTK panel, using the Frame's existing GTK4/GI platform libraries."""
+    def __init__(self):
+        os.environ["GDK_BACKEND"] = "x11"
+        import gi
+        gi.require_version("Gtk", "4.0")
+        gi.require_version("GdkX11", "4.0")
+        from gi.repository import Gtk, Gdk, GdkX11, GLib
+        Gtk.init()
+        self.running = True
+        self.window = Gtk.Window(title="Frame Control · Heart rate")
+        self.window.set_default_size(480, 320)
+        self.window.connect("close-request", self.stop)
+        Gtk.Settings.get_default().set_property("gtk-application-prefer-dark-theme", True)
+        box = Gtk.Box(orientation=Gtk.Orientation.VERTICAL, spacing=16)
+        box.set_valign(Gtk.Align.CENTER)
+        box.set_halign(Gtk.Align.CENTER)
+        box.set_size_request(440, -1)
+        for side in ("top", "bottom", "start", "end"):
+            getattr(box, "set_margin_" + side)(24)
+        self.window.set_child(box)
+        title = Gtk.Label(label="Heart rate")
+        title.add_css_class("title-2")
+        box.append(title)
+        self.reading = Gtk.Label(label="—")
+        self.reading.add_css_class("reading")
+        box.append(self.reading)
+        self.status = Gtk.Label(label="Waiting for strap")
+        box.append(self.status)
+        button = Gtk.Button(label="Stop")
+        button.connect("clicked", self.stop)
+        box.append(button)
+        css = Gtk.CssProvider()
+        css.load_from_data(b".reading { font-size: 144px; font-weight: 700; }")
+        Gtk.StyleContext.add_provider_for_display(Gdk.Display.get_default(), css, Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION)
+        self.window.present()
+        context = GLib.MainContext.default()
+        while context.pending():
+            context.iteration(False)
+        try:
+            xid = GdkX11.X11Surface.get_xid(self.window.get_surface())
+            subprocess.run(["xprop", "-id", str(xid), "-f", "STEAM_GAME", "32c", "-set", "STEAM_GAME", "2000000027"],
+                           check=True, stdout=subprocess.DEVNULL)
+        except Exception:
+            self.window.destroy()
+            raise
+
+    def stop(self, *args):
+        self.running = False
+        return True
+
+    def update(self, bpm):
+        self.reading.set_label(str(bpm) if bpm is not None else "—")
+        self.status.set_label("beats per minute" if bpm is not None else "Waiting for strap")
+
+    def close(self):
+        self.window.destroy()
+
+
+def run_heart(args, osc):
+    import dbus
+    from dbus.mainloop.glib import DBusGMainLoop
+    from gi.repository import GLib
+    DBusGMainLoop(set_as_default=True)
+    session = HeartSession(osc, args.address, args.log)
+    reader, root = None, None
+    failure = []
+    def value(data):
+        if data is None:
+            session.bpm = None
+            failure.append("Strap disconnected; reconnect and start again")
+            return
+        try:
+            session.notification(data)
+        except ValueError:
+            session.bpm = None
+        except OSError:
+            failure.append("OSC or session log write failed")
+    try:
+        reader = BluezHeart(dbus.SystemBus(), dbus.Interface, args.device, value)
+        context = GLib.MainContext.default()
+        deadline = time.monotonic() + 20
+        while not reader.subscribe():
+            if time.monotonic() > deadline:
+                raise TrackingError("Timed out waiting for the strap's GATT services")
+            while context.pending():
+                context.iteration(False)
+            time.sleep(0.1)
+        end = time.monotonic() + args.seconds
+        print("Heart-rate notifications started; readings stay local unless OSC or a log was selected.")
+        if args.panel:
+            root = HeartPanel()
+        running = lambda: root.running if root else True
+        while running() and time.monotonic() < end and not failure:
+            while context.pending():
+                context.iteration(False)
+            if root:
+                root.update(session.current())
+            time.sleep(0.05)
+        if failure:
+            raise TrackingError(failure[0])
+        return 0
+    finally:
+        if root:
+            root.close()
+        try:
+            if reader:
+                reader.close()
+        finally:
+            session.close()
+
+
+def run_pulse(args, osc):
+    """Experimental: estimate pulse from the IR eye cameras (see pulse.py)."""
+    import pulse
+    if not pulse.ET_BIN.exists():
+        raise TrackingError("SteamVR's eye-tracking tool is not installed on this Frame")
+    print(f"Capturing {args.seconds} s from the eye cameras. Wear the headset and keep still.", flush=True)
+    readings = [pulse.proximity()]
+    try:
+        frames = pulse.Capture(args.seconds).run()
+        readings.append(pulse.proximity())
+    except RuntimeError as error:  # capture status only; no image data
+        raise TrackingError(str(error))
+    print(f"Captured {len(frames)} eye frames; images already deleted. Analysing...", flush=True)
+    try:
+        result = pulse.analyse(frames)
+    except ValueError as error:
+        raise TrackingError(str(error))
+    on_face = all(pulse.worn(reading) for reading in readings)
+    if not on_face:
+        # Unworn, the cameras still show a steady periodic artifact that looks
+        # like a pulse (verified on the Frame), so it is never called clear.
+        print("The proximity sensor says the headset is not being worn; no pulse can be read.")
+    clear = on_face and pulse.reliable(result)
+    offset = time.time() - time.monotonic()  # the capture's timestamps are CLOCK_MONOTONIC
+    if args.log:
+        fd = os.open(args.log, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+        with os.fdopen(fd, "w") as log:
+            log.write("unix_seconds,bpm\n")
+            for when, bpm in result["series"]:
+                log.write(f"{when + offset:.3f},{bpm:.1f}\n")
+    if clear:
+        osc.send(args.address, [round(result["bpm"])])
+    if args.show:
+        print(f"Estimate: {result['bpm']:.1f} BPM ({'clear' if clear else 'NOT clear'}; "
+              f"patch agreement {result['agreement']:.0%}, signal/noise {result['snr']:.2f}, "
+              f"{result['patches']} of {result['usable']} usable patches)")
+        print("Per-second estimates (15 s windows): "
+              + " ".join(str(round(bpm)) for _, bpm in result["series"]))
+    else:
+        print("A clear pulse was found." if clear else "No clear pulse was found.")
+    return 0 if clear else 3
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    commands = parser.add_subparsers(dest="command", required=True)
+    gaze = commands.add_parser("gaze", help="headless OpenXR; prints counters only without --osc")
+    heart = commands.add_parser("heart", help="standard BLE HRS from an explicitly selected strap")
+    pulse = commands.add_parser("pulse", help="experimental pulse estimate from the IR eye cameras")
+    for command in (gaze, heart, pulse):
+        command.add_argument("--osc", nargs=2, metavar=("IP", "PORT"), help="explicit UDP destination; no default")
+    for command in (gaze, heart):
+        command.add_argument("--seconds", type=int, default=10, help="bounded run, 1..86400 seconds (default: 10)")
+    pulse.add_argument("--seconds", type=int, default=60, help="capture length, 20..300 seconds (default: 60)")
+    heart.add_argument("--device", required=True, help="strap Bluetooth address already discovered by BlueZ")
+    heart.add_argument("--panel", action="store_true", help="show our panel on gamescope DISPLAY=:0")
+    for command in (heart, pulse):
+        command.add_argument("--address", default="/avatar/parameters/HeartRate", help="integer BPM OSC parameter")
+        command.add_argument("--log", help="new private CSV file; disabled by default")
+    pulse.add_argument("--show", action="store_true", help="print the estimate and per-second series")
+    args = parser.parse_args()
+    if not 1 <= args.seconds <= 86400:
+        parser.error("--seconds must be 1..86400")
+    if args.command == "pulse" and not 20 <= args.seconds <= 300:
+        parser.error("pulse --seconds must be 20..300")
+    def interrupted(signum, frame):
+        raise KeyboardInterrupt
+    signal.signal(signal.SIGTERM, interrupted)
+    if hasattr(signal, "SIGHUP"):
+        signal.signal(signal.SIGHUP, interrupted)
+    osc = None
+    try:
+        if args.command in ("heart", "pulse"):
+            osc_message(args.address, [0])
+            if getattr(args, "panel", False):
+                os.environ["DISPLAY"] = ":0"
+        osc = Osc(args.osc)
+        run = {"gaze": run_gaze, "heart": run_heart, "pulse": run_pulse}[args.command]
+        return run(args, osc)
+    except TrackingError as error:
+        print(str(error))
+        return 1
+    except KeyboardInterrupt:
+        return 130
+    except Exception as error:
+        # Never dump notifications, gaze, BLE addresses or exception payloads.
+        print(f"Tracking stopped ({type(error).__name__}). Check the device, runtime and selected output.")
+        return 1
+    finally:
+        if osc:
+            osc.close()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -26,5 +26,3 @@
 - (instancetype)initWithDescriptor:(CGVirtualDisplayDescriptor *)descriptor;
 - (BOOL)applySettings:(CGVirtualDisplaySettings *)settings;
@end
-
-#include "../../../desktop/controller.h"
@@ -1,45 +1,234 @@
-// Thin, serialized binding to the same controller used by the PC host.
-// Algorithm and bounded state live in desktop/controller.c.
+// Adapts each stream to its network, latency first. The viewer acknowledges
+// every frame as it arrives ("rx"); from those acks the controller knows how
+// long frames take to get through and how fast the link delivers them.
+//
+// - The gate: a new frame is sent only while the oldest unacknowledged one is
+//   younger than the path's usual round trip plus a little slack. So frames
+//   never queue up in SSH, TCP or the Wi-Fi driver; while the link is stuck
+//   the newest picture waits and goes out as soon as it moves again.
+// - The bitrate: when frames start queueing (the round trip grows) or the
+//   gate has to hold frames back, it drops to a bit under what the link
+//   actually delivered; once things are clear it probes up again slowly, never
+//   above the quality setting's bitrate (the ceiling).
+// - The tier: as the bitrate falls, fewer frames per second (60, 45, 30), then
+//   a smaller picture (75%, then 50% of the panel's pixels).
+// See docs/mac-in-headset.md ("Adapting to the network"). Thread-safe.
 import Foundation

 final class RateController {
+    struct Tier: Equatable {
+        let fps: Int
+        let scale: Double  // of the picture's long side
+    }
+
+    static let tiers = [Tier(fps: 60, scale: 1), Tier(fps: 45, scale: 1), Tier(fps: 30, scale: 1),
+                        Tier(fps: 30, scale: 0.75), Tier(fps: 30, scale: 0.5)]
+    /// A tier is used while the target bitrate is at least this share of the ceiling.
+    static let floors = [0.45, 0.28, 0.16, 0.08, 0]
    static let enabled = ProcessInfo.processInfo.environment["FRAME_MAC_VIEW_ADAPT"] != "0"
+
    let maxFps: Int
    private let lock = NSLock()
-    private let core: OpaquePointer
-    private var events: [[String: Any]] = []
-    init(maxFps: Int) {
-        self.maxFps = maxFps
-        core = fc_new(Int32(maxFps), Self.enabled ? 1 : 0)!
-    }
-    deinit { fc_free(core) }
+    private var ceiling = 0  // bits/s at full size and frame rate
+    private(set) var target = 0
+    private(set) var tier = 0
+    private var unacked: [(seq: UInt32, sent: Int64, bytes: Int)] = []
+    /// Round trips (send -> ack arrives here), for the baseline: the lowest
+    /// in the last 10 s is the path without any queue.
+    private var rtts: [(t: Int64, v: Int64)] = []
+    private var acked: [(t: Int64, bytes: Int)] = []  // the last second
+    private var sentLog: [(t: Int64, bytes: Int)] = []
+    private var captures: [Int64] = []  // the last second
+    private var frameBytes = 0  // average recent frame, kept while the gate holds everything back
+    private var held = 0  // frames the gate held back since the last update
+    private var lastSignal = false
+    private var sawAck = false
+    private var lastDecrease: Int64 = 0
+    private var lastIncrease: Int64 = 0
+    private var belowSince: Int64 = 0, aboveSince: Int64 = 0
+    /// What changed, for the timeline: (time, event).
+    private(set) var events: [(Int64, String)] = []
+
+    init(maxFps: Int) { self.maxFps = maxFps }
+
    private func locked<T>(_ f: () -> T) -> T { lock.lock(); defer { lock.unlock() }; return f() }
-    private func value(_ field: Int32) -> Int { Int(fc_value(core, field)) }
-    var target: Int { locked { value(0) } }
-    var tier: Int { locked { value(2) } }
-    var fps: Int { locked { value(3) } }
-    var scale: Double { locked { Double(value(4)) / 100 } }
-    var baseRtt: Int64 { locked { fc_value(core, 5) } }
-    func setCeiling(_ bps: Int) { locked { fc_ceiling(core, Int32(bps)) } }
-    func maySend(now: Int64, counts: Bool = true) -> Bool { locked { fc_gate(core, now, counts ? 1 : 0) != 0 } }
-    func captured(at t: Int64) { locked { fc_capture(core, t) } }
-    func sent(seq: UInt32, bytes: Int, at t: Int64) { locked { fc_sent(core, seq, Int32(bytes), t) } }
-    func acked(seq: UInt32, at t: Int64) -> Bool { locked { fc_ack(core, seq, t) != 0 } }
-    func update(now: Int64) -> Int? {
+
+    /// The quality setting's bitrate at full size; the first call also starts there.
+    func setCeiling(_ bps: Int) {
        locked {
-            let old = value(0), tier = value(2)
-            let result = Int(fc_update(core, now))
-            if value(0) < old || value(2) != tier {
-                events.append(["t": now, "e": "target \(value(0)) bit/s; tier \(value(2))"])
-                if events.count > 200 { events.removeFirst() }
-            }
-            return result == 0 ? nil : result
+            if target == 0 || target > bps { target = bps }
+            ceiling = bps
        }
    }
-    func state() -> [String: Any] {
-        locked { ["target": value(0), "ceiling": value(1), "tier": value(2), "fps": value(3),
-                  "scale": Double(value(4)) / 100, "baseRtt": Double(value(5)) / 1000,
-                  "inFlight": value(6), "slack": Double(value(7)) / 1000, "adapt": Self.enabled] }
+
+    var fps: Int { locked { fpsLocked } }
+    private var fpsLocked: Int { min(maxFps, RateController.tiers[tier].fps) }
+    var scale: Double { locked { RateController.tiers[tier].scale } }
+    var baseRtt: Int64 { locked { baseline() } }
+
+    private func baseline() -> Int64 { rtts.map(\.v).min() ?? 0 }
+
+    /// How late a frame may be before the gate holds the next one: one frame
+    /// interval, plus room for the jitter this link normally has (1.5 times
+    /// its recent spread), so ordinary Wi-Fi jitter doesn't cost frames but a
+    /// real queue does. Updated in update().
+    private var slack: Int64 = 40_000
+
+    /// Whether a frame may be sent now without queueing behind earlier ones.
+    /// `counts`: a held frame is a sign of congestion (not when merely
+    /// re-checking whether a held frame can go yet).
+    func maySend(now: Int64, counts: Bool = true) -> Bool {
+        locked {
+            guard RateController.enabled, sawAck else { return true }  // not heard from the viewer yet
+            // Unacknowledged for 2 s: gone with a reconnection, not in a queue.
+            unacked.removeAll { now - $0.sent > 2_000_000 }
+            guard let oldest = unacked.first else { return true }
+            // Age is what bounds latency. The count only stops a burst, and it
+            // allows a full round trip of frames, so a long but clear path
+            // (100 ms away) still gets every frame.
+            let interval = Int64(1_000_000 / max(1, fpsLocked))
+            let window = max(3, Int((baseline() + slack) / interval) + 1)
+            if unacked.count < window, now - oldest.sent <= baseline() + slack { return true }
+            if counts { held += 1 }
+            return false
+        }
    }
-    func eventList() -> [[String: Any]] { locked { events } }
+
+    /// A picture was captured (sent or not): with the frame sizes, what this
+    /// stream would send if the link allowed.
+    func captured(at t: Int64) {
+        locked {
+            captures.append(t)
+            if captures.count > 256 { captures.removeFirst(captures.count - 256) }
+        }
+    }
+
+    func sent(seq: UInt32, bytes: Int, at t: Int64) {
+        locked {
+            // Bounded even if the viewer never acknowledges (an old viewer, or
+            // the controller is off).
+            unacked.append((seq, t, bytes))
+            if unacked.count > 512 { unacked.removeFirst(unacked.count - 512) }
+            sentLog.append((t, bytes))
+            if sentLog.count > 1024 { sentLog.removeFirst(sentLog.count - 1024) }
+        }
+    }
+
+    /// The viewer has frame `seq`. Returns true if that may let a held frame go.
+    func acked(seq: UInt32, at now: Int64) -> Bool {
+        locked {
+            sawAck = true
+            guard let i = unacked.firstIndex(where: { $0.seq == seq }) else { return false }
+            let f = unacked[i]
+            unacked.removeSubrange(0...i)  // TCP delivers in order: earlier ones arrived too
+            rtts.append((now, now - f.sent))
+            acked.append((now, f.bytes))
+            return true
+        }
+    }
+
+    /// Called every 100 ms. Returns the new bitrate target, or nil if the
+    /// controller is off.
+    func update(now: Int64) -> Int? {
+        locked {
+            rtts.removeAll { now - $0.t > 10_000_000 }
+            acked.removeAll { now - $0.t > 500_000 }
+            sentLog.removeAll { now - $0.t > 500_000 }
+            unacked.removeAll { now - $0.sent > 2_000_000 }
+            captures.removeAll { now - $0 > 1_000_000 }
+            guard RateController.enabled, ceiling > 0 else { return nil }
+            let base = baseline()
+            let spread = rtts.filter { now - $0.t < 2_000_000 }.map(\.v).sorted()
+            let jitter = spread.isEmpty ? 0 : spread[spread.count * 9 / 10] - base
+            let interval = Int64(1_000_000 / max(1, fpsLocked))
+            slack = interval + min(max(jitter * 3 / 2, 25_000), 80_000)
+            let recent = rtts.filter { now - $0.t < 300_000 }.map(\.v).sorted()
+            let queueing = recent.isEmpty ? 0 : recent[recent.count / 2] - base
+            let oldestAge = unacked.first.map { now - $0.sent } ?? 0
+            let stuck = oldestAge > base + 100_000
+            let delivered = acked.reduce(0) { $0 + $1.bytes } * 16  // bits/s over the last half second
+            let sending = sentLog.reduce(0) { $0 + $1.bytes } * 16
+            // Demand: captures per second (up to the tier's rate) times the
+            // average frame. A test card or a mostly still window wants far
+            // less than its budget; when the link hiccups, cutting its bitrate
+            // can't help, and it would only look link-limited afterwards.
+            if !sentLog.isEmpty { frameBytes = sentLog.reduce(0) { $0 + $1.bytes } / sentLog.count }
+            let demand = min(captures.count, fpsLocked) * frameBytes * 8
+            // Delay alone isn't our queue: Wi-Fi jitters by itself. It only
+            // counts while this stream uses a good part of its budget (so its
+            // own data could be what's queueing). Frames the gate had to hold,
+            // or one stuck in flight, show demand the link isn't carrying
+            // whatever was sent (the gate itself keeps what's sent low).
+            let busy = sending >= target / 2
+            // Twice in a row (200 ms), so one late ack doesn't count.
+            let signal = (busy && queueing > 40_000) || held >= 3 || stuck
+            let congested = signal && lastSignal
+            lastSignal = signal
+            let heldNow = held
+            held = 0
+            let floorBps = 300_000
+            if congested, now - lastDecrease > 300_000 {
+                // Down to a bit under what got through: at least a fifth off, at
+                // most half (a stall delivers nothing, but the link is still there).
+                let measured = Int(Double(delivered) * 0.9)
+                var next = max(floorBps, min(target * 4 / 5, max(measured, target / 2)))
+                // App-limited (it wants about half its budget or less): never
+                // below twice what it wants, however many cuts in a row. The
+                // extra quarter is hysteresis, so frame sizes wobbling at the
+                // floor don't switch the protection off.
+                if demand > 0, demand * 2 <= target * 5 / 4 { next = max(next, min(target, demand * 2)) }
+                target = next
+                lastDecrease = now
+                events.append((now, "down to \(target / 1000) kbit/s: queue \(queueing / 1000) ms, held \(heldNow), "
+                                    + "oldest \(oldestAge / 1000) ms, base \(base / 1000) ms, sent \(sending / 1000) got \(delivered / 1000) "
+                                    + "wants \(demand / 1000)"))
+            } else if !congested, now - lastDecrease > 1_000_000, now - lastIncrease > 250_000, target < ceiling,
+                      sending > target * 6 / 10 || now - lastDecrease > 3_000_000 {
+                // Clear for a second and using what it has: probe up.
+                target = min(ceiling, Int(Double(target) * 1.1) + 50_000)
+                lastIncrease = now
+            }
+            // Fewer frames or pixels only help a stream that fills its budget;
+            // a small one (a still window, a test card) keeps its tier.
+            retier(now: now, linkLimited: sending >= target * 7 / 10)
+            if events.count > 200 { events.removeFirst(events.count - 200) }
+            return target
+        }
+    }
+
+    /// Steps down quickly, straight to the tier the bitrate supports, and back
+    /// up one tier at a time only when there's clearly room (hysteresis).
+    private func retier(now: Int64, linkLimited: Bool) {
+        let share = Double(target) / Double(max(ceiling, 1))
+        if tier < RateController.tiers.count - 1, share < RateController.floors[tier], linkLimited {
+            if belowSince == 0 { belowSince = now }
+            if now - belowSince > 500_000 {
+                tier = RateController.floors.firstIndex { share >= $0 } ?? RateController.tiers.count - 1
+                belowSince = 0
+                events.append((now, "tier \(tier)"))
+            }
+        } else {
+            belowSince = 0
+        }
+        if tier > 0, share > RateController.floors[tier - 1] * 1.25 {
+            if aboveSince == 0 { aboveSince = now }
+            if now - aboveSince > 2_000_000 {
+                tier -= 1
+                aboveSince = 0
+                events.append((now, "tier \(tier)"))
+            }
+        } else {
+            aboveSince = 0
+        }
+    }
+
+    func state() -> [String: Any] {
+        locked {
+            ["target": target, "ceiling": ceiling, "tier": tier, "fps": min(maxFps, RateController.tiers[tier].fps),
+             "scale": RateController.tiers[tier].scale, "baseRtt": Double(baseline()) / 1000,
+             "inFlight": unacked.count, "slack": Double(slack) / 1000, "adapt": RateController.enabled]
+        }
+    }
+
+    func eventList() -> [[String: Any]] { locked { events.map { ["t": $0.0, "e": $0.1] } } }
 }
@@ -5,10 +5,7 @@ set -eu
 here=$(cd "$(dirname "$0")" && pwd)
 out=${1:-$here/../bin/frame-mac-view}
 mkdir -p "$(dirname "$out")"
-obj=$(mktemp /tmp/frame-controller.XXXXXX)
-trap 'rm -f "$obj"' EXIT
-xcrun clang -O2 -target arm64-apple-macos14.0 -c "$here/../../desktop/controller.c" -o "$obj"
 xcrun swiftc -O -swift-version 5 -target arm64-apple-macos14.0 \
  -import-objc-header "$here/Sources/CGVirtualDisplay.h" \
-  -o "$out" "$here"/Sources/*.swift "$obj"
+  -o "$out" "$here"/Sources/*.swift
 echo "built $out"
@@ -0,0 +1,274 @@
+#!/usr/bin/env python3
+"""Check Frame Control's heart-rate readings against a reference, on your computer.
+
+  python3 scripts/heart-check.py listen --port 9000 --out ours.csv
+  python3 scripts/heart-check.py compare ours.csv reference.csv
+  python3 scripts/heart-check.py compare ours.csv ~/Downloads/export.zip
+
+`listen` receives our integer-BPM OSC messages (send them here with
+`tracking-on-frame.py heart --osc <this computer's IP> 9000`) and shows each
+reading live, so you can watch it next to a reference such as your Apple
+Watch. `--out` also records `unix_seconds,bpm` to a new private file.
+
+`compare` lines up two recordings by time and reports how far apart they are.
+The reference can be:
+- a CSV whose first column is a time (unix seconds or ISO 8601) and whose
+  second is BPM, such as our own log, `listen --out`, or the test strap's
+  output (a third `flags` column marks skin-contact loss as "no reading");
+- an Apple Health export (`export.zip` or `export.xml`, from Health → your
+  profile → Export All Health Data). Only heart-rate records within the
+  recording's time range are read.
+
+Everything stays on this computer. Nothing is uploaded.
+"""
+import argparse
+import bisect
+import csv
+from datetime import datetime
+import io
+import os
+from pathlib import Path
+import re
+import socket
+import struct
+import sys
+import time
+import zipfile
+from xml.etree import ElementTree
+
+ADDRESS = "/avatar/parameters/HeartRate"
+
+
+def parse_osc(packet):
+    """Return (address, values) for a single OSC message with i/f arguments."""
+    def string(offset):
+        end = packet.index(b"\0", offset)
+        return packet[offset:end].decode("utf-8"), (end + 4) & ~3
+    address, offset = string(0)
+    tags, offset = string(offset)
+    if not tags.startswith(","):
+        raise ValueError("not an OSC message")
+    values = []
+    for tag in tags[1:]:
+        if tag not in "if" or offset + 4 > len(packet):
+            raise ValueError("unsupported OSC argument")
+        values.append(struct.unpack(">i" if tag == "i" else ">f", packet[offset:offset + 4])[0])
+        offset += 4
+    return address, values
+
+
+def listen(port, address, out, seconds, clock=time.time, stream=sys.stdout):
+    log = None
+    if out:
+        log = os.fdopen(os.open(out, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), "w")
+        log.write("unix_seconds,bpm\n")
+    received = 0
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+        sock.bind(("0.0.0.0", port))
+        sock.settimeout(0.5)
+        print(f"Listening for {address} on UDP port {port}. Ctrl-C stops.", file=stream, flush=True)
+        end = clock() + seconds if seconds else None
+        try:
+            while end is None or clock() < end:
+                try:
+                    packet = sock.recv(1024)
+                except socket.timeout:
+                    continue
+                try:
+                    path, values = parse_osc(packet)
+                except (ValueError, UnicodeDecodeError):
+                    continue
+                if path != address or len(values) != 1:
+                    continue
+                now = clock()
+                bpm = int(values[0])
+                received += 1
+                print(f"{time.strftime('%H:%M:%S', time.localtime(now))}  {bpm:3d} bpm", file=stream, flush=True)
+                if log:
+                    log.write(f"{now:.3f},{bpm}\n")
+                    log.flush()
+        except KeyboardInterrupt:
+            pass
+        finally:
+            if log:
+                log.close()
+    return received
+
+
+def parse_time(text):
+    text = text.strip()
+    if re.fullmatch(r"\d+(\.\d+)?", text):
+        return float(text)
+    # Apple Health uses "2026-09-29 09:12:03 +1000".
+    text = re.sub(r" ([+-]\d{2}):?(\d{2})$", r"\1\2", text).replace("Z", "+0000")
+    for pattern in ("%Y-%m-%d %H:%M:%S%z", "%Y-%m-%dT%H:%M:%S%z", "%Y-%m-%dT%H:%M:%S.%f%z"):
+        try:
+            return datetime.strptime(text, pattern).timestamp()
+        except ValueError:
+            pass
+    raise ValueError(f"unrecognised time {text!r}")
+
+
+def read_csv(path):
+    """[(time, bpm or None)], sorted. A header row is skipped."""
+    samples = []
+    with open(path, newline="") as source:
+        for row in csv.reader(source):
+            if len(row) < 2:
+                continue
+            try:
+                when, bpm = parse_time(row[0]), int(float(row[1]))
+            except (ValueError, OverflowError):
+                continue  # header or unparseable line
+            try:
+                flags = int(float(row[2])) if len(row) > 2 else None
+            except (ValueError, OverflowError):
+                flags = None  # an unrecognised flag leaves the reading as it is
+            if flags is not None and flags & 4 and not flags & 2:
+                bpm = None  # contact supported and not detected: no reading
+            samples.append((when, bpm))
+    return sorted(samples, key=lambda s: s[0])
+
+
+def read_health(path, start, end):
+    """Heart-rate records from an Apple Health export between start and end."""
+    samples = []
+    def scan(source):
+        for _, element in ElementTree.iterparse(source):
+            if element.tag == "Record" and element.get("type") == "HKQuantityTypeIdentifierHeartRate":
+                try:
+                    when = parse_time(element.get("startDate") or "")
+                    value = round(float(element.get("value") or ""))
+                except (ValueError, OverflowError):
+                    continue
+                if start <= when <= end:
+                    samples.append((when, value))
+            element.clear()
+    if zipfile.is_zipfile(path):
+        with zipfile.ZipFile(path) as archive:
+            names = [n for n in archive.namelist() if n.endswith("/export.xml") or n == "export.xml"]
+            if not names:
+                raise ValueError("no export.xml in that archive; use Health's Export All Health Data")
+            with archive.open(names[0]) as source:
+                scan(source)
+    else:
+        with open(path, "rb") as source:
+            scan(source)
+    return sorted(samples)
+
+
+def read_any(path, start=None, end=None):
+    path = str(path)
+    if path.endswith((".zip", ".xml")):
+        return read_health(path, start, end)
+    return read_csv(path)
+
+
+def value_at(samples, when, hold, times=None):
+    """Our reading at a moment: the latest sample no older than `hold` seconds.
+    `times` is the samples' time column, if the caller has already built it."""
+    times = times if times is not None else [s[0] for s in samples]
+    i = bisect.bisect_right(times, when) - 1
+    if i < 0 or when - times[i] > hold:
+        return None
+    return samples[i][1]
+
+
+def compare(ours, reference, max_lag=10.0, hold=5.0):
+    """Compare our readings with the reference at each reference moment.
+
+    `lag` is the delay added to reference times before looking up ours (our
+    readings arrive after the sensor's). The best lag within ±max_lag is used.
+    """
+    real = [(t, b) for t, b in reference if b is not None]
+    if not real or not any(b is not None for _, b in ours):
+        raise ValueError("both recordings need at least one reading")
+    best = None
+    ours_times = [t for t, _ in ours]
+    steps = int(max_lag * 4)
+    for step in range(-steps, steps + 1):
+        lag = step / 4
+        pairs = [(value_at(ours, t + lag, hold, ours_times), b) for t, b in real]
+        pairs = [(o, r) for o, r in pairs if o is not None]
+        if not pairs:
+            continue
+        error = sum(abs(o - r) for o, r in pairs) / len(pairs)
+        key = (-len(pairs), error, abs(lag))
+        if best is None or key < best[0]:
+            best = (key, lag, pairs)
+    if best is None:
+        raise ValueError("the recordings do not overlap in time")
+    _, lag, pairs = best
+    differences = [o - r for o, r in pairs]
+    # While the reference says "no reading" (lost skin contact), we must not
+    # produce new readings. Count ours that arrive during such a stretch.
+    gaps = [t for t, b in reference if b is None]
+    reference_times = [t for t, _ in reference]
+    shown_in_gaps = 0
+    for t, bpm in ours:
+        i = bisect.bisect_right(reference_times, t - lag) - 1
+        if bpm is not None and i >= 0 and reference[i][1] is None:
+            shown_in_gaps += 1
+    return {
+        "reference_readings": len(real),
+        "matched": len(pairs),
+        "lag_seconds": lag,
+        "mean_abs_error": sum(abs(d) for d in differences) / len(differences),
+        "bias": sum(differences) / len(differences),
+        "max_abs_error": max(abs(d) for d in differences),
+        "within_5": sum(1 for d in differences if abs(d) <= 5) / len(differences),
+        "exact": sum(1 for d in differences if d == 0) / len(differences),
+        "no_contact_moments": len(gaps),
+        "shown_during_no_contact": shown_in_gaps,
+    }
+
+
+def report(result, tolerance, stream=sys.stdout):
+    print(f"Reference readings: {result['reference_readings']}, matched: {result['matched']}", file=stream)
+    print(f"Best alignment: ours {result['lag_seconds']:+.2f} s after the reference", file=stream)
+    print(f"Mean absolute difference: {result['mean_abs_error']:.2f} BPM "
+          f"(bias {result['bias']:+.2f}, worst {result['max_abs_error']})", file=stream)
+    print(f"Within ±5 BPM: {result['within_5']:.0%}; identical: {result['exact']:.0%}", file=stream)
+    if result["no_contact_moments"]:
+        print(f"No-contact moments: {result['no_contact_moments']}, where we showed a stale "
+              f"reading: {result['shown_during_no_contact']}", file=stream)
+    coverage = result["matched"] / result["reference_readings"]
+    passed = (result["mean_abs_error"] <= tolerance and coverage >= 0.8
+              and not result["shown_during_no_contact"])
+    print(("PASS" if passed else "FAIL") + f" (mean difference ≤ {tolerance} BPM, ≥80% of reference "
+          f"readings matched, nothing shown without contact)", file=stream)
+    return passed
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    commands = parser.add_subparsers(dest="command", required=True)
+    heard = commands.add_parser("listen", help="show and optionally record our OSC readings live")
+    heard.add_argument("--port", type=int, default=9000)
+    heard.add_argument("--address", default=ADDRESS)
+    heard.add_argument("--out", help="new private CSV file")
+    heard.add_argument("--seconds", type=float, default=0, help="stop after this long (default: until Ctrl-C)")
+    check = commands.add_parser("compare", help="compare our recording with a reference")
+    check.add_argument("ours", type=Path)
+    check.add_argument("reference", type=Path)
+    check.add_argument("--tolerance", type=float, default=5.0, help="allowed mean difference in BPM (default 5)")
+    check.add_argument("--max-lag", type=float, default=10.0, help="largest time offset to search, seconds")
+    args = parser.parse_args(argv)
+    if args.command == "listen":
+        count = listen(args.port, args.address, args.out, args.seconds)
+        print(f"Received {count} readings.")
+        return 0 if count else 3
+    try:
+        ours = read_csv(args.ours)
+        if not ours:
+            raise ValueError("our recording has no readings")
+        reference = read_any(args.reference, ours[0][0] - 60, ours[-1][0] + 60)
+        result = compare(ours, reference, args.max_lag)
+    except (ValueError, OSError, csv.Error, ElementTree.ParseError, zipfile.BadZipFile) as error:
+        print(f"Could not compare: {error}")
+        return 1
+    return 0 if report(result, args.tolerance) else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,100 @@
+// A synthetic Bluetooth heart-rate strap for testing, run on the Mac.
+//
+//   swiftc -O scripts/heart-test-strap.swift -o /tmp/heart-test-strap
+//   /tmp/heart-test-strap [seconds]      # default 60
+//
+// Advertises the standard Heart Rate Service (180d) as "FC Test Strap" and,
+// while a central is subscribed, sends one Heart Rate Measurement (2a37) per
+// second from a fixed, known sequence. Each sent value is printed to stdout as
+// `unix_seconds,bpm,flags` so scripts/heart-check.py can compare what the
+// Frame received with what was sent. Every value is synthetic; this is not a
+// sensor. macOS asks for Bluetooth permission the first time it runs.
+import CoreBluetooth
+import Foundation
+
+let hrs = CBUUID(string: "180D")
+let measurement = CBUUID(string: "2A37")
+
+/// The known sequence: an 8-bit ramp, 16-bit encodings, a skin-contact loss
+/// (which must show as no reading) and a recovery.
+func packet(_ second: Int) -> (bpm: Int, flags: UInt8) {
+    switch second % 60 {
+    case 0..<30: return (60 + second % 60 * 4, 0x06)   // 60…176, contact detected
+    case 30..<40: return (180 - (second % 60 - 30) * 3, 0x07) // 16-bit value
+    case 40..<45: return (150, 0x04)                  // contact lost
+    default: return (72 + (second % 60 - 45), 0x06)
+    }
+}
+
+final class Strap: NSObject, CBPeripheralManagerDelegate {
+    let seconds: Int
+    var manager: CBPeripheralManager!
+    var characteristic: CBMutableCharacteristic!
+    var subscribed = false
+    var sent = 0
+
+    init(seconds: Int) {
+        self.seconds = seconds
+        super.init()
+        manager = CBPeripheralManager(delegate: self, queue: nil)
+    }
+
+    func peripheralManagerDidUpdateState(_ peripheral: CBPeripheralManager) {
+        guard peripheral.state == .poweredOn else {
+            FileHandle.standardError.write("Bluetooth state \(peripheral.state.rawValue)\n".data(using: .utf8)!)
+            if peripheral.state == .unauthorized || peripheral.state == .unsupported || peripheral.state == .poweredOff {
+                FileHandle.standardError.write("Bluetooth unavailable (state \(peripheral.state.rawValue))\n".data(using: .utf8)!)
+                exit(1)
+            }
+            return
+        }
+        characteristic = CBMutableCharacteristic(type: measurement, properties: [.notify], value: nil, permissions: [])
+        let service = CBMutableService(type: hrs, primary: true)
+        service.characteristics = [characteristic]
+        peripheral.add(service)
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, didAdd service: CBService, error: Error?) {
+        if let error { fail("add service: \(error.localizedDescription)") }
+        peripheral.startAdvertising([CBAdvertisementDataLocalNameKey: "FC Test Strap",
+                                     CBAdvertisementDataServiceUUIDsKey: [hrs]])
+    }
+
+    func peripheralManagerDidStartAdvertising(_ peripheral: CBPeripheralManager, error: Error?) {
+        if let error { fail("advertise: \(error.localizedDescription)") }
+        FileHandle.standardError.write("Advertising FC Test Strap\n".data(using: .utf8)!)
+        Timer.scheduledTimer(withTimeInterval: 1, repeats: true) { _ in self.tick() }
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didSubscribeTo characteristic: CBCharacteristic) {
+        subscribed = true
+        FileHandle.standardError.write("Central subscribed\n".data(using: .utf8)!)
+    }
+
+    func peripheralManager(_ peripheral: CBPeripheralManager, central: CBCentral, didUnsubscribeFrom characteristic: CBCharacteristic) {
+        subscribed = false
+        FileHandle.standardError.write("Central unsubscribed\n".data(using: .utf8)!)
+    }
+
+    func tick() {
+        guard subscribed else { return }
+        if sent >= seconds { exit(0) }
+        let (bpm, flags) = packet(sent)
+        var bytes: [UInt8] = [flags, UInt8(bpm & 0xff)]
+        if flags & 1 != 0 { bytes.append(UInt8(bpm >> 8)) }
+        if manager.updateValue(Data(bytes), for: characteristic, onSubscribedCentrals: nil) {
+            print(String(format: "%.3f,%d,%d", Date().timeIntervalSince1970, bpm, flags))
+            fflush(stdout)
+            sent += 1
+        }
+    }
+
+    func fail(_ message: String) -> Never {
+        FileHandle.standardError.write("\(message)\n".data(using: .utf8)!)
+        exit(1)
+    }
+}
+
+let seconds = CommandLine.arguments.count > 1 ? Int(CommandLine.arguments[1]) ?? 60 : 60
+let strap = Strap(seconds: seconds)
+RunLoop.main.run()
@@ -55,7 +55,6 @@ from urllib.parse import quote, urlencode  # %20, not +: the agent's URLComponen
 ROOT = Path(__file__).resolve().parent.parent
 sys.path.insert(0, str(ROOT / "ui"))
 import frame_macview  # noqa: E402
-import frame_pcview  # noqa: E402

