diff --git a/dashboard/src/vms.rs b/dashboard/src/vms.rs
index 1c1513b8cf20b252851939307f4f202000ec484a..a1c311e6cad72aea7683183be64379dd278e3274 100644
--- a/dashboard/src/vms.rs
+++ b/dashboard/src/vms.rs
@@ -34,12 +34,29 @@ pub async fn console(request: Request, name: &str, serial: bool) -> Result<Respo
         .map_err(|_| Error::new(400, "Open the screen from the VM page."))?
         .max_message_size(1024 * 1024)
         .max_frame_size(1024 * 1024);
-    let target = json!({"operation":if serial { "vm.serial" } else { "vm.console" },"payload":{"name":name}});
+    let name = name.to_owned();
     Ok(upgrade
         .protocols(["binary"])
         .on_upgrade(move |mut socket| async move {
-            match host::open(target).await {
-                Ok((_, stream)) => bridge(socket, stream).await,
+            let stream = async {
+                if serial {
+                    return host::open(json!({"operation":"vm.serial","payload":{"name":name}}))
+                        .await
+                        .map(|(_, stream)| stream);
+                }
+                let mut stream = tokio::net::UnixStream::connect(env(
+                    "STUDIO_VM_SCREEN_SOCKET",
+                    "/run/studio-vm-screen/screen.sock",
+                ))
+                .await?;
+                stream
+                    .write_all(format!("{}\n", json!({"name":name})).as_bytes())
+                    .await?;
+                Ok(stream)
+            }
+            .await;
+            match stream {
+                Ok(stream) => bridge(socket, stream).await,
                 Err(error) => {
                     let reason = if error.message.len() <= 120 {
                         error.message
@@ -89,9 +106,9 @@ async fn bridge(socket: WebSocket, stream: tokio::net::UnixStream) {
         while let Some(Ok(message)) = receive.next().await {
             match message {
                 Message::Binary(data) => write.write_all(&data).await?,
+                Message::Text(data) => write.write_all(data.as_bytes()).await?,
                 Message::Close(_) => break,
                 Message::Ping(_) | Message::Pong(_) => {}
-                _ => break,
             }
         }
         Ok::<_, std::io::Error>(())
diff --git a/dashboard/vite.config.ts b/dashboard/vite.config.ts
index 54d16d109b20c762382ddba2ac19e9ed2adab4ad..8ecb5ec28d49272e8de4dd00d5e06168e732777b 100644
--- a/dashboard/vite.config.ts
+++ b/dashboard/vite.config.ts
@@ -1,9 +1,12 @@
 import { defineConfig } from "vite";
 import solid from "vite-plugin-solid";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
 
 export default defineConfig({
   root: "web",
   plugins: [solid()],
+  resolve: { alias: { "@novnc/keyboard": resolve(dirname(createRequire(import.meta.url).resolve("@novnc/novnc")), "input/keyboard.js") } },
   build: { outDir: "../dist", emptyOutDir: true },
   server: {
     host: true,
diff --git a/dashboard/web/components/VMConsole.tsx b/dashboard/web/components/VMConsole.tsx
index ef1aa59401aeea4cd5156dff7a7d9d538439d7bd..09413ba5b00acc3f8d0136f1a404ef4106368a0b 100644
--- a/dashboard/web/components/VMConsole.tsx
+++ b/dashboard/web/components/VMConsole.tsx
@@ -5,56 +5,200 @@ import Keyboard from "lucide-solid/icons/keyboard";
 import Clipboard from "lucide-solid/icons/clipboard";
 import Maximize from "lucide-solid/icons/maximize";
 import RefreshCw from "lucide-solid/icons/refresh-cw";
+import RemoteKeyboard from "@novnc/keyboard";
 
 export function VMConsole(props: { name: string; enabled: boolean; active: boolean; toolbar: JSX.Element; content: (toolbar: HTMLDivElement) => JSX.Element }) {
   const enabled = createMemo(() => props.enabled);
   let attempt = 0;
-  let screen!: HTMLDivElement;
+  let video!: HTMLVideoElement;
+  let cursorImage!: HTMLImageElement;
+  let cursorInvert!: HTMLImageElement;
   let panel!: HTMLDivElement;
-  let connection: import("@novnc/novnc").default | undefined;
+  let input: RTCDataChannel | undefined;
+  let disconnect = () => {};
+  let width = 0;
+  let height = 0;
+  let buttons = 0;
   let disposed = false;
+  let cursorFrames: { image: string; invert?: string; duration: number }[] = [];
+  let cursorFrame = 0;
+  let cursorTimer: number | undefined;
+  let cursorX = 0;
+  let cursorY = 0;
+  let pointerX = 0;
+  let pointerY = 0;
+  let cursorInside = false;
+  let cursorVisible = true;
+  const drawCursor = () => {
+    const frame = cursorFrames[cursorFrame];
+    const overlay = !!frame?.invert && cursorInside && cursorVisible;
+    cursorImage.style.display = cursorInvert.style.display = overlay ? "block" : "none";
+    if (!frame || !cursorVisible) { video.style.cursor = cursorVisible ? "default" : "none"; return; }
+    video.style.cursor = frame.invert ? (cursorInside ? "none" : "default") : `url(${frame.image}) ${cursorX} ${cursorY}, default`;
+    if (overlay) {
+      cursorImage.src = frame.image;
+      cursorInvert.src = frame.invert!;
+      cursorImage.style.transform = cursorInvert.style.transform = `translate(${pointerX - cursorX}px, ${pointerY - cursorY}px)`;
+    }
+  };
+  const animateCursor = () => {
+    const frame = cursorFrames[cursorFrame];
+    if (!frame) return;
+    cursorTimer = window.setTimeout(() => {
+      cursorFrame = (cursorFrame + 1) % cursorFrames.length;
+      drawCursor();
+      animateCursor();
+    }, frame.duration);
+  };
   const [state, setState] = createSignal<"Connecting…" | "Connected" | "Disconnected">("Connecting…");
   const connected = () => state() === "Connected";
   const [problem, setProblem] = createSignal("");
   const [clipboard, setClipboard] = createSignal("");
   const [showClipboard, setShowClipboard] = createSignal(false);
   const [tools, setTools] = createSignal<HTMLDivElement>();
+  const send = (message: object) => { if (input?.readyState === "open") input.send(JSON.stringify(message)); };
+  const release = () => { buttons = 0; send({ type: "release" }); };
   const connect = async () => {
     const current = ++attempt;
-    const previous = connection;
-    connection = undefined;
-    previous?.disconnect();
+    disconnect();
+    input = undefined;
     setProblem("");
     setState("Connecting…");
     try {
-      const { default: RFB } = await import("@novnc/novnc");
       if (disposed || !enabled() || current !== attempt) return;
+      if (!window.RTCPeerConnection) {
+        setProblem("This browser cannot stream VM screens. Open it in a current browser.");
+        setState("Disconnected");
+        return;
+      }
       const url = new URL(`/api/vms/${encodeURIComponent(props.name)}/console`, location.href);
       url.protocol = location.protocol === "https:" ? "wss:" : "ws:";
-      const rfb = new RFB(screen, url.href, { shared: true, wsProtocols: ["binary"] });
-      connection = rfb;
-      rfb.scaleViewport = true;
-      rfb.background = "#101014";
-      rfb.addEventListener("connect", () => {
-        if (connection !== rfb) return;
+      const socket = new WebSocket(url.href, ["binary"]);
+      socket.binaryType = "arraybuffer";
+      const keyboard = new RemoteKeyboard(video);
+      const focus = () => { if (input?.readyState === "open") keyboard.grab(); };
+      const blur = () => { keyboard.ungrab(); release(); };
+      video.addEventListener("focus", focus);
+      video.addEventListener("blur", blur);
+      let peer: RTCPeerConnection | undefined;
+      let pending = "";
+      let messages = Promise.resolve();
+      const decoder = new TextDecoder();
+      const candidates: RTCIceCandidateInit[] = [];
+      const signal = (message: object) => socket.send(JSON.stringify(message) + "\n");
+      const fail = (message: string) => {
+        if (current !== attempt || disposed) return;
+        setState("Disconnected");
+        setProblem(message);
+        disconnect();
+      };
+      const timeout = window.setTimeout(() => fail("The screen couldn't connect. Reconnect to try again."), 20000);
+      disconnect = () => {
+        clearTimeout(timeout);
+        blur();
+        video.removeEventListener("focus", focus);
+        video.removeEventListener("blur", blur);
+        socket.onclose = null;
+        socket.close();
+        peer?.close();
+        video.onplaying = null;
+        video.srcObject = null;
+        clearTimeout(cursorTimer);
+        cursorFrames = [];
+        cursorFrame = 0;
+        cursorVisible = true;
+        cursorImage.style.display = cursorInvert.style.display = "none";
+        video.style.cursor = "default";
+      };
+      socket.onclose = () => fail("The screen disconnected. Check that the VM is running, then reconnect.");
+      socket.onerror = () => fail("Unable to connect the screen. Reconnect to try again.");
+      socket.onmessage = (event: MessageEvent<ArrayBuffer>) => {
+        pending += decoder.decode(event.data, { stream: true });
+        if (pending.length > 262144) { fail("The screen connection stopped. Reconnect to try again."); return; }
+        let end: number;
+        while ((end = pending.indexOf("\n")) !== -1) {
+          const line = pending.slice(0, end);
+          pending = pending.slice(end + 1);
+          messages = messages.then(async () => {
+            if (current !== attempt || disposed) return;
+            const message = JSON.parse(line);
+            if (message.type === "ready") {
+              peer = new RTCPeerConnection({ iceServers: message.iceServers });
+              const transceiver = peer.addTransceiver("video", { direction: "recvonly" });
+              const codecs = RTCRtpReceiver.getCapabilities("video")?.codecs.filter((codec) => codec.mimeType === "video/H264");
+              if (codecs?.length) transceiver.setCodecPreferences(codecs);
+              input = peer.createDataChannel("input");
+              keyboard.onkeyevent = (key, _code, down) => send({ type: "key", key, down });
+              input.onopen = () => { if (document.activeElement === video) focus(); };
+              peer.onicecandidate = ({ candidate }) => { if (candidate) signal({ type: "candidate", ...candidate.toJSON() }); };
+              peer.onconnectionstatechange = () => {
+                if (peer?.connectionState === "failed" || peer?.connectionState === "disconnected") {
+                  fail("The screen disconnected. Reconnect to try again.");
+                }
+              };
+              peer.ontrack = ({ track }) => {
+                video.srcObject = new MediaStream([track]);
+                void video.play().catch(() => {
+                  if (current === attempt && video.srcObject) fail("The browser couldn't play the screen. Reconnect to try again.");
+                });
+              };
+              await peer.setLocalDescription(await peer.createOffer());
+              signal({ type: "offer", sdp: peer.localDescription!.sdp });
+            } else if (message.type === "answer" && peer) {
+              await peer.setRemoteDescription({ type: "answer", sdp: message.sdp });
+              for (const candidate of candidates.splice(0)) await peer.addIceCandidate(candidate);
+            } else if (message.type === "candidate") {
+              if (peer?.remoteDescription) await peer.addIceCandidate(message);
+              else candidates.push(message);
+            } else if (message.type === "display") {
+              width = message.width;
+              height = message.height;
+              video.dataset.encoder = message.encoder;
+              video.dataset.source = message.source ?? "qemu";
+            } else if (message.type === "cursor") {
+              if (message.frame === 0) {
+                clearTimeout(cursorTimer);
+                cursorFrames = [];
+                cursorFrame = 0;
+                cursorX = message.x;
+                cursorY = message.y;
+                if (message.source !== "guest") cursorVisible = !!message.fallback || (!!message.width && !!message.height);
+                video.dataset.cursorSource = message.source;
+              }
+              if (!message.image) { drawCursor(); return; }
+              for (const url of [message.image, message.invert].filter(Boolean)) {
+                const image = new Image();
+                image.src = url;
+                await image.decode();
+              }
+              if (current !== attempt || disposed) return;
+              cursorFrames.push({ image: message.image, invert: message.invert, duration: message.duration });
+              if (message.frame === 0) drawCursor();
+              if (cursorFrames.length === message.frames && message.frames > 1) animateCursor();
+            } else if (message.type === "cursor-position") {
+              cursorVisible = message.visible;
+              drawCursor();
+            } else if (message.type === "clipboard") setClipboard(message.text);
+            else if (message.type === "error") {
+              if (message.fatal) fail(message.message);
+              else setProblem(message.message);
+            }
+          }).catch((failure) => {
+            console.error("VM screen connection", failure);
+            fail("The browser couldn't connect the screen. Reconnect to try again.");
+          });
+        }
+      };
+      video.onplaying = () => {
+        if (current !== attempt || disposed) return;
+        clearTimeout(timeout);
         setState("Connected");
-      });
-      rfb.addEventListener("disconnect", () => {
-        if (connection !== rfb || disposed) return;
-        setState("Disconnected");
-        setProblem("The screen disconnected. Check that the VM is running, then reconnect.");
-      });
-      rfb.addEventListener("credentialsrequired", () => {
-        if (connection !== rfb || disposed) return;
-        setProblem("This screen requires a VNC password. Remove it in the VM's display settings, then reconnect.");
-        rfb.disconnect();
-      });
-      rfb.addEventListener("clipboard", (event: Event) => {
-        if (connection !== rfb || disposed) return;
-        setClipboard((event as CustomEvent<{ text: string }>).detail.text);
-      });
+        if (props.active) video.focus();
+      };