 RESULTS = ROOT / "bench" / "results"
 PAGES = ROOT / "bench" / "pages"
@@ -255,10 +254,7 @@ class LabView(frame_macview.MacView):

 def ssh_runner(base):
    def run(remote, stdin=None, timeout=30):
-        r = subprocess.run([*base, remote], input=stdin.encode("utf-8") if stdin is not None else None,
-                           capture_output=True, timeout=timeout)
-        r.stdout = r.stdout.decode("utf-8", errors="replace")
-        r.stderr = r.stderr.decode("utf-8", errors="replace")
+        r = subprocess.run([*base, remote], input=stdin, capture_output=True, text=True, timeout=timeout)
        if r.returncode:
            e = RuntimeError((r.stderr or r.stdout).strip())
            e.stdout = r.stdout
@@ -385,11 +381,7 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
    if args.browser_flag is not None:
        mv.browser_flags = [f for f in args.browser_flag if f]
    chrome = None
-    src = args.source or "test"
-    cpu = None
-    if args.pc:
-        mv.host = "windows" if sys.platform == "win32" else "linux"
-        mv.viewer_profile = "pc-view"
+    src = "test"
    try:
        if scenario in ("scroll", "type"):
            chrome = chrome_window(f"{scenario}.html")
@@ -413,10 +405,9 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
        since = max([f["s"] for f in first["frames"]] or [0])
        captured_before = first["captured"]
        start_mac_us = mv.call("/stats", id=stream["id"])["now"]
-        if not args.pc:
-            agent_pid = int(subprocess.run(["pgrep", "-f", "Frame Mac View Lab.app/Contents/MacOS/frame-mac-view"],
-                                           capture_output=True, text=True).stdout.split()[0])
-            cpu = CpuSampler(frame_ssh, agent_pid)
+        agent_pid = int(subprocess.run(["pgrep", "-f", "Frame Mac View Lab.app/Contents/MacOS/frame-mac-view"],
+                                       capture_output=True, text=True).stdout.split()[0])
+        cpu = CpuSampler(frame_ssh, agent_pid)
        if relay:
            relay.begin()
        expected = 0  # input events the harness asked the viewer for
@@ -452,8 +443,7 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
        if not streams:
            raise SystemExit(f"{scenario}: the stream ended during the run (did the Frame go to sleep?)")
        data = streams[0]
-        if cpu:
-            cpu.stop()
+        cpu.stop()
        if args.raw:
            Path(f"{args.raw}-{scenario}.json").write_text(json.dumps(data))
        result = summarize(scenario, data, start_mac_us, end_mac_us, args, relay, schedule, expected)
@@ -462,7 +452,7 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
                            for e in data.get("events", []) if e["t"] >= start_mac_us]
        result["captured"] = (captured_end if captured_end is not None else data["captured"]) - captured_before
        result["source_fps"] = round(result["captured"] / max(result["duration_s"], 1), 1)
-        result["cpu"] = cpu.summary() if cpu else {"host": "not sampled"}
+        result["cpu"] = cpu.summary()
        result["viewer"] = data["summary"].get("decoder", "")
        result["show_s"] = show_s
        result["panel"] = shown.get("panel")
@@ -470,8 +460,6 @@ def run_scenario(args, scenario, agent_port, token, frame_ssh):
        result["route"] = mv.route
        return result
    finally:
-        if cpu:
-            cpu.stop()
        try:
            mv.stop(src)
        except Exception:  # noqa: BLE001 - best effort
@@ -682,8 +670,6 @@ def fmt(v):

 def add_run_args(r):
    r.add_argument("--scenario", default="test,scroll,type")
-    r.add_argument("--pc", action="store_true", help="run the bundled PC host; use --scenario test or capture")
-    r.add_argument("--source", default="", help="PC source: window:ID, display:ID, or choose (Linux portal)")
    r.add_argument("--duration", type=float, default=20)
    r.add_argument("--warmup", type=float, default=3)
    r.add_argument("--quality", default="balanced", choices=list(frame_macview.QUALITY))
@@ -731,7 +717,7 @@ def frame_ssh_for(args):


 def run_suite(args, frame_ssh, quiet=False):
-    agent_port, token = (args.pc_view.port, args.pc_view.token) if args.pc else lab_agent()
+    agent_port, token = lab_agent()
    results = []
    for sc in args.scenario.split(","):
        if not quiet:
@@ -758,12 +744,11 @@ def document(args, frame_ssh, results, **extra):
    commit = git("rev-parse", "--short", "HEAD") + ("+dirty" if git("status", "--porcelain", "--", "mac", "ui") else "")
    return {
        "label": args.label or args.cmd, "date": datetime.datetime.now().isoformat(timespec="seconds"), "commit": commit,
-        "config": {"quality": args.quality, "mode": "native" if args.pc else args.mode, "net": args.net or "none", "delay_ms": args.delay,
+        "config": {"quality": args.quality, "mode": args.mode, "net": args.net or "none", "delay_ms": args.delay,
                   "buffer_ms": args.buffer, "host": args.host or args.frame, "usb": args.usb, "ssh_opts": args.ssh_opt,
                   "encoder": os.environ.get("FRAME_MAC_VIEW_ENCODER", ""), "duration_s": args.duration,
                   "browser_flags": args.browser_flag if args.browser_flag is not None else frame_macview.BROWSER_FLAGS},
-        "frame_build": build.strip().partition("=")[2], "mac": platform.mac_ver()[0],
-        "host_platform": platform.platform(), "source": args.source, "pc_host": args.pc, "headset": standby[-40:],
+        "frame_build": build.strip().partition("=")[2], "mac": platform.mac_ver()[0], "headset": standby[-40:],
        "scenarios": results, **extra,
    }

@@ -834,46 +819,19 @@ def main():
            print("\nworse:\n  " + "\n  ".join(regs))
        sys.exit(1 if regs else 0)