     } catch (failure) {
-      setProblem(`Unable to connect. ${reason(failure)}`);
+      console.error("VM screen connection", failure);
+      disconnect();
+      setProblem("The browser couldn't connect the screen. Reconnect to try again.");
       setState("Disconnected");
     }
   };
@@ -62,21 +206,38 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
     if (enabled()) void connect();
     else {
       attempt++;
-      const previous = connection;
-      connection = undefined;
-      previous?.disconnect();
+      disconnect();
+      input = undefined;
       setState("Disconnected");
       setProblem("");
     }
   });
-  createEffect(() => { if (props.active && connected()) connection?.focus(); });
-  onCleanup(() => { disposed = true; connection?.disconnect(); });
+  createEffect(() => { if (props.active && connected()) video.focus(); else release(); });
+  onCleanup(() => { disposed = true; disconnect(); });
+  const pointer = (event: PointerEvent | WheelEvent, mask = buttons) => {
+    if (!connected() || !width || !height) return;
+    const rect = video.getBoundingClientRect();
+    const scale = Math.min(rect.width / width, rect.height / height);
+    const x = Math.floor((event.clientX - rect.left - (rect.width - width * scale) / 2) / scale);
+    const y = Math.floor((event.clientY - rect.top - (rect.height - height * scale) / 2) / scale);
+    pointerX = event.clientX;
+    pointerY = event.clientY;
+    cursorInside = x >= 0 && y >= 0 && x < width && y < height;
+    drawCursor();
+    if ((event.type === "pointerdown" || event.type === "wheel") && (x < 0 || y < 0 || x >= width || y >= height)) return false;
+    send({ type: "pointer", x, y, buttons: mask });
+    return true;
+  };
+  const ctrlAltDel = () => {
+    for (const key of [0xffe3, 0xffe9, 0xffff]) send({ type: "key", key, down: true });
+    for (const key of [0xffff, 0xffe9, 0xffe3]) send({ type: "key", key, down: false });
+  };
   return <div class="vm-console" ref={panel}>
     <div class="vm-console-toolbar" ref={setTools}>
       {props.toolbar}
       <Show when={props.active}>
       <VMMenu label="Input">
-        <button disabled={!connected()} onClick={() => connection?.sendCtrlAltDel()}><Keyboard size={14} aria-hidden="true" />Ctrl+Alt+Del</button>
+        <button disabled={!connected()} onClick={ctrlAltDel}><Keyboard size={14} aria-hidden="true" />Ctrl+Alt+Del</button>
         <button disabled={!connected()} onClick={() => setShowClipboard(!showClipboard())}><Clipboard size={14} aria-hidden="true" />Clipboard</button>
       </VMMenu>
       <VMMenu label="View">
@@ -93,12 +254,37 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         <label class="field">clipboard<textarea class="search" rows="3" value={clipboard()} onInput={(event) => setClipboard(event.currentTarget.value)} /></label>
         <span class="hint">Clipboard sharing requires support in the guest</span>
         <div class="row">
-          <button class="button small" disabled={!connected()} onClick={() => connection?.clipboardPasteFrom(clipboard())}>send text</button>
+          <button class="button small" disabled={!connected()} onClick={() => send({ type: "clipboard", text: clipboard() })}>send text</button>
           <button class="button small" onClick={() => navigator.clipboard.writeText(clipboard()).catch((failure) => setProblem(reason(failure)))}>copy text</button>
         </div>
       </div>
     </Show>
-    <div class="vm-console-screen" hidden={!props.active || !props.enabled} ref={screen} />
+    <div class="vm-console-screen" hidden={!props.active || !props.enabled}>
+      <video ref={video} autoplay muted playsinline tabindex="0" aria-label="VM screen"
+        onContextMenu={(event) => event.preventDefault()}
+        onPointerMove={pointer}
+        onPointerLeave={() => { cursorInside = false; drawCursor(); }}
+        onPointerDown={(event) => {
+          event.preventDefault();
+          const mask = buttons | (event.button === 0 ? 1 : event.button === 1 ? 2 : event.button === 2 ? 4 : 0);
+          if (!pointer(event, mask)) return;
+          buttons = mask;
+          video.focus(); video.setPointerCapture(event.pointerId);
+        }}
+        onPointerUp={(event) => {
+          buttons &= ~(event.button === 0 ? 1 : event.button === 1 ? 2 : event.button === 2 ? 4 : 0);
+          pointer(event);
+          if (!event.buttons && video.hasPointerCapture(event.pointerId)) video.releasePointerCapture(event.pointerId);
+        }}
+        onPointerCancel={release}
+        onWheel={(event) => {
+          event.preventDefault();
+          const mask = event.deltaY ? (event.deltaY < 0 ? 8 : 16) : event.deltaX < 0 ? 32 : 64;
+          pointer(event, buttons | mask); pointer(event);
+        }} />
+      <img ref={cursorImage} class="vm-cursor" alt="" aria-hidden="true" />
+      <img ref={cursorInvert} class="vm-cursor vm-cursor-invert" alt="" aria-hidden="true" />
+    </div>
     <Show when={tools()}>{(toolbar) => props.content(toolbar())}</Show>
     <Show when={props.active && !props.enabled}><div class="empty"><p>The VM is off. Start it from the Machine menu.</p></div></Show>
   </div>;
diff --git a/dashboard/web/pages/VMs.css b/dashboard/web/pages/VMs.css
index 67318279a9446b3b5054257dfe515414afcacdd1..955f7b44908478e7a7b47ba0e710670bc83ba728 100644
--- a/dashboard/web/pages/VMs.css
+++ b/dashboard/web/pages/VMs.css
@@ -94,6 +94,9 @@
 .vm-password { display: grid; gap: 6px; padding: 8px 10px; color: var(--muted); font-size: 11px; }
 .vm-password input { width: 26ch; min-width: 0; padding: 5px 6px; color: var(--text); font: 12px monospace; }
 .vm-console-screen { flex: 1; background: #101014; min-height: 0; }
+.vm-console-screen video { display: block; width: 100%; height: 100%; object-fit: contain; outline: none; touch-action: none; }
+.vm-cursor { display: none; position: fixed; left: 0; top: 0; pointer-events: none; }
+.vm-cursor-invert { mix-blend-mode: difference; }
 .vm-console-error { padding: 8px 12px; margin: 0; font-size: 12px; }
 .vm-clipboard { display: grid; gap: 8px; padding: 12px; }
 @media (max-width: 640px) {
diff --git a/dashboard/web/types/novnc.d.ts b/dashboard/web/types/novnc.d.ts
index 0d04aaa51d7a194701b748ce12c24e6b9e1e928d..2fe2d7b6e9923e621c48592ed3fc8e3bd7fcbb17 100644
--- a/dashboard/web/types/novnc.d.ts
+++ b/dashboard/web/types/novnc.d.ts
@@ -1,12 +1,8 @@
-declare module "@novnc/novnc" {
-  export default class RFB extends EventTarget {
-    constructor(target: HTMLElement, url: string, options?: { shared?: boolean; wsProtocols?: string[] });
-    scaleViewport: boolean;
-    resizeSession: boolean;
-    background: string;
-    disconnect(): void;
-    focus(): void;
-    sendCtrlAltDel(): void;
-    clipboardPasteFrom(text: string): void;
+declare module "@novnc/keyboard" {
+  export default class Keyboard {
+    constructor(target: HTMLElement);
+    onkeyevent: (keysym: number, code: string, down: boolean) => void;
+    grab(): void;
+    ungrab(): void;
   }
 }
diff --git a/guest/.gitignore b/guest/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..567609b1234a9b8806c5a05da6c866e480aa148d
--- /dev/null
+++ b/guest/.gitignore
@@ -0,0 +1 @@
+build/
diff --git a/guest/DESIGN.md b/guest/DESIGN.md
new file mode 100644
index 0000000000000000000000000000000000000000..b4b773662e9bc1bd6b2e9d7923876d954843d84d
--- /dev/null
+++ b/guest/DESIGN.md
@@ -0,0 +1,25 @@
+# Guest cursor stream
+
+The executable is freestanding C99. `cursor.c` contains pixel conversion and dirty-rectangle detection; `windows.c` owns Win32 capture and transport. Zig supplies the cross compiler and Windows headers, with no Zig or C runtime in the executable. x86 and x64 target Windows 7; ARM64 targets Windows 10. PE subsystem versions and imported DLLs are checked by `python3 guest/test.py`. Runtime validation currently uses Windows 10, not a Windows 7 fixture.
+
+Build with `python3 guest/build.py --arch x86_64` (also `x86` and `aarch64`). In an elevated PowerShell session inside the logged-in administrator's desktop, run `./install.ps1 -Binary ./build/snowglobe-guest-x86_64.exe`. The installer uses Task Scheduler COM APIs available to PowerShell 2, installs into protected Program Files, and starts an elevated task at that user's logon. `-Remove` removes that task and executable. Elevation is required by the VirtIO serial driver's device ACL; capture must run in the interactive session, not session 0. The guest needs a compatible VirtIO serial driver and the channel named in `protocol.json`. A standard-user launcher requires a privileged handle broker; it is not part of this first backend.
+
+`BitBlt` copies the primary desktop into a CPU DIB without drawing the cursor. RGB comparisons ignore the unused fourth byte. Unchanged pixels produce no screen packets; changed pixels produce one bounding rectangle. Cursor polling runs every 8 ms; screen capture runs at most 30 Hz. The host's existing encoder supplies WebRTC video. Secure desktops, RDP sessions that differ from the physical console, and capture failures return the viewer to QEMU capture.
+
+`GetCursorInfo` supplies the shape, visibility, and observed position. `GetIconInfo` and black/white `DrawIconEx` renders recover RGBA and binary XOR planes, including colored XOR. Nonbinary color XOR and unsupported cursor sizes explicitly fall back to the browser's default cursor, preserving video. Animation timing uses the optional `GetCursorFrameInfo` user32 export, resolved by name. Missing or unusable animation metadata falls back to a static frame. Animation starts a browser-local clock; Windows does not expose the current animation phase through this interface. Ordinary shapes use the browser cursor; XOR shapes use local layers with difference blending. Neither follows streamed positions.
+
+## Wire format
+
+`protocol.json` is the only home for packet IDs, field order, channel name, flags, and bounds. The build generates its private C header; the host reads that same schema. Each packet begins with the four-byte magic, a big-endian uint32 type, and a big-endian uint32 payload length. Fields listed in the schema are big-endian uint32 values.
+
+- Screen: tightly packed top-down BGRx rectangle rows following the listed fields. A connection, refresh request, resize, or resumed capture starts with a full frame.
+- Cursor: each frame is a uint32 duration in milliseconds, width × height RGBA pixels, then one XOR bit mask byte per pixel. The schema assigns the channel bits; each selected channel inverts the underlying browser pixel. Zero dimensions and zero frames mean unsupported shape/default cursor.
+- Pointer: coordinates use signed two's-complement values in the uint32 fields. These are observations, not a cursor hit map.
+- Suspend and heartbeat have empty payloads. A heartbeat arrives at least once per second; four seconds without a packet falls back to QEMU.
+- Refresh is the only host-to-guest message and has an empty payload. The agent validates the entire request. The host requests it on every connection, including reconnects that reuse an open guest port.
+
+The host broker validates a running VM's libvirt-owned channel path. One guest reader fans out to that VM's viewers. Guest bytes are untrusted and bounded before decoding; viewer buffers are bounded independently. No guest network listener or GPU is required.
+
+## Later backends and surfaces
+
+Keep the core independent of an OS and add real platform implementations when their capture and cursor APIs can be tested. X11 cursor notifications, Wayland's compositor/portal permissions, and macOS capture permissions need separate backend decisions, not empty adapters. The next Windows experiment can enumerate HWNDs and attach full surfaces, geometry, stacking, and dirty regions to this transport; occlusion, layered windows, protected content, DPI, and secure desktops need explicit behavior. A window rectangle does not imply a uniform cursor: application hit testing can change the shape anywhere inside it. Region prediction should be based on validated application information or observations with invalidation, not fabricated bounding boxes.
diff --git a/guest/build.py b/guest/build.py
new file mode 100644
index 0000000000000000000000000000000000000000..397469e76e8110bd00a21b60787668bfd74ad7c5
--- /dev/null
+++ b/guest/build.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+import argparse
+import json
+from pathlib import Path
+import re
+import subprocess
+
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--arch", choices=["x86", "x86_64", "aarch64"], default="x86_64")
+parser.add_argument("--output", type=Path, default=Path(__file__).parent / "build")
+args = parser.parse_args()
+source = Path(__file__).resolve().parent
+args.output.mkdir(parents=True, exist_ok=True)
+schema = json.loads((source / "protocol.json").read_text())
+header = ["#ifndef SG_PROTOCOL_H", "#define SG_PROTOCOL_H"]
+header += [f"#define SG_MAX_{key.upper()} {value}u" for key, value in schema["limits"].items()]
+header += [f"#define SG_XOR_{key.upper()} {value}u" for key, value in schema["xor_bits"].items()]
+for name, packet in schema["packets"].items():
+    header += [f"#define SG_{name.upper()} {packet['id']}u", f"#define SG_{name.upper()}_WORDS {len(packet['fields'])}u"]
+    header += [f"#define SG_{name.upper()}_{field.upper()} {index}u" for index, field in enumerate(packet["fields"])]
+header += [f'#define SG_MAGIC "{schema["magic"]}"', f'#define SG_CHANNEL L"{schema["channel"]}"', "#endif"]
+(args.output / "protocol.h").write_text("\n".join(header) + "\n")
+subsystem = "10.0" if args.arch == "aarch64" else "6.1"
+environment = subprocess.check_output(["zig", "env"], text=True)
+match = re.search(r'\.lib_dir\s*=\s*"([^"]+)"', environment)
+library = Path(match[1] if match else json.loads(environment)["lib_dir"])
+subprocess.run([
+    "zig", "cc", "-target", args.arch + ("-windows.win10-gnu" if args.arch == "aarch64" else "-windows.win7-gnu"), "-std=c99", "-Os", "-Wall", "-Wextra", "-Werror",
+    "-ffreestanding", "-fno-stack-protector", "-nostdlib", "-D_WIN32_WINNT=0x0601", "-DWINVER=0x0601",