-    if args.pc and (args.cmd == "ab" or args.scenario not in ("test", "capture")):
-        p.error("PC runs use --scenario test or --scenario capture; Mac automation is not portable")
-    if args.pc and args.scenario == "capture" and not args.source:
-        p.error("capture needs --source window:ID, display:ID, or choose")
-    if not args.pc:
-        lab_agent()
+    lab_agent()
    frame_ssh = frame_ssh_for(args)
    # Keep the Mac's screen awake: virtual displays aren't removed while it sleeps.
    runs = 1 if args.cmd == "run" else args.repeat * len(args.arm)
-    awake = subprocess.Popen(["caffeinate", "-d", "-u", "-t", str(int(runs * (args.duration * 4 + 60) + 120))]) if sys.platform == "darwin" else None
-    args.pc_view = None
+    awake = subprocess.Popen(["caffeinate", "-d", "-u", "-t", str(int(runs * (args.duration * 4 + 60) + 120))])
    try:
-        if args.pc:
-            args.pc_view = frame_pcview.PCView(frame_ssh[:-1], ssh_runner(frame_ssh), frame_ssh[-1])
-            args.pc_view.ensure_agent()
-            if args.source == "choose":
-                args.pc_view.call("/permissions", method="POST")
-                print("Choose a window or screen in your desktop's sharing dialog.", flush=True)
-                deadline = time.monotonic()+125
-                while time.monotonic() < deadline:
-                    state = args.pc_view.call("/status")
-                    if not state.get("selecting"):
-                        sources = args.pc_view.call("/windows")["windows"]
-                        if not sources:
-                            raise SystemExit(state.get("selectionError") or "Nothing was shared")
-                        args.source = sources[-1]["src"]
-                        break
-                    time.sleep(.5)
-                else:
-                    raise SystemExit("Sharing dialog timed out")
        if args.cmd == "ab":
            arm_runs, table = ab(args, frame_ssh)
            write(document(args, frame_ssh, [], arms=args.arm, runs=arm_runs, table=table), args)
            return
        results = run_suite(args, frame_ssh)
    finally:
-        if args.pc_view:
-            args.pc_view.shutdown()
-        if awake:
-            awake.terminate()
+        awake.terminate()
    doc = document(args, frame_ssh, results)
    write(doc, args)
    bad = [f"{r['scenario']} {k}" for r in results for k, v in r["grades"].items() if v in ("bad", "missing")]
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Install or run our local-only tracking tools on the Frame.
+
+  python3 scripts/tracking-on-frame.py install
+  python3 scripts/tracking-on-frame.py gaze --seconds 10
+  python3 scripts/tracking-on-frame.py gaze --seconds 3600 --osc 127.0.0.1 9000
+  python3 scripts/tracking-on-frame.py heart --device AA:BB:CC:DD:EE:FF --panel
+  python3 scripts/tracking-on-frame.py pulse --seconds 60 --show   # experimental
+
+FRAME_ALIAS overrides the SSH alias (default: frame). Runs in the foreground;
+Ctrl-C stops the reader. No service, autostart, sudo or SteamVR settings changes.
+"""
+import os
+from pathlib import Path
+import shlex
+import subprocess
+import sys
+import tarfile
+
+REMOTE = '"$HOME/.local/share/frame-control/tracking"'
+INSTALL = '''set -eu
+base="$HOME/.local/share/frame-control/tracking"
+mkdir -p "$base"
+stage=$(mktemp -d "$base/.install.XXXXXX")
+trap 'rm -rf "$stage"' EXIT
+ tar -xf - -C "$stage"
+cc -O2 -Wall -Wextra -Werror "$stage/gaze.c" \\
+  -L/opt/steamvr/bin/linuxarm64 -Wl,-rpath,/opt/steamvr/bin/linuxarm64 \\
+  -lopenxr_loader -o "$stage/gaze"
+chmod 700 "$stage/gaze" "$stage/tracking.py"
+chmod 600 "$stage/pulse.py"
+mv "$stage/gaze" "$stage/tracking.py" "$stage/pulse.py" "$base/"
+echo 'Installed Frame Control tracking tools (no service started).'
+'''
+
+
+def main():
+    if len(sys.argv) < 2 or sys.argv[1] not in ("install", "gaze", "heart", "pulse"):
+        print(__doc__)
+        return 2
+    host = os.environ.get("FRAME_ALIAS", "frame")
+    if not host or host.startswith("-"):
+        raise ValueError("invalid SSH alias")
+    ssh = ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=10", host]
+    if sys.argv[1] == "install":
+        import tempfile
+        source = Path(__file__).resolve().parents[1] / "frame" / "tracking"
+        with tempfile.TemporaryFile() as archive:
+            with tarfile.open(fileobj=archive, mode="w") as tar:
+                for name in ("gaze.c", "tracking.py", "pulse.py"):
+                    tar.add(source / name, arcname=name)
+            archive.seek(0)
+            return subprocess.call(ssh + ["bash -c " + shlex.quote(INSTALL)], stdin=archive)
+    # Allocate a tty so SSH forwards Ctrl-C and hangup to the foreground process.
+    command = 'exec python3 ' + REMOTE + '/tracking.py ' + shlex.join(sys.argv[1:])
+    return subprocess.call(ssh[:-1] + ["-tt", host, command])
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -64,7 +64,7 @@ function sharedPage({productionApi=false} = {}) {
      const request=deferred();request.path=path;request.opts=opts;requests.push(request);return request.promise;
    };
    Object.assign(context,{renderPill(){},renderConnDlg(){},renderBanner(){},viaText(){},netLabel(){},
-      resetShots(){},closeDevPop(){},loadDevices(){},renderDevices(){},renderTests(){},reloadAll(){},checkContactPrompt(){}});
+      resetShots(){},loadDevices(){},renderDevices(){},renderTests(){},reloadAll(){},checkContactPrompt(){}});
    vm.runInContext(`const UI_KEY = 'test-only';
      const link = {s:null,device:'frame-a',phase:'connected',rev:0,net:null};
      const disp = {}, gm = {seq:0}, cat = {}, wi = {};
@@ -443,20 +443,20 @@ test('every linked workflow selects its real page and section, preserving shortc
  const start=html.indexOf('const PAGES ='),end=html.indexOf('window.addEventListener("hashchange", showPage);',start);
  const ids=new Set([...html.matchAll(/\bid="([^"]+)"/g)].map(m=>m[1]));
  let activePage,scrolled;
-  const nodes=['home','games','android','tools','devices','control','settings'].map(page=>({dataset:{page},classList:{toggle(key,on){if(on)activePage=page;}}}));
+  const nodes=['home','games','android','tools','devices','control'].map(page=>({dataset:{page},classList:{toggle(key,on){if(on)activePage=page;}}}));
  const sections=new Map();
  const context={location:{hash:'#control'},document:{querySelectorAll:s=>s==='.page'?nodes:[],title:''},
    window:{scrollTo(){}},$:id=>{
      if(!ids.has(id))return null;
-      if(!sections.has(id))sections.set(id,{hidden:false,classList:{toggle(){}},scrollIntoView(){scrolled=id;}});
+      if(!sections.has(id))sections.set(id,{hidden:false,scrollIntoView(){scrolled=id;}});
      return sections.get(id);
-    },live:false,toggleLive(){},scrollToY(){},loadMacView(){},loadPanelSwitcher(){}};
+    },live:false,toggleLive(){},loadMacView(){},loadPanelSwitcher(){}};
  const androidStart=html.indexOf('function showAndroidTab(');
  const androidEnd=html.indexOf("document.querySelectorAll('[data-store-tab]').forEach(button => button.onclick",androidStart);
-  vm.createContext(context);vm.runInContext(html.slice(androidStart,androidEnd)+html.slice(start,end)+'\n'+html.match(/^PAGES\.push\([^\n]+/m)[0],context);
+  vm.createContext(context);vm.runInContext(html.slice(androidStart,androidEnd)+html.slice(start,end)+'\nPAGES.push("devices", "control");',context);
  vm.runInContext('showPage()',context);assert.equal(activePage,'control');
  const expected={view:'home',shots:'home',vrTools:'home',comfort:'home',pad:'home',library:'games',getgames:'games',sideloaded:'games',android:'android',display:'android',androidLibrary:'android',appStore:'android',
-    power:'tools',transfer:'tools',media:'tools',apps:'tools',artworkSettings:'settings',privacy:'settings',panels:'tools',macview:'tools',devices:'devices'};
+    power:'tools',transfer:'tools',media:'tools',apps:'tools',artworkSettings:'tools',privacy:'tools',panels:'tools',macview:'tools',devices:'devices'};
  for(const item of cc.catalog) for(const [href] of item.links||[]) {
    if(!href.startsWith('#')||href==='#connection')continue;
    const id=href.slice(1);assert.ok(ids.has(id)||['android','devices'].includes(id),href);
@@ -468,5 +468,4 @@ test('every linked workflow selects its real page and section, preserving shortc
  }
  assert.equal(vm.runInContext('PAGES[4]',context),'devices');
  assert.equal(vm.runInContext('PAGES[5]',context),'control');
-  assert.equal(vm.runInContext('PAGES[6]',context),'settings');
 });
@@ -19,8 +19,8 @@ function grab(name) {
  fail(`unbalanced ${name}`);
 }
 const names = ["esc", "storeName", "storeHue", "storeInitial", "storeText", "storeOpenSource", "sourcePage", "storeImage",
-               "GLYPH_VR", "GLYPH_APP", "RUNS", "storeRuns", "storeKind", "storeArt", "storeIcon", "sourceMark", "currentOffer", "detailBadges", "renderAppDetail", "renderAppDetailBody",
-               "updateInstall", "openStoreApp", "loadOfferDetails", "installStoreApp"];
+               "storeArt", "storeIcon", "sourceMark", "currentOffer", "detailBadges", "renderAppDetail", "renderAppDetailBody",
+               "updateInstall", "openStoreApp", "loadOfferDetails"];
 const code = names.map(grab).join("");

 // A fake page: elements by id. The install panel's elements exist only while
@@ -34,10 +34,8 @@ function page(api = async () => ({})) {
  const document = { activeElement: null, querySelector: () => null };
  const console = { error() {} };
  const calls = [];
-  const fns = new Function("$", "sourceState", "document", "console", "api", "runJob", "loadAndroid", "act", "window", code + "; return { renderAppDetail, openStoreApp };")(
-    $, sourceState, document, console, (...a) => { calls.push(a); return api(...a); },
-    async (title, key, work) => work(), () => {}, async (title, work) => work(),
-    { open() { fail("an in-app installation opened an external page"); } });
+  const fns = new Function("$", "sourceState", "document", "console", "api", code + "; return { renderAppDetail, openStoreApp };")(
+    $, sourceState, document, console, (...a) => { calls.push(a); return api(...a); });
  return { els, sourceState, calls, ...fns };
 }

@@ -70,7 +68,7 @@ const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid
 {
  const p = page(async () => { throw new Error("offline"); });
  p.sourceState.apps = [{ name: "Broken", offers: [] }];
-  await p.openStoreApp(0, true);
+  await p.openStoreApp(0);
  if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('role="alert"')) fail("broken listing didn't open with the error");
  if (p.calls.length) fail("asked for details of a listing that couldn't render");
 }
@@ -92,18 +90,4 @@ const offer = { source: "fdroid", id: "org.example.brush", source_name: "F-Droid
  if (!p.els.detailBody.innerHTML.includes('id="detailTitle">Open Brush<')) fail("page lost after a failed details request");
  if (!p.els.detailInstallNote.textContent.includes("couldn't be refreshed")) fail("no note after a failed details request");
 }
-// The featured Install starts a new or failed job, while a job already running or
-// installed opens its details without another install or a launch command.
-for (const [job, expected] of [[null, 1], [{ done: false }, 0],
-    [{ done: true, result: { package: offer.package } }, 0], [{ done: true, error: "offline" }, 1]]) {
-  const p = page(async path => path === "/api/sources/install" ? { package: offer.package } : {});
-  p.sourceState.apps = [{ name: "Open Brush", offers: [{ ...offer }] }];
-  if (job) p.sourceState.jobs.set(`${offer.source}:${offer.id}`, job);
-  await p.openStoreApp(0, true);
-  if (!p.els.appDetail.open || !p.els.detailBody.innerHTML.includes('id="detailInstall"')) fail("hero installation didn't open details");
-  const installs = p.calls.filter(([path]) => path === "/api/sources/install");
-  if (installs.length !== expected) fail(`expected ${expected} installation requests, got ${installs.length}`);
-  if (installs.some(([, body]) => body.source !== offer.source || body.id !== offer.id)) fail("installed a different offer");
-  if (p.calls.some(([path]) => path === "/api/android")) fail("hero Install launched an already installed app");
-}
 console.log("ok");
@@ -56,48 +56,6 @@ const log = ()=>{}, toast = ()=>{};
  assert.equal($('sessionMinutes').disabled,false);
  assert.equal($('sessionCancel').disabled,true);
 })().catch(e=>{console.error(e);process.exitCode=1;});
-'''
-        result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True)
-        self.assertEqual(result.returncode, 0, result.stderr)
-
-    def test_a_finished_session_leaves_the_defaults(self):
-        """A one-minute test session that has ended mustn't fill the form with 1 / 0 / 0."""
-        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
-        code = page[page.index('let comfortBusy ='):page.index('async function pollComfort()')]
-        setup = r'''
-const assert = require('node:assert/strict');
-const elements = new Map();
-const $ = id => {
-  // The form's own defaults, as in the page's HTML.
-  const value = {sessionMinutes:'30', breakMinutes:'20', stillMinutes:'30'}[id] || '';
-  if (!elements.has(id)) elements.set(id, {textContent:'', hidden:true, disabled:false, value, defaultValue:value,
-    checked:true, defaultChecked:true, type: /Alert$/.test(id) ? 'checkbox' : 'number'});
-  return elements.get(id);
-};
-const window = {frameApp:{notify:async()=>{}}};
-const log = ()=>{}, toast = ()=>{};
-'''
-        checks = r'''
-renderComfort({id:'old', active:false, time:100, options:{minutes:1,breakMinutes:0,stillMinutes:0,batteryAlert:false,heatAlert:false},
-  events:[{id:'old:1',kind:'finished',time:90,message:'Session ended'}]});
-assert.equal($('sessionMinutes').value, '30');
-assert.equal($('breakMinutes').value, '20');
-assert.equal($('batteryAlert').checked, true);
-assert.match($('comfortEvents').textContent, /Session ended/);
-assert.notEqual($('comfortEvents').textContent, 'Session ended');  // it carries a time
-renderComfort({id:'new', active:true, time:200, remaining:600, options:{minutes:45,breakMinutes:15,stillMinutes:20,batteryAlert:true,heatAlert:false}, events:[]});
-assert.equal($('sessionMinutes').value, 45);  // a running session shows its own settings
-assert.equal($('heatAlert').checked, false);
-// The page stays open while that session ends: the next one starts from the defaults again.
-renderComfort({id:'new', active:false, time:900, options:{minutes:45,breakMinutes:15,stillMinutes:20,batteryAlert:true,heatAlert:false},
-  events:[{id:'new:1',kind:'finished',time:899,message:'Session ended'}]});
-assert.equal($('sessionMinutes').value, '30');
-assert.equal($('breakMinutes').value, '20');
-assert.equal($('heatAlert').checked, true);
-renderComfort({id:'new', active:false, time:905, options:{minutes:45}, events:[]});
-$('sessionMinutes').value = '50';  // what's typed for the next session
-renderComfort({id:'new', active:false, time:910, options:{minutes:45}, events:[]});
-assert.equal($('sessionMinutes').value, '50');  // later polls leave it alone
 '''
        result = subprocess.run(['node', '-e', setup + code + checks], capture_output=True, text=True)
        self.assertEqual(result.returncode, 0, result.stderr)
@@ -323,20 +323,6 @@ class Pins(Base):


 class Registry(Base):
-    def test_an_address_added_first_wins_on_its_own_network(self):
-        # The page's "Add 192.168.x.x" offer: the headset is reached over Tailscale, which has
-        # worked here before. The LAN address has to go ahead of it to be used at home.
-        d = self.reg.add_device("frame-4", hosts=["frame.tail1234.ts.net"])
-        self.reg.record_success(d["id"], "frame.tail1234.ts.net", "n-home", 6.0)
-        self.reg.add_address(d["id"], "192.168.1.40", kind="lan", first=True)
-        self.reg.record_success(d["id"], "192.168.1.40", "n-home", 1.0)  # Test now found it
-        addrs = self.reg.get(d["id"])["addresses"]
-        self.assertEqual([a["host"] for a in addrs], ["192.168.1.40", "frame.tail1234.ts.net"])
-        at_home = [a["host"] for a, _ in fd.order_addresses(addrs, "n-home", True)]
-        self.assertEqual(at_home[0], "192.168.1.40")
-        away = [a["host"] for a, _ in fd.order_addresses(addrs, "n-cafe", True)]
-        self.assertEqual(away[0], "frame.tail1234.ts.net")  # elsewhere Tailscale still leads
-
    def test_address_editing(self):
        d = self.reg.add_device("frame-3", hosts=["192.168.1.40"])
        a = self.reg.add_address(d["id"], "frame-3.local", label="mDNS")
@@ -897,47 +897,6 @@ class Connecting(unittest.TestCase):
        self.assertEqual(self.routes, [])
        self.assertTrue(all("ControlPath=none" in c for c in self.calls() if "-G" not in c))

-    def test_a_test_started_earlier_cant_overwrite_a_newer_one(self):
-        d = self.device("nothing.invalid")
-        entered = {1: threading.Event(), 2: threading.Event()}
-        release = {1: threading.Event(), 2: threading.Event()}
-        calls = []
-
-        def probe(host, port, update=None):
-            calls.append(host)
-            n = len(calls)
-            entered[n].set()
-            release[n].wait(10)
-            return {"state": "refused", "detail": f"test {n}", "ip": None, "rtt_ms": None}
-
-        tests = [threading.Thread(target=self.link.test, args=(d["id"],), daemon=True) for _ in range(2)]
-        with mock.patch.object(fl, "probe", probe):
-            try:
-                tests[0].start()
-                self.assertTrue(entered[1].wait(5), "the first test never probed")
-                tests[1].start()
-                self.assertTrue(entered[2].wait(5), "the second test never probed")
-                # The first finishes while the second is still probing: it mustn't show its
-                # rows or mark the second done.
-                release[1].set()
-                tests[0].join(10)
-                self.assertFalse(tests[0].is_alive())
-                running = self.link.snapshot()["tests"][d["id"]]
-                self.assertFalse(running["done"])
-                self.assertEqual(running["rows"][0]["detail"], "Waiting")
-                release[2].set()
-                tests[1].join(10)
-                self.assertFalse(tests[1].is_alive())
-            finally:
-                for e in release.values():
-                    e.set()
-                for t in tests:
-                    if t.ident:  # started
-                        t.join(10)
-        result = self.link.snapshot()["tests"][d["id"]]
-        self.assertTrue(result["done"])
-        self.assertEqual(result["rows"][0]["detail"], "test 2")
-
    def test_switching_to_a_headset_that_never_answers_stops_using_the_last_one(self):
        self.device("localhost")
        self.hosts({"localhost": "ok"})
@@ -56,19 +56,18 @@ class LinkUI(unittest.TestCase):
        r = subprocess.run(["node", "-e", script], capture_output=True, text=True)
        self.assertEqual(r.returncode, 0, r.stderr)

-    def test_the_pill_keeps_the_failure_detail_in_its_tooltip(self):
-        # The connection redesign keeps the state and retry countdown in the pill,
-        # with the full failure explanation in its tooltip and details dialog.
+    def test_the_pill_leads_with_the_reason(self):
+        # The header pill cut off "Offline: checking the headset's identity failed · retry in…":
+        # the reason comes first, in a few words, and only the countdown gets cut.
        self.run_page(r'''
  link.s = changed;
  renderPill();
-  assert.match($('conn').innerHTML, /<b>Office Frame<\/b><span>Offline<span class="via"> · retrying in 12 s<\/span>/);
-  assert.ok($('conn').title.includes(changed.error.message));
+  assert.match($('conn').innerHTML, /<b>Office Frame<\/b><span>SSH identity changed · retry in 12 s<\/span>/);
+  assert.equal($('conn').title, 'Office Frame is offline: SSH identity changed · retry in 12 s. Click for details.');
  // Without a short reason: the stage that failed.
  link.s = {...changed, retry_at: null, error: {stage: 'identity', message: 'Something.'}};
  renderPill();
-  assert.match($('conn').innerHTML, /<span>Offline<\/span>/);
-  assert.ok($('conn').title.includes('Something.'));
+  assert.match($('conn').innerHTML, /<span>Checking the headset&#39;s identity failed<\/span>/);
 ''')

    def test_the_banner_never_doubles_a_full_stop(self):
@@ -84,10 +84,7 @@ class Helpers(unittest.TestCase):
    @unittest.skipUnless(shutil.which("bash"), "needs bash")
    @unittest.skipIf(os.name == "nt", "Windows' bash.exe is WSL's launcher, and runners have no distribution")
    def test_launch_script_parses(self):
-        bash = str(Path(os.environ.get("ProgramFiles", "C:/Program Files")) / "Git/bin/bash.exe") if sys.platform == "win32" else "bash"
-        if sys.platform == "win32" and not Path(bash).exists():
-            self.skipTest("Git Bash is not installed (WSL bash is not a local shell)")
-        r = subprocess.run([bash, "-n"], input=frame_macview.LAUNCH.encode("utf-8"), capture_output=True)
+        r = subprocess.run(["bash", "-n"], input=frame_macview.LAUNCH, text=True, capture_output=True)
        self.assertEqual(r.returncode, 0, r.stderr)