+    "-isystem", str(library / "libc/include/any-windows-any"),
+    "-I", str(args.output), str(source / "cursor.c"), str(source / "windows.c"),
+    "-lkernel32", "-luser32", "-lgdi32", "-Wl,--entry,mainCRTStartup", "-Wl,--subsystem,windows",
+    "-Wl,--major-subsystem-version," + subsystem.split(".")[0], "-Wl,--minor-subsystem-version," + subsystem.split(".")[1],
+    "-o", str(args.output / ("snowglobe-guest-" + args.arch + ".exe")),
+], check=True)
diff --git a/guest/cursor.c b/guest/cursor.c
new file mode 100644
index 0000000000000000000000000000000000000000..2f510494056d72d70cc81bd76cb5fd9d3675c78c
--- /dev/null
+++ b/guest/cursor.c
@@ -0,0 +1,70 @@
+#include "cursor.h"
+
+void sg_word(uint8_t *bytes, uint32_t value) {
+    bytes[0] = (uint8_t)(value >> 24);
+    bytes[1] = (uint8_t)(value >> 16);
+    bytes[2] = (uint8_t)(value >> 8);
+    bytes[3] = (uint8_t)value;
+}
+
+int sg_difference(const uint8_t *before, const uint8_t *after, uint32_t width, uint32_t height, struct sg_rect *rect) {
+    uint32_t x, y, left = width, top = height, right = 0, bottom = 0;
+    if (!width || !height || width > SG_MAX_DIMENSION || height > SG_MAX_DIMENSION || width * height > SG_MAX_PIXELS) return -1;
+    for (y = 0; y < height; ++y) {
+        for (x = 0; x < width; ++x) {
+            size_t pixel = ((size_t)y * width + x) * 4;
+            if (before[pixel] == after[pixel] && before[pixel + 1] == after[pixel + 1] && before[pixel + 2] == after[pixel + 2]) continue;
+            if (x < left) left = x;
+            if (y < top) top = y;
+            if (x >= right) right = x + 1;
+            if (y >= bottom) bottom = y + 1;
+        }
+    }
+    if (left == width) return 0;
+    rect->x = left; rect->y = top; rect->width = right - left; rect->height = bottom - top;
+    return 1;
+}
+
+int sg_rgba(const uint8_t *black, const uint8_t *white, uint8_t *rgba, uint8_t *invert, size_t pixels) {
+    size_t i;
+    for (i = 0; i < pixels; ++i) {
+        int difference = (int)white[i * 4] - black[i * 4];
+        int green = (int)white[i * 4 + 1] - black[i * 4 + 1];
+        int red = (int)white[i * 4 + 2] - black[i * 4 + 2];
+        unsigned alpha;
+        invert[i] = 0;
+        if (difference < 0 || green < 0 || red < 0 || green - difference > 1 || difference - green > 1 || red - difference > 1 || difference - red > 1) {
+            unsigned channel;
+            for (channel = 0; channel < 3; ++channel) {
+                uint8_t value = black[i * 4 + channel];
+                if ((value != 0 && value != 255) || (value ^ white[i * 4 + channel]) != 255) return 0;
+            }
+            invert[i] = (black[i * 4 + 2] ? SG_XOR_RED : 0) | (black[i * 4 + 1] ? SG_XOR_GREEN : 0) | (black[i * 4] ? SG_XOR_BLUE : 0);
+            alpha = 0;
+        } else alpha = 255u - (unsigned)((difference + green + red + 1) / 3);
+        rgba[i * 4 + 3] = (uint8_t)alpha;
+        {
+            unsigned channel;
+            for (channel = 0; channel < 3; ++channel) {
+                unsigned value = alpha ? (black[i * 4 + 2 - channel] * 255u + alpha / 2) / alpha : 0;
+                rgba[i * 4 + channel] = (uint8_t)(value > 255 ? 255 : value);
+            }
+        }
+    }
+    return 1;
+}
+
+void *memcpy(void *destination, const void *source, size_t length) {
+    uint8_t *out = destination;
+    const uint8_t *in = source;
+    size_t i;
+    for (i = 0; i < length; ++i) out[i] = in[i];
+    return destination;
+}
+
+void *memset(void *destination, int value, size_t length) {
+    uint8_t *out = destination;
+    size_t i;
+    for (i = 0; i < length; ++i) out[i] = (uint8_t)value;
+    return destination;
+}
diff --git a/guest/cursor.h b/guest/cursor.h
new file mode 100644
index 0000000000000000000000000000000000000000..c83bd9ee4700f3b3bcaa603a7f1842bdb32bf8aa
--- /dev/null
+++ b/guest/cursor.h
@@ -0,0 +1,11 @@
+#ifndef SG_CURSOR_H
+#define SG_CURSOR_H
+#include <stddef.h>
+#include <stdint.h>
+#include "protocol.h"
+
+struct sg_rect { uint32_t x, y, width, height; };
+int sg_difference(const uint8_t *before, const uint8_t *after, uint32_t width, uint32_t height, struct sg_rect *rect);
+int sg_rgba(const uint8_t *black, const uint8_t *white, uint8_t *rgba, uint8_t *invert, size_t pixels);
+void sg_word(uint8_t *bytes, uint32_t value);
+#endif
diff --git a/guest/install.ps1 b/guest/install.ps1
new file mode 100644
index 0000000000000000000000000000000000000000..de3defa0758f32fe3042faf9332c864cc1170255
--- /dev/null
+++ b/guest/install.ps1
@@ -0,0 +1,38 @@
+param([string]$Binary, [switch]$Remove)
+$ErrorActionPreference = 'Stop'
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principal = New-Object Security.Principal.WindowsPrincipal($identity)
+if (!$principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Run this installer as administrator to access the VirtIO serial port.' }
+if ((Get-WmiObject Win32_ComputerSystem).UserName -ne $identity.Name) { throw 'Run this installer from the signed-in administrator account on the VM desktop.' }
+$directory = Join-Path $env:ProgramFiles 'Snowglobe\Guest'
+$destination = Join-Path $directory 'snowglobe-guest.exe'
+$service = New-Object -ComObject Schedule.Service
+$service.Connect()
+$folder = $service.GetFolder('\')
+$name = 'SnowglobeGuest-' + $identity.User.Value
+if ($Remove) {
+    try { $folder.GetTask($name).Stop(0); $folder.DeleteTask($name, 0) } catch { if (Test-Path $destination) { throw } }
+    $used = $false
+    foreach ($task in $folder.GetTasks(1)) {
+        foreach ($action in $task.Definition.Actions) { if ($action.Path -eq $destination) { $used = $true } }
+    }
+    if (!$used -and (Test-Path $destination)) { Remove-Item $destination }
+    return
+}
+if (!$Binary) { throw 'Pass the path to the guest executable with -Binary.' }
+Get-WmiObject Win32_Process -Filter "name='snowglobe-guest.exe'" | Where-Object { $_.ExecutablePath -eq $destination } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
+New-Item -ItemType Directory -Path $directory -Force | Out-Null
+Copy-Item -LiteralPath $Binary -Destination $destination -Force
+$task = $service.NewTask(0)
+$task.Principal.UserId = $identity.User.Value
+$task.Principal.LogonType = 3
+$task.Principal.RunLevel = 1
+$task.Settings.ExecutionTimeLimit = 'PT0S'
+$task.Settings.DisallowStartIfOnBatteries = $false
+$task.Settings.StopIfGoingOnBatteries = $false
+$trigger = $task.Triggers.Create(9)
+$trigger.UserId = $identity.User.Value
+$action = $task.Actions.Create(0)
+$action.Path = $destination
+$registered = $folder.RegisterTaskDefinition($name, $task, 6, $identity.User.Value, $null, 3, $null)
+$registered.Run($null) | Out-Null
diff --git a/guest/protocol.json b/guest/protocol.json
new file mode 100644
index 0000000000000000000000000000000000000000..902cd72501c51dba5c7be61dc677e5904cc3445f
--- /dev/null
+++ b/guest/protocol.json
@@ -0,0 +1,14 @@
+{
+  "magic": "SGV1",
+  "channel": "net.paperclover.snowglobe.0",
+  "xor_bits": {"red": 1, "green": 2, "blue": 4},
+  "limits": {"dimension": 4096, "pixels": 8294400, "cursor_size": 128, "cursor_frames": 64, "packet_bytes": 33554456},
+  "packets": {
+    "screen": {"id": 1, "fields": ["width", "height", "x", "y", "rect_width", "rect_height"]},
+    "cursor": {"id": 2, "fields": ["id", "width", "height", "hot_x", "hot_y", "frames"]},
+    "pointer": {"id": 3, "fields": ["id", "x", "y", "visible"]},
+    "suspend": {"id": 4, "fields": []},
+    "refresh": {"id": 5, "fields": []},
+    "heartbeat": {"id": 6, "fields": []}
+  }
+}
diff --git a/guest/test.py b/guest/test.py
new file mode 100644
index 0000000000000000000000000000000000000000..34a2c16195d593f9ec28c1fe58eddbe53e4f3568
--- /dev/null
+++ b/guest/test.py
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+from pathlib import Path
+import struct
+import subprocess
+import tempfile
+
+source = Path(__file__).resolve().parent
+for arch in ['x86', 'x86_64', 'aarch64']:
+    subprocess.run(['python3', str(source / 'build.py'), '--arch', arch], check=True)
+    data = (source / 'build' / ('snowglobe-guest-' + arch + '.exe')).read_bytes()
+    pe = struct.unpack_from('<I', data, 60)[0]
+    assert data[pe:pe + 4] == b'PE\0\0'
+    machine, sections, _, _, _, optional_size = struct.unpack_from('<HHIIIH', data, pe + 4)
+    optional = pe + 24
+    assert machine == {'x86': 0x14c, 'x86_64': 0x8664, 'aarch64': 0xaa64}[arch]
+    assert struct.unpack_from('<HH', data, optional + 48) == ((10, 0) if arch == 'aarch64' else (6, 1))
+    table = optional + optional_size
+    def offset(rva):
+        for index in range(sections):
+            size, start, raw_size, raw = struct.unpack_from('<IIII', data, table + 40 * index + 8)
+            if start <= rva < start + max(size, raw_size): return raw + rva - start
+        raise AssertionError('unmapped PE address')
+    directory = optional + (96 if arch == 'x86' else 112)
+    imports = offset(struct.unpack_from('<I', data, directory + 8)[0])
+    libraries = set()
+    while any(data[imports:imports + 20]):
+        name = offset(struct.unpack_from('<I', data, imports + 12)[0])
+        libraries.add(data[name:data.index(0, name)].decode().lower())
+        imports += 20
+    assert libraries == {'kernel32.dll', 'user32.dll', 'gdi32.dll'}, libraries
+    print(arch, len(data), 'bytes; system DLLs only; minimum subsystem verified')
+with tempfile.TemporaryDirectory() as temporary:
+    binary = Path(temporary) / 'cursor-tests'
+    subprocess.run(['cc', '-std=c99', '-Wall', '-Wextra', '-Werror', '-ffreestanding', '-fsanitize=address,undefined', '-I', str(source / 'build'), str(source / 'cursor.c'), str(source / 'tests.c'), '-o', str(binary)], check=True)
+    subprocess.run([str(binary)], check=True)
+print('cursor alpha, inversion, dirty rectangles, and bounds passed')
diff --git a/guest/tests.c b/guest/tests.c
new file mode 100644
index 0000000000000000000000000000000000000000..caa9e280bfdda40154d326fa1803ec28f3f0f33e
--- /dev/null
+++ b/guest/tests.c
@@ -0,0 +1,32 @@
+#include "cursor.h"
+#include <assert.h>
+
+int main(void) {
+    uint8_t before[4 * 4 * 3] = {0}, after[4 * 4 * 3] = {0};
+    struct sg_rect rect;
+    uint8_t black[] = {0,0,0,0, 255,255,255,0, 0,0,0,0, 20,40,60,0};
+    uint8_t white[] = {255,255,255,0, 0,0,0,0, 0,0,0,0, 147,167,187,0};
+    uint8_t rgba[16], invert[4], word[4];
+    assert(sg_difference(before, after, 4, 3, &rect) == 0);
+    after[3] = 255;
+    assert(sg_difference(before, after, 4, 3, &rect) == 0);
+    after[(1 * 4 + 1) * 4] = 1;
+    after[(2 * 4 + 3) * 4 + 2] = 2;
+    assert(sg_difference(before, after, 4, 3, &rect) == 1);
+    assert(rect.x == 1 && rect.y == 1 && rect.width == 3 && rect.height == 2);
+    assert(sg_difference(before, after, 0, 3, &rect) == -1);
+    assert(sg_difference(before, after, 65535, 65535, &rect) == -1);
+    assert(sg_rgba(black, white, rgba, invert, 4));
+    assert(rgba[3] == 0 && invert[0] == 0);
+    assert(rgba[7] == 0 && invert[1] == (SG_XOR_RED | SG_XOR_GREEN | SG_XOR_BLUE));
+    assert(rgba[11] == 255 && rgba[8] == 0 && invert[2] == 0);
+    assert(rgba[12] == 120 && rgba[13] == 80 && rgba[14] == 40 && rgba[15] == 128 && invert[3] == 0);
+    black[0] = 0; black[1] = 0; black[2] = 255;
+    white[0] = 255; white[1] = 255; white[2] = 0;
+    assert(sg_rgba(black, white, rgba, invert, 1) && invert[0] == SG_XOR_RED && rgba[3] == 0);
+    black[2] = 127; white[2] = 128;
+    assert(!sg_rgba(black, white, rgba, invert, 1));
+    sg_word(word, 0x12345678);
+    assert(word[0] == 0x12 && word[1] == 0x34 && word[2] == 0x56 && word[3] == 0x78);
+    return 0;
+}
diff --git a/guest/windows.c b/guest/windows.c
new file mode 100644
index 0000000000000000000000000000000000000000..bbf790c606b91b6b82c3aea5c932520023fd4c32
--- /dev/null
+++ b/guest/windows.c
@@ -0,0 +1,241 @@
+#define WIN32_LEAN_AND_MEAN
+#define UNICODE
+#define _UNICODE
+#include <windows.h>
+#include "cursor.h"
+
+typedef HCURSOR (WINAPI *cursor_frame_fn)(HCURSOR, DWORD, DWORD, DWORD *, DWORD *);
+static cursor_frame_fn cursor_frame;
+static HANDLE output;
+static HANDLE heap;
+static OVERLAPPED sending;
+
+static int write_bytes(const void *data, DWORD length) {
+    const uint8_t *bytes = data;
+    DWORD written;
+    while (length) {
+        ResetEvent(sending.hEvent);
+        if (!WriteFile(output, bytes, length, &written, &sending)) {
+            if (GetLastError() != ERROR_IO_PENDING) return 0;
+            if (WaitForSingleObject(sending.hEvent, 3000) != WAIT_OBJECT_0) {
+                CancelIo(output); WaitForSingleObject(sending.hEvent, INFINITE); return 0;
+            }
+        }
+        if (!GetOverlappedResult(output, &sending, &written, FALSE)) return 0;
+        if (!written) return 0;
+        bytes += written; length -= written;
+    }
+    return 1;
+}
+
+static int packet(uint32_t type, uint32_t length, const uint32_t *words, uint32_t count) {
+    uint8_t header[12], number[4];
+    uint32_t i;
+    header[0] = SG_MAGIC[0]; header[1] = SG_MAGIC[1]; header[2] = SG_MAGIC[2]; header[3] = SG_MAGIC[3];
+    sg_word(header + 4, type); sg_word(header + 8, length);
+    if (!write_bytes(header, sizeof(header))) return 0;
+    for (i = 0; i < count; ++i) {
+        sg_word(number, words[i]);
+        if (!write_bytes(number, sizeof(number))) return 0;
+    }
+    return 1;
+}
+
+static int capture_cursor(HCURSOR cursor, uint32_t id) {
+    ICONINFO icon = {0};
+    BITMAP bitmap;
+    BITMAPINFO info = {0};
+    HDC dc = NULL;
+    HBITMAP dib = NULL, previous = NULL;
+    uint8_t *bits = NULL, *black = NULL, *frames = NULL;
+    uint32_t width, height, count = 1, step, words[SG_CURSOR_WORDS] = {0};
+    DWORD rate = 6, total = 1;
+    size_t pixels, frame_bytes;
+    int success = -1;
+    if (!GetIconInfo(cursor, &icon)) return -1;
+    if (!GetObjectW(icon.hbmColor ? icon.hbmColor : icon.hbmMask, sizeof(bitmap), &bitmap)) goto done;
+    width = (uint32_t)bitmap.bmWidth;
+    height = (uint32_t)(icon.hbmColor ? bitmap.bmHeight : bitmap.bmHeight / 2);
+    if (!width || !height || width > SG_MAX_CURSOR_SIZE || height > SG_MAX_CURSOR_SIZE || icon.xHotspot >= width || icon.yHotspot >= height) goto done;
+    if (cursor_frame && cursor_frame(cursor, 0, 0, &rate, &total) && total > 1 && total <= SG_MAX_CURSOR_FRAMES) count = total;
+    pixels = (size_t)width * height;
+    frame_bytes = 4 + pixels * 5;
+    frames = HeapAlloc(heap, 0, frame_bytes * count);
+    black = HeapAlloc(heap, 0, pixels * 4);
+    dc = CreateCompatibleDC(NULL);
+    info.bmiHeader.biSize = sizeof(BITMAPINFOHEADER); info.bmiHeader.biWidth = (LONG)width;
+    info.bmiHeader.biHeight = -(LONG)height; info.bmiHeader.biPlanes = 1; info.bmiHeader.biBitCount = 32;
+    dib = CreateDIBSection(dc, &info, DIB_RGB_COLORS, (void **)&bits, NULL, 0);
+    if (!frames || !black || !dc || !dib) goto done;
+    previous = SelectObject(dc, dib);
+    for (step = 0; step < count; ++step) {
+        uint8_t *frame = frames + frame_bytes * step;
+        size_t i;
+        HCURSOR image = cursor;
+        rate = 6;
+        if (count > 1) {
+            image = cursor_frame(cursor, 0, step, &rate, &total);
+            if (!image || total != count || !rate || rate > 3600) { image = cursor; count = 1; rate = 6; }
+        }
+        sg_word(frame, (rate * 1000u + 30u) / 60u);
+        for (i = 0; i < pixels * 4; ++i) bits[i] = 0;
+        if (!DrawIconEx(dc, 0, 0, image, (int)width, (int)height, 0, NULL, DI_NORMAL)) goto done;
+        GdiFlush();
+        for (i = 0; i < pixels * 4; ++i) black[i] = bits[i];
+        for (i = 0; i < pixels * 4; ++i) bits[i] = 255;
+        if (!DrawIconEx(dc, 0, 0, image, (int)width, (int)height, 0, NULL, DI_NORMAL)) goto done;
+        GdiFlush();
+        if (!sg_rgba(black, bits, frame + 4, frame + 4 + pixels * 4, pixels)) goto done;
+    }
+    words[SG_CURSOR_ID] = id; words[SG_CURSOR_WIDTH] = width; words[SG_CURSOR_HEIGHT] = height;
+    words[SG_CURSOR_HOT_X] = icon.xHotspot; words[SG_CURSOR_HOT_Y] = icon.yHotspot; words[SG_CURSOR_FRAMES] = count;
+    success = packet(SG_CURSOR, SG_CURSOR_WORDS * 4 + (uint32_t)(frame_bytes * count), words, SG_CURSOR_WORDS) && write_bytes(frames, (DWORD)(frame_bytes * count));
+done:
+    if (previous) SelectObject(dc, previous);
+    if (dib) DeleteObject(dib);
+    if (dc) DeleteDC(dc);
+    if (icon.hbmColor) DeleteObject(icon.hbmColor);
+    if (icon.hbmMask) DeleteObject(icon.hbmMask);
+    if (black) HeapFree(heap, 0, black);
+    if (frames) HeapFree(heap, 0, frames);
+    return success;
+}
+
+static void stream(DWORD session) {
+    HDC screen = GetDC(NULL), dc = CreateCompatibleDC(screen);
+    HBITMAP dib = NULL, previous = NULL;
+    uint8_t *pixels = NULL, *before = NULL;
+    uint32_t width = 0, height = 0, id = 0;
+    HCURSOR last_cursor = NULL;
+    POINT last_point = {-1, -1};
+    DWORD last_flags = ~0u, captured = GetTickCount() - 34;
+    DWORD heartbeat = GetTickCount(), received = 0;
+    OVERLAPPED receiving = {0};
+    uint8_t request[12];
+    int pending = 0;
+    int suspended = 0, initial = 1;
+    receiving.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
+    if (!screen || !dc || !receiving.hEvent) goto done;
+    for (;;) {
+        if (session != WTSGetActiveConsoleSessionId()) goto done;
+        CURSORINFO cursor = {sizeof(CURSORINFO), 0, NULL, {0, 0}};
+        HDESK desktop;
+        WCHAR name[32];
+        DWORD length;
+        DWORD amount = 0;
+        if (!pending) {
+            ResetEvent(receiving.hEvent);
+            if (!ReadFile(output, request + received, (DWORD)sizeof(request) - received, &amount, &receiving)) {
+                if (GetLastError() != ERROR_IO_PENDING) goto done;
+                pending = 1;
+            } else if (!GetOverlappedResult(output, &receiving, &amount, FALSE)) goto done;
+        } else if (GetOverlappedResult(output, &receiving, &amount, FALSE)) pending = 0;
+        else if (GetLastError() != ERROR_IO_INCOMPLETE) goto done;
+        if (!pending) {
+            if (!amount) goto done;
+            received += amount;
+            if (received == sizeof(request)) {
+                uint8_t expected[12] = {SG_MAGIC[0], SG_MAGIC[1], SG_MAGIC[2], SG_MAGIC[3], 0,0,0,0, 0,0,0,0};
+                uint32_t i;
+                sg_word(expected + 4, SG_REFRESH);
+                for (i = 0; i < sizeof(request); ++i) if (request[i] != expected[i]) goto done;
+                received = 0; initial = 1; last_cursor = NULL; last_flags = ~0u;
+            }
+        }
+        if ((DWORD)(GetTickCount() - heartbeat) >= 1000) {
+            if (!packet(SG_HEARTBEAT, 0, NULL, 0)) goto done;
+            heartbeat = GetTickCount();
+        }
+        desktop = OpenInputDesktop(0, FALSE, DESKTOP_READOBJECTS);
+        int active = desktop && GetUserObjectInformationW(desktop, UOI_NAME, name, sizeof(name), &length) && name[0] == L'D' && name[1] == L'e' && name[2] == L'f' && name[3] == L'a' && name[4] == L'u' && name[5] == L'l' && name[6] == L't' && !name[7];
+        if (desktop) CloseDesktop(desktop);
+        if (!active || !GetCursorInfo(&cursor)) {
+            if (!suspended && !packet(SG_SUSPEND, 0, NULL, 0)) goto done;
+            suspended = 1; initial = 1; last_cursor = NULL; last_flags = ~0u;
+            Sleep(100); continue;
+        }
+        int changed = cursor.hCursor && cursor.hCursor != last_cursor;
+        if (changed) ++id;
+        if (changed || cursor.flags != last_flags || cursor.ptScreenPos.x != last_point.x || cursor.ptScreenPos.y != last_point.y) {
+            uint32_t words[SG_POINTER_WORDS] = {0};
+            words[SG_POINTER_ID] = id; words[SG_POINTER_X] = (uint32_t)cursor.ptScreenPos.x;
+            words[SG_POINTER_Y] = (uint32_t)cursor.ptScreenPos.y; words[SG_POINTER_VISIBLE] = (cursor.flags & CURSOR_SHOWING) ? 1 : 0;
+            if (!packet(SG_POINTER, sizeof(words), words, SG_POINTER_WORDS)) goto done;
+            last_flags = cursor.flags; last_point = cursor.ptScreenPos;
+        }
+        if (changed) {
+            int result = capture_cursor(cursor.hCursor, id);
+            if (!result) goto done;
+            if (result < 0) {
+                uint32_t words[SG_CURSOR_WORDS] = {0};
+                words[SG_CURSOR_ID] = id;
+                if (!packet(SG_CURSOR, sizeof(words), words, SG_CURSOR_WORDS)) goto done;
+            }
+            last_cursor = cursor.hCursor;
+        }
+        if ((DWORD)(GetTickCount() - captured) >= 33) {
+            uint32_t w = (uint32_t)GetSystemMetrics(SM_CXSCREEN), h = (uint32_t)GetSystemMetrics(SM_CYSCREEN), y;
+            struct sg_rect rect;
+            uint32_t words[SG_SCREEN_WORDS] = {0};
+            if (!w || !h || w > SG_MAX_DIMENSION || h > SG_MAX_DIMENSION || w * h > SG_MAX_PIXELS) goto done;
+            if (w != width || h != height) {
+                BITMAPINFO info = {0};
+                if (previous) { SelectObject(dc, previous); previous = NULL; }
+                if (dib) DeleteObject(dib);
+                if (before) HeapFree(heap, 0, before);
+                before = HeapAlloc(heap, 0, (size_t)w * h * 4);
+                info.bmiHeader.biSize = sizeof(BITMAPINFOHEADER); info.bmiHeader.biWidth = (LONG)w;
+                info.bmiHeader.biHeight = -(LONG)h; info.bmiHeader.biPlanes = 1; info.bmiHeader.biBitCount = 32;
+                dib = CreateDIBSection(dc, &info, DIB_RGB_COLORS, (void **)&pixels, NULL, 0);
+                if (!before || !dib) goto done;
+                previous = SelectObject(dc, dib); width = w; height = h; initial = 1;
+            }
+            if (!BitBlt(dc, 0, 0, (int)width, (int)height, screen, 0, 0, SRCCOPY | CAPTUREBLT)) {
+                if (!suspended && !packet(SG_SUSPEND, 0, NULL, 0)) goto done;
+                suspended = 1; initial = 1; Sleep(100); continue;
+            }
+            GdiFlush();
+            if (initial) { rect.x = 0; rect.y = 0; rect.width = width; rect.height = height; }
+            else if (!sg_difference(before, pixels, width, height, &rect)) { captured = GetTickCount(); Sleep(8); continue; }
+            words[SG_SCREEN_WIDTH] = width; words[SG_SCREEN_HEIGHT] = height;
+            words[SG_SCREEN_X] = rect.x; words[SG_SCREEN_Y] = rect.y;
+            words[SG_SCREEN_RECT_WIDTH] = rect.width; words[SG_SCREEN_RECT_HEIGHT] = rect.height;
+            if (!packet(SG_SCREEN, sizeof(words) + rect.width * rect.height * 4, words, SG_SCREEN_WORDS)) goto done;
+            for (y = rect.y; y < rect.y + rect.height; ++y) {
+                size_t offset = ((size_t)y * width + rect.x) * 4, i;
+                if (!write_bytes(pixels + offset, rect.width * 4)) goto done;
+                for (i = 0; i < rect.width * 4; ++i) before[offset + i] = pixels[offset + i];
+            }
+            initial = 0; suspended = 0; captured = GetTickCount();
+        }
+        Sleep(8);
+    }
+done:
+    CancelIo(output);
+    if (pending) WaitForSingleObject(receiving.hEvent, INFINITE);
+    if (receiving.hEvent) CloseHandle(receiving.hEvent);
+    if (previous) SelectObject(dc, previous);
+    if (dib) DeleteObject(dib);
+    if (before) HeapFree(heap, 0, before);
+    if (dc) DeleteDC(dc);
+    if (screen) ReleaseDC(NULL, screen);
+}
+
+void mainCRTStartup(void) {
+    FARPROC symbol;
+    DWORD session;
+    if (!ProcessIdToSessionId(GetCurrentProcessId(), &session)) ExitProcess(1);
+    heap = GetProcessHeap();
+    sending.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
+    if (!sending.hEvent) ExitProcess(1);
+    SetProcessDPIAware();
+    symbol = GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetCursorFrameInfo");
+    /* This optional user32 export supplies ANI step timing; static capture uses only documented APIs. */
+    cursor_frame = (cursor_frame_fn)symbol;
+    for (;;) {
+        if (session != WTSGetActiveConsoleSessionId()) { Sleep(1000); continue; }
+        output = CreateFileW(L"\\\\.\\Global\\" SG_CHANNEL, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL);
+        if (output != INVALID_HANDLE_VALUE) { stream(session); CloseHandle(output); }
+        Sleep(1000);
+    }
+}
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index cb84feef3249213a2b6f89910dca93eb5cc41fa8..2cdd4d20987c046d4571bc9fb1cd510d0f180dbc 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -6,9 +6,11 @@ let
   proxyToken = "/var/lib/studio/dashboard-proxy.token";
   hostTools = lib.fileset.toSource {
     root = ../.;
-    fileset = lib.fileset.unions [ ../tools/dashboard-host.py ../tools/vms.py ../tools/dashboard-run.py ../tools/release.py ];
+    fileset = lib.fileset.unions [ ../tools/dashboard-host.py ../tools/vms.py ../tools/dashboard-run.py ../tools/release.py ../guest/protocol.json ];
   };
   nativePkl = pkgs.callPackage ./pkl.nix { };
+  screenPython = pkgs.python3.withPackages (packages: [ packages.pygobject3 packages.gst-python ]);
+  screenPlugins = (with pkgs.gst_all_1; [ (lib.getLib gstreamer) gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly ]) ++ [ (lib.getLib pkgs.libnice) ];
   secureOvmf = pkgs.OVMF.override {
     secureBoot = true;
     msVarsTemplate = true;
@@ -21,6 +23,7 @@ in
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [ 22 ];
+    allowedUDPPortRanges = [{ from = 50000; to = 50031; }];
     interfaces.podman0.allowedTCPPorts = [ 443 internalPort 10428 15432 18428 ];
     interfaces.podman0.allowedTCPPortRanges = [{ from = 20000; to = 32000; }];
     interfaces.tailscale0.allowedTCPPorts = [ 80 443 445 8081 8082 ];
@@ -118,6 +121,38 @@ in
     isSystemUser = true;
     group = "studio-dashboard";
   };
+  systemd.services.studio-vm-screen = {
+    wantedBy = [ "multi-user.target" ];
+    wants = [ "studio-host.service" ];
+    after = [ "studio-host.service" ];
+    environment = {
+      GST_PLUGIN_SYSTEM_PATH_1_0 = lib.makeSearchPath "lib/gstreamer-1.0" screenPlugins;
+      GI_TYPELIB_PATH = lib.makeSearchPath "lib/girepository-1.0" (map lib.getLib ([ pkgs.gst_all_1.gstreamer ] ++ screenPlugins));
+      LD_LIBRARY_PATH = "/run/opengl-driver/lib";
+      STUDIO_VM_GUEST_PROTOCOL = toString ../guest/protocol.json;
+    };
+    serviceConfig = {
+      ExecStart = "${screenPython}/bin/python3 ${../tools/vm-screen.py}";
+      User = "studio-dashboard";
+      Group = "studio-dashboard";
+      RuntimeDirectory = "studio-vm-screen";
+      RuntimeDirectoryMode = "0700";
+      RuntimeDirectoryPreserve = "yes";
+      UMask = "0077";
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      PrivateTmp = true;
+      NoNewPrivileges = true;
+      CapabilityBoundingSet = "";
+      MemoryMax = "2G";
+      TasksMax = 128;
+      DevicePolicy = "closed";
+      DeviceAllow = lib.optional (builtins.elem "nvidia" config.services.xserver.videoDrivers) "char-nvidia* rw";
+      RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];
+      Restart = "always";
+      RestartSec = 2;
+    };
+  };
   systemd.services.studio-host = {
     wantedBy = [ "multi-user.target" ];
     wants = [ "podman.socket" ];
@@ -181,8 +216,8 @@ in
   in {
     inherit environment;
     wantedBy = [ "multi-user.target" ];
-    wants = [ "nomad.service" "studio-router.service" "studio-host.service" ];
-    after = [ "nomad.service" "studio-host.service" ];
+    wants = [ "nomad.service" "studio-router.service" "studio-host.service" "studio-vm-screen.service" ];
+    after = [ "nomad.service" "studio-host.service" "studio-vm-screen.service" ];
     unitConfig.ConditionPathExists = [ "/var/lib/studio/dashboard.token" "/var/lib/studio/ca-bundle.crt" "/opt/studio/current" ];
     path = [ pkgs.podman pkgs.coreutils pkgs.curl pkgs.openssl pkgs.systemd ];
     serviceConfig = {
@@ -210,6 +245,7 @@ in
           --env=HOME=/data --env=XDG_CACHE_HOME=/data/cache \
           --volume=/var/lib/studio/dashboard:/data:rw \
           --volume=/run/studio-host:/run/studio-host:ro \
+          --volume=/run/studio-vm-screen:/run/studio-vm-screen:ro \
           --volume=${proxyToken}:/run/secrets/dashboard-proxy.token:ro \
           --volume=/var/lib/studio/dashboard.token:/run/secrets/dashboard-nomad.token:ro \
           --volume=/var/lib/studio/ca-bundle.crt:/run/secrets/ca-bundle.crt:ro \
diff --git a/readme.md b/readme.md
index 074de7d43a4d9c289afbf77b1767c7bb4d799def..84a00ad4fa7e548579c99382fe93d6e585fec63a 100644
--- a/readme.md
+++ b/readme.md
@@ -18,44 +18,6 @@ it -- It's kind of like "easy kubernetes."