    def test_show_checks_the_source_before_anything_else(self):
@@ -1,141 +0,0 @@
-"""The page's inline scripts share one global scope, so a second top-level function or
-variable with a name already used replaces the first everywhere, silently."""
-import html.parser
-import json
-import pathlib
-import shutil
-import subprocess
-import unittest
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-
-# Compiles the scripts as one strict-mode block. There, functions are block scoped like let
-# and const, so V8 itself rejects a name declared twice in the shared scope (however it's
-# indented or declared: function, class, let, const, destructuring), while helpers with the
-# same name inside different functions stay legal. var is the exception (declaring one twice
-# is allowed), so the page doesn't use var at all: Node's own copy of the acorn parser finds
-# real var declarations, not the word in comments, strings or CSS var().
-DUPLICATES = r'''
-const vm = require('vm');
-const scripts = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-try { new vm.Script('"use strict"; {\n' + scripts.join('\n;\n') + '\n}'); console.log('ok'); }
-catch (e) { console.log(e.message); }
-'''
-VARS = r'''
-const scripts = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-let acorn, walk;
-try {
-  acorn = require('internal/deps/acorn/acorn/dist/acorn');
-  walk = require('internal/deps/acorn/acorn-walk/dist/walk');
-} catch { console.log('no parser'); process.exit(0); }
-for (const code of scripts) {
-  let found = null;
-  try {
-    walk.simple(acorn.parse(code, { ecmaVersion: 'latest' }), {
-      VariableDeclaration(n) { if (n.kind === 'var' && !found) found = code.slice(n.start, n.end).slice(0, 40); },
-    });
-  } catch (e) { console.log(e.message); process.exit(0); }
-  if (found) { console.log('declares with var: ' + found); process.exit(0); }
-}
-console.log('ok');
-'''
-
-
-def node(script, scripts, *flags):
-    r = subprocess.run(['node', *flags, '-e', script], input=json.dumps(scripts), capture_output=True, text=True)
-    return r.stdout.strip() or r.stderr.strip()
-
-
-def check(scripts):
-    """'ok', or V8's message for the first name declared twice."""
-    return node(DUPLICATES, scripts)
-
-
-def check_vars(scripts):
-    """'ok', or the first var declaration. Skips where Node doesn't include acorn."""
-    out = node(VARS, scripts, '--expose-internals')
-    if out == 'no parser':
-        raise unittest.SkipTest("this Node doesn't include acorn")
-    return out
-
-
-class ClassicScripts(html.parser.HTMLParser):
-    """The page's inline classic scripts: no src, and no type other than a JavaScript one (a
-    module has its own scope, and JSON data isn't code). The types a browser runs as script:
-    https://mimesniff.spec.whatwg.org/#javascript-mime-type"""
-    JS = {'', 'application/ecmascript', 'application/javascript', 'application/x-ecmascript',
-          'application/x-javascript', 'text/ecmascript', 'text/javascript', 'text/javascript1.0',
-          'text/javascript1.1', 'text/javascript1.2', 'text/javascript1.3', 'text/javascript1.4',
-          'text/javascript1.5', 'text/jscript', 'text/livescript', 'text/x-ecmascript', 'text/x-javascript'}
-
-    def __init__(self):
-        super().__init__()
-        self.scripts, self.current = [], None
-
-    def handle_starttag(self, tag, attrs):
-        if tag == 'script':
-            a = dict(attrs)
-            inline = 'src' not in a and (a.get('type') or '').strip().lower() in self.JS
-            self.current = [] if inline else None
-
-    def handle_data(self, data):
-        if self.current is not None:
-            self.current.append(data)
-
-    def handle_endtag(self, tag):
-        if tag == 'script' and self.current is not None:
-            self.scripts.append(''.join(self.current))
-        if tag == 'script':
-            self.current = None
-
-
-def classic_scripts(page):
-    p = ClassicScripts()
-    p.feed(page)
-    return p.scripts
-
-
-@unittest.skipUnless(shutil.which('node'), 'Node parses the page scripts')
-class PageScripts(unittest.TestCase):
-    def test_no_top_level_name_is_declared_twice(self):
-        scripts = classic_scripts((ROOT / 'ui/index.html').read_text(encoding='utf-8'))
-        self.assertGreaterEqual(len(scripts), 2)
-        self.assertEqual(check(scripts), 'ok')
-
-    def test_the_page_declares_nothing_with_var(self):
-        scripts = classic_scripts((ROOT / 'ui/index.html').read_text(encoding='utf-8'))
-        self.assertEqual(check_vars(scripts), 'ok')
-
-    def test_the_check_finds_what_it_should(self):
-        twice = {
-            'indented function': ['function loadPanels() {}', '  async function loadPanels() {}'],
-            'class': ['class Panel {}', 'class Panel {}'],
-            'destructured': ['const { a, b } = {};', 'let [b] = [];'],
-            'later declarator': ['let x = 1;', 'const y = 2, x = 3;'],
-            'function and const': ['function f() {}', 'const f = 1;'],
-        }
-        for what, scripts in twice.items():
-            with self.subTest(what):
-                self.assertIn('already been declared', check(scripts))
-        helpers = ['function a() { function help() {} }', 'function b() { const help = 1; }']
-        self.assertEqual(check(helpers), 'ok')
-
-    def test_the_var_check_finds_what_it_should(self):
-        # var: legal to declare twice, so not allowed at all; however it's written.
-        for code in ['var x = 1;', 'var/*c*/x = 1;', 'var {x} = {x: 1};', 'function f() { var y; }']:
-            with self.subTest(code):
-                self.assertIn('declares with var', check_vars([code]))
-        # The word var elsewhere is fine.
-        text = ['// var x\nconst a = "var y", b = `var ${a}`, c = "color: var(--blue)", d = {}.var;']
-        self.assertEqual(check_vars(text), 'ok')
-
-    def test_only_inline_classic_scripts_are_checked(self):
-        page = ('<script>let a;</script><script type="module">export const m = 1;</script>'
-                '<script type="application/json">{"b": 1}</script><script src = "x.js"></script>'
-                '<script data-src="y" type="text/javascript">let c;</script>'
-                '<script type="text/ecmascript">let d;</script><script type=" Application/X-JavaScript ">let e;</script>')
-        self.assertEqual(classic_scripts(page), ['let a;', 'let c;', 'let d;', 'let e;'])
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -1,55 +0,0 @@
-"""The page calls showPage() while its first script is still running, before names declared
-later (in that script or the second one) exist. Touching one of them there throws, and the
-rest of the page's setup never runs: opening Frame Control at #games did exactly that."""
-import json
-import pathlib
-import re
-import shutil
-import subprocess
-import unittest
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-STUBS = ['$', 'toggleLive', 'scrollToY', 'loadMacView', 'loadPanels', 'loadPanelSwitcher', 'loadTitles', 'showAndroidTab']
-
-RUN = r'''
-const vm = require('vm');
-const {code, hashes} = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-const failures = [];
-for (const hash of hashes) {
-  const context = vm.createContext({
-    location: {hash}, document: {querySelectorAll: () => [], title: ''}, live: false,
-  });
-  try { vm.runInContext(code, context); }
-  catch (e) { failures.push(`${hash}: ${e.message}`); }
-}
-console.log(JSON.stringify(failures));
-'''
-
-
-@unittest.skipUnless(shutil.which('node'), 'Node runs the page code')
-class PageStartup(unittest.TestCase):
-    def test_opening_any_page_or_section_at_startup_runs(self):
-        page = (ROOT / 'ui/index.html').read_text(encoding='utf-8')
-        first, second = re.findall(r'<script>(.*?)</script>', page, re.S)[:2]
-        tables = first[first.index('const PAGES ='):first.index('let page =')]
-        start = first.index('function showPage(')
-        show = first[start:first.index('\n}\n', start) + 3]
-        # Everything declared after the startup call is still uninitialised when it runs.
-        call = re.search(r'^showPage\(\);', first, re.M).end()
-        later = re.findall(r'^(?:const|let)\s+(\w+)', first[call:] + second, re.M)
-        later = [n for n in dict.fromkeys(later) if n not in STUBS and n not in ('PAGES', 'SECTION_PAGE', 'page')]
-        self.assertIn('link', later)  # the name that broke #games
-        stubs = ''.join(f'function {n}() {{ return {{ classList: {{ toggle() {{}} }}, scrollIntoView() {{}} }}; }}\n'
-                        for n in STUBS if n != '$')
-        code = ('const $ = id => id === "nowhere" ? null : { classList: { toggle() {} }, scrollIntoView() {} };\n' + stubs + tables + 'let page = "home";\n' + show +
-                'showPage();\n' + ''.join(f'let {n};\n' for n in later))
-        hashes = ['', '#home', '#games', '#android', '#tools', '#settings', '#devices', '#control', '#nowhere']
-        hashes += ['#' + k for k in re.findall(r'(\w+): "', tables)]
-        r = subprocess.run(['node', '-e', RUN], input=json.dumps({'code': code, 'hashes': hashes}),
-                           capture_output=True, text=True)
-        self.assertEqual(r.returncode, 0, r.stderr)
-        self.assertEqual(json.loads(r.stdout), [])
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -1,64 +0,0 @@
-"""Frozen regression trace from the original mac-in-headset Swift controller.
-The 600-state reference was produced at 1b90c64, before the C extraction:
-60 seconds with a slow/congested middle, then recovery. No generated behavior
-from the new implementation is used to calculate the expected digest.
-"""
-import ctypes as C
-import hashlib
-import json
-from pathlib import Path
-import shutil
-import subprocess
-import sys
-import tempfile
-import unittest
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / 'ui'))
-from frame_pc_capture import Controller
-
-
-class ControllerTrace(unittest.TestCase):
-    def test_original_mac_congestion_and_recovery(self):
-        cc = shutil.which('cc') or shutil.which('gcc')
-        if not cc:
-            self.skipTest('C compiler not installed; native build jobs cover this trace')
-        with tempfile.TemporaryDirectory() as tmp:
-            path = Path(tmp) / ('trace.dll' if sys.platform == 'win32' else 'trace.so')
-            subprocess.run([cc, '-O2', '-shared', '-fPIC', str(ROOT/'desktop/controller.c'), '-o', str(path)], check=True, capture_output=True)
-            lib = C.CDLL(str(path))
-            sig = {'new': (C.c_void_p, [C.c_int, C.c_int]), 'free': (None, [C.c_void_p]),
-                   'ceiling': (None, [C.c_void_p, C.c_int]), 'value': (C.c_int64, [C.c_void_p, C.c_int]),
-                   'capture': (None, [C.c_void_p, C.c_int64]), 'gate': (C.c_int, [C.c_void_p, C.c_int64, C.c_int]),
-                   'sent': (None, [C.c_void_p, C.c_uint32, C.c_int, C.c_int64]),
-                   'ack': (C.c_int, [C.c_void_p, C.c_uint32, C.c_int64]), 'update': (C.c_int, [C.c_void_p, C.c_int64])}
-            for name, (ret, args) in sig.items():
-                fn = getattr(lib, 'fc_'+name)
-                fn.restype, fn.argtypes = ret, args
-            c = Controller(lib, 60, 8000000)
-            due, states, seq = [], [], 0
-            try:
-                for tick in range(6000):
-                    now = 10000000+tick*10000
-                    for t, s in due:
-                        if t <= now:
-                            c.call('ack', s, now)
-                    due = [(t, s) for t, s in due if t > now]
-                    if tick % 2 == 0:
-                        c.call('capture', now)
-                        if c.call('gate', now, 1):
-                            seq += 1
-                            c.call('sent', seq, 8000 if tick < 1000 or tick > 4000 else 22000, now)
-                            due.append((now+(240000 if 1500 < tick < 3500 else 20000), seq))
-                    if tick % 10 == 0:
-                        c.update(now)
-                        x = c.state()
-                        states.append([x[k] for k in ('target', 'ceiling', 'tier', 'fps', 'inFlight')] +
-                                      [round(x['scale']*100), round(x['baseRtt']*1000), round(x['slack']*1000)])
-                digest = hashlib.sha256(json.dumps(states, separators=(',', ':')).encode()).hexdigest()
-                self.assertEqual(digest, '1932f16aafce5c9157bcd2aba5d90719a366f9999422920aaeae78a6cdec08f6')
-            finally:
-                c.close()
-                if sys.platform == 'win32':
-                    import _ctypes
-                    _ctypes.FreeLibrary(lib._handle)
@@ -1,388 +0,0 @@
-"""PC adapters: grants, input cleanup, launcher reuse and native codec contract.
-Native tests require the bundled libraries; CI sets REQUIRE_NATIVE so a missing
-bundle is a failure, never a silent skip. No desktop consent or GPU is faked as
-successful real-host capture.
-"""
-import ctypes
-import http.client
-import json
-import os
-from pathlib import Path
-import shutil
-import struct
-import subprocess
-import sys
-import threading
-import time
-import unittest
-from unittest import mock
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / 'ui'))
-import frame_pc_agent as agent
-import frame_pc_capture as capture
-import frame_pcview
-import frame_macview
-from frame_stream_stats import Stats
-from test_macview import WS
-
-
-class GrantsTests(unittest.TestCase):
-    def test_source_bound_retry_ack_and_stop(self):
-        g = agent.Grants('master')
-        ticket = g.ticket('window:1')
-        self.assertIsNone(g.redeem('window:2', {'t': ticket}))
-        key = g.redeem('window:1', {'t': ticket})
-        self.assertEqual(key, g.redeem('window:1', {'t': ticket}))
-        g.ack(key)
-        self.assertIsNone(g.redeem('window:1', {'t': ticket}))
-        self.assertEqual(key, g.redeem('window:1', {'r': key}))
-        self.assertIsNone(g.redeem('window:2', {'r': key}))
-        g.revoke('window:1')
-        self.assertIsNone(g.redeem('window:1', {'r': key}))
-
-    def test_expiry_and_stop_before_redeem(self):
-        g = agent.Grants('master')
-        with mock.patch.object(agent.time, 'monotonic', return_value=1):
-            ticket = g.ticket('test')
-        with mock.patch.object(agent.time, 'monotonic', return_value=62):
-            self.assertIsNone(g.redeem('test', {'t': ticket}))
-        ticket = g.ticket('test')
-        g.revoke()
-        self.assertIsNone(g.redeem('test', {'t': ticket}))
-
-
-class AdapterTests(unittest.TestCase):
-    def test_windows_uses_wgc_and_media_foundation(self):
-        for kind in ('window', 'display'):
-            pipeline = capture.pipeline(dict(src=kind+':42'), 'win32', 'mfh264enc', 640, 360, 30, 1000000)
-            self.assertIn('capture-api=wgc', pipeline)
-            self.assertIn('window-handle=42' if kind == 'window' else 'monitor-handle=42', pipeline)
-            self.assertIn('mfh264enc name=enc low-latency=true bframes=0', pipeline)
-            self.assertNotIn('drop=true', pipeline)
-        with self.assertRaises(ValueError):
-            capture.pipeline(dict(src='window:42 ! fakesink'), 'win32', 'mfh264enc', 640, 360, 30, 1000000)
-
-    def test_linux_uses_only_portal_fd_and_node(self):
-        p = capture.pipeline(dict(src='window:consented', fd=19, node=47), 'linux', 'x264enc', 640, 360, 30, 1000000)
-        self.assertIn('pipewiresrc fd=19 path=47', p)
-        self.assertIn('tune=zerolatency', p)
-        self.assertEqual(capture.dimensions(1920, 1080, 1280), (1280, 720))
-
-    def test_portal_input_clamps_and_releases_held_state(self):
-        native = mock.Mock()
-        native.lib.fc_portal_input.return_value = 1
-        inp = capture.PortalInput(native, dict(portal=123, w=100, h=50))
-        inp.handle(dict(t='m', e='down', b=0, x=2, y=-1))
-        inp.handle(dict(t='k', e='down', key='Control'))
-        inp.release()
-        calls = native.lib.fc_portal_input.call_args_list
-        self.assertEqual(calls[0].args, (123, 0, 99, 0, 0, 0))
-        self.assertIn(mock.call(123, 1, 0, 0, 0x110, 0), calls)
-        self.assertIn(mock.call(123, 3, 0, 0, 0xffe3, 0), calls)
-        self.assertFalse(inp.buttons or inp.keys)
-
-    def test_windows_release_and_negative_monitor_origin(self):
-        host = mock.Mock()
-        host.user.GetSystemMetrics.side_effect = [-1920, 0, 3840, 1080]
-        inp = capture.WindowsInput(host, dict(src='display:4', x=-1920, y=0, w=1920, h=1080))
-        inp.handle(dict(t='m', e='down', b=2, x=0, y=0))
-        self.assertEqual(host.send.call_args_list[0], mock.call(mouse=(0, 0, 0, 0xc001)))
-        inp.handle(dict(t='k', e='down', code='ControlLeft', key='Control'))
-        inp.release()
-        self.assertIn(mock.call(mouse=(0, 0, 0, 0x10)), host.send.call_args_list)
-        self.assertIn(mock.call(key=(162, 0, 2)), host.send.call_args_list)
-
-    def test_refused_windows_focus_never_clicks_the_covering_app(self):
-        host = mock.Mock()
-        host.rect.return_value = (0, 0, 800, 600)
-        host.user.GetForegroundWindow.return_value = 99
-        host.user.SetForegroundWindow.return_value = False
-        inp = capture.WindowsInput(host, dict(src='window:12', w=800, h=600))
-        with self.assertRaisesRegex(RuntimeError, 'could not focus'):
-            inp.handle(dict(t='m', e='down', b=0, x=.5, y=.5))
-        host.send.assert_not_called()
-
-    def test_pc_reuses_launcher_and_namespaces_panel_ids(self):
-        view = frame_pcview.PCView(['ssh'], mock.Mock(return_value='panel created'), 'frame')
-        view.call = mock.Mock(side_effect=lambda path, **kw: {'screen': True, 'ticket': 'one-use', 'streams': []})
-        view.ensure_tunnel = mock.Mock()
-        view.remote_port = 47900
-        view.show('window:12')
-        self.assertEqual(view.run.call_args.kwargs['stdin'], frame_macview.LAUNCH)
-        self.assertNotEqual(frame_macview.panel_id('window:12'), frame_macview.panel_id('window:12', 'windows'))
-        self.assertFalse(view.prefer_usb)
-        with self.assertRaises(frame_macview.MacViewError):
-            view.show('separate:12')
-
-    def test_session_end_releases_native_input_only_once(self):
-        session = object.__new__(agent.Session)
-        session.lock, session.input_lock = threading.RLock(), threading.RLock()
-        session.stop_event = threading.Event()
-        session.ws, session.input = mock.Mock(), mock.Mock()
-        session.released = False
-        session.end()
-        session.end()
-        session.input.release.assert_called_once()
-        self.assertTrue(session.stop_event.is_set())
-
-    def test_idle_source_is_not_a_stall(self):
-        # PipeWire/WGC deliver frames only on damage: a static desktop sends
-        # its first frame and then nothing. That must not end the session.
-        session = object.__new__(agent.Session)
-        session.lock, session.pending = threading.RLock(), {}
-        session.stats = Stats(lambda: 0)
-        session.stats.captured = 1
-        self.assertIsNone(session.stalled(60000000, 0, 0))
-        # A frame that entered the encoder and never came out is a fault.
-        session.pending[5] = dict(cap=0, arr=0, e0=1000000, tier=0, br=0)
-        self.assertIn('encoder', session.stalled(12000000, 0, 0))
-        self.assertIsNone(session.stalled(10000000, 0, 0))
-        # No initial frame at all after the pipeline opened is a fault.
-        session.pending.clear()
-        self.assertIn('capture', session.stalled(12000000, 0, 1))
-        self.assertIsNone(session.stalled(9000000, 0, 1))
-
-    def test_controller_is_inert_after_close(self):
-        lib = mock.Mock()
-        lib.fc_new.return_value = 1234
-        lib.fc_value.return_value = 100
-        controller = capture.Controller(lib, 60, 5000000)
-        controller.close()
-        lib.fc_free.assert_called_once_with(1234)
-        lib.reset_mock()
-        state = controller.state()
-        self.assertEqual((state['fps'], state['target'], state['scale']), (60, 0, 1))
-        self.assertEqual(controller.call('gate', 1, 1), 0)
-        self.assertEqual(controller.update(1), 0)
-        controller.close()
-        self.assertEqual(lib.method_calls, [])  # nothing touched the freed pointer
-
-    def test_library_path_prepend_adds_no_empty_entry(self):
-        env = {}
-        frame_pcview.prepend(env, 'LD_LIBRARY_PATH', '/opt/fc/lib')
-        self.assertEqual(env['LD_LIBRARY_PATH'], '/opt/fc/lib')
-        frame_pcview.prepend(env, 'LD_LIBRARY_PATH', '/x')
-        self.assertEqual(env['LD_LIBRARY_PATH'], '/x' + os.pathsep + '/opt/fc/lib')
-        with mock.patch.dict(os.environ, clear=True):
-            env = frame_pcview.PCView([], lambda *a: None, 'frame').agent_environment()
-        for name in ('PATH', 'LD_LIBRARY_PATH'):
-            parts = env.get(name, 'x').split(os.pathsep)
-            self.assertNotIn('', parts, name)
-
-    def test_malformed_viewer_input_is_dropped_not_fatal(self):
-        session = object.__new__(agent.Session)
-        session.lock, session.input_lock = threading.RLock(), threading.RLock()
-        session.stop_event, session.key_event = threading.Event(), threading.Event()
-        session.src, session.codec, session.key, session.w, session.h = 'display:1', 'h264', 'r', 100, 100
-        session.source = dict(src='display:1', w=100, h=100, portal=1)
-        session.input_enabled, session.released = True, False
-        session.native = mock.Mock()
-        session.native.now.return_value = 0
-        session.controller, session.agent = mock.Mock(), mock.Mock()
-        session.stats = Stats(lambda: 0)
-        session.produce = lambda: None
-        lib = mock.Mock()
-        lib.fc_portal_input.return_value = 1
-        session.input = capture.PortalInput(mock.Mock(lib=lib), session.source)
-        session.ws = mock.Mock()
-        session.ws.receive.side_effect = [
-            dict(t='m', x='left', y=0), dict(t='wheel', dx=[1]), dict(t='k', e='down', key=None, i='x'),
-            dict(t='fd', drop='many'), dict(t='rx', s=[1]), dict(t='m', x=.5, y=.5), ConnectionError('closed')]
-        with self.assertRaises(ConnectionError):
-            session.start()
-        # Every malformed message was skipped; the good move after them still ran.
-        moves = [c.args for c in lib.fc_portal_input.call_args_list if c.args[1] == 0]
-        self.assertAlmostEqual(moves[-1][2], .5*99)
-        self.assertEqual(session.ws.receive.call_count, 7)
-
-    def test_stats_keep_capture_time_and_bound_records(self):
-        stats = Stats(lambda: 10000000)
-        stats.input(dict(t='m', i=1, tv=9999990))
-        f = stats.add(cap=10000001, arr=10000002, e0=10000003, e1=10000004)
-        self.assertEqual(f['echo'], 1)
-        stats.report(dict(t='rx', s=f['s'], r=10000010))
-        stats.report(dict(t='fd', f=[[f['s'], 10000011, 10000012, 10000013]]))
-        self.assertEqual(stats.snapshot(settle=0)['inputs'][0]['frame'], f['s'])
-        for _ in range(4100):
-            stats.add(cap=10000001)
-        self.assertEqual(len(stats.frames), 4096)
-
-
-class NativeTests(unittest.TestCase):
-    @classmethod
-    def setUpClass(cls):
-        if not capture.LIBRARY.exists():
-            if os.environ.get('FRAME_PC_REQUIRE_NATIVE') == '1':
-                raise AssertionError('CI required native PC libraries but they were not built')
-            raise unittest.SkipTest('native PC libraries not built on this host')
-        cls.token = 'test-' + os.urandom(8).hex()
-        env = frame_pcview.PCView([], lambda *a: None, 'frame').agent_environment()
-        env['FRAME_MAC_VIEW_TOKEN'] = cls.token
-        cls.proc = subprocess.Popen([sys.executable, str(ROOT/'ui/frame_pc_agent.py'), 'serve', '--port', '0',
-            '--page', str(ROOT/'ui/mac-view.html'), '--exit-on-eof'], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE, text=True, env=env)
-        line = cls.proc.stdout.readline()
-        if 'listening' not in line:
-            raise AssertionError('Native agent failed: ' + cls.proc.stderr.read())
-        cls.port = int(line.rsplit(':', 1)[1])
-
-    @classmethod
-    def tearDownClass(cls):
-        cls.proc.stdin.close()
-        try:
-            rc = cls.proc.wait(10)
-        except subprocess.TimeoutExpired:
-            cls.proc.kill()
-            raise AssertionError('Native agent did not stop after EOF')
-        error = cls.proc.stderr.read()
-        cls.proc.stdout.close()
-        cls.proc.stderr.close()
-        if rc:
-            raise AssertionError('Native agent exited %s: %s' % (rc, error))
-
-    def request(self, path, method='GET'):
-        conn = http.client.HTTPConnection('127.0.0.1', self.port, timeout=10)
-        try:
-            conn.request(method, path)
-            response = conn.getresponse()
-            return response.status, response.read()
-        finally:
-            conn.close()
-
-    def tearDown(self):
-        self.request('/close?k='+self.token, 'POST')
-
-    @unittest.skipUnless(sys.platform.startswith('linux'), 'Linux PipeWire client libraries')
-    def test_bundled_pipewire_context_needs_no_system_modules(self):
-        # No portal request, remote connection or desktop capture: create and
-        # destroy a private client context to test the dynamically loaded SPA
-        # and protocol modules that ldd cannot discover.
-        code = """
-import ctypes as C, os
-lib = C.CDLL(os.path.join(os.environ['FRAME_PC_NATIVE'], 'lib', 'libpipewire-0.3.so.0'))
-for name, ret, args in [
-    ('pw_init', None, [C.c_void_p, C.c_void_p]),
-    ('pw_main_loop_new', C.c_void_p, [C.c_void_p]),
-    ('pw_main_loop_get_loop', C.c_void_p, [C.c_void_p]),
-    ('pw_context_new', C.c_void_p, [C.c_void_p, C.c_void_p, C.c_size_t]),
-    ('pw_context_find_factory', C.c_void_p, [C.c_void_p, C.c_char_p]),
-    ('pw_context_find_spa_lib', C.c_char_p, [C.c_void_p, C.c_char_p]),
-    ('pw_context_destroy', None, [C.c_void_p]),
-    ('pw_main_loop_destroy', None, [C.c_void_p])]:
-    fn = getattr(lib, name)
-    fn.restype, fn.argtypes = ret, args
-lib.pw_init(None, None)
-loop = lib.pw_main_loop_new(None)
-assert loop, 'bundled SPA loop support did not load'
-context = lib.pw_context_new(lib.pw_main_loop_get_loop(loop), None, 0)
-assert context, 'bundled PipeWire client modules did not load'
-assert lib.pw_context_find_factory(context, b'adapter'), 'video adapter factory is missing'
-# The exported factory is video.adapt, which needs a live follower node to
-# instantiate. Check its configured library and exported factory without
-# pretending a headless context is a consented video stream.
-plugin_name = lib.pw_context_find_spa_lib(context, b'video.adapt')
-assert plugin_name, 'video.adapt has no bundled library mapping'
-plugin = C.CDLL(os.path.join(os.environ['SPA_PLUGIN_DIR'], plugin_name.decode() + '.so'))
-class Factory(C.Structure):
-    _fields_ = [('version', C.c_uint32), ('name', C.c_char_p)]
-plugin.spa_handle_factory_enum.argtypes = [C.POINTER(C.POINTER(Factory)), C.POINTER(C.c_uint32)]
-plugin.spa_handle_factory_enum.restype = C.c_int
-factory, index, names = C.POINTER(Factory)(), C.c_uint32(), []
-while plugin.spa_handle_factory_enum(C.byref(factory), C.byref(index)) > 0:
-    names.append(factory.contents.name)
-assert b'video.adapt' in names, 'bundled SPA video adapter factory is missing'
-lib.pw_context_destroy(context)
-lib.pw_main_loop_destroy(loop)
-"""
-        env = frame_pcview.PCView([], lambda *a: None, 'frame').agent_environment()
-        env['FRAME_PC_NATIVE'] = str(capture.NATIVE)
-        result = subprocess.run([sys.executable, '-c', code], env=env, capture_output=True, text=True, timeout=15)
-        self.assertEqual(result.returncode, 0, result.stderr)
-
-    def test_last_raw_picture_survives_a_closed_gate(self):
-        # A source sends ONE changed frame, then becomes idle. It must reach
-        # the encoder after congestion clears, without needing another update.
-        code = """
-import ctypes as C, sys, time
-from frame_pc_capture import Native, GATE, Encoded, pipeline
-native = Native()
-start = None
-closing = False
-phases = []
-def gate(stage, pts, capture, arrived):
-    global start
-    phases.append(stage)
-    if closing: return -1
-    if start is None: start = time.monotonic()
-    return int(stage == 1 or time.monotonic()-start >= .15)
-callback = GATE(gate)
-p = pipeline(dict(src='test'), sys.platform, 'x264enc', 320, 180, 30, 300000)
-p = p.replace('is-live=true', 'is-live=true num-buffers=1')
-error = C.create_string_buffer(1024)
-handle = native.lib.fc_capture_open(p.encode(), callback, error, len(error))
-assert handle, error.value
-try:
-    frame = Encoded()
-    result = 0
-    deadline = time.monotonic()+5
-    while not result and time.monotonic() < deadline:
-        result = native.lib.fc_capture_pull(handle, C.byref(frame))
-    assert result == 1, native.lib.fc_capture_error(handle)
-    assert frame.key and frame.size > 17
-    assert phases.count(0) == 1 and 2 in phases, phases
-finally:
-    closing = True
-    native.lib.fc_capture_close(handle)
-"""
-        env = frame_pcview.PCView([], lambda *a: None, 'frame').agent_environment()
-        env['PYTHONPATH'] = str(ROOT / 'ui')
-        result = subprocess.run([sys.executable, '-c', code], env=env, capture_output=True, text=True, timeout=10)
-        self.assertEqual(result.returncode, 0, result.stderr)
-
-    def test_auth_and_real_h264_stats(self):
-        self.assertEqual(self.request('/status')[0], 403)
-        status, body = self.request('/ticket?src=test&k='+self.token, 'POST')
-        self.assertEqual(status, 200)
-        ticket = json.loads(body)['ticket']
-        ws = WS(self.port, '/stream?src=test&fps=30&max=640&t='+ticket)
-        try:
-            self.assertEqual(ws.status, 101)
-            key, got, echo = None, 0, False
-            ws.send_text(json.dumps(dict(t='m', e='down', i=7, tv=1, x=.2, y=.3)))
-            deadline = time.monotonic()+10
-            while time.monotonic() < deadline and (got < 5 or not echo):
-                op, data = ws.recv()
-                if op == 1:
-                    m = json.loads(data)
-                    self.assertNotEqual(m.get('t'), 'error', m)
-                    if m.get('t') == 'hello':
-                        key = m['r']
-                        ws.send_text(json.dumps(dict(t='ack')))
-                elif op == 2:
-                    got += 1
-                    seq, echoed = struct.unpack('!II', data[9:17])
-                    now = struct.unpack('!Q', data[1:9])[0]
-                    echo |= echoed == 7
-                    self.assertIn(b'\x00\x00\x00\x01', data[17:])
-                    ws.send_text(json.dumps(dict(t='rx', s=seq, r=now+100)))
-                    ws.send_text(json.dumps(dict(t='fd', f=[[seq, now+200, now+300, now+400]])))