 
 [paper clover]: https://paperclover.net
 
-## deployment loop
-
-```sh
-python3 tools/deploy.py stage shale  # preview the working files, even without a commit message
-python3 tools/deploy.py stage shale  # update the same URL and staging data after another edit
-python3 tools/deploy.py publish      # upload the described, conflict-free main commit for GUI review
-python3 tools/deploy.py prod         # upload and deploy main directly
-```
-
-Production always deploys a snapshot exported from `main`, never working files
-or a stage. The dashboard's **deploy main** page shows the uploaded commit and
-its message; deploying applies the full repository configuration and retains
-production data. A newer upload invalidates an older deployment confirmation.
-Sibling application build sources declared in `build-source.json` are bundled
-at upload time. Their frozen contents are part of the release digest.
-
-`main` joins the infra-2 and home-infra histories. Its tree contains infra-2;
-the retired configuration remains available in the home-infra parent history.
-
-## installer
-
-After publishing main, build the prepared USB image on an x86 Linux host:
-
-```sh
-nix build --extra-experimental-features 'nix-command flakes' path:/opt/studio/main#installer
-```
-
-The ISO is in `result/iso/`. It boots a live installer with this Mac's SSH key,
-ZFS and migration tools, the uploaded repository at `/etc/infra-2`, and a cached
-dashboard image. It does not install automatically. The physical installation
-uses `#zenith` after generating its hardware configuration; the existing data
-pool and service state follow the [handoff](tools/legacy-handoff.md).
-
-On Zenith, the live installer uses the same wired addresses and gateway as the
-installed system. Once firmware boots the USB, connect from this Mac with
-`ssh root@10.0.0.1`. SSH starts automatically and accepts the admin key only;
-no monitor, local login, or DHCP address lookup is needed after USB boot.
-
 ## filesystem layout
 
 The computer mounts the ZFS root dataset under `/srv`, meaning "server," loosely
@@ -94,154 +56,3 @@ Media is it's own dataset so it can be snapshotted independently of my personal
 data (less frequent, lower retention), and all my personal files are on the same
 dataset to allow fast move/copying between top level folders. Services use their
 own datasets to implement copy-on-write forks.
-
-## testing domains on a Mac
-
-[tools/mac-domains.py](tools/mac-domains.py) routes `.studio.test` and its nested
-subdomains through the rehearsal VM's HTTPS, DNS, and login services. Start the
-rehearsal SSH forwards first, then run:
-
-```sh
-sudo /usr/bin/python3 tools/mac-domains.py start /path/to/rehearsal-ca.crt
-```
-
-The relay binds loopback ports, drops administrator privileges, and passes TLS
-through to the VM. Local UDP DNS queries use the SSH tunnel's TCP DNS connection.
-Existing certificate trust is preserved. Mac DNS and hosts
-settings are backed up before editing; `sudo /usr/bin/python3 tools/mac-domains.py
-stop` restores them and stops the relay. Undo refuses to overwrite later edits.
-After a Mac restart, run stop and start again to restart the relay.
-
-The dashboard package uses `home-dashboard`. Existing state paths, environment
-names, service IDs, and telemetry names keep their old names for compatibility.
-
-## dashboard boundary
-
-NixOS runs `studio-dashboard` in a non-root Podman container with a read-only
-root, private network, resource limits, and explicit data mounts. The small
-`studio-host` service authenticates the dashboard UID on its Unix socket and
-performs bounded ZFS, VM, deployment, host-sampling, and identity operations.
-Host control sockets and management credentials stay outside the container.
-
-Snowglobe and Copyparty use the Rust dashboard's accounts and host-only sessions.
-Account state lives in `/var/lib/studio/dashboard/accounts.sqlite`. Deployment
-backups include consistent SQLite copies and profile pictures; `data-restore`
-accepts `dashboard` and preserves a safety copy before restoring. Invitations reserve a username and groups,
-expire after 24 hours, and can be revoked. Setup offers optional passkey enrollment.
-Existing passkeys retain the `auth.paperclover.net` RP ID; that host serves related
-origin metadata for Snowglobe. Keycloak remains available for other services.
-The sign-in page shares the original Keycloak theme stylesheet and artwork.
-Passkeys support username-free sign-in and browser autofill; the remember-me
-checkbox chooses between a browser session cookie and a 30-day cookie.
-
-`tools/import-dashboard-auth.py --host root@zenith --output /private/path/accounts.json`
-exports account IDs, groups, password hashes and public passkey credentials without
-changing the source realm. Keep the export private. The dashboard imports
-`accounts-import.json` from its data directory at startup and removes it after
-success; importing the same export again is safe, while a different export is
-refused once accounts exist. `home-dashboard --import-accounts /private/path/accounts.json`
-supports an offline rehearsal with a separate `STUDIO_DATA_DIR`.
-
-The MCP tab manages separate observability, agent, and Shale catalogs through
-the native dashboard account. Each connection has explicit service, machine, or
-repository grants; Shale credentials belong to the signed-in user. Agent Relay's
-existing outbound client protocol connects to the Rust server.
-
-Build the image with `nix build .#dashboard-image` on Linux. Run
-`python3 tools/dashboard-unit-test.py --output /tmp/dashboard-checks.json` on the
-rehearsal VM to exercise the generated NixOS units, containment, IAM, and MCP
-connectors with disposable fixtures. `--relay-agent-dir` includes the existing
-Agent Relay client interoperability check; `--browser-ready-file` temporarily
-routes the public dashboard to the fixture for browser and SSO load checks.
-
-## local agents
-
-On each Mac or Linux machine, run this from your usual terminal:
-
-```sh
-curl -fsSL https://snowglobe.paperclover.net/agent/install.sh | sh
-```
-
-On Windows, use a PowerShell window without administrator privileges:
-
-```powershell
-irm https://snowglobe.paperclover.net/agent/install.ps1 | iex
-```
-
-The installer downloads a private Node runtime, verifies its SHA-256 checksum,
-and installs the agent without npm or a repository checkout. On NixOS, it
-installs the runtime through Nix into the agent folder. Prompts ask for a
-machine name, existing project folders where new chats may start, and optional
-experimental Codex desktop control on macOS or Linux. No folders or desktop
-control are enabled on a fresh install unless selected. Codex or Claude Code
-must already be installed and signed in as your login user.
-
-While the installer waits, open **MCP → Settings → Local agents**, enter the printed
-pairing code, and click **Link machine**. Finish installation in the terminal.
-The machine appears **Online** when its background agent connects. Pairing
-belongs to the signed-in dashboard account; each machine connects outward and
-needs no incoming firewall port. Startup uses a systemd user service on Linux,
-a LaunchAgent on macOS, and a current-user scheduled task at logon on Windows.
-Linux needs an active systemd user session. The agent starts immediately after
-installation and again at login.
-
-Copy **Local agents**' endpoint, `https://snowglobe.paperclover.net/mcp/agents`,
-into the AI client's MCP connector settings using OAuth. Sign in to the
-dashboard and select the machines the client may access. The consent screen
-shows whether the connection requests session control. A granted machine
-exposes saved Codex and Claude Code chats; project folders constrain **new**
-chats, not saved-chat reads or the permissions of existing chats.
-
-Example requests to the connected AI client:
-
-```text
-List my machines, target "Work PC", and show its recent Codex chats.
-Read the latest chat in that list.
-Start a Codex chat on "Work PC" in C:\Users\Clover\dev\site:
-check the build and fix the failing tests.
-Read that chat again to check the result.
-```
-
-Read access supports listing machines and chats and reading transcripts.
-Session control adds starting chats, sending messages, and interrupting turns.
-Writes always select one machine. Agent-owned Codex and Claude Code chats
-support these operations; existing Codex desktop control is experimental and
-requires the installer option. Existing Claude Code chats accept messages only
-when their local inbox supports delivery. Windows installs support saved-chat
-reads and agent-owned CLI chats; this installer does not enable existing
-desktop chat control there. A submitted message acknowledges delivery; read
-the chat again for its result. Commands needing local approval are refused.
-
-For an external script, create an **API key** in the MCP tab, select its
-machines, and enable **Allow session control** only if required. Use the key
-as a bearer token with `/api/v1/machines` and
-`/api/v1/machines/{id}/commands`. Keep it in the script's secret store. Unlinking
-a machine disconnects it and revokes its machine credential; revoking a client
-connection removes only that client's access.
-
-Rerun the install command to update the agent or change project folders. It
-keeps the machine identity and pairing. Leaving the first folder answer blank
-keeps existing folders; entering `-` clears them. A reinstall needs the existing
-pairing to remain active. Unlink first, then remove the saved `agent.json` if
-you want a new pairing or a different dashboard account.
-
-The installed `agent-relay` command accepts `status`, `start`, `stop`, and
-`uninstall`. Use its full path:
-
-| Platform | Command | Logs |
-| --- | --- | --- |
-| Linux | `~/.local/share/agent-relay/agent-relay status` | `journalctl --user -u agent-relay -f` |
-| macOS | `"$HOME/Library/Application Support/AgentRelay/agent-relay" status` | `~/Library/Application Support/AgentRelay/agent.log` |
-| Windows | `& "$env:LOCALAPPDATA\AgentRelay\agent-relay.cmd" status` | `%LOCALAPPDATA%\AgentRelay\agent.log` |
-
-Linux honors `XDG_DATA_HOME` and `XDG_CONFIG_HOME`. Uninstall removes startup
-registration and stops the agent, preserving pairing and session files. Pairing
-is in `~/.config/agent-relay/agent.json` on macOS/Linux, or
-`%LOCALAPPDATA%\AgentRelay\config\agent.json` on Windows.
-
-The local client source remains in the sibling Agent Relay project identified
-by `dashboard/agent/source.json`. `tools/deploy.py` bundles it into each frozen
-release before computing its digest. For a direct dashboard build or local
-preview, run `pnpm --dir dashboard install --frozen-lockfile` and
-`python3 tools/build-agent.py` first. The generated `relay.mjs` is a deployment
-artifact and is not checked into this repository.
diff --git a/service/shale/readme/readme.js b/service/shale/readme/readme.js
index 3caee492a1e9088f32d516e7eb41e09be03cadf1..03493055308f6c4da3a31a5a7ce3633b3dabc316 100644
--- a/service/shale/readme/readme.js
+++ b/service/shale/readme/readme.js
@@ -2,31 +2,91 @@
   const readme = document.querySelector("#readme .markdown");
   if (!readme || !window.markdownit || !window.DOMPurify) return;
 
-  const response = await fetch("/snowbound/plain/main/readme.md");
+  const repo = document.querySelector('meta[name="astheno.shale.repo.name"]')?.content;
+  if (!repo) return;
+  const tree = await fetch(`/${encodeURIComponent(repo)}/tree/-/`);
+  if (!tree.ok) return;
+  const page = new DOMParser().parseFromString(await tree.text(), "text/html");
+  const file = [...page.querySelectorAll(".objblob a[href]")]
+    .find(link => /^readme\.md$/i.test(link.textContent.trim()));
+  if (!file) return;
+  const source = new URL(file.getAttribute("href"), tree.url);
+  const linkBase = new URL("./", source);
+  source.pathname = source.pathname.replace(`/${encodeURIComponent(repo)}/tree/`, `/${encodeURIComponent(repo)}/plain/`);
+  const response = await fetch(source);
   if (!response.ok) return;
 
   const markdown = await response.text();
   const rendered = window.markdownit({ html: true }).render(markdown);
   const fragment = window.DOMPurify.sanitize(rendered, {
-    USE_PROFILES: { html: true },
+    // https://github.com/gjtorikian/html-pipeline/blob/main/lib/html_pipeline/sanitization_filter.rb
+    ALLOWED_TAGS: [
+      "h1", "h2", "h3", "h4", "h5", "h6", "br", "b", "i", "strong", "em", "a", "pre", "code", "img", "tt",
+      "div", "ins", "del", "sup", "sub", "p", "picture", "ol", "ul", "table", "thead", "tbody", "tfoot",
+      "blockquote", "dl", "dt", "dd", "kbd", "q", "samp", "var", "hr", "ruby", "rt", "rp", "li", "tr", "td",
+      "th", "s", "strike", "summary", "details", "caption", "figure", "figcaption", "abbr", "bdo", "cite",
+      "dfn", "mark", "small", "source", "span", "time", "wbr",
+    ],
+    ALLOWED_ATTR: [
+      "href", "src", "longdesc", "loading", "alt", "itemscope", "itemtype", "cite", "srcset",
+      "abbr", "accept", "accept-charset", "accesskey", "action", "align", "aria-describedby", "aria-hidden",
+      "aria-label", "aria-labelledby", "axis", "border", "char", "charoff", "charset", "checked", "clear",
+      "cols", "colspan", "compact", "coords", "datetime", "dir", "disabled", "enctype", "for", "frame",
+      "headers", "height", "hreflang", "hspace", "ismap", "label", "lang", "maxlength", "media", "method",
+      "multiple", "nohref", "noshade", "nowrap", "open", "progress", "prompt", "readonly", "rel", "rev",
+      "role", "rows", "rowspan", "rules", "scope", "selected", "shape", "size", "span", "start", "summary",
+      "tabindex", "title", "type", "usemap", "valign", "value", "width", "itemprop", "style",
+    ],
+    ALLOW_DATA_ATTR: false,
+    ALLOW_ARIA_ATTR: false,
     RETURN_DOM_FRAGMENT: true,
   });
+  for (const element of fragment.querySelectorAll("[style]")) {
+    const ratio = element.tagName === "IMG" ? element.style.aspectRatio : "";
+    element.removeAttribute("style");
+    if (/^(?:auto\s+)?\d+(?:\.\d+)?(?:\s*\/\s*\d+(?:\.\d+)?)?$/.test(ratio)) {
+      element.style.aspectRatio = ratio;
+    }
+  }
+  for (const element of fragment.querySelectorAll("[align]")) {
+    const align = element.getAttribute("align").toLowerCase();
+    if (element.tagName === "IMG") {
+      if (["top", "middle", "bottom"].includes(align)) element.style.verticalAlign = align;
+      if (["left", "right"].includes(align)) element.style.float = align;
+    } else if (["left", "center", "right", "justify"].includes(align)) {
+      element.style.textAlign = align;
+    }
+  }
 
-  const mediaBase = new URL("/snowbound/plain/main/", location.origin);
-  const linkBase = new URL("/snowbound/tree/main/", location.origin);
+  const mediaBase = new URL("./", source);
   const rebase = (value, base) =>
     value && !value.startsWith("/") && !value.startsWith("#") && !/^[a-z][a-z\d+.-]*:/i.test(value)
       ? new URL(value, base).href
       : value;
 
-  for (const image of fragment.querySelectorAll("img[src]")) {
+  await Promise.all([...fragment.querySelectorAll("img[src]")].map(async image => {
     image.src = rebase(image.getAttribute("src"), mediaBase);
     for (const dimension of ["width", "height"]) {
       const value = image.getAttribute(dimension);
       if (value && /^\d+$/.test(value)) image.style[dimension] = `${value}px`;
     }
-  }
-  for (const pictureSource of fragment.querySelectorAll("source[srcset]")) {
+    if (image.style.width) {
+      if (!image.style.aspectRatio && image.style.height) {
+        image.style.aspectRatio = `auto ${image.getAttribute("width")} / ${image.getAttribute("height")}`;
+      }
+      image.style.height = "auto";
+    }
+    // Shale serves raw SVG as text/plain, which browsers reject as an image.
+    const url = new URL(image.src);
+    if (url.origin === location.origin && url.pathname.startsWith(mediaBase.pathname) && /\.svg$/i.test(url.pathname)) {
+      const source = await fetch(url).then(response => response.ok ? response.text() : null).catch(() => null);
+      if (source) {
+        const svg = window.DOMPurify.sanitize(source, { USE_PROFILES: { svg: true, svgFilters: true } });
+        image.src = `data:image/svg+xml;charset=utf-8,${encodeURIComponent(svg)}`;
+      }
+    }
+  }));
+  for (const pictureSource of fragment.querySelectorAll("img[srcset], source[srcset]")) {
     pictureSource.srcset = pictureSource.srcset.split(",").map(candidate => {
       const [, path, descriptor] = candidate.trim().match(/^(\S+)(.*)$/) || [];
       return path ? rebase(path, mediaBase) + descriptor : candidate;
diff --git a/service/shale/service.pkl b/service/shale/service.pkl
index bf80f1e14d6f19a5250bee2acf193eb7c931f003..7cf8e20c659d1ed50e0720ea4d4b36c527f38276 100644
--- a/service/shale/service.pkl
+++ b/service/shale/service.pkl
@@ -30,7 +30,7 @@ container {
       ["/-/studio-readme/"] = "readme"
     }
     headHtml {
-      ["/snowbound/"] = """
+      ["/*"] = """
         <script defer src="/-/studio-readme/markdown-it.min.js"></script><script defer src="/-/studio-readme/purify.min.js"></script><script defer src="/-/studio-readme/readme.js"></script>
         """
     }
diff --git a/tools/dashboard-host.py b/tools/dashboard-host.py
index 5b54addf9081a45e4d06f9a2533df61e2b7c8cb1..cb5d832952ea5cac9fb3b5696dafb8b3ddac4183 100644
--- a/tools/dashboard-host.py
+++ b/tools/dashboard-host.py
@@ -33,6 +33,7 @@ TEXT_FIELDS = {"name", "compression", "mountpoint", "origin", "mounted"}
 MAX_REQUEST = 65536
 MAX_RESPONSE = 16 * 1024 * 1024
 STREAM_SLOTS = threading.BoundedSemaphore(4)
+GUEST_SLOTS = threading.BoundedSemaphore(4)
 VM_PREPARATION_SLOT = threading.BoundedSemaphore(1)
 INDEX_SNAPSHOT = r"index-[0-9]+(?:-[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12})?"
 
@@ -322,6 +323,11 @@ def stream_console(connection, host, request):
             except BlockingIOError:
                 raise Rejected("This console is already open. Close its other console tab, then reconnect.") from None
             tty.setraw(descriptor)
+        elif request["operation"] == "vm.guest":
+            screen = resources.enter_context(socket.socket(socket.AF_UNIX, socket.SOCK_STREAM))
+            screen.settimeout(10)
+            screen.connect(details["path"])
+            screen.setblocking(False)
         else:
             identity = details["uuid"]
             deadline = time.monotonic() + 5
@@ -427,17 +433,18 @@ def serve_connection(connection, host, allowed_uid):
             if len(line) > MAX_REQUEST or not line.endswith(b"\n"):
                 raise Rejected("The host request is too large or incomplete.")
             request = json.loads(line)
-            if isinstance(request, dict) and request.get("operation") in {"vm.console", "vm.serial", "vm.upload"}:
-                if not STREAM_SLOTS.acquire(blocking=False):
+            if isinstance(request, dict) and request.get("operation") in {"vm.console", "vm.serial", "vm.guest", "vm.upload"}:
+                streams = GUEST_SLOTS if request["operation"] == "vm.guest" else STREAM_SLOTS
+                if not streams.acquire(blocking=False):
                     raise Rejected("Four VM connections or uploads are open. Close one and try again.")
                 try:
-                    if request["operation"] in {"vm.console", "vm.serial"}:
+                    if request["operation"] in {"vm.console", "vm.serial", "vm.guest"}:
                         stream_console(connection, host, request)
                     else:
                         stream_upload(connection, request)
                     return
                 finally:
-                    STREAM_SLOTS.release()
+                    streams.release()
             response = {"value": host.handle(request)}
         except Rejected as error:
             response = {"error": str(error), "status": 400}
diff --git a/tools/dashboard-vms-test.py b/tools/dashboard-vms-test.py
index 53c61b849db2973e8ffb19fa823366e3ce7b6a9a..ac821fcd4a7165141e8a35e5f6ccd4cf9274bce1 100644
--- a/tools/dashboard-vms-test.py
+++ b/tools/dashboard-vms-test.py
@@ -82,6 +82,11 @@ class VMTests(unittest.TestCase):
             with self.subTest(name=name):
                 spec = windows if name.startswith('Windows') else linux
                 self.assertEqual(vms.installer_profile(Path(name), spec), expected)
+        self.assertEqual(vms.profile('linux-aarch64-virtio')['video'], 'virtio')
+        self.assertEqual(vms.profile('linux-aarch64-virtio')['keyboard'], 'usb')
+        self.assertEqual(vms.profile('linux-aarch64-virtio')['serial'], 'ttyAMA0')
+        self.assertEqual(vms.profile('windows-q35-secure')['cpu_mode'], 'host-passthrough')
+        self.assertEqual(vms.profile('windows-q35-secure')['clock'], 'utc')
         with self.assertRaisesRegex(ValueError, 'Windows ARM'):
             vms.installer_profile(Path('Windows 11 26H2 English arm64.iso'), windows)
 
@@ -129,7 +134,7 @@ class VMTests(unittest.TestCase):
                     patch.object(vms.subprocess, 'run', return_value=SimpleNamespace(stdout='$6$hash\n')), \
                     patch.object(vms.secrets, 'token_urlsafe', return_value='generated-password'), \
                     patch.object(vms.secrets, 'token_hex', side_effect=['1234abcd', 'instance']):
-                vms.linux_seed(directory, 'snow', 'NixOS')
+                vms.linux_seed(directory, 'snow', 'NixOS', 'ttyAMA0')
             config = captured['config']
             self.assertEqual(config['bootcmd'][0], ['rm', '-f', '/etc/gdm/custom.conf'])
             self.assertIn('/run/current-system/sw/bin/getent', config['bootcmd'][1][-1])
@@ -140,6 +145,7 @@ class VMTests(unittest.TestCase):
                 'content': 'snowglobe-vm-1234abcd\n',
             }])
             self.assertEqual(config['runcmd'][0][-1], 'sshd')
+            self.assertEqual(config['runcmd'][1][-1], 'serial-getty@ttyAMA0.service')
 
     def test_console_cannot_choose_an_arbitrary_network_target(self):
         xml = "<domain><uuid>fixture-vm</uuid><devices><graphics type='vnc' listen='127.0.0.1' port='5901'/></devices></domain>"
diff --git a/tools/guest-channel-test.py b/tools/guest-channel-test.py
new file mode 100644
index 0000000000000000000000000000000000000000..2310a5fa3e540fc24c4ce939d103ab49b0c9a8fa
--- /dev/null
+++ b/tools/guest-channel-test.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+import sys
+import unittest
+from unittest.mock import patch
+import vms
+
+
+class ChannelTests(unittest.TestCase):
+    def request(self, source, state="running", channel=None):
+        channel = vms.GUEST_CHANNEL if channel is None else channel
+        xml = f'<domain id="9"><name>fixture</name><devices><channel type="unix"><source mode="bind" path="{source}"/><target type="virtio" name="{channel}"/></channel></devices></domain>'
+        with patch.object(sys, "argv", ["vms.py", "guest", '{"name":"fixture"}']), patch.object(vms, "virsh", side_effect=[xml, state]):
+            return vms.main()
+
+    def test_only_the_running_domains_owned_channel_is_opened(self):
+        path = f"/run/libvirt/qemu/channel/9-fixture/{vms.GUEST_CHANNEL}"
+        self.assertEqual(self.request(path), {"path": path})
+        for source, state, channel in [("/run/studio-host/host.sock", "running", None),
+                                        (path.replace("9-fixture", "8-other"), "running", None),
+                                        (path, "paused", None), (path, "running", "org.qemu.guest_agent.0")]:
+            with self.subTest(source=source, state=state, channel=channel), self.assertRaises(ValueError):
+                self.request(source, state, channel)
+        with self.assertRaises(ValueError):
+            vms.validate("guest", {"name": "fixture", "path": "/run/studio-host/host.sock"})
+        with self.assertRaises(ValueError):
+            vms.validate("guest", {"name": "../other"})
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/release.py b/tools/release.py
index d61fc124023c976197d50bf8f99a4abbc6799aaf..484240ff894b3ae90d4e85b24ab20d20fdd72163 100644
--- a/tools/release.py
+++ b/tools/release.py
@@ -15,7 +15,7 @@ ROOT = Path("/opt/studio")
 RELEASES = ROOT / "releases"
 STATE = Path("/var/lib/studio")
 HISTORY = STATE / "deployments.json"
-SOURCES = ("config", "service", "tools", "nixos", "dashboard", "flake.nix", "flake.lock", "readme.md")
+SOURCES = ("config", "service", "tools", "nixos", "dashboard", "guest", "flake.nix", "flake.lock", "readme.md")
 RELEASE_ID = re.compile(r"[0-9a-f]{16}\Z")
 STAGE_ID = re.compile(r"[a-z][a-z0-9-]*\Z")
 
@@ -42,6 +42,7 @@ def files(root):
             if relative.parts[:2] in (
                 ("dashboard", "node_modules"), ("dashboard", "dist"),
                 ("dashboard", ".cache"), ("dashboard", "data"), ("dashboard", "target"),
+                ("guest", "build"),
             ):
                 continue
             if any(part in {".DS_Store", "__pycache__", ".identities.lock", "identities.pending"} or part.startswith("._") or part.endswith(".pyc") for part in relative.parts):
@@ -73,7 +74,7 @@ def host_digest(root):
     digest = hashlib.sha256()
     paths = sorted(path for path, relative in files(root)
                    if relative.parts[0] in {"nixos", "dashboard", "config", "service"}
-                   or str(relative) in {"flake.nix", "flake.lock", "tools/router.py", "tools/dashboard-host.py", "tools/dashboard-run.py", "tools/release.py", "tools/vms.py"})
+                   or str(relative) in {"flake.nix", "flake.lock", "tools/router.py", "tools/dashboard-host.py", "tools/dashboard-run.py", "tools/release.py", "tools/vms.py", "tools/vm-screen.py", "guest/protocol.json"})
     for path in paths:
         digest.update(str(path.relative_to(root)).encode())
         _hash_contents(digest, path)
diff --git a/tools/vm-screen-test.py b/tools/vm-screen-test.py
new file mode 100644
index 0000000000000000000000000000000000000000..df3283c5d50e54af5fe04060697d2755e8617457
--- /dev/null
+++ b/tools/vm-screen-test.py
@@ -0,0 +1,248 @@
+#!/usr/bin/env python3
+import asyncio
+import base64
+import importlib.util
+import json
+from pathlib import Path
+import random
+import struct
+import threading
+import unittest
+import zlib
+from types import SimpleNamespace
+from unittest.mock import Mock
+
+
+spec = importlib.util.spec_from_file_location("vm_screen", Path(__file__).with_name("vm-screen.py"))
+screen = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(screen)
+
+
+class Writer:
+    def __init__(self):
+        self.data = bytearray()
+        self.closed = False
+        self.transport = self
+
+    def write(self, data):
+        self.data.extend(data)
+
+    async def drain(self):
+        pass
+
+    def get_write_buffer_size(self):
+        return len(self.data)
+
+    def is_closing(self):
+        return self.closed
+
+    def close(self):
+        self.closed = True
+
+
+class DesktopTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        self.reader, self.writer = asyncio.StreamReader(), Writer()
+        self.messages = []
+        self.desktop = screen.Desktop(self.reader, self.writer, self.messages.append)
+        self.desktop.resize(4, 2)
+
+    async def update(self, rectangles):
+        self.reader.feed_data(struct.pack("!BBH", 0, 0, len(rectangles)) + b"".join(rectangles))
+        self.reader.feed_eof()
+        self.presented = self.resized = 0
+
+        def present():
+            self.presented += 1
+
+        def resize():
+            self.resized += 1
+
+        with self.assertRaises(asyncio.IncompleteReadError):
+            await self.desktop.read(present, resize)
+
+    async def test_handshake(self):
+        self.reader.feed_data(b"RFB 003.008\n\x01\x01\0\0\0\0" + struct.pack("!HH16sI", 4, 2, bytes(16), 4) + b"test")
+        await self.desktop.start()
+        self.assertEqual(self.writer.data[:14], b"RFB 003.008\n\x01\x01")
+        self.assertEqual(self.writer.data[-10:], struct.pack("!BBHHHH", 3, 0, 0, 0, 4, 2))
+
+    async def test_raw_and_overlapping_copy_present_once(self):
+        pixels = b"".join(bytes([value, 0, 0, 0]) for value in range(1, 9))
+        await self.update([
+            struct.pack("!HHHHi", 0, 0, 4, 2, 0) + pixels,
+            struct.pack("!HHHHiHH", 1, 0, 3, 2, 1, 0, 0),
+        ])
+        self.assertEqual(list(self.desktop.pixels[::4]), [1, 1, 2, 3, 5, 5, 6, 7])
+        self.assertEqual(self.presented, 1)
+
+    async def test_idle_and_cursor_do_not_encode(self):
+        await self.update([struct.pack("!HHHHi", 0, 0, 2, 1, -239) + bytes([1, 2, 3, 0, 4, 5, 6, 0, 128])])
+        self.assertEqual(self.presented, 0)
+        encoded = base64.b64decode(self.messages[0]["image"].split(",")[1])
+        length = struct.unpack("!I", encoded[33:37])[0]
+        self.assertEqual(zlib.decompress(encoded[41:41 + length]), bytes([0, 3, 2, 1, 255, 6, 5, 4, 0]))
+
+    async def test_resize_and_out_of_bounds(self):
+        await self.update([struct.pack("!HHHHi", 0, 0, 2, 2, -223)])
+        self.assertEqual((self.desktop.width, self.desktop.height, self.resized), (2, 2, 1))
+        self.reader = asyncio.StreamReader()
+        self.desktop.reader = self.reader
+        with self.assertRaisesRegex(ValueError, "outside"):
+            await self.update([struct.pack("!HHHHi", 1, 0, 2, 1, 0)])
+        for width, height in [(0, 2), (4097, 1), (65535, 65535)]:
+            with self.assertRaises(ValueError):
+                self.desktop.resize(width, height)
+
+    def test_input_validation_and_release(self):
+        self.desktop.input({"type": "key", "key": 65507, "down": True})
+        self.desktop.input({"type": "pointer", "x": -1, "y": 10, "buttons": 1})
+        self.desktop.input({"type": "release"})
+        self.assertFalse(self.desktop.keys)
+        self.assertEqual(self.writer.data[-6:], struct.pack("!BBHH", 5, 0, 0, 1))
+        for message in [{"type": "key", "key": True, "down": True}, {"type": "pointer", "x": 1, "y": 1, "buttons": 256}]:
+            with self.assertRaises(ValueError):
+                self.desktop.input(message)
+
+
+class GuestTests(unittest.IsolatedAsyncioTestCase):
+    def setUp(self):
+        self.guest = screen.GuestDesktop("fixture")
+        self.messages = []
+        self.presented = self.resized = 0
+        self.viewer = Mock(desktop=SimpleNamespace(cursor={"type": "cursor", "source": "qemu"}),
+                                      writer=Writer(), send=self.messages.append, resize=self.resize, present=self.present)
+        self.guest.screens = {self.viewer}
+
+    def present(self):
+        self.presented += 1
+
+    def resize(self):
+        self.resized += 1
+
+    async def packets(self, *packets):
+        reader = asyncio.StreamReader()
+        for name, words, data in packets:
+            kind = screen.GUEST_PROTOCOL["packets"][name]["id"]
+            payload = struct.pack("!" + "I" * len(words), *words) + data
+            reader.feed_data(struct.pack("!4sII", b"SGV1", kind, len(payload)) + payload)
+        reader.feed_eof()
+        with self.assertRaises(asyncio.IncompleteReadError):
+            await self.guest.read(reader)
+
+    async def test_dirty_rectangles_and_cursor_do_not_reencode_video(self):
+        await self.packets(("screen", [4, 2, 0, 0, 4, 2], bytes(32)),
+                           ("screen", [4, 2, 2, 1, 1, 1], b"\x01\x02\x03\0"),
+                           ("cursor", [7, 1, 1, 0, 0, 2], struct.pack("!I", 17) + bytes([0,0,0,0,7]) + struct.pack("!I", 33) + bytes([1,2,3,255,0])),
+                           ("pointer", [7, 0xffffffff, 9, 1], b""))