-            self.assertGreaterEqual(got, 5)
-            self.assertTrue(echo)
-            time.sleep(.1)
-            stats = json.loads(self.request('/stats?settle=0&k='+self.token)[1])['streams'][0]
-            self.assertGreater(stats['frames'][0]['e1'], stats['frames'][0]['e0'])
-            self.assertIn('controller', stats)
-            used = WS(self.port, '/stream?src=test&t='+ticket)
-            self.assertEqual(used.status, 403)
-            used.close()
-            self.request('/close?src=test&k='+self.token, 'POST')
-            revoked = WS(self.port, '/stream?src=test&r='+key)
-            self.assertEqual(revoked.status, 403)
-            revoked.close()
-        finally:
-            ws.close()
-
-
-if __name__ == '__main__':
-    unittest.main()
@@ -0,0 +1,472 @@
+"""Eye-camera pulse estimate and the heart-rate comparison tool; no headset needed."""
+import importlib.util
+import io
+import json
+import math
+import os
+from pathlib import Path
+import random
+import socket
+import struct
+import sys
+import tempfile
+import unittest
+import zipfile
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def load(name, path):
+    spec = importlib.util.spec_from_file_location(name, ROOT / path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+pulse = load("pulse", "frame/tracking/pulse.py")
+check = load("heart_check", "scripts/heart-check.py")
+
+
+def synthetic(bpm, pulsing, seconds=40, fps=30, patches=48, noise=0.004, seed=7):
+    """Patch brightness with a faint pulse in `pulsing` patches, plus sensor
+    noise, slow drift, blinks in some patches and eye movement in others."""
+    rng = random.Random(seed)
+    times = [i / fps for i in range(seconds * fps)]
+    values = {}
+    for k in range(patches):
+        base, amplitude, trace = 40 + k, 0.003 if k < pulsing else 0.0, []
+        for t in times:
+            v = base * (1 + amplitude * math.sin(2 * math.pi * bpm / 60 * t)
+                        + noise * rng.gauss(0, 1) + 0.02 * math.sin(0.1 * t + k))
+            if k % 8 == 7 and int(t * 10) % 47 == 0:
+                v *= 0.5   # blink
+            if k % 8 == 6 and int(t * 10) % 23 == 0:
+                v *= 1.3   # frequent eye movement
+            trace.append(v)
+        values[k] = trace
+    return times, values
+
+
+class Estimate(unittest.TestCase):
+    def test_finds_pulse(self):
+        for bpm in (58, 72, 115):
+            with self.subTest(bpm=bpm):
+                result = pulse.estimate(*synthetic(bpm, 16))
+                self.assertAlmostEqual(result["bpm"], bpm, delta=1.5)
+                self.assertTrue(pulse.reliable(result))
+                self.assertTrue(all(abs(b - bpm) <= 2 for _, b in result["series"]))
+
+    def test_noise_and_blinks_are_not_a_pulse(self):
+        result = pulse.estimate(*synthetic(72, 0))
+        self.assertFalse(pulse.reliable(result))
+
+    def test_frequent_spike_patches_are_dropped(self):
+        times, values = synthetic(72, 16)
+        result = pulse.estimate(times, values)
+        self.assertLess(result["usable"], len(values))
+
+    def test_needs_enough_frames(self):
+        with self.assertRaises(ValueError):
+            pulse.estimate(*synthetic(72, 16, seconds=5))
+        times, values = synthetic(72, 16)
+        with self.assertRaises(ValueError):
+            pulse.estimate(times, {k: [0.0] * len(times) for k in values})  # all dark
+
+    def test_series_times(self):
+        times, values = synthetic(72, 16, seconds=20)
+        series = pulse.estimate(times, values)["series"]
+        self.assertAlmostEqual(series[0][0], pulse.WINDOW, delta=0.1)
+        self.assertEqual(len(series), 20 - int(pulse.WINDOW) + 1)
+
+    def test_flat_patches_do_not_rank_first(self):
+        times, values = synthetic(72, 16)
+        values["flat"] = [100.0] * len(times)
+        result = pulse.estimate(times, values)
+        self.assertAlmostEqual(result["bpm"], 72, delta=1.5)
+        self.assertEqual(pulse.snr([(60.0, 0.0), (61.0, 0.0)], 60), 0.0)
+
+    def test_analyse_uses_nearest_frame(self):
+        times, values = synthetic(72, 4, patches=4, seconds=10)
+        # Right-eye frames 1 ms before each left frame: nearest is that frame.
+        frames = [(t, "left", [values[k][i] for k in range(4)]) for i, t in enumerate(times)]
+        frames += [(t - 0.001, "right", [float(i)] * 4) for i, t in enumerate(times)]
+        seen = {}
+        original = pulse.estimate
+        with patch.object(pulse, "estimate", lambda t, p: seen.update(p) or original(t, p)):
+            pulse.analyse(frames)
+        self.assertEqual(seen["right0"][:5], [0.0, 0.0, 1.0, 1.0, 2.0])
+
+    def test_fft_matches_dft(self):
+        signal = [math.sin(i) + (i % 3) for i in range(16)]
+        fast = pulse.fft(signal)
+        for k in range(16):
+            slow = sum(signal[n] * complex(math.cos(2 * math.pi * k * n / 16), -math.sin(2 * math.pi * k * n / 16))
+                       for n in range(16))
+            self.assertAlmostEqual(abs(fast[k] - slow), 0, places=9)
+
+    def test_grid_means(self):
+        # 4 × 4 image in RGB with padding: left half 10, right half 30 (channel 0).
+        width, height, channels, stride = 4, 4, 3, 16
+        pixels = bytearray(stride * height)
+        for y in range(height):
+            for x in range(width):
+                pixels[y * stride + x * channels] = 10 if x < 2 else 30
+                pixels[y * stride + x * channels + 1] = 255  # other channels ignored
+        self.assertEqual(pulse.grid_means(bytes(pixels), width, height, stride, channels, grid=2),
+                         [10, 30, 10, 30])
+
+    def test_analyse_combines_both_eyes(self):
+        times, values = synthetic(80, 16, patches=16)
+        frames = []
+        for i, t in enumerate(times):
+            frames.append((t, "left", [values[k][i] for k in range(16)]))
+            frames.append((t + 0.001, "right", [values[k][i] for k in range(16)]))
+        result = pulse.analyse(frames)
+        self.assertAlmostEqual(result["bpm"], 80, delta=1.5)
+        self.assertEqual(result["usable"] % 2, 0)
+
+
+class FakeCaptureTool:
+    """Stands in for `eyetracking --calib`: writes PNG names over a few polls."""
+    def __init__(self, directory, frames=6, fail=False):
+        self.directory, self.frames, self.fail = Path(directory), frames, fail
+        self.polls = 0
+        self.returncode = None
+        self.stdout = None
+        self.announce = None  # a different directory to report, if set
+
+    def __call__(self, command, cwd, stdout, stderr):
+        self.command = command
+        self.stdout = stdout
+        if self.fail:
+            stdout.write("Failed to initialize cameras\n")
+            stdout.flush()
+            self.returncode = 1
+            return self
+        # Real output is block-buffered until exit, so nothing is printed here.
+        stdout.flush()
+        self.directory.mkdir()
+        return self
+
+    def poll(self):
+        if self.returncode is not None:
+            return self.returncode
+        if self.polls < self.frames:
+            for eye in ("left", "right"):
+                (self.directory / f"{eye}_{self.polls}.png").write_bytes(b"png")
+            self.polls += 1
+            return None
+        meta = {"frames": [{eye: {"fname": str(self.directory / f"{eye}_{i}.png"), "frameNum": i + 10,
+                                  "tsMono": 100 + i / 90, "valid": i != 2} for eye in ("left", "right")}
+                           for i in range(self.frames)]}
+        (self.directory / "meta.json").write_text(json.dumps(meta))
+        # The real tool's buffered output only appears once it exits.
+        self.stdout.write(f"Writing capture to: {self.announce or self.directory}\nCaptured images\n")
+        self.stdout.flush()
+        self.returncode = 0
+        return 0
+
+    def terminate(self):
+        raise AssertionError("the capture tool must never be signalled")
+
+    kill = terminate
+
+    def wait(self, timeout=None):
+        return self.returncode
+
+
+class WornCheck(unittest.TestCase):
+    def sensor(self, name, raw):
+        root = Path(self.enterContext(tempfile.TemporaryDirectory()))
+        device = root / "iio:device2"
+        device.mkdir()
+        (device / "name").write_text(name + "\n")
+        (device / "in_proximity_raw").write_text(raw + "\n")
+        return root
+
+    def test_reads_the_proximity_sensor(self):
+        self.assertEqual(pulse.proximity(self.sensor("vcnl4000", "3.250000000")), 3.25)
+
+    def test_unreadable_sensor_does_not_block(self):
+        self.assertIsNone(pulse.proximity(self.sensor("other", "9")))
+        self.assertIsNone(pulse.proximity(self.sensor("vcnl4000", "junk")))
+        self.assertIsNone(pulse.proximity(Path("/nonexistent")))
+        self.assertTrue(pulse.worn(None))
+
+    def test_low_reading_means_unworn(self):
+        self.assertFalse(pulse.worn(3.1))
+        self.assertTrue(pulse.worn(pulse.WORN_MIN))
+
+
+class CaptureLifecycle(unittest.TestCase):
+    def setUp(self):
+        self.root = Path(tempfile.mkdtemp())
+        self.directory = self.root / "etcalib_test"
+        (self.root / "etcalib_older").mkdir()  # an earlier capture is not ours
+        self.loaded = []
+
+    def tearDown(self):
+        import shutil
+        shutil.rmtree(self.root, ignore_errors=True)
+
+    def loader(self, path):
+        self.loaded.append(Path(path).name)
+        self.assertTrue(Path(path).exists())
+        return [float(len(self.loaded))]
+
+    def capture(self, tool):
+        class TestCapture(pulse.Capture):
+            # A temporary directory stands in for /tmp/etcalib_*.
+            PREFIX = str(self.root / "etcalib_")
+        capture = TestCapture(20, runner=tool, loader=self.loader, workers=0)
+        with patch.object(pulse.time, "sleep", lambda s: None):
+            return capture, capture.run()
+
+    def test_reduces_deletes_and_joins_metadata(self):
+        tool = FakeCaptureTool(self.directory)
+        capture, frames = self.capture(tool)
+        self.assertEqual(sorted(self.loaded), sorted(f"{e}_{i}.png" for e in ("left", "right") for i in range(6)))
+        self.assertFalse(self.directory.exists())  # images and metadata removed
+        self.assertTrue((self.root / "etcalib_older").exists())
+        self.assertEqual(len(frames), 10)          # frame 2 invalid in both eyes
+        self.assertEqual(tool.command[-2:], ["--calib", "20"])
+        self.assertTrue(all(isinstance(t, float) and eye in ("left", "right") for t, eye, _ in frames))
+
+    def test_camera_failure(self):
+        tool = FakeCaptureTool(self.directory, fail=True)
+        with self.assertRaises(RuntimeError) as raised:
+            self.capture(tool)
+        self.assertIn("cameras unavailable", str(raised.exception))
+
+    def test_backlog_abandons_capture_and_removes_images(self):
+        class Stalled(FakeCaptureTool):
+            def poll(self):
+                if self.polls > 8:
+                    self.returncode = 0  # the bounded run ends by itself
+                    return 0
+                for i in range(20):
+                    for eye in ("left", "right"):
+                        (self.directory / f"{eye}_{self.polls * 20 + i}.png").write_bytes(b"png")
+                self.polls += 1
+                return None
+        tool = Stalled(self.directory)
+        class TestCapture(pulse.Capture):
+            PREFIX = str(self.root / "etcalib_")
+            MAX_BACKLOG = 50
+        capture = TestCapture(20, runner=tool, loader=self.loader, workers=0)
+        capture.reduce = lambda final=False, original=capture.reduce: (
+            original(final) if tool.polls > 3 else None)  # reduction stalls
+        with patch.object(pulse.time, "sleep", lambda s: None), self.assertRaises(RuntimeError) as raised:
+            capture.run()
+        self.assertIn("fell behind", str(raised.exception))
+        self.assertEqual(tool.returncode, 0)         # left to end by itself, never signalled
+        self.assertFalse(self.directory.exists())    # no image left behind
+
+    def test_second_capture_directory_stops_and_removes_both(self):
+        foreign = self.root / "etcalib_foreign"
+        class Racing(FakeCaptureTool):
+            def poll(self):
+                if self.polls == 2:
+                    foreign.mkdir()
+                    (foreign / "left_0.png").write_bytes(b"png")
+                return super().poll()
+        tool = Racing(self.directory)
+        with self.assertRaises(RuntimeError) as raised:
+            self.capture(tool)
+        self.assertIn("another eye-camera capture", str(raised.exception))
+        self.assertFalse(self.directory.exists())
+        self.assertFalse(foreign.exists())  # no eye image outlives the run
+        self.assertTrue((self.root / "etcalib_older").exists())
+
+    def test_images_elsewhere_are_not_used_but_are_removed(self):
+        tool = FakeCaptureTool(self.directory)
+        tool.announce = self.root / "etcalib_reported"
+        tool.announce.mkdir()
+        (tool.announce / "left_0.png").write_bytes(b"png")
+        with self.assertRaises(RuntimeError) as raised:
+            self.capture(tool)
+        self.assertIn("somewhere else", str(raised.exception))
+        self.assertFalse(tool.announce.exists())
+        self.assertFalse(self.directory.exists())
+
+    def test_interrupt_during_cleanup_still_removes_images(self):
+        class Stubborn(FakeCaptureTool):
+            interrupts = 0
+            def poll(self):
+                if self.polls == 2 and self.interrupts < 2:
+                    self.interrupts += 1
+                    raise KeyboardInterrupt  # Ctrl-C mid-capture, and again while waiting
+                return super().poll()
+        tool = Stubborn(self.directory)
+        with self.assertRaises(KeyboardInterrupt):
+            self.capture(tool)
+        self.assertEqual(tool.returncode, 0)         # still let finish, never signalled
+        self.assertFalse(self.directory.exists())
+
+    def test_overrunning_tool_is_killed_as_a_last_resort(self):
+        class Hung(FakeCaptureTool):
+            killed = False
+            def poll(self):
+                (self.directory / "left_0.png").write_bytes(b"png")
+                return None if not self.killed else -9
+            def kill(self):
+                self.killed = True
+        tool = Hung(self.directory)
+        clock = iter(range(0, 10000, 20))
+        with patch.object(pulse.time, "monotonic", lambda: next(clock)), \
+                self.assertRaises(RuntimeError) as raised:
+            self.capture(tool)
+        self.assertIn("may need a reboot", str(raised.exception))
+        self.assertTrue(tool.killed)
+        self.assertFalse(self.directory.exists())
+
+    def test_cleanup_tries_every_directory(self):
+        capture = pulse.Capture(20)
+        capture.PREFIX = str(self.root / "etcalib_")
+        first, second = self.root / "etcalib_a", self.root / "etcalib_b"
+        for directory in (first, second):
+            directory.mkdir()
+            (directory / "left_0.png").write_bytes(b"png")
+        capture.new = {first, second}
+        real = pulse.shutil.rmtree
+        def flaky(path):
+            if Path(path) == first:
+                raise OSError("busy")
+            real(path)
+        with patch.object(pulse.shutil, "rmtree", flaky), self.assertRaises(RuntimeError) as raised:
+            capture.remove()
+        self.assertIn("etcalib_a", str(raised.exception))
+        self.assertFalse(second.exists())
+
+    def test_removes_a_directory_seen_only_at_the_end(self):
+        capture = pulse.Capture(20)
+        capture.PREFIX = str(self.root / "etcalib_")
+        capture.before = capture.candidates()
+        late = self.root / "etcalib_late"
+        late.mkdir()
+        (late / "left_0.png").write_bytes(b"png")
+        capture.remove()
+        self.assertFalse(late.exists())
+        self.assertTrue((self.root / "etcalib_older").exists())
+
+    def test_never_adopts_directories_without_a_baseline(self):
+        capture = pulse.Capture(20)
+        capture.PREFIX = str(self.root / "etcalib_")
+        capture.remove()
+        self.assertTrue((self.root / "etcalib_older").exists())
+
+    def test_only_removes_capture_directories(self):
+        capture = pulse.Capture(20)
+        capture.directory = self.root
+        capture.remove()
+        self.assertTrue(self.root.exists())
+
+
+class HeartCheck(unittest.TestCase):
+    def write(self, name, text):
+        path = Path(self.enterContext(tempfile.TemporaryDirectory())) / name
+        path.write_text(text)
+        return path
+
+    def test_osc_round_trip(self):
+        tracking = load("tracking", "frame/tracking/tracking.py")
+        self.assertEqual(check.parse_osc(tracking.osc_message("/avatar/parameters/HeartRate", [72])),
+                         ("/avatar/parameters/HeartRate", [72]))
+        address, values = check.parse_osc(tracking.osc_message("/x", [1.5, -2.0]))
+        self.assertEqual((address, values), ("/x", [1.5, -2.0]))
+        with self.assertRaises(ValueError):
+            check.parse_osc(b"/x\0\0,s\0\0abc\0")
+
+    def test_listen_records_readings(self):
+        tracking = load("tracking", "frame/tracking/tracking.py")
+        with tempfile.TemporaryDirectory() as directory:
+            out = Path(directory) / "ours.csv"
+            with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as probe:
+                probe.bind(("127.0.0.1", 0))
+                port = probe.getsockname()[1]
+            import threading
+            def send():
+                import time
+                time.sleep(0.3)
+                with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sender:
+                    sender.sendto(tracking.osc_message(check.ADDRESS, [72]), ("127.0.0.1", port))
+                    sender.sendto(tracking.osc_message("/other", [1]), ("127.0.0.1", port))
+            threading.Thread(target=send).start()
+            shown = io.StringIO()
+            count = check.listen(port, check.ADDRESS, str(out), 1.5, stream=shown)
+            self.assertEqual(count, 1)
+            self.assertIn("72 bpm", shown.getvalue())
+            self.assertEqual(out.read_text().splitlines()[1].split(",")[1], "72")
+            self.assertEqual(out.stat().st_mode & 0o777, 0o600)
+
+    def test_compare_finds_lag_and_contact_loss(self):
+        reference = [(1000.0 + i, 60 + i, 6) for i in range(40)] + [(1040.0 + i, 150, 4) for i in range(5)]
+        ours = [(1002.0 + i, 60 + i) for i in range(40)]  # 2 s late, nothing during contact loss
+        ref = self.write("ref.csv", "unix_seconds,bpm,flags\n" + "".join(f"{t},{b},{f}\n" for t, b, f in reference))
+        mine = self.write("ours.csv", "unix_seconds,bpm\n" + "".join(f"{t},{b}\n" for t, b in ours))
+        result = check.compare(check.read_csv(mine), check.read_any(ref))
+        self.assertEqual(result["lag_seconds"], 2.0)
+        self.assertEqual(result["mean_abs_error"], 0)
+        self.assertEqual(result["shown_during_no_contact"], 0)
+        self.assertTrue(check.report(result, 5, stream=io.StringIO()))
+        # A stale reading sent during contact loss fails the check.
+        stale = check.read_csv(mine) + [(1043.0, 99)]
+        result = check.compare(stale, check.read_any(ref))
+        self.assertEqual(result["shown_during_no_contact"], 1)
+        self.assertFalse(check.report(result, 5, stream=io.StringIO()))
+
+    def test_compare_against_apple_health_export(self):
+        records = "".join(
+            f'<Record type="HKQuantityTypeIdentifierHeartRate" unit="count/min" '
+            f'startDate="2026-09-29 12:00:{s:02d} +1000" endDate="2026-09-29 12:00:{s:02d} +1000" value="{70 + s % 3}"/>'
+            for s in range(0, 60, 5))
+        other = '<Record type="HKQuantityTypeIdentifierStepCount" startDate="2026-09-29 12:00:00 +1000" value="9"/>'
+        xml = f'<?xml version="1.0"?><HealthData>{other}{records}</HealthData>'
+        with tempfile.TemporaryDirectory() as directory:
+            archive = Path(directory) / "export.zip"
+            with zipfile.ZipFile(archive, "w") as z:
+                z.writestr("apple_health_export/export.xml", xml)
+            start = check.parse_time("2026-09-29 12:00:00 +1000")
+            samples = check.read_any(archive, start - 60, start + 120)
+            self.assertEqual(len(samples), 12)
+            self.assertEqual(samples[0], (start, 70))
+            ours = [(start + i + 1.0, 71) for i in range(60)]
+            result = check.compare(ours, samples)
+            self.assertLessEqual(result["mean_abs_error"], 1)
+
+    def test_unusual_flags_and_missing_export(self):
+        path = self.write("ref.csv", "time,bpm,flags\n1000,70,6.0\n1001,71,yes\n1002,72,4\n")
+        self.assertEqual(check.read_csv(path), [(1000.0, 70), (1001.0, 71), (1002.0, None)])
+        with tempfile.TemporaryDirectory() as directory:
+            archive = Path(directory) / "other.zip"
+            with zipfile.ZipFile(archive, "w") as z:
+                z.writestr("notes.txt", "x")
+            with self.assertRaises(ValueError):
+                check.read_any(archive, 0, 1)
+
+    def test_compare_reports_bad_input_without_traceback(self):
+        good = self.write("ref.csv", "1000,70\n")
+        shown = io.StringIO()
+        with patch("sys.stdout", shown):
+            self.assertEqual(check.main(["compare", str(good.parent / "missing.csv"), str(good)]), 1)
+            self.assertEqual(check.main(["compare", str(self.write("ours.csv", "1000,inf\n1001,70\n")),
+                                         str(self.write("bad.xml", "<not closed"))]), 1)
+        self.assertEqual(shown.getvalue().count("Could not compare"), 2)
+
+    def test_health_records_with_non_finite_values_are_skipped(self):
+        record = '<Record type="HKQuantityTypeIdentifierHeartRate" startDate="2026-09-29 12:00:00 +1000" value="%s"/>'
+        path = self.write("export.xml", "<HealthData>" + record % "inf" + record % "72" + "</HealthData>")
+        start = check.parse_time("2026-09-29 12:00:00 +1000")
+        self.assertEqual(check.read_health(path, start - 1, start + 1), [(start, 72)])
+
+    def test_time_formats(self):
+        self.assertEqual(check.parse_time("1700000000.5"), 1700000000.5)
+        self.assertEqual(check.parse_time("2023-11-14T22:13:20Z"), 1700000000)
+        self.assertEqual(check.parse_time("2023-11-15 08:13:20 +1000"), 1700000000)
+        with self.assertRaises(ValueError):
+            check.parse_time("yesterday")
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,188 @@
+"""Tracking protocols and fake-Frame BlueZ lifecycle; no headset or strap needed."""
+import importlib.util
+import math
+import os
+from pathlib import Path
+import socket
+import stat
+import struct
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+
+SPEC = importlib.util.spec_from_file_location("tracking", Path(__file__).resolve().parents[1] / "frame/tracking/tracking.py")
+t = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(t)
+
+
+class Protocols(unittest.TestCase):
+    def test_hrs_formats(self):
+        self.assertEqual(t.heart_rate(b"\x00\x48"), 72)
+        self.assertEqual(t.heart_rate(b"\x01\x2c\x01"), 300)
+        self.assertEqual(t.heart_rate(b"\x1e\x48\x01\x00\x00\x04\x00\x04"), 72)
+        self.assertEqual(t.heart_rate(b"\x02\x48"), 72)  # contact not supported
+        self.assertIsNone(t.heart_rate(b"\x04\x48"))  # no contact
+        self.assertIsNone(t.heart_rate(b"\x00\x00"))
+
+    def test_hrs_malformed(self):
+        for packet in (b"", b"\x00", b"\x01\x48", b"\x08\x48\x00", b"\x10\x48",
+                       b"\x10\x48\x00", b"\x00\x48\x01", b"\xe0\x48"):
+            with self.subTest(packet=packet), self.assertRaises(ValueError):
+                t.heart_rate(packet)
+
+    def test_gaze_coordinates(self):
+        self.assertEqual(t.gaze_angles([0, 0, 0, 1]), (0, 0))
+        angle = math.radians(15)
+        pitch, yaw = t.gaze_angles([math.sin(angle), 0, 0, math.cos(angle)])
+        self.assertAlmostEqual(pitch, -30)  # OpenXR +X rotation looks up
+        self.assertAlmostEqual(yaw, 0)
+        pitch, yaw = t.gaze_angles([0, -math.sin(angle), 0, math.cos(angle)])
+        self.assertAlmostEqual(pitch, 0)
+        self.assertAlmostEqual(yaw, 30)  # right
+
+    def test_invalid_gaze(self):
+        for pose in ([0, 0, 0, 0], [math.nan, 0, 0, 1], [0, 0, 0], [0, 0, 0, math.inf]):
+            with self.assertRaises(ValueError):
+                t.gaze_angles(pose)
+
+    def test_osc_wire(self):
+        self.assertEqual(t.osc_message('/x', [72]), b'/x\0\0,i\0\0' + struct.pack('>i', 72))
+        self.assertEqual(t.osc_message('/x', [1.0, -2.0]), b'/x\0\0,ff\0' + struct.pack('>ff', 1, -2))
+        for address in ('x', '/x\0y', '/x y', '/x*'):
+            with self.assertRaises(ValueError):
+                t.osc_message(address, [1])
+
+    def test_default_never_opens_socket(self):
+        with patch.object(t.socket, 'socket') as create:
+            osc = t.Osc()
+            osc.send('/x', [72])
+            osc.close()
+            create.assert_not_called()
+
+    def test_only_configured_endpoint(self):
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as receiver:
+            receiver.bind(('127.0.0.1', 0))
+            receiver.settimeout(1)
+            osc = t.Osc(receiver.getsockname())
+            try:
+                osc.send('/tracking/eye/CenterPitchYaw', [0.0, 30.0])
+                self.assertEqual(receiver.recv(1024), t.osc_message('/tracking/eye/CenterPitchYaw', [0.0, 30.0]))
+            finally:
+                osc.close()
+
+    def test_endpoint_validation(self):
+        for endpoint in [('example.org', 9000), ('0.0.0.0', 9000), ('224.0.0.1', 9000), ('127.0.0.1', 0), ('::1', 65536)]:
+            with self.assertRaises(ValueError):
+                t.Osc(endpoint)
+
+    def test_heart_staleness_contact_and_log(self):
+        now = [0]
+        osc = Mock()
+        with tempfile.TemporaryDirectory() as directory:
+            path = Path(directory) / 'session.csv'
+            session = t.HeartSession(osc, '/hr', path, lambda: now[0])
+            self.assertIsNone(session.current())
+            session.notification(b'\x00\x48')
+            self.assertEqual(session.current(), 72)
+            osc.send.assert_called_once_with('/hr', [72])
+            now[0] = 6
+            self.assertIsNone(session.current())
+            session.notification(b'\x04\x48')
+            self.assertIsNone(session.current())
+            self.assertEqual(osc.send.call_count, 1)
+            session.close()
+            self.assertEqual(path.read_text().splitlines()[0], 'unix_seconds,bpm')
+            self.assertEqual(len(path.read_text().splitlines()), 2)
+            if os.name != 'nt':
+                self.assertEqual(stat.S_IMODE(path.stat().st_mode), 0o600)
+            with self.assertRaises(FileExistsError):
+                t.HeartSession(osc, '/hr', path)
+
+    def test_no_log_by_default(self):
+        with patch.object(t.os, 'open') as create:
+            session = t.HeartSession(Mock(), '/hr')
+            session.notification(b'\x00\x48')
+            session.close()
+            create.assert_not_called()
+
+
+class FakeBluez(unittest.TestCase):
+    def setUp(self):
+        self.device = '/org/bluez/hci0/dev_TEST'
+        self.service = self.device + '/service1'
+        self.char = self.service + '/char1'
+        self.objects = {
+            self.device: {t.DEVICE: {'Address': 'AA:BB:CC:DD:EE:FF', 'Connected': False, 'ServicesResolved': True}},
+            self.service: {t.SERVICE: {'UUID': t.HRS, 'Device': self.device}},
+            self.char: {t.CHARACTERISTIC: {'UUID': t.MEASUREMENT, 'Service': self.service, 'Flags': ['notify']}},
+        }
+        self.api = Mock()
+        self.api.GetManagedObjects.side_effect = lambda: self.objects
+        self.bus = Mock()
+        self.interface = Mock(return_value=self.api)
+        self.values = Mock()
+
+    def reader(self):
+        return t.BluezHeart(self.bus, self.interface, 'AA:BB:CC:DD:EE:FF', self.values)
+
+    def test_subscribe_receive_and_cleanup(self):
+        reader = self.reader()
+        self.api.Connect.assert_called_once()
+        self.assertTrue(reader.subscribe())
+        self.api.StartNotify.assert_called_once()
+        reader.changed(t.CHARACTERISTIC, {'Value': [0, 72]}, [], self.char)
+        self.values.assert_called_once_with([0, 72])
+        reader.changed(t.CHARACTERISTIC, {'Value': [0, 73]}, [], '/other/strap')
+        self.assertEqual(self.values.call_count, 1)
+        reader.close()
+        self.api.StopNotify.assert_called_once()
+        self.api.Disconnect.assert_called_once()
+        self.bus.add_signal_receiver.return_value.remove.assert_called_once()
+
+    def test_preserve_existing_connection(self):
+        self.objects[self.device][t.DEVICE]['Connected'] = True
+        reader = self.reader()
+        reader.subscribe()
+        reader.close()
+        self.api.Connect.assert_not_called()
+        self.api.Disconnect.assert_not_called()
+
+    def test_only_selected_device_service(self):
+        self.objects[self.service][t.SERVICE]['Device'] = '/other/device'
+        reader = self.reader()
+        try:
+            with self.assertRaises(RuntimeError):
+                reader.subscribe()
+        finally:
+            reader.close()
+        self.api.StartNotify.assert_not_called()
+
+    def test_wait_for_services(self):
+        self.objects[self.device][t.DEVICE]['ServicesResolved'] = False
+        reader = self.reader()
+        self.assertFalse(reader.subscribe())
+        reader.close()
+        self.api.StartNotify.assert_not_called()
+        self.api.StopNotify.assert_not_called()
+
+    def test_disconnect_notification(self):
+        reader = self.reader()
+        reader.changed(t.DEVICE, {'Connected': 0}, [], self.device)  # dbus.Boolean behaves as int
+        self.values.assert_called_once_with(None)
+        reader.close()
+
+    def test_failed_notify_cleans_connection(self):
+        reader = self.reader()
+        self.api.StartNotify.side_effect = RuntimeError('failure')
+        with self.assertRaises(RuntimeError):
+            reader.subscribe()
+        reader.close()
+        self.api.StopNotify.assert_not_called()
+        self.api.Disconnect.assert_called_once()
+
+    def test_unknown_device_does_not_connect_or_scan(self):
+        self.objects.clear()
+        with self.assertRaises(RuntimeError):
+            self.reader()
+        self.api.Connect.assert_not_called()
+        self.api.StartDiscovery.assert_not_called()
@@ -740,9 +740,7 @@ class Registry:
                return a
        raise DeviceError(f"{host} isn't one of this headset's addresses")