+        self.assertEqual(self.guest.pixels[24:28], b"\x01\x02\x03\0")
+        self.assertEqual((self.presented, self.resized), (2, 1))
+        self.assertEqual([message["duration"] for message in self.messages if message["type"] == "cursor"], [17, 33])
+        self.assertIn("invert", self.messages[0])
+        self.assertEqual(self.guest.pointer["x"], -1)
+
+    async def test_suspend_restores_fallback_and_requires_full_refresh(self):
+        await self.packets(("screen", [2, 2, 0, 0, 2, 2], bytes(16)), ("suspend", [], b""))
+        self.assertFalse(self.guest.pixels)
+        self.assertEqual(self.messages[-1]["source"], "qemu")
+        with self.assertRaisesRegex(ValueError, "complete"):
+            await self.packets(("screen", [2, 2, 0, 0, 1, 1], bytes(4)))
+        self.viewer.desktop.cursor = None
+        await self.packets(("screen", [1, 1, 0, 0, 1, 1], bytes(4)), ("suspend", [], b""))
+        self.assertTrue(self.messages[-1]["fallback"])
+
+    async def test_untrusted_guest_packets_are_bounded(self):
+        for packet in [("screen", [4097, 1, 0, 0, 1, 1], bytes(4)),
+                       ("screen", [2, 2, 1, 1, 2, 2], bytes(16)),
+                       ("cursor", [1, 1, 1, 1, 0, 1], struct.pack("!I", 100) + bytes(5)),
+                       ("cursor", [1, 1, 1, 0, 0, 1], struct.pack("!I", 0) + bytes(5)),
+                       ("pointer", [1, 0, 0, 2], b""), ("suspend", [], b"x")]:
+            with self.subTest(packet=packet), self.assertRaises(ValueError):
+                await self.packets(packet)
+        reader = asyncio.StreamReader()
+        reader.feed_data(struct.pack("!4sII", b"SGV1", 1, 0xffffffff))
+        with self.assertRaises(ValueError):
+            await self.guest.read(reader)
+
+    async def test_viewer_close_during_cursor_fanout(self):
+        await self.packets(("screen", [1, 1, 0, 0, 1, 1], bytes(4)))
+        self.viewer.send = lambda _: self.guest.screens.discard(self.viewer)
+        await self.packets(("cursor", [1, 1, 1, 0, 0, 2], (struct.pack("!I", 100) + bytes(5)) * 2))
+        self.assertFalse(self.guest.screens)
+        self.assertEqual(len(self.guest.cursor), 2)
+
+    async def test_missing_heartbeat_times_out_but_does_not_encode(self):
+        await self.packets(("screen", [1, 1, 0, 0, 1, 1], bytes(4)), ("heartbeat", [], b""))
+        self.assertEqual(self.presented, 1)
+        reader = asyncio.StreamReader()
+        with self.assertRaises(TimeoutError):
+            await self.guest.read(reader)
+
+
+class StreamTests(unittest.IsolatedAsyncioTestCase):
+    async def asyncSetUp(self):
+        self.writer = Writer()
+        desktop = screen.Desktop(asyncio.StreamReader(), Writer(), lambda _: None)
+        desktop.resize(320, 200)
+        self.stream = screen.Screen(self.writer, desktop)
+
+    async def asyncTearDown(self):
+        self.writer.close()
+        self.stream.close()
+
+    async def test_browser_payload_and_sending_direction(self):
+        sdp = "\r\n".join([
+            "v=0", "o=- 1 1 IN IP4 127.0.0.1", "s=-", "t=0 0", "a=group:BUNDLE 0",
+            "m=video 9 UDP/TLS/RTP/SAVPF 96 103", "c=IN IP4 0.0.0.0", "a=mid:0", "a=recvonly",
+            "a=rtcp-mux", "a=ice-ufrag:abcd", "a=ice-pwd:abcdefghijklmnopqrstuvwxyz",
+            "a=setup:actpass", "a=fingerprint:sha-256 " + ":".join(["00"] * 32),
+            "a=rtpmap:96 VP8/90000", "a=rtpmap:103 H264/90000",
+            "a=fmtp:103 packetization-mode=1;profile-level-id=42e01f;level-asymmetry-allowed=1", "",
+        ])
+        self.stream.signal({"type": "offer", "sdp": sdp})
+        async with asyncio.timeout(5):
+            while b'"type":"answer"' not in self.writer.data:
+                await asyncio.sleep(0.01)
+        answer = next(json.loads(line) for line in self.writer.data.splitlines() if json.loads(line)["type"] == "answer")
+        self.assertIn("a=sendonly", answer["sdp"])
+        self.assertIn("a=rtpmap:103 H264/90000", answer["sdp"])
+        self.assertEqual(self.stream.pipeline.get_by_name("pay").get_property("pt"), 103)
+
+    async def test_stalled_guest_closes_and_ignores_queued_input(self):
+        message = json.dumps({"type": "clipboard", "text": "a" * 65536})
+        for _ in range(64):
+            self.stream.input(message)
+        self.assertTrue(self.writer.closed)
+        self.assertLess(len(self.stream.desktop.writer.data), 327680)
+
+    async def test_rtp_packets_fit_tunneled_network(self):
+        Gst = screen.Gst
+        pipeline = self.stream.pipeline
+        pipeline.set_state(Gst.State.NULL)
+        pipeline.remove(self.stream.rtc)
+        sink = Gst.ElementFactory.make("appsink")
+        sink.set_property("sync", False)
+        pipeline.add(sink)
+        pipeline.get_by_name("codec").link(sink)
+        pipeline.set_state(Gst.State.PLAYING)
+        pixels = random.Random(0).randbytes(len(self.stream.desktop.pixels))
+        self.stream.frames.emit("push-buffer", Gst.Buffer.new_wrapped(pixels))
+        packets = []
+        async with asyncio.timeout(5):
+            while True:
+                sample = sink.emit("try-pull-sample", 0)
+                if sample:
+                    buffer = sample.get_buffer()
+                    packets.append(buffer.get_size())
+                    if buffer.extract_dup(1, 1)[0] & 0x80:
+                        break
+                else:
+                    await asyncio.sleep(0.01)
+        self.assertGreater(len(packets), 1)
+        self.assertLessEqual(max(packets), 1200)
+
+
+if __name__ == "__main__":
+    screen.Gst.init(None)
+    threading.Thread(target=screen.GLib.MainLoop().run, daemon=True).start()
+    unittest.main()
diff --git a/tools/vm-screen.py b/tools/vm-screen.py
new file mode 100644
index 0000000000000000000000000000000000000000..9a4e54b0ac414dd79a9be0dc269b98c9c393d27a
--- /dev/null
+++ b/tools/vm-screen.py
@@ -0,0 +1,600 @@
+#!/usr/bin/env python3
+import asyncio
+import base64
+import contextlib
+import json
+import logging
+import os
+from pathlib import Path
+import socket
+import struct
+import threading
+import zlib
+
+import gi
+
+gi.require_version("Gst", "1.0")
+gi.require_version("GstSdp", "1.0")
+gi.require_version("GstWebRTC", "1.0")
+from gi.repository import GLib, Gst, GstSdp, GstWebRTC
+
+
+MAX_PIXELS = 3840 * 2160
+STUN = os.environ.get("STUDIO_VM_STUN_SERVER", "stun://stun.cloudflare.com:3478")
+SLOTS = asyncio.Semaphore(4)
+GUEST_PROTOCOL = json.loads(Path(os.environ.get("STUDIO_VM_GUEST_PROTOCOL", Path(__file__).resolve().parent.parent / "guest/protocol.json")).read_text())
+GUESTS = {}
+
+
+def png(width, height, pixels):
+    def chunk(kind, data):
+        return struct.pack("!I", len(data)) + kind + data + struct.pack("!I", zlib.crc32(kind + data))
+    rows = b"".join(b"\0" + pixels[row * width * 4:(row + 1) * width * 4] for row in range(height))
+    data = b"\x89PNG\r\n\x1a\n" + chunk(b"IHDR", struct.pack("!IIBBBBB", width, height, 8, 6, 0, 0, 0)) + chunk(b"IDAT", zlib.compress(rows)) + chunk(b"IEND", b"")
+    return "data:image/png;base64," + base64.b64encode(data).decode()
+
+
+class GuestDesktop:
+    def __init__(self, name):
+        self.name = name
+        self.screens = set()
+        self.pixels = bytearray()
+        self.cursor = []
+        self.pointer = None
+
+    def suspend(self):
+        active = bool(self.pixels)
+        self.pixels = bytearray()
+        self.cursor.clear()
+        self.pointer = None
+        if active:
+            for screen in self.screens:
+                screen.resize()
+                screen.send(screen.desktop.cursor or {"type": "cursor", "source": "qemu", "frame": 0, "fallback": True, "x": 0, "y": 0})
+                screen.present()
+
+    async def read(self, reader):
+        limits = GUEST_PROTOCOL["limits"]
+        packets = {packet["id"]: (name, packet["fields"]) for name, packet in GUEST_PROTOCOL["packets"].items()}
+        while True:
+            async with asyncio.timeout(4):
+                magic, kind, length = struct.unpack("!4sII", await reader.readexactly(12))
+                if magic != GUEST_PROTOCOL["magic"].encode() or kind not in packets or length > limits["packet_bytes"]:
+                    raise ValueError("Invalid guest display packet")
+                name, fields = packets[kind]
+                if length < len(fields) * 4:
+                    raise ValueError("Incomplete guest display packet")
+                payload = await reader.readexactly(length)
+            values = dict(zip(fields, struct.unpack("!" + "I" * len(fields), payload[:len(fields) * 4])))
+            data = payload[len(fields) * 4:]
+            if name == "screen":
+                width, height = values["width"], values["height"]
+                x, y, w, h = values["x"], values["y"], values["rect_width"], values["rect_height"]
+                if not 0 < width <= limits["dimension"] or not 0 < height <= limits["dimension"] or width * height > limits["pixels"] or not w or not h or x + w > width or y + h > height or len(data) != w * h * 4:
+                    raise ValueError("Invalid guest display rectangle")
+                resized = not self.pixels or (width, height) != (self.width, self.height)
+                if resized:
+                    if (x, y, w, h) != (0, 0, width, height):
+                        raise ValueError("Guest display needs a complete first frame")
+                    self.width, self.height = width, height
+                    self.pixels = bytearray(width * height * 4)
+                for row in range(h):
+                    offset = ((y + row) * width + x) * 4
+                    self.pixels[offset:offset + w * 4] = data[row * w * 4:(row + 1) * w * 4]
+                for screen in tuple(self.screens):
+                    if resized:
+                        screen.resize()
+                        if self.pointer:
+                            screen.send(self.pointer)
+                        for cursor in self.cursor:
+                            screen.send(cursor)
+                    screen.present()
+                    await asyncio.sleep(0)
+            elif name == "cursor":
+                width, height, count = values["width"], values["height"], values["frames"]
+                if not width and not height and not count and not data and not values["hot_x"] and not values["hot_y"]:
+                    self.cursor = [{"type": "cursor", "source": "guest", "id": values["id"], "width": 0, "height": 0, "frame": 0, "frames": 0, "fallback": True, "x": 0, "y": 0}]
+                    if self.pixels:
+                        for screen in self.screens:
+                            screen.send(self.cursor[0])
+                    continue
+                pixels = width * height
+                frame_bytes = 4 + pixels * 5
+                if not 0 < width <= limits["cursor_size"] or not 0 < height <= limits["cursor_size"] or not 0 < count <= limits["cursor_frames"] or values["hot_x"] >= width or values["hot_y"] >= height or len(data) != frame_bytes * count:
+                    raise ValueError("Invalid guest cursor")
+                self.cursor.clear()
+                for index in range(count):
+                    frame = data[index * frame_bytes:(index + 1) * frame_bytes]
+                    duration = struct.unpack("!I", frame[:4])[0]
+                    if not 1 <= duration <= 60000:
+                        raise ValueError("Invalid guest cursor duration")
+                    mask = frame[4 + pixels * 4:]
+                    if any(value & ~sum(GUEST_PROTOCOL["xor_bits"].values()) for value in mask):
+                        raise ValueError("Invalid guest cursor inversion")
+                    message = {"type": "cursor", "source": "guest", "id": values["id"], "width": width, "height": height,
+                               "x": values["hot_x"], "y": values["hot_y"], "frame": index, "frames": count,
+                               "duration": duration, "image": png(width, height, frame[4:4 + pixels * 4])}
+                    if any(mask):
+                        bits = GUEST_PROTOCOL["xor_bits"]
+                        message["invert"] = png(width, height, b"".join(bytes([255 if value & bits["red"] else 0,
+                                                                            255 if value & bits["green"] else 0,
+                                                                            255 if value & bits["blue"] else 0,
+                                                                            255 if value else 0]) for value in mask))
+                    self.cursor.append(message)
+                    if self.pixels:
+                        for screen in tuple(self.screens):
+                            screen.send(message)
+                        await asyncio.sleep(0)
+            elif name == "pointer":
+                if data or values["visible"] > 1:
+                    raise ValueError("Invalid guest pointer")
+                self.pointer = {"type": "cursor-position", "id": values["id"], "visible": bool(values["visible"]),
+                                "x": (values["x"] ^ 0x80000000) - 0x80000000, "y": (values["y"] ^ 0x80000000) - 0x80000000}
+                if self.pixels:
+                    for screen in self.screens:
+                        screen.send(self.pointer)
+            elif name == "suspend":
+                if data:
+                    raise ValueError("Invalid guest display suspension")
+                self.suspend()
+            elif name == "heartbeat":
+                if data:
+                    raise ValueError("Invalid guest display heartbeat")
+            else:
+                raise ValueError("Unexpected guest display request")
+
+    async def run(self):
+        while True:
+            writer = None
+            try:
+                reader, writer = await asyncio.wait_for(asyncio.open_unix_connection(
+                    os.environ.get("STUDIO_HOST_SOCKET", "/run/studio-host/host.sock")), 10)
+                peer = writer.get_extra_info("socket")
+                if struct.unpack("3i", peer.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12))[1] != 0:
+                    raise ValueError("Untrusted guest display broker")
+                writer.write(json.dumps({"operation": "vm.guest", "payload": {"name": self.name}}).encode() + b"\n")
+                size = struct.unpack("!I", await asyncio.wait_for(reader.readexactly(4), 70))[0]
+                if size > 65536:
+                    raise ValueError("Invalid guest display broker response")
+                response = json.loads(await reader.readexactly(size))
+                if "error" not in response:
+                    writer.write(struct.pack("!4sII", GUEST_PROTOCOL["magic"].encode(), GUEST_PROTOCOL["packets"]["refresh"]["id"], 0))
+                    await self.read(reader)
+            except (OSError, ValueError, EOFError, asyncio.IncompleteReadError, TimeoutError) as error:
+                logging.info("Guest display %s: %s", self.name, error)
+            finally:
+                self.suspend()
+                if writer:
+                    writer.close()
+                    with contextlib.suppress(OSError, TimeoutError):
+                        await asyncio.wait_for(writer.wait_closed(), 2)
+            await asyncio.sleep(2)
+
+
+class Desktop:
+    def __init__(self, reader, writer, notify):
+        self.reader, self.writer, self.notify = reader, writer, notify
+        self.keys = set()
+        self.pointer = (0, 0)
+        self.pixels = bytearray()
+        self.cursor = None
+
+    def resize(self, width, height):
+        if not 0 < width <= 4096 or not 0 < height <= 4096 or width * height > MAX_PIXELS:
+            raise ValueError("The VM screen exceeds the supported 4K display size.")