-    def add_address(self, device_id, host, kind=None, label="", first=False):
-        """Add an address at the end of the list, or at the front (first=True), where the
-        user's order makes it win over the others that work on the same network."""
+    def add_address(self, device_id, host, kind=None, label=""):
        with self._changing():
            d = self._find(device_id)
            a = new_address(host, kind, label)
@@ -750,7 +748,7 @@ class Registry:
                raise DeviceError(f"{a['host']} is already on the list")
            if len(d["addresses"]) >= 32:
                raise DeviceError("That's enough addresses for one headset")
-            d["addresses"].insert(0 if first else len(d["addresses"]), a)
+            d["addresses"].append(a)
            self.save()
            return copy.deepcopy(a)

@@ -356,7 +356,6 @@ class Link:
        self.version = 0
        self.stopped = False
        self.kicks = []                 # reasons someone asked for a (re)connect
-        self.test_gen = {}              # device id -> its newest test of the addresses (see test())
        self.busy = False               # the loop is handling kicks
        self.state = {"phase": "idle", "reason": None, "device": None, "network": None, "stages": [],
                      "probes": [], "via": None, "error": None, "retry_at": None, "attempt": 0,
@@ -1307,13 +1306,9 @@ class Link:
        started = now()
        rows = [{"host": a["host"], "kind": a["kind"], "state": "waiting", "detail": "Waiting", "ip": None,
                 "rtt_ms": None, "ssh": None} for a in device["addresses"]]
-        with self.cond:
-            gen = self.test_gen[device_id] = self.test_gen.get(device_id, 0) + 1

        def put(**fields):
            with self.cond:
-                if gen != self.test_gen[device_id]:
-                    return  # a newer test has started: its results are the ones to show
                self.state["tests"][device_id] = dict({"started": started, "done": False, "rows": rows}, **fields)
                self.version += 1
                self.cond.notify_all()
@@ -1622,8 +1617,7 @@ def devices_action(link, body, open_setup, busy=lambda: 0):
                raise frame_devices.DeviceError(f"Removed, but couldn't edit ~/.ssh/config: {e}")
        msg = f"Removed {d['name']}" + (f" and its '{d['alias']}' entry in ~/.ssh/config" if removed else "")
    elif action == "address-add":
-        a = reg.add_address(did, body.get("host"), body.get("kind") or None, body.get("label") or "",
-                            first=body.get("first") is True)
+        a = reg.add_address(did, body.get("host"), body.get("kind") or None, body.get("label") or "")
        if is_active and link.state["phase"] == "failed":
            link.kick("retry")
        msg = f"Added {a['host']}"
@@ -56,12 +56,12 @@ BROWSER_FLAGS = []
 PANEL_BOX = (1920, 1080)

 # Opens one viewer on gamescope's X display and gives its window its own panel
-# id. Args: appid url width height tag profile [browser flags...]. The page puts "[tag]" in its title at
+# id. Args: appid url width height tag [browser flags...]. The page puts "[tag]" in its title at
 # once, which is how its X window is found (Chromium may hand the URL to an
 # instance that's already running, so there's no process to follow).
 LAUNCH = r"""set -u
-appid=$1 url=$2 w=$3 h=$4 tag=$5 profile=$6
-shift 6
+appid=$1 url=$2 w=$3 h=$4 tag=$5
+shift 5
 export DISPLAY=:0 LC_ALL=C.UTF-8
 unset WAYLAND_DISPLAY
 if ! xprop -root GAMESCOPE_FOCUSABLE_WINDOWS >/dev/null 2>&1; then
@@ -73,15 +73,15 @@ common=(--ozone-platform=x11 --force-device-scale-factor=1 --no-first-run --no-d
  --disable-features=Translate,MediaRouter --autoplay-policy=no-user-gesture-required
  "--window-size=$w,$h" "$@" "--app=$url")
 if [ -x "$HOME/chromium-xr/chrome" ]; then
-  cmd=("$HOME/chromium-xr/chrome" "--user-data-dir=$HOME/.local/share/frame-control/$profile" "${common[@]}")
+  cmd=("$HOME/chromium-xr/chrome" "--user-data-dir=$HOME/.local/share/frame-control/mac-view" "${common[@]}")
 elif flatpak info org.chromium.Chromium >/dev/null 2>&1; then
  cmd=(flatpak run org.chromium.Chromium
-    "--user-data-dir=$HOME/.var/app/org.chromium.Chromium/data/frame-$profile" "${common[@]}")
+    "--user-data-dir=$HOME/.var/app/org.chromium.Chromium/data/frame-mac-view" "${common[@]}")
 else
  echo "NO_BROWSER"
  exit 3
 fi
-log=/tmp/frame-$profile.log
+log=/tmp/frame-mac-view.log
 setsid nohup "${cmd[@]}" >>"$log" 2>&1 </dev/null &
 for _ in $(seq 1 60); do
  sleep 0.5
@@ -105,9 +105,9 @@ class MacViewError(Exception):
    pass


-def panel_id(src, host="mac"):
+def panel_id(src):
    """A stable panel id per source, in the range panel-on-frame.sh uses."""
-    return 2_001_000_000 + zlib.crc32(f"{host}:{src}".encode()) % 1_000_000
+    return 2_001_000_000 + zlib.crc32(f"mac:{src}".encode()) % 1_000_000


 def fit(w, h, box=PANEL_BOX):
@@ -116,9 +116,6 @@ def fit(w, h, box=PANEL_BOX):


 class MacView:
-    host = "mac"
-    viewer_profile = "mac-view"
-
    def __init__(self, tunnel_ssh, run, frame, track=None):
        self.tunnel_ssh = list(tunnel_ssh)
        self.run = run
@@ -173,17 +170,10 @@ class MacView:
    def _stale(self):
        try:
            built = AGENT.stat().st_mtime
-            return any(p.stat().st_mtime > built for p in [*(SOURCES / "Sources").glob("*.swift"),
-                       ROOT / "desktop" / "controller.c", ROOT / "desktop" / "controller.h"])
+            return any(p.stat().st_mtime > built for p in (SOURCES / "Sources").glob("*.swift"))
        except OSError:
            return False

-    def agent_command(self):
-        return [str(AGENT)]
-
-    def agent_environment(self):
-        return {**os.environ, "FRAME_MAC_VIEW_TOKEN": self.token}
-
    def ensure_agent(self):
        with self.lock:
            if self.agent and self.agent.poll() is None:
@@ -192,11 +182,11 @@ class MacView:
            if reason:
                raise MacViewError(reason)
            self.build()
-            env = self.agent_environment()
+            env = {**os.environ, "FRAME_MAC_VIEW_TOKEN": self.token}
            # The same port as before when restarting, so a running tunnel still
            # fits; otherwise (or if it's gone) whatever the system gives.
            for port in dict.fromkeys([self.port or 0, 0]):
-                self.agent = subprocess.Popen([*self.agent_command(), "serve", "--port", str(port), "--page", str(PAGE),
+                self.agent = subprocess.Popen([str(AGENT), "serve", "--port", str(port), "--page", str(PAGE),
                                               "--exit-on-eof"], env=env, stdin=subprocess.PIPE,
                                              stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
                line = self.agent.stdout.readline()
@@ -205,7 +195,7 @@ class MacView:
                    break
                self.agent.kill()
            else:
-                raise MacViewError(f"The streaming helper didn't start: {line.strip() or 'no output'}")
+                raise MacViewError(f"The Mac streaming helper didn't start: {line.strip() or 'no output'}")
            if self.port != int(m.group(1)):
                self._drop_tunnel()
            self.port = int(m.group(1))
@@ -221,7 +211,7 @@ class MacView:
            with urllib.request.urlopen(req, timeout=10) as r:
                return json.load(r)
        except (urllib.error.URLError, OSError, ValueError) as e:
-            raise MacViewError(f"The streaming helper didn't answer: {e}")
+            raise MacViewError(f"The Mac streaming helper didn't answer: {e}")

    # ---- the tunnel from the Frame ----

@@ -406,7 +396,7 @@ class MacView:
        # the agent no longer counts them, so only move when none are out there.
        others = self.shown - {src}
        self.ensure_tunnel(allow_new_port=not others)
-        appid = panel_id(src, self.host)
+        appid = panel_id(src)
        # Unique per launch, so a new window is never confused with an old one.
        tag = "fc" + secrets.token_hex(4)
        # A single-use ticket for this source, not Frame Control's key: the URL
@@ -416,7 +406,7 @@ class MacView:
                  "bpp": q["bpp"]}
        url = f"http://127.0.0.1:{self.remote_port}/view?{urlencode(params)}"
        w, h = fit(width or 1280, height or 720)
-        args = " ".join(_quote(str(a)) for a in (appid, url, w, h, tag, self.viewer_profile, *self.browser_flags))
+        args = " ".join(_quote(str(a)) for a in (appid, url, w, h, tag, *self.browser_flags))
        try:
            out = self.run("bash -s -- " + args, stdin=LAUNCH, timeout=60)
        except Exception as e:  # noqa: BLE001 - the server's Failure carries the Frame's words
@@ -448,8 +438,7 @@ class MacView:
            if self.shown or self.shows != shows or self.launching:
                return
            try:
-                pattern = "[f]rame-control/" + self.viewer_profile + "|[d]ata/frame-" + self.viewer_profile
-                self.run("pkill -f " + _quote(pattern) + " || true", timeout=10)
+                self.run("pkill -f '[f]rame-control/mac-view|[d]ata/frame-mac-view' || true", timeout=10)
            except Exception:
                pass

@@ -460,8 +449,7 @@ class MacView:
        status = self.call("/status")
        windows = self.call("/windows").get("windows", []) if status.get("screen") else []
        displays = self.call("/displays").get("displays", [])
-        return {"available": True, "host": self.host, "selecting": status.get("selecting", False),
-                "selectionError": status.get("selectionError", ""), "screen": status.get("screen", False),
+        return {"available": True, "screen": status.get("screen", False),
                "accessibility": status.get("accessibility", False), "streams": status.get("streams", []),
                "windows": windows, "displays": displays, "tunnel": self.tunnel_up(),
                "route": self.route}
@@ -1,624 +0,0 @@
-#!/usr/bin/env python3
-"""Frame Control's Windows/Linux host. Same ticket, H.264/JPEG, timing and
-input protocol as frame-mac-view; serves the same ui/mac-view.html.
-
-Only loopback is bound. Frame Control owns the master token, the Frame gets
-one-source tickets and reconnect keys. Native libraries are bundled.
-"""
-import argparse
-import base64
-import ctypes as C
-import hashlib
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import math
-import os
-import queue
-from pathlib import Path
-import secrets
-import socket
-import struct
-import sys
-import threading
-import time
-from urllib.parse import parse_qs, urlsplit
-
-from frame_pc_capture import Native, Controller, Windows, WindowsInput, PortalInput, Encoded, GATE, dimensions, pipeline
-from frame_stream_stats import Stats
-
-
-# Viewer fields are untrusted JSON: float('x'), int(None), m['t'] missing.
-MALFORMED = (ValueError, TypeError, KeyError, OverflowError)
-
-
-class Grants:
-    """Caller holds the agent lock, including replacement and Stop."""
-    def __init__(self, token):
-        self.token, self.tickets, self.keys = token, {}, {}
-
-    def master(self, key):
-        return isinstance(key, str) and secrets.compare_digest(key, self.token)
-
-    def ticket(self, src):
-        self.tickets = {k: v for k, v in self.tickets.items() if v[1] > time.monotonic()}
-        if len(self.tickets) >= 128:
-            raise ValueError('Too many pending viewers')
-        ticket = secrets.token_urlsafe(24)
-        self.tickets[ticket] = (src, time.monotonic()+60, None)
-        return ticket
-
-    def redeem(self, src, q):
-        if self.master(q.get('k')):
-            key = secrets.token_urlsafe(24)
-            self.keys[key] = src
-            return key
-        entry = self.tickets.get(q.get('t'))
-        if entry and entry[0] == src and entry[1] > time.monotonic():
-            key = entry[2] or secrets.token_urlsafe(24)
-            self.tickets[q['t']] = (src, entry[1], key)
-            self.keys[key] = src
-            return key
-        key = q.get('r')
-        return key if key and self.keys.get(key) == src else None
-
-    def ack(self, key):
-        self.tickets = {k: v for k, v in self.tickets.items() if v[2] != key}
-
-    def revoke(self, src=None):
-        self.tickets = {k: v for k, v in self.tickets.items() if src is not None and v[0] != src}
-        self.keys = {k: v for k, v in self.keys.items() if src is not None and v != src}
-
-
-class WebSocket:
-    def __init__(self, handler):
-        self.sock, self.reader = handler.connection, handler.rfile
-        self.lock = threading.Lock()
-        self.closed = False
-        self.sock.settimeout(5)
-        self.sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
-
-    def send(self, data, opcode=1):
-        if not isinstance(data, bytes):
-            data = json.dumps(data, separators=(',', ':')).encode()
-        n = len(data)
-        head = bytes([0x80 | opcode, n]) if n < 126 else bytes([0x80 | opcode, 126]) + struct.pack('!H', n) if n <= 65535 else bytes([0x80 | opcode, 127]) + struct.pack('!Q', n)
-        with self.lock:
-            if self.closed:
-                raise ConnectionError('Viewer disconnected')
-            self.sock.sendall(head + data)
-
-    def exact(self, n):
-        data = self.reader.read(n)
-        if len(data) != n:
-            raise ConnectionError('Viewer disconnected')
-        return data
-
-    def receive(self):
-        a, b = self.exact(2)
-        opcode, size = a & 15, b & 127
-        if a & 0x70 or not a & 0x80 or not b & 0x80 or opcode not in (1, 8, 9, 10):
-            raise ValueError('Unsupported WebSocket frame')
-        if size == 126:
-            size = struct.unpack('!H', self.exact(2))[0]
-        elif size == 127:
-            size = struct.unpack('!Q', self.exact(8))[0]
-        if size > 65536 or (opcode >= 8 and size > 125):
-            raise ValueError('WebSocket message too large')
-        mask = self.exact(4)
-        data = bytes(v ^ mask[i % 4] for i, v in enumerate(self.exact(size)))
-        if opcode == 8:
-            raise ConnectionError('Viewer closed')
-        if opcode == 9:
-            self.send(data, 10)
-        if opcode != 1:
-            return {}
-        message = json.loads(data)
-        if not isinstance(message, dict):
-            raise ValueError('Expected an input object')
-        return message
-
-    def close(self):
-        self.closed = True
-        try:
-            self.sock.shutdown(socket.SHUT_RDWR)
-        except OSError:
-            pass
-
-
-class Session:
-    def __init__(self, agent, ws, key, source, query):
-        self.agent, self.native, self.ws, self.key, self.source = agent, agent.native, ws, key, source
-        self.src = source['src']
-        self.codec = query.get('codec', 'h264')
-        if self.codec not in ('h264', 'jpeg'):
-            raise ValueError('Unsupported codec')
-        self.fps = min(120, max(5, int(query.get('fps', 60))))
-        bpp = float(query.get('bpp', .1))
-        if not math.isfinite(bpp):
-            raise ValueError('Invalid bitrate')
-        self.w, self.h = dimensions(source['w'], source['h'], min(3840, max(320, int(query.get('max', 1920)))))
-        self.bitrate = max(300000, int(self.w*self.h*self.fps*min(.5, max(.02, bpp))))
-        self.controller = Controller(self.native.lib, self.fps, self.bitrate)
-        self.stats = Stats(self.native.now)
-        self.stop_event, self.key_event = threading.Event(), threading.Event()
-        self.lock, self.input_lock = threading.RLock(), threading.RLock()
-        self.pending, self.last_submit = {}, 0
-        self.reconfiguring = False
-        self.test_inputs = queue.Queue(maxsize=128)
-        self.input = None if self.src == 'test' else WindowsInput(agent.windows, source) if agent.windows else PortalInput(self.native, source)
-        self.writer = None
-        self.released = False
-        self.input_enabled = self.src == 'test' or self.source.get('devices', 3) == 3
-
-    def gate(self, stage, pts, capture, arrived):
-        # Exceptions cannot cross a ctypes callback boundary.
-        try:
-            with self.lock:
-                if self.stop_event.is_set() or self.reconfiguring:
-                    return -1
-                if stage == 1:
-                    if pts in self.pending:
-                        self.pending[pts]['e0'] = self.native.now()
-                    return 1
-                if stage == 0:
-                    self.stats.captured += 1
-                    self.controller.call('capture', arrived)
-                now = self.native.now()
-                state = self.controller.state()
-                if len(self.pending) >= 3 or now-self.last_submit < 1000000/state['fps'] or not self.controller.call('gate', now, int(stage == 0)):
-                    if stage == 0:
-                        self.stats.skipped += 1
-                    return 0
-                self.pending[pts] = dict(cap=capture, arr=arrived, e0=now, tier=state['tier'], br=state['target'])
-                self.last_submit = now
-                return 1
-        except Exception:
-            self.stop_event.set()
-            return -1
-
-    STALL = 10000000
-
-    def stalled(self, now, opened, captured_at_open):
-        """PipeWire and WGC deliver frames only on screen damage, so an idle
-        desktop legitimately produces no output. Fail only on evidence of a
-        fault: a frame entered the encoder and never came out, or the capture
-        never produced its initial frame after the pipeline opened."""
-        with self.lock:
-            oldest = min((r['e0'] for r in self.pending.values()), default=None)
-            captured = self.stats.captured
-        if oldest is not None and now-oldest > self.STALL:
-            return 'The encoder stopped producing frames; check the video encoder'
-        if captured == captured_at_open and now-opened > self.STALL:
-            return 'No frames captured for 10 seconds; check capture permissions'
-        return None
-
-    def fresh_pipewire(self):
-        if 'portal' not in self.source:
-            return
-        error = C.create_string_buffer(1024)
-        fd = self.native.lib.fc_portal_refresh(self.source['portal'], error, len(error))
-        if fd < 0:
-            raise RuntimeError(error.value.decode(errors='replace'))
-        self.source['fd'] = fd
-
-    def produce(self):
-        native, capture = self.native.lib, None
-        try:
-            encoder = "x264enc" if self.src == "test" and self.native.has("x264enc") else self.agent.encoder
-            self.fresh_pipewire()
-            description = pipeline(self.source, sys.platform, encoder, self.w, self.h, self.fps, self.bitrate, self.codec)
-            self.callback = GATE(self.gate)
-            error = C.create_string_buffer(1024)
-            capture = native.fc_capture_open(description.encode(), self.callback, error, len(error))
-            if not capture:
-                raise RuntimeError(error.value.decode(errors='replace'))
-            last_update = last_stats = self.native.now()
-            last_config = opened = last_update
-            captured_at_open = self.stats.captured
-            applied = (self.w, self.h, self.bitrate)
-            wanted = applied
-            while not self.stop_event.is_set():
-                while not self.test_inputs.empty():
-                    event = self.test_inputs.get_nowait()
-                    try:
-                        native.fc_capture_test(capture, int(event.get('i', 0)) & 0xffffffff)
-                        self.stats.input(event)
-                    except MALFORMED:
-                        pass  # a bad probe field drops the event, not the stream
-                output = Encoded()
-                result = native.fc_capture_pull(capture, C.byref(output))
-                now = self.native.now()
-                if result < 0:
-                    raise RuntimeError(native.fc_capture_error(capture).decode(errors='replace'))
-                if result:
-                    with self.lock:
-                        # At most three raw frames are in flight; no B-frames.
-                        # x264 offsets PTS, so match the FIFO encode order while
-                        # retaining the actual pre-encode capture timestamp.
-                        raw_pts = next(iter(self.pending), None)
-                        record = self.pending.get(raw_pts)
-                        if record is None:
-                            raise RuntimeError('Encoder changed frame timestamps; timing cannot be matched')
-                        data = C.string_at(output.data, output.size)
-                        f = self.stats.add(**record, e1=now, snd=now, b=len(data), k=output.key,
-                                           w=output.width or self.w, h=output.height or self.h)
-                        self.controller.call('sent', f['s'], len(data)+17, now)
-                    self.ws.send(struct.pack('!BQII', output.key, max(0, f['cap']), f['s'], f['echo'])+data, 2)
-                    with self.lock:
-                        f['wire'] = self.native.now()
-                        self.pending.pop(raw_pts, None)
-                stall = self.stalled(now, opened, captured_at_open)
-                if stall:
-                    raise RuntimeError(stall)
-                if self.key_event.is_set():
-                    self.key_event.clear()
-                    if self.codec == 'h264':
-                        native.fc_capture_key(capture)
-                if now-last_update >= 100000:
-                    target = self.controller.update(now)
-                    state = self.controller.state()
-                    w, h = dimensions(self.w, self.h, max(320, int(max(self.w, self.h)*state['scale'])))
-                    if target and self.codec == 'h264' and encoder == 'x264enc':
-                        native.fc_capture_bitrate(capture, target)
-                        self.bitrate = target
-                    # Hardware properties are not uniformly mutable in PLAYING.
-                    # Drain then reopen the pipeline at a keyframe when its
-                    # budget changes materially. The portal fd/session stays
-                    # alive, so this does not bypass or repeat user consent.
-                    desired_bitrate = target or applied[2]
-                    bitrate_change = self.codec == 'h264' and encoder != 'x264enc' and abs(desired_bitrate-applied[2]) > applied[2]*.2
-                    if not self.reconfiguring and now-last_config >= 1000000 and ((w, h) != applied[:2] or bitrate_change):
-                        wanted = (w, h, desired_bitrate)
-                        with self.lock:
-                            self.reconfiguring = True
-                    last_update = now
-                if self.reconfiguring:
-                    with self.lock:
-                        drained = not self.pending
-                    if drained:
-                        native.fc_capture_close(capture)
-                        capture = None
-                        self.fresh_pipewire()
-                        description = pipeline(self.source, sys.platform, encoder, wanted[0], wanted[1], self.fps, wanted[2], self.codec)
-                        capture = native.fc_capture_open(description.encode(), self.callback, error, len(error))
-                        if not capture:
-                            raise RuntimeError(error.value.decode(errors='replace'))
-                        applied, self.bitrate, last_config = wanted, wanted[2], now
-                        opened, captured_at_open = now, self.stats.captured
-                        with self.lock:
-                            self.reconfiguring = False
-                if now-last_stats >= 1000000:
-                    self.ws.send(dict(self.stats.summary(), t='stats', bitrate=self.bitrate,
-                                      size='%dx%d' % (self.w, self.h), tier=self.controller.state()['tier']))
-                    last_stats = now
-        except Exception as e:
-            try:
-                self.ws.send({'t': 'error', 'message': str(e)})
-            except OSError:
-                pass
-        finally:
-            self.stop_event.set()
-            if capture:
-                native.fc_capture_close(capture)
-            self.ws.close()
-
-    def start(self):
-        if self.stop_event.is_set():
-            self.controller.close()
-            return
-        self.ws.send(dict(t='hello', r=self.key))
-        self.ws.send(dict(t='info', src=self.src, title=self.source.get('title', self.source.get('name', 'Test pattern')),
-                          app='PC', codec=self.codec, input=self.input_enabled,
-                          inputMessage='Allow pointer and keyboard control in the host sharing dialog.',
-                          aspect=self.w/self.h, warm=0))
-        with self.lock:
-            if self.stop_event.is_set():
-                self.controller.close()
-                return
-            self.writer = threading.Thread(target=self.produce, daemon=True)
-            self.writer.start()
-        try:
-            while not self.stop_event.is_set():
-                m = self.ws.receive()
-                t = m.get('t')
-                if t == 'ping':
-                    self.ws.send(dict(t='pong', c=m.get('c', 0), a=self.native.now()))
-                elif t == 'ack':
-                    with self.agent.lock:
-                        self.agent.grants.ack(self.key)
-                elif t == 'key-frame':
-                    self.key_event.set()
-                elif t in ('rx', 'fd', 'clock'):
-                    try:
-                        self.stats.report(m)
-                    except MALFORMED:
-                        pass
-                    if t == 'rx' and isinstance(m.get('s'), int):
-                        self.controller.call('ack', m['s'] & 0xffffffff, self.native.now())
-                elif t in ('m', 'wheel', 'k', 'text', 'release'):
-                    with self.input_lock:
-                        if self.stop_event.is_set():
-                            break
-                        if self.input:
-                            if not self.input_enabled and t != 'release':
-                                continue
-                            try:
-                                self.input.handle(m)
-                                self.stats.input(m)
-                            except MALFORMED:
-                                pass  # drop a malformed viewer event; keep the session
-                            except RuntimeError as e:
-                                self.input_enabled = False
-                                try:
-                                    self.input.release()
-                                except RuntimeError:
-                                    pass
-                                self.ws.send(dict(t='error', message=str(e)))
-                        elif m.get('i'):
-                            try:
-                                self.test_inputs.put_nowait(m)
-                            except queue.Full:
-                                pass
-        finally:
-            self.end()
-            self.writer.join(6)
-            if not self.writer.is_alive():
-                self.controller.close()
-
-    def end(self):
-        with self.lock:
-            self.stop_event.set()
-        self.ws.close()
-        with self.input_lock:
-            if self.input and not self.released:
-                self.released = True
-                try:
-                    self.input.release()
-                except (RuntimeError, OSError):
-                    pass
-
-
-class Agent:
-    def __init__(self, native, token, page):
-        self.native, self.page = native, page
-        self.lock = threading.RLock()
-        self.grants = Grants(token)
-        self.sessions, self.sources = {}, {}
-        self.next_id, self.selecting, self.selection_error = 1, False, ''
-        self.windows = Windows() if sys.platform == 'win32' else None
-        self.encoder = 'mfh264enc' if self.windows else 'vah264enc' if native.has('vah264enc') else 'x264enc'
-        self.shutting_down = False
-        self.selection_generation = 0
-
-    def lists(self):
-        if self.windows:
-            windows, displays = self.windows.sources()
-            self.sources = {s['src']: s for s in windows + displays}
-            return windows, displays
-        return [{k: v for k, v in s.items() if k not in ('portal', 'fd', 'node')} for s in self.sources.values()], []
-
-    def source(self, src):
-        if src == 'test':
-            return dict(src='test', title='Test pattern', w=1280, h=720)
-        self.lists()
-        if src not in self.sources:
-            raise ValueError('Choose a window or screen on this computer first')
-        return dict(self.sources[src])
-
-    def select(self):
-        if self.windows or self.selecting or self.shutting_down:
-            return
-        if len(self.sources) >= 8:
-            raise ValueError('Stop a panel before sharing another source')
-        self.selecting, self.selection_error = True, ''
-        generation = self.selection_generation
-        def choose():
-            error = C.create_string_buffer(1024)
-            portal = self.native.lib.fc_portal_select(error, len(error))
-            with self.lock:
-                self.selecting = False
-                if not portal:
-                    self.selection_error = error.value.decode(errors='replace')
-                elif self.shutting_down or generation != self.selection_generation:
-                    self.native.lib.fc_portal_close(portal)
-                else:
-                    fd, node, w, h, devices = [self.native.lib.fc_portal_value(portal, i) for i in range(5)]
-                    src = 'window:' + secrets.token_hex(8)
-                    self.sources[src] = dict(src=src, title='Shared window or screen', app='Linux portal',
-                                             w=w, h=h, fd=fd, node=node, portal=portal, devices=devices)
-        threading.Thread(target=choose, daemon=True).start()
-
-    def stop(self, src=None):
-        with self.lock:
-            if src is None:
-                self.selection_generation += 1
-            self.grants.revoke(src)
-            sessions = [s for s in self.sessions.values() if src is None or s.src == src]
-            for session in sessions:
-                try:
-                    session.ws.send(dict(t='close'))
-                except OSError:
-                    pass
-                session.end()
-        for session in sessions:
-            if session.writer and session.writer is not threading.current_thread():
-                session.writer.join(6)
-        # The capture is stopped before releasing its PipeWire fd/session.
-        with self.lock:
-            if not self.windows:
-                for key, source in list(self.sources.items()):
-                    if src is None or key == src:
-                        if any(s.src == key and s.writer and s.writer.is_alive() for s in sessions):
-                            continue
-                        self.native.lib.fc_portal_close(source['portal'])
-                        self.sources.pop(key, None)
-        return {'closed': len(sessions)}
-
-
-class Handler(BaseHTTPRequestHandler):
-    protocol_version = 'HTTP/1.1'
-
-    def log_message(self, *args):
-        pass  # URLs contain credentials
-
-    def reply(self, data, status=200, content='application/json'):
-        if not isinstance(data, bytes):
-            data = json.dumps(data).encode()
-        self.send_response(status)
-        self.send_header('Content-Type', content)
-        self.send_header('Content-Length', str(len(data)))
-        self.send_header('Cache-Control', 'no-store')
-        self.send_header('Connection', 'close')
-        self.end_headers()
-        self.wfile.write(data)
-        self.close_connection = True
-
-    def do_GET(self):
-        self.dispatch('GET')
-
-    def do_POST(self):
-        self.dispatch('POST')
-
-    def dispatch(self, method):
-        agent = self.server.agent
-        url = urlsplit(self.path)
-        q = {k: v[-1] for k, v in parse_qs(url.query).items()}
-        try:
-            if method == 'GET' and url.path == '/ping':
-                return self.reply(b'frame-mac-view', content='text/plain')
-            if method == 'GET' and url.path == '/view':
-                return self.reply(agent.page.read_bytes(), content='text/html; charset=utf-8')
-            if method == 'GET' and url.path == '/stream':
-                return self.stream(q)
-            if not agent.grants.master(q.get('k', self.headers.get('X-Token'))):
-                return self.reply({'error': 'forbidden'}, 403)
-            if method == 'POST' and url.path == '/close':
-                return self.reply(agent.stop(q.get('src')))
-            with agent.lock:
-                windows, displays = agent.lists()
-                if method == 'GET' and url.path == '/status':
-                    data = dict(version=1, host='windows' if agent.windows else 'linux', screen=True,
-                                accessibility=True, selecting=agent.selecting, selectionError=agent.selection_error,
-                                encoder=agent.encoder, finished=[], streams=[dict(id=i, src=s.src,
-                                    title=s.source.get('title', ''), stats=s.stats.summary(), controller=s.controller.state())
-                                    for i, s in agent.sessions.items() if not s.stop_event.is_set()])
-                elif method == 'GET' and url.path in ('/windows', '/displays'):
-                    data = dict(windows=windows, displays=displays, screen=True)
-                elif method == 'POST' and url.path == '/ticket':
-                    agent.source(q.get('src'))
-                    data = {'ticket': agent.grants.ticket(q['src'])}
-                elif method == 'POST' and url.path == '/permissions':
-                    agent.select()
-                    data = {'selecting': agent.selecting}
-                elif method == 'GET' and url.path == '/stats':
-                    data = dict(now=agent.native.now(), streams=[dict(id=i, src=s.src, controller=s.controller.state(),
-                         events=list(s.controller.events), **s.stats.snapshot(max(0, int(q.get('since', 0))), max(0, int(q.get('settle', 1500000)))))
-                         for i, s in agent.sessions.items() if q.get('id', str(i)) == str(i) and not s.stop_event.is_set()])
-                elif method == 'POST' and url.path == '/bench':
-                    data = {'sent': 0}
-                    for s in agent.sessions.values():
-                        if s.src == q.get('src'):
-                            m = {k: v for k, v in q.items() if k not in ('k', 'src')}
-                            for k in ('x', 'y', 'interval'):
-                                if k in m:
-                                    m[k] = float(m[k])
-                            s.ws.send(dict(m, t='bench'))
-                            data['sent'] += 1
-                else:
-                    return self.reply({'error': 'not found'}, 404)
-            self.reply(data)
-        except (ValueError, RuntimeError) as e:
-            self.reply({'error': str(e)}, 400)
-        except (OSError, ConnectionError):
-            self.close_connection = True
-
-    def stream(self, query):
-        agent = self.server.agent
-        with agent.lock:
-            key = agent.grants.redeem(query.get('src'), query)
-            if not key:
-                return self.reply({'error': 'forbidden'}, 403)
-            source = agent.source(query.get('src'))
-            if self.headers.get('Upgrade', '').lower() != 'websocket' or self.headers.get('Sec-WebSocket-Version') != '13':
-                return self.reply({'error': 'expected WebSocket'}, 400)
-            wskey = self.headers.get('Sec-WebSocket-Key', '')
-            if len(base64.b64decode(wskey, validate=True)) != 16:
-                raise ValueError('Bad WebSocket key')
-            if len(agent.sessions) >= 8:
-                raise ValueError('At most eight panels may be open')
-            # Stop can revoke and close only a registered session. Register
-            # under the same lock as redemption, before any capture starts.
-            session = Session(agent, WebSocket(self), key, source, query)
-            for old in list(agent.sessions.values()):
-                if old.key == key or old.src == source['src']:
-                    if old.key != key:
-                        agent.grants.keys.pop(old.key, None)
-                        try:
-                            old.ws.send(dict(t='close'))
-                        except OSError:
-                            pass
-                    old.end()
-                    if old.writer:
-                        old.writer.join(6)
-                        if old.writer.is_alive():
-                            session.controller.close()
-                            raise ValueError('The previous capture is still stopping; retry shortly')
-            ident = agent.next_id
-            agent.next_id += 1
-            agent.sessions[ident] = session
-            accept = base64.b64encode(hashlib.sha1((wskey+'258EAFA5-E914-47DA-95CA-C5AB0DC85B11').encode()).digest()).decode()
-            self.send_response(101)
-            self.send_header('Upgrade', 'websocket')
-            self.send_header('Connection', 'Upgrade')
-            self.send_header('Sec-WebSocket-Accept', accept)
-            self.end_headers()
-        try:
-            session.start()
-        except (OSError, ValueError, RuntimeError):
-            session.end()
-        finally:
-            session.end()
-            if session.writer:
-                session.writer.join(6)
-            if not session.writer or not session.writer.is_alive():
-                session.controller.close()
-            with agent.lock:
-                agent.sessions.pop(ident, None)
-            self.close_connection = True
-
-
-def main():
-    parser = argparse.ArgumentParser()
-    parser.add_argument('command', choices=['serve'])
-    parser.add_argument('--port', type=int, default=0)
-    parser.add_argument('--page', type=Path, required=True)
-    parser.add_argument('--exit-on-eof', action='store_true')
-    args = parser.parse_args()
-    token = os.environ.get('FRAME_MAC_VIEW_TOKEN')
-    if not token:
-        raise SystemExit('Frame Control must provide a private token')
-    native = Native()
-    server = ThreadingHTTPServer(('127.0.0.1', args.port), Handler)
-    agent = server.agent = Agent(native, token, args.page)
-    if args.exit_on_eof:
-        def eof():
-            sys.stdin.buffer.read()
-            with agent.lock:
-                agent.shutting_down = True
-            agent.stop()
-            server.shutdown()
-        threading.Thread(target=eof, daemon=True).start()
-    print('listening on 127.0.0.1:%d' % server.server_port, flush=True)
-    try:
-        server.serve_forever()
-    finally:
-        agent.shutting_down = True
-        agent.stop()
-        server.server_close()
-
-
-if __name__ == '__main__':
-    try:
-        main()
-    except (OSError, RuntimeError, AttributeError) as e:
-        raise SystemExit('PC streaming helper: ' + str(e))
@@ -1,383 +0,0 @@
-"""Native PC capture and input bindings. No desktop-streaming app required.
-
-The packaged native library contains our adapter and the shared rate controller;
-GStreamer supplies WGC/Media Foundation and PipeWire/VA-API/x264 libraries.
-"""
-import ctypes as C
-import os
-from pathlib import Path
-import re
-import sys
-import threading
-
-ROOT = Path(__file__).resolve().parent.parent
-NATIVE = Path(os.environ.get('FRAME_PC_NATIVE', ROOT / 'desktop' / 'bundle'))
-LIBRARY = NATIVE / ('pc-host.dll' if sys.platform == 'win32' else 'pc-host.so')
-
-
-class Encoded(C.Structure):
-    _fields_ = [('data', C.c_void_p), ('size', C.c_int), ('key', C.c_int),
-                ('width', C.c_int), ('height', C.c_int), ('pts', C.c_int64)]
-
-
-GATE = C.CFUNCTYPE(C.c_int, C.c_int, C.c_int64, C.c_int64, C.c_int64)
-
-
-class Native:
-    def __init__(self, path=LIBRARY):
-        self.dll_dirs = []
-        if sys.platform == 'win32':
-            # Set process coordinates before loading GStreamer: a plugin may
-            # create a helper HWND during discovery, after which it is too late.
-            user = C.WinDLL('user32')
-            user.SetProcessDpiAwarenessContext.argtypes = [C.c_void_p]
-            user.SetProcessDpiAwarenessContext(C.c_void_p(-4))
-            for folder in (path.parent, path.parent / 'bin'):
-                self.dll_dirs.append(os.add_dll_directory(str(folder)))
-        self.lib = C.CDLL(str(path))
-        signatures = {
-            'fc_now': (C.c_int64, []), 'fc_gst_init': (None, []),
-            'fc_has_element': (C.c_int, [C.c_char_p]),
-            'fc_new': (C.c_void_p, [C.c_int, C.c_int]), 'fc_free': (None, [C.c_void_p]),
-            'fc_ceiling': (None, [C.c_void_p, C.c_int]),
-            'fc_gate': (C.c_int, [C.c_void_p, C.c_int64, C.c_int]),
-            'fc_capture': (None, [C.c_void_p, C.c_int64]),
-            'fc_sent': (None, [C.c_void_p, C.c_uint32, C.c_int, C.c_int64]),
-            'fc_ack': (C.c_int, [C.c_void_p, C.c_uint32, C.c_int64]),
-            'fc_update': (C.c_int, [C.c_void_p, C.c_int64]),
-            'fc_value': (C.c_int64, [C.c_void_p, C.c_int]),
-            'fc_capture_open': (C.c_void_p, [C.c_char_p, GATE, C.c_char_p, C.c_int]),
-            'fc_capture_pull': (C.c_int, [C.c_void_p, C.POINTER(Encoded)]),
-            'fc_capture_error': (C.c_char_p, [C.c_void_p]),
-            'fc_capture_bitrate': (None, [C.c_void_p, C.c_int]),
-            'fc_capture_key': (None, [C.c_void_p]),
-            'fc_capture_test': (None, [C.c_void_p, C.c_uint32]), 'fc_capture_close': (None, [C.c_void_p]),
-        }
-        if sys.platform.startswith('linux'):
-            signatures.update({
-                'fc_portal_select': (C.c_void_p, [C.c_char_p, C.c_int]),
-                'fc_portal_close': (None, [C.c_void_p]),
-                'fc_portal_refresh': (C.c_int, [C.c_void_p, C.c_char_p, C.c_int]),
-                'fc_portal_value': (C.c_int, [C.c_void_p, C.c_int]),
-                'fc_portal_input': (C.c_int, [C.c_void_p, C.c_int, C.c_double, C.c_double, C.c_int, C.c_int]),
-            })
-        for name, (result, args) in signatures.items():
-            fn = getattr(self.lib, name)
-            fn.restype, fn.argtypes = result, args
-        self.lib.fc_gst_init()
-
-    def has(self, name):
-        return bool(self.lib.fc_has_element(name.encode()))
-
-    def now(self):
-        return self.lib.fc_now()
-
-
-class Controller:
-    def __init__(self, lib, fps, ceiling):
-        # close() may run on the stream thread while /status reads state();
-        # after close every entry point is a no-op, never a NULL dereference.
-        self.lib, self.lock, self.fps = lib, threading.RLock(), fps
-        self.enabled = os.environ.get('FRAME_MAC_VIEW_ADAPT') != '0'
-        self.ptr = lib.fc_new(fps, self.enabled)
-        if not self.ptr:
-            raise MemoryError('Unable to allocate the streaming controller')
-        lib.fc_ceiling(self.ptr, ceiling)
-        self.events = []
-
-    def state(self):
-        with self.lock:
-            names = ['target', 'ceiling', 'tier', 'fps', 'scale', 'baseRtt', 'inFlight', 'slack']
-            if not self.ptr:
-                out = dict.fromkeys(names, 0)
-                out.update(fps=self.fps, scale=100)
-            else:
-                out = {k: self.lib.fc_value(self.ptr, i) for i, k in enumerate(names)}
-            out.update(scale=out['scale'] / 100, baseRtt=out['baseRtt'] / 1000,
-                       slack=out['slack'] / 1000, adapt=self.enabled)
-            return out
-
-    def call(self, name, *args):
-        with self.lock:
-            return getattr(self.lib, 'fc_' + name)(self.ptr, *args) if self.ptr else 0
-
-    def update(self, now):
-        with self.lock:
-            if not self.ptr:
-                return 0
-            old = self.state()
-            result = self.lib.fc_update(self.ptr, now)
-            state = self.state()
-            if state['target'] < old['target'] or state['tier'] != old['tier']:
-                self.events.append({'t': now, 'e': 'target %s bit/s; tier %s' % (state['target'], state['tier'])})
-                self.events = self.events[-200:]
-            return result
-
-    def close(self):
-        with self.lock:
-            if self.ptr:
-                self.lib.fc_free(self.ptr)
-                self.ptr = None
-
-
-def dimensions(w, h, maximum):
-    scale = min(1, maximum / max(w, h))
-    return max(2, int(w * scale) // 2 * 2), max(2, int(h * scale) // 2 * 2)
-
-
-def pipeline(source, platform, encoder, w, h, fps, bitrate, codec='h264'):
-    """Only locally constructed numeric source IDs enter the pipeline parser."""
-    if source['src'] == 'test':
-        capture = 'videotestsrc name=source is-live=true pattern=ball'
-    elif platform == 'win32':
-        kind, ident = source['src'].split(':')
-        if kind not in ('window', 'display') or not re.fullmatch(r'[0-9]+', ident):
-            raise ValueError('Invalid Windows capture source')
-        prop = 'window-handle' if kind == 'window' else 'monitor-handle'
-        capture = 'd3d11screencapturesrc capture-api=wgc show-cursor=true show-border=true %s=%d' % (prop, int(ident))
-    else:
-        capture = 'pipewiresrc fd=%d path=%d do-timestamp=true' % (source['fd'], source['node'])
-    # The source gate runs before conversion/encoding. There is no leaky queue
-    # of H.264 frames; every encoded reference frame reaches the socket.
-    raw = '%s ! video/x-raw,framerate=%d/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=%d,height=%d' % (capture, fps, w, h)
-    if codec == 'jpeg':
-        enc = 'jpegenc name=enc quality=80'
-        parse = ''
-    else:
-        choices = {
-            'mfh264enc': 'mfh264enc name=enc low-latency=true bframes=0 gop-size=60',
-            'vah264enc': 'vah264enc name=enc b-frames=0 key-int-max=60',
-            'x264enc': 'x264enc name=enc tune=zerolatency speed-preset=ultrafast bframes=0 key-int-max=60',
-        }
-        enc = choices[encoder] + ' bitrate=%d' % max(1, bitrate // 1000)
-        raw += ',format=NV12' if encoder != 'x264enc' else ',format=I420'
-        parse = ' ! h264parse config-interval=-1 ! video/x-h264,stream-format=byte-stream,alignment=au'
-    return raw + ' ! ' + enc + parse + ' ! appsink name=out sync=false max-buffers=2 drop=false'
-
-
-# X11 keysyms work on Wayland through the RemoteDesktop portal too. The host's
-# keyboard layout handles physical keys; Unicode text is sent as Unicode keysyms.
-KEYSYMS = {'Enter': 0xff0d, 'Tab': 0xff09, 'Backspace': 0xff08, 'Escape': 0xff1b,
-           'Delete': 0xffff, 'ArrowLeft': 0xff51, 'ArrowUp': 0xff52, 'ArrowRight': 0xff53,
-           'ArrowDown': 0xff54, 'Home': 0xff50, 'End': 0xff57, 'PageUp': 0xff55,
-           'PageDown': 0xff56, 'Shift': 0xffe1, 'Control': 0xffe3, 'Alt': 0xffe9, 'Meta': 0xffeb}
-
-
-class PortalInput:
-    def __init__(self, native, source):
-        self.lib, self.source = native.lib, source
-        self.buttons, self.keys = set(), set()
-
-    def emit(self, kind, x=0, y=0, code=0, down=0):
-        if not self.lib.fc_portal_input(self.source['portal'], kind, x, y, code, down):
-            raise RuntimeError('The desktop portal refused input; check the sharing permission')
-
-    def release(self):
-        error = None
-        for values, kind in ((self.buttons, 1), (self.keys, 3)):
-            for code in list(values):
-                try:
-                    self.emit(kind, code=code, down=0)
-                    values.discard(code)
-                except RuntimeError as e:
-                    error = e
-        if error:
-            raise error
-
-    def handle(self, m):
-        t = m['t']
-        if t == 'release':
-            return self.release()
-        if t in ('m', 'wheel'):
-            x, y = (max(0, min(1, float(m.get(k, 0)))) for k in ('x', 'y'))
-            self.emit(0, x * (self.source['w'] - 1), y * (self.source['h'] - 1))
-        if t == 'm' and m.get('e') in ('up', 'down'):
-            b = {0: 0x110, 1: 0x112, 2: 0x111}.get(m.get('b', 0))
-            if b is not None:
-                down = m['e'] == 'down'
-                self.emit(1, code=b, down=down)
-                (self.buttons.add if down else self.buttons.discard)(b)
-        elif t == 'wheel':
-            self.emit(2, max(-4096, min(4096, float(m.get('dx', 0)))), max(-4096, min(4096, float(m.get('dy', 0)))))
-        elif t == 'k':
-            key = str(m.get('key', ''))
-            k = KEYSYMS.get(key) or (ord(key) if len(key) == 1 and ord(key) < 256 else
-                                     0x1000000 + ord(key) if len(key) == 1 else 0)
-            if k:
-                down = m.get('e') == 'down'
-                self.emit(3, code=k, down=down)
-                (self.keys.add if down else self.keys.discard)(k)
-        elif t == 'text':
-            for ch in str(m.get('s', ''))[:4096]:
-                k = ord(ch) if ord(ch) < 256 else 0x1000000 + ord(ch)
-                self.emit(3, code=k, down=1)
-                self.emit(3, code=k, down=0)
-
-
-class Windows:
-    """WGC source handles and SendInput. No elevation or global input hook."""
-    def __init__(self):
-        from ctypes import wintypes as W
-        self.W = W
-        self.user = C.WinDLL('user32', use_last_error=True)
-        self.dwm = C.WinDLL('dwmapi')
-        self.user.IsWindow.argtypes = [W.HWND]
-        self.user.IsWindowVisible.argtypes = [W.HWND]
-        self.user.IsIconic.argtypes = [W.HWND]
-        self.user.GetWindowTextLengthW.argtypes = [W.HWND]
-        self.user.GetWindowTextW.argtypes = [W.HWND, W.LPWSTR, C.c_int]
-        self.user.GetWindowRect.argtypes = [W.HWND, C.POINTER(W.RECT)]
-        self.user.SetForegroundWindow.argtypes = [W.HWND]
-        self.user.GetForegroundWindow.argtypes = []
-        self.user.GetForegroundWindow.restype = W.HWND
-        self.dwm.DwmGetWindowAttribute.argtypes = [W.HWND, W.DWORD, C.c_void_p, W.DWORD]
-        self.callback = C.WINFUNCTYPE(W.BOOL, W.HWND, W.LPARAM)
-        self.monitor_callback = C.WINFUNCTYPE(W.BOOL, W.HMONITOR, W.HDC, C.POINTER(W.RECT), W.LPARAM)
-        self.user.EnumWindows.argtypes = [self.callback, W.LPARAM]
-        self.user.EnumDisplayMonitors.argtypes = [W.HDC, C.c_void_p, self.monitor_callback, W.LPARAM]
-        class Mouse(C.Structure):
-            _fields_ = [('dx', W.LONG), ('dy', W.LONG), ('data', W.DWORD), ('flags', W.DWORD),
-                        ('time', W.DWORD), ('extra', C.c_size_t)]
-        class Key(C.Structure):
-            _fields_ = [('vk', W.WORD), ('scan', W.WORD), ('flags', W.DWORD), ('time', W.DWORD), ('extra', C.c_size_t)]
-        class Union(C.Union):
-            _fields_ = [('mouse', Mouse), ('key', Key)]
-        class Input(C.Structure):
-            _fields_ = [('type', W.DWORD), ('data', Union)]
-        self.Mouse, self.Key, self.Input = Mouse, Key, Input
-        self.user.SendInput.argtypes = [W.UINT, C.POINTER(Input), C.c_int]
-        self.user.SendInput.restype = W.UINT
-
-    def rect(self, hwnd):
-        r = self.W.RECT()
-        if not self.user.IsWindow(hwnd) or self.user.IsIconic(hwnd):
-            raise RuntimeError('The captured window closed or was minimized')
-        # WGC captures the visible extended frame, excluding invisible resize borders.
-        if self.dwm.DwmGetWindowAttribute(hwnd, 9, C.byref(r), C.sizeof(r)):
-            if not self.user.GetWindowRect(hwnd, C.byref(r)):
-                raise RuntimeError('Cannot locate the captured window')
-        return r.left, r.top, r.right - r.left, r.bottom - r.top
-
-    def sources(self):
-        windows, displays = [], []
-        def window(hwnd, _):
-            if not self.user.IsWindowVisible(hwnd) or self.user.IsIconic(hwnd):
-                return True
-            n = self.user.GetWindowTextLengthW(hwnd)
-            if n:
-                title = C.create_unicode_buffer(n + 1)
-                self.user.GetWindowTextW(hwnd, title, n + 1)
-                try:
-                    x, y, w, h = self.rect(hwnd)
-                    if w > 0 and h > 0:
-                        windows.append(dict(src='window:%d' % hwnd, id=hwnd, title=title.value,
-                                            app='Windows', w=w, h=h, x=x, y=y))
-                except RuntimeError:
-                    pass
-            return True
-        def monitor(handle, dc, rect, data):
-            r = rect.contents
-            displays.append(dict(src='display:%d' % handle, name='Display %d' % (len(displays) + 1),
-                                 x=r.left, y=r.top, w=r.right-r.left, h=r.bottom-r.top))
-            return True
-        self.user.EnumWindows(self.callback(window), 0)
-        self.user.EnumDisplayMonitors(None, None, self.monitor_callback(monitor), 0)
-        return windows, displays
-
-    def send(self, mouse=None, key=None):
-        inp = self.Input()
-        inp.type = 0 if mouse else 1
-        if mouse:
-            inp.data.mouse = self.Mouse(*mouse, 0, 0)
-        else:
-            inp.data.key = self.Key(*key, 0, 0)
-        if self.user.SendInput(1, C.byref(inp), C.sizeof(inp)) != 1:
-            raise RuntimeError('Windows refused input (elevated apps and the secure desktop cannot be controlled)')
-
-
-class WindowsInput:
-    def __init__(self, host, source):
-        self.host, self.source = host, source
-        self.buttons, self.keys = set(), set()
-
-    def release(self):
-        error = None
-        for button in list(self.buttons):
-            try:
-                self.host.send(mouse=(0, 0, 0, {0: 4, 1: 0x40, 2: 0x10}[button]))
-                self.buttons.discard(button)
-            except RuntimeError as e:
-                error = e
-        for vk in list(self.keys):
-            try:
-                extended = 1 if vk in (33, 34, 35, 36, 37, 38, 39, 40, 45, 46, 91, 92, 163, 165) else 0
-                self.host.send(key=(vk, 0, 2 | extended))
-                self.keys.discard(vk)
-            except RuntimeError as e:
-                error = e
-        if error:
-            raise error
-
-    def focus(self):
-        if not self.source['src'].startswith('window:'):
-            return
-        hwnd = int(self.source['src'].split(':')[1])
-        user = self.host.user
-        if user.GetForegroundWindow() != hwnd and not user.SetForegroundWindow(hwnd):
-            raise RuntimeError('Windows could not focus this window. Bring it to the front on your PC, then press Stop and Show again.')
-        if user.GetForegroundWindow() != hwnd:
-            raise RuntimeError('The selected window is not in front. Reopen the view after bringing it to the front on your PC.')
-
-    def handle(self, m):
-        t, u = m['t'], self.host.user
-        if t == 'release':
-            return self.release()
-        if t in ('m', 'wheel'):
-            source = self.source
-            if source['src'].startswith('window:'):
-                hwnd = int(source['src'].split(':')[1])
-                x, y, w, h = self.host.rect(hwnd)
-                if m.get('e') == 'down' or t == 'wheel':
-                    self.focus()
-            else:
-                x, y, w, h = (source[k] for k in ('x', 'y', 'w', 'h'))
-            x += max(0, min(1, float(m.get('x', 0)))) * (w - 1)
-            y += max(0, min(1, float(m.get('y', 0)))) * (h - 1)
-            left, top, width, height = (u.GetSystemMetrics(i) for i in (76, 77, 78, 79))
-            self.host.send(mouse=(round((x-left)*65535/max(1,width-1)), round((y-top)*65535/max(1,height-1)), 0, 0xc001))
-        if t == 'm' and m.get('e') in ('up', 'down'):
-            b = m.get('b', 0)
-            if b in (0, 1, 2):
-                down = m['e'] == 'down'
-                self.host.send(mouse=(0, 0, 0, {0: 2, 1: 0x20, 2: 8}[b] * (1 if down else 2)))
-                (self.buttons.add if down else self.buttons.discard)(b)
-        elif t == 'wheel':
-            for name, flag, direction in (('dy', 0x800, -1), ('dx', 0x1000, 1)):
-                delta = int(max(-4096, min(4096, float(m.get(name, 0))))) * direction
-                if delta:
-                    self.host.send(mouse=(0, 0, delta & 0xffffffff, flag))
-        elif t == 'k':
-            code, down = str(m.get('code', '')), m.get('e') == 'down'
-            if down:
-                self.focus()
-            special = {'Enter': 13, 'Escape': 27, 'Tab': 9, 'Backspace': 8, 'Space': 32,
-                       'ArrowLeft': 37, 'ArrowUp': 38, 'ArrowRight': 39, 'ArrowDown': 40,
-                       'Delete': 46, 'Home': 36, 'End': 35, 'PageUp': 33, 'PageDown': 34,
-                       'ShiftLeft': 160, 'ShiftRight': 161, 'ControlLeft': 162, 'ControlRight': 163,
-                       'AltLeft': 164, 'AltRight': 165, 'MetaLeft': 91, 'MetaRight': 92}
-            vk = special.get(code, 0)
-            if re.fullmatch(r'Key[A-Z]', code) or re.fullmatch(r'Digit[0-9]', code):
-                vk = ord(code[-1])
-            if vk:
-                extended = 1 if vk in (33, 34, 35, 36, 37, 38, 39, 40, 45, 46, 91, 92, 163, 165) else 0
-                self.host.send(key=(vk, 0, extended | (0 if down else 2)))
-                (self.keys.add if down else self.keys.discard)(vk)
-            elif down and len(str(m.get('key', ''))) == 1:
-                self.handle({'t': 'text', 's': m['key']})
-        elif t == 'text':
-            self.focus()
-            raw = str(m.get('s', ''))[:4096].encode('utf-16-le')
-            for i in range(0, len(raw), 2):
-                unit = int.from_bytes(raw[i:i+2], 'little')
-                self.host.send(key=(0, unit, 4))
-                self.host.send(key=(0, unit, 6))
@@ -1,90 +0,0 @@
-"""PC host selection behind the existing MacView tunnel/panel controller.
-
-The public /api/macview name and viewer URL remain compatible with the Mac
-base branch. Only helper launch, platform availability and source validation
-are different. No second viewer, SSH supervisor or benchmark launcher.
-"""
-import os
-import sys
-import subprocess
-from frame_macview import MacView, MacViewError, ROOT
-from frame_pc_capture import LIBRARY, NATIVE
-
-
-def prepend(env, name, path):
-    """An empty entry means the current directory to the loader; never add one."""
-    rest = env.get(name, '')
-    env[name] = str(path) + (os.pathsep + rest if rest else '')
-
-
-class PCView(MacView):
-    viewer_profile = 'pc-view'
-    host = 'windows' if sys.platform == 'win32' else 'linux'
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.prefer_usb = False  # Mac networksetup probe is platform-specific
-
-    def unavailable(self):
-        if sys.platform not in ('win32', 'linux'):
-            return 'PC streaming needs Windows or a Linux desktop.'
-        if not LIBRARY.is_file():
-            return 'The PC streaming libraries are missing from this build. See docs/pc-in-headset.md.'
-        return None
-
-    def state(self):
-        result = super().state()
-        result["host"] = self.host
-        return result
-
-    def build(self):
-        pass  # native libraries are built and bundled with the app
-
-    def agent_command(self):
-        return [sys.executable, str(ROOT / 'ui' / 'frame_pc_agent.py')]
-
-    def agent_environment(self):
-        env = super().agent_environment()
-        env['GST_PLUGIN_PATH_1_0'] = str(NATIVE / 'lib' / 'gstreamer-1.0')
-        env['GST_PLUGIN_SYSTEM_PATH_1_0'] = ''
-        cache = os.path.join(os.path.expanduser('~'), '.cache', 'frame-control')
-        os.makedirs(cache, exist_ok=True)
-        env['GST_REGISTRY_1_0'] = os.path.join(cache, 'gstreamer-registry.bin')
-        env['GST_REGISTRY_FORK'] = 'no'
-        if sys.platform == 'win32':
-            prepend(env, 'PATH', NATIVE / 'bin')
-        else:
-            prepend(env, 'LD_LIBRARY_PATH', NATIVE / 'lib')
-            env['PIPEWIRE_MODULE_DIR'] = str(NATIVE / 'lib' / 'pipewire-0.3')
-            env['SPA_PLUGIN_DIR'] = str(NATIVE / 'lib' / 'spa-0.2')
-            env['PIPEWIRE_CONFIG_DIR'] = str(NATIVE / 'share' / 'pipewire')
-            env['PIPEWIRE_CONFIG_NAME'] = 'client.conf'
-        return env
-
-    def shutdown(self):
-        self.closing = True
-        try:
-            self.stop()
-        except MacViewError:
-            pass
-        if self.tunnel and self.tunnel.poll() is None:
-            self.tunnel.terminate()
-        if self.agent and self.agent.poll() is None:
-            # EOF gives the host a chance to release held input and portal
-            # sessions, including on Windows where terminate is uncatchable.
-            if self.agent.stdin:
-                self.agent.stdin.close()
-            try:
-                self.agent.wait(10)
-            except subprocess.TimeoutExpired:
-                self.agent.kill()
-                self.agent.wait(5)
-
-    def _show(self, src, quality, width, height):
-        if src.startswith('separate:'):
-            raise MacViewError('Separate virtual displays are a Mac-only feature. Choose a window or screen.')
-        return super()._show(src, quality, width, height)
-
-
-def host_view(*args, **kwargs):
-    return (MacView if sys.platform == 'darwin' else PCView)(*args, **kwargs)
@@ -1,88 +0,0 @@
-"""The desktop stream's timing records, in the Mac viewer/bench schema.
-
-Times are host monotonic microseconds. Zero means unknown, never a fabricated
-capture/display timestamp. Storage is bounded to the same 4096/512 records as
-Stats.swift. The existing macview-bench.py grades these records unchanged.
-"""
-from collections import OrderedDict
-import threading
-
-
-def distribution(values):
-    values = sorted(v for v in values if v is not None)
-    if not values:
-        return {}
-    return {key: round(values[min(len(values)-1, int((len(values)-1)*p + .5))], 1)
-            for key, p in (('p50', .5), ('p95', .95))}
-
-
-class Stats:
-    def __init__(self, now):
-        self.now, self.lock = now, threading.RLock()
-        self.frames, self.inputs = OrderedDict(), OrderedDict()
-        self.captured = self.skipped = self.dropped = 0
-        self.rtt, self.decoder, self.synced = 0, '', False
-        self.sequence = 0
-
-    def add(self, **values):
-        with self.lock:
-            self.sequence = (self.sequence + 1) & 0xffffffff
-            record = dict.fromkeys(('s', 'k', 'b', 'w', 'h', 'cap', 'arr', 'e0', 'e1', 'snd',
-                                    'wire', 'rx', 'dec', 'drw', 'vs', 'echo', 'tier', 'br'), 0)
-            record.update(values, s=self.sequence)
-            self.frames[self.sequence] = record
-            while len(self.frames) > 4096:
-                self.frames.popitem(last=False)
-            for event in self.inputs.values():
-                if not event['frame'] and event['inj'] <= record['cap']:
-                    event.update(frame=self.sequence, cap=record['cap'])
-                    record['echo'] = event['id']
-            return record
-
-    def report(self, message):
-        with self.lock:
-            if message['t'] == 'rx':
-                frame = self.frames.get(message.get('s'))
-                if frame and isinstance(message.get('r'), (int, float)):
-                    frame['rx'] = int(message['r'])
-            elif message['t'] == 'fd':
-                for item in message.get('f', [])[:4096]:
-                    if isinstance(item, list) and len(item) >= 4:
-                        frame = self.frames.get(item[0])
-                        if frame:
-                            for name, val in zip(('dec', 'drw', 'vs'), item[1:4]):
-                                if isinstance(val, (int, float)):
-                                    frame[name] = int(val)
-                self.dropped += max(0, int(message.get('drop', 0)))
-            elif message['t'] == 'clock':
-                self.rtt = float(message.get('rtt', 0))
-                self.decoder = str(message.get('dec', ''))[:1024]
-                self.synced = True
-
-    def input(self, m):
-        if not isinstance(m.get('i'), int) or not m['i']:
-            return
-        with self.lock:
-            self.inputs[m['i']] = dict(id=m['i'], kind=m['t'], tv=m.get('tv') or 0,
-                                       inj=self.now(), frame=0, cap=0)
-            while len(self.inputs) > 512:
-                self.inputs.popitem(last=False)
-
-    def summary(self):
-        with self.lock:
-            now = self.now()
-            frames = [f for f in self.frames.values() if f['cap'] >= now-2000000]
-            out = dict(captured=self.captured, skipped=self.skipped, dropped=self.dropped,
-                       rtt=self.rtt, decoder=self.decoder, synced=self.synced,
-                       fps=sum(f['vs'] > 0 for f in frames)/2, sentFps=len(frames)/2,
-                       mbps=round(sum(f['b'] for f in frames)*4/1e6, 2))
-            for key, start, end in (('capture', 'cap', 'arr'), ('queue', 'arr', 'e0'),
-                                    ('encode', 'e0', 'e1'), ('network', 'e1', 'rx'),
-                                    ('decode', 'rx', 'dec'), ('draw', 'dec', 'drw'), ('total', 'cap', 'drw')):
-                out[key] = distribution([(f[end]-f[start])/1000 for f in frames if f[start] and f[end]])
-            return out
-
-    def snapshot(self, since=0, settle=1500000):
-        with self.lock:
-            return dict(frames=[dict(f) for f in self.frames.values() if f['s'] > since and f['cap'] <= self.now()-settle],
-                        inputs=[dict(i) for i in self.inputs.values()], captured=self.captured, summary=self.summary())
@@ -22,7 +22,7 @@
 </head>
 <body>
 <canvas id="c" width="16" height="9"></canvas>
-<div id="note">Connecting to your computer…</div>
+<div id="note">Connecting to the Mac…</div>
 <div id="hud" hidden></div>
 <script>
 "use strict";
@@ -243,14 +243,14 @@ async function connect() {
    // Refused before ever getting a key: the ticket expired or was revoked,
    // and retrying can't help.
    if (!reconnectKey && ++failedStarts >= 3) {
-      show("This view has expired. Press Show in Frame Control on your computer to open it again.");
+      show("This view has expired. Press Show in Frame Control on the Mac to open it again.");
      return;
    }
    hideNoteOnFrame = true;
    // The Mac may be asleep or the tunnel restarting: keep trying.
    retry = Math.min(retry + 1, 6);
    // Keep the Mac's reason (a missing permission, a closed window) on screen.
-    show(lastError ? `${lastError} Retrying…` : "Lost the computer. Reconnecting…");
+    show(lastError ? `${lastError} Retrying…` : "Lost the Mac. Reconnecting…");
    setTimeout(connect, 500 * 2 ** retry);
  };
 }
@@ -269,7 +269,7 @@ function control(m) {
    document.title = tag ? `${name} [${tag}]` : name;
    if (!m.input) {
      hideNoteOnFrame = false;  // a warning, not a connection notice: let it stay its 8 s
-      show(m.inputMessage || "Clicks and keys need Accessibility permission on the Mac (Frame Control asks for it).", 8000);
+      show("Clicks and keys need Accessibility permission on the Mac (Frame Control asks for it).", 8000);
    }
  } else if (m.t === "error") {
    stats.errors.push(m.message);
@@ -391,7 +391,7 @@ addEventListener("keydown", e => onKey(e, true));
 addEventListener("keyup", e => onKey(e, false));
 addEventListener("blur", () => send({ t: "release" }));

-show("Connecting to your computer…");
+show("Connecting to the Mac…");
 connect();
 </script>
 </body>
@@ -55,7 +55,6 @@ import frame_contact  # noqa: E402
 import frame_host  # noqa: E402
 import frame_link  # noqa: E402
 import frame_macview  # noqa: E402
-import frame_pcview  # noqa: E402
 import frame_media  # noqa: E402
 import frame_panels  # noqa: E402
 import frame_quest  # noqa: E402
@@ -2344,9 +2343,8 @@ def push_media(path):

 # The tunnel gets its own connection: the shared master's options would win
 # over anything added after them.
-macview = frame_pcview.host_view(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=8"],
-                                lambda remote, stdin=None, timeout=30: ssh(remote, stdin=stdin.encode("utf-8") if stdin is not None else None,
-                                                                           timeout=timeout, text=False).decode("utf-8", errors="replace"),
+macview = frame_macview.MacView(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=8"],
+                                lambda remote, stdin=None, timeout=30: ssh(remote, stdin=stdin, timeout=timeout),
                                FRAME, track=_live_tunnels.add)
Author	SHA1	Message	Date
SAPHID	342bf78b05	Merge main and preserve tracking and Windows test guidance	2026-10-18 00:06:01 +00:00
SAPHID	b51fab9872	chore: resolve conflicts with main	2026-10-17 22:10:01 +00:00
saphidandClaude Sonnet 5.5	8fb00b263c	fix(tracking): review 7 - rescan on cleanup, non-finite Health values Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-29 20:29:56 +10:00
saphidandClaude Sonnet 5.5	4937caf310	fix(tracking): don't call an unworn eye-camera artifact a pulse Unworn Frame runs gave a steady 'clear' 90-96 BPM. pulse now reads the proximity sensor and refuses to report when the headset is not worn. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-29 20:20:23 +10:00
saphidandClaude Sonnet 5.5	128e7a4c94	fix(tracking): never signal the eye-camera capture; finish cleanup exhaustively Terminating eyetracking --calib left the DSP eye camera stuck streaming on the Frame. Capture now lets the bounded run end by itself, deleting images meanwhile, and only kills as a last resort. Also hardens Ctrl-C cleanup and heart-check error handling. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-09-29 20:15:24 +10:00
saphidandClaude Opus 5.5	1a439f05c2	fix(tracking): make eye-image cleanup exhaustive and confirm capture ownership Follow-up review findings: remove() now tries every capture directory and reports any it could not delete; each cleanup step runs even if an earlier one fails; the directory the capture tool reports (once its output is flushed) must match the one we reduced, and is always removed. heart-check keeps readings with an unrecognised flag and reports unreadable references without a traceback. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 13:07:33 +10:00
saphidandClaude Opus 5.5	016d2b8c2d	fix(tracking): address independent review of the pulse experiment - Watch for a second capture directory on every poll; stop and remove every directory that appeared, and fail loudly if an eye image can't be deleted. - Start the worker pool inside the cleanup block. - Flat patches no longer rank first (zero-power SNR is 0, not infinity). - Align eyes to the truly nearest frame. - Keep patch grids as float arrays (a 300 s run no longer needs ~0.4 GB). - heart-check: tolerate unusual flags, close the Health archive, give a clear error when export.xml is missing, and build the lookup index once. Found by a SWE-2 Max read-only review. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 12:59:13 +10:00
saphidandClaude Opus 5.5	42ec68ed51	fix(tracking): reduce eye images while capturing, with a backlog cap The capture tool's stdout is block-buffered, so waiting for its directory name left every image on disk until the capture ended (3,554 PNGs in a 20 s run on the Frame). Detect the new capture directory instead, decode in three worker processes, and stop the capture if more than 900 images wait. On the Frame a 30 s run now peaks at 7 images on disk. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 12:44:51 +10:00
saphidandClaude Opus 5.5	fa49fab5bf	feat(tracking): experimental eye-camera pulse estimate and heart-rate comparison tool Adds 'pulse', which captures the IR eye cameras through SteamVR's own eyetracking --calib mode, reduces each image to patch averages and deletes it immediately, then estimates pulse from skin brightness. Adds heart-check.py to show OSC readings live and compare recordings with an Apple Health export or CSV, and a synthetic Mac BLE strap for relay tests. Part of #27 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-09-29 12:15:05 +10:00
saphid	ce9e476ec7	feat(tracking): add local OpenXR OSC and BlueZ heart-rate tools	2026-09-28 22:33:02 +10:00