+        self.width, self.height = width, height
+        self.pixels = bytearray(width * height * 4)
+
+    async def start(self):
+        if not (await self.reader.readexactly(12)).startswith(b"RFB 003."):
+            raise ValueError("The VM screen did not respond. Restart the VM and reconnect.")
+        self.writer.write(b"RFB 003.008\n")
+        count = (await self.reader.readexactly(1))[0]
+        security = await self.reader.readexactly(count)
+        if 1 not in security:
+            raise ValueError("Remove the VM's VNC password in its display settings, then reconnect.")
+        self.writer.write(b"\x01")
+        if await self.reader.readexactly(4) != b"\0\0\0\0":
+            raise ValueError("The VM rejected the screen connection. Restart it and reconnect.")
+        self.writer.write(b"\x01")
+        width, height, _, length = struct.unpack("!HH16sI", await self.reader.readexactly(24))
+        if length > 65536:
+            raise ValueError("The VM screen sent an unsupported desktop name.")
+        await self.reader.readexactly(length)
+        self.resize(width, height)
+        self.writer.write(struct.pack("!B3xBBBBHHHBBB3x", 0, 32, 24, 0, 1, 255, 255, 255, 16, 8, 0))
+        encodings = (0, 1, -223, -224, -239)
+        self.writer.write(struct.pack("!BBH" + "i" * len(encodings), 2, 0, len(encodings), *encodings))
+        self.request(False)
+
+    def request(self, incremental=True):
+        self.writer.write(struct.pack("!BBHHHH", 3, incremental, 0, 0, self.width, self.height))
+
+    def input(self, message):
+        kind = message.get("type")
+        if kind == "key":
+            key, down = message.get("key"), message.get("down")
+            if type(key) is not int or not 0 <= key <= 0xFFFFFFFF or type(down) is not bool:
+                raise ValueError("Unsupported key event.")
+            if down:
+                self.keys.add(key)
+            else:
+                self.keys.discard(key)
+            self.writer.write(struct.pack("!BB2xI", 4, down, key))
+        elif kind == "pointer":
+            x, y, buttons = message.get("x"), message.get("y"), message.get("buttons")
+            if any(type(value) is not int for value in (x, y, buttons)) or not 0 <= buttons <= 255:
+                raise ValueError("Unsupported pointer event.")
+            self.pointer = (max(0, min(x, self.width - 1)), max(0, min(y, self.height - 1)))
+            self.writer.write(struct.pack("!BBHH", 5, buttons, *self.pointer))
+        elif kind == "release":
+            for key in self.keys:
+                self.writer.write(struct.pack("!BB2xI", 4, 0, key))
+            self.keys.clear()
+            self.writer.write(struct.pack("!BBHH", 5, 0, *self.pointer))
+        elif kind == "clipboard":
+            text = message.get("text")
+            if not isinstance(text, str) or len(text) > 65536:
+                raise ValueError("Shorten the clipboard text, then send it again.")
+            try:
+                data = text.encode("latin1")
+            except UnicodeEncodeError:
+                raise ValueError("Some clipboard characters aren't supported by this guest.") from None
+            self.writer.write(struct.pack("!B3xI", 6, len(data)) + data)
+        else:
+            raise ValueError("Unsupported input event.")
+
+    async def read(self, present, resized):
+        while True:
+            kind = (await self.reader.readexactly(1))[0]
+            if kind == 0:
+                _, count = struct.unpack("!BH", await self.reader.readexactly(3))
+                dirty = False
+                for _ in range(count):
+                    x, y, width, height, encoding = struct.unpack("!HHHHi", await self.reader.readexactly(12))
+                    if encoding == -224:
+                        break
+                    if encoding == -223:
+                        self.resize(width, height)
+                        resized()
+                        continue
+                    if encoding == -239:
+                        if width * height > 256 * 256:
+                            raise ValueError("The VM sent an unsupported cursor size.")
+                        pixels = bytearray(await self.reader.readexactly(width * height * 4))
+                        mask = await self.reader.readexactly(((width + 7) // 8) * height)
+                        for row in range(height):
+                            for col in range(width):
+                                offset = (row * width + col) * 4
+                                pixels[offset], pixels[offset + 2] = pixels[offset + 2], pixels[offset]
+                                pixels[offset + 3] = 255 if mask[row * ((width + 7) // 8) + col // 8] & (128 >> (col % 8)) else 0
+                        self.cursor = {"type": "cursor", "source": "qemu", "width": width, "height": height, "x": x, "y": y,
+                                       "frame": 0, "frames": 1, "duration": 100,
+                                       "image": png(width, height, pixels) if width and height else None}
+                        self.notify(self.cursor)
+                        continue
+                    if x + width > self.width or y + height > self.height:
+                        raise ValueError("The VM sent a screen update outside its display.")
+                    if encoding == 0:
+                        data = await self.reader.readexactly(width * height * 4)
+                    elif encoding == 1:
+                        source_x, source_y = struct.unpack("!HH", await self.reader.readexactly(4))
+                        if source_x + width > self.width or source_y + height > self.height:
+                            raise ValueError("The VM sent a screen copy outside its display.")
+                        data = b"".join(self.pixels[((source_y + row) * self.width + source_x) * 4:
+                                                   ((source_y + row) * self.width + source_x + width) * 4] for row in range(height))
+                    else:
+                        raise ValueError("The VM sent an unsupported screen encoding.")
+                    for row in range(height):
+                        start = ((y + row) * self.width + x) * 4
+                        self.pixels[start:start + width * 4] = data[row * width * 4:(row + 1) * width * 4]
+                    dirty = dirty or bool(width and height)
+                if dirty:
+                    present()
+                self.request()
+                await self.writer.drain()
+            elif kind == 2:
+                pass
+            elif kind == 3:
+                _, length = struct.unpack("!3sI", await self.reader.readexactly(7))
+                if length > 65536:
+                    raise ValueError("The VM sent too much clipboard text.")
+                self.notify({"type": "clipboard", "text": (await self.reader.readexactly(length)).decode("latin1")})
+            else:
+                raise ValueError("The VM sent an unsupported screen message.")
+
+
+class Screen:
+    def __init__(self, writer, desktop):
+        self.loop = asyncio.get_running_loop()
+        self.writer, self.desktop = writer, desktop
+        self.guest = None
+        self.channel = None
+        hardware = Gst.ElementFactory.make("nvh264enc")
+        encoder = "nvh264enc name=encoder preset=p4 tune=ultra-low-latency zerolatency=true bframes=0 bitrate=6000 gop-size=30" if hardware else (
+            "x264enc name=encoder tune=zerolatency speed-preset=ultrafast bitrate=6000 key-int-max=30 bframes=0")
+        width, height = self.desktop.width, self.desktop.height
+        self.pipeline = Gst.parse_launch(
+            f"appsrc name=frames is-live=true format=time do-timestamp=true max-buffers=1 leaky-type=downstream "
+            f"caps=video/x-raw,format=BGRx,width={width},height={height},framerate=30/1 "
+            f"! videoconvert ! videoscale ! capsfilter name=size caps=video/x-raw,format=NV12,width={width + width % 2},height={height + height % 2} "
+            f"! {encoder} ! video/x-h264,profile=constrained-baseline ! h264parse "
+            "! rtph264pay name=pay pt=96 mtu=1200 config-interval=-1 aggregate-mode=zero-latency "
+            "! capsfilter name=codec caps=application/x-rtp,media=video,encoding-name=H264,clock-rate=90000 "
+            "! webrtcbin name=rtc bundle-policy=max-bundle")
+        self.frames = self.pipeline.get_by_name("frames")
+        self.rtc = self.pipeline.get_by_name("rtc")
+        self.ice = self.rtc.get_property("ice-agent")
+        self.ice._ref_sink()  # PyGObject sinks the default agent's floating reference, which webrtcbin still owns.
+        self.ice.set_property("min-rtp-port", 50000)
+        self.ice.set_property("max-rtp-port", 50031)
+        if STUN:
+            self.rtc.set_property("stun-server", STUN)
+        self.handlers = [
+            (self.rtc, self.rtc.connect("on-ice-candidate", lambda _, line, candidate: self.loop.call_soon_threadsafe(
+                self.send, {"type": "candidate", "sdpMLineIndex": line, "candidate": candidate}))),
+            (self.rtc, self.rtc.connect("on-data-channel", self.data_channel)),
+            (self.rtc, self.rtc.connect("notify::connection-state", self.connection_state)),
+        ]
+        self.probe = self.frames.get_static_pad("src").add_probe(Gst.PadProbeType.EVENT_UPSTREAM, self.refresh)
+        self.bus = self.pipeline.get_bus()
+        self.bus.add_signal_watch()
+        self.handlers.append((self.bus, self.bus.connect("message::error", self.pipeline_error)))
+        self.pipeline.set_state(Gst.State.PLAYING)
+        self.send({"type": "display", "width": width, "height": height, "encoder": "nvenc" if hardware else "x264"})
+
+    def close(self):
+        self.desktop.notify = None
+        if self.guest:
+            self.guest.screens.discard(self)
+            if not self.guest.screens:
+                GUESTS.pop(self.guest.name, None)
+                self.guest.task.cancel()
+        for element, handler in self.handlers:
+            element.disconnect(handler)
+        self.handlers.clear()
+        self.frames.get_static_pad("src").remove_probe(self.probe)
+        self.bus.remove_signal_watch()
+        self.pipeline.set_state(Gst.State.NULL)
+
+    def send(self, message):
+        if not self.writer.is_closing():
+            self.writer.write(json.dumps(message, separators=(",", ":")).encode() + b"\n")
+            if self.writer.transport.get_write_buffer_size() > 262144:
+                self.writer.close()
+
+    def fail(self, message):
+        self.send({"type": "error", "message": message, "fatal": True})
+        self.writer.close()
+
+    def pipeline_error(self, _, message):
+        error, debug = message.parse_error()
+        logging.error("VM screen stream: %s (%s)", error, debug)
+        self.loop.call_soon_threadsafe(self.fail, "The screen stream stopped. Reconnect to try again.")
+
+    def resize(self):
+        width, height = self.source.width, self.source.height
+        self.frames.set_property("caps", Gst.Caps.from_string(
+            f"video/x-raw,format=BGRx,width={width},height={height},framerate=30/1"))
+        self.pipeline.get_by_name("size").set_property("caps", Gst.Caps.from_string(
+            f"video/x-raw,format=NV12,width={width + width % 2},height={height + height % 2}"))
+        self.send({"type": "display", "width": width, "height": height,
+                   "source": "guest" if self.source is self.guest else "qemu",
+                   "encoder": "nvenc" if self.pipeline.get_by_name("encoder").get_factory().get_name() == "nvh264enc" else "x264"})
+
+    def refresh(self, _, info):
+        event = info.get_event().get_structure()
+        if event and event.get_name() == "GstForceKeyUnit":
+            self.loop.call_soon_threadsafe(self.present)
+        return Gst.PadProbeReturn.OK
+
+    def connection_state(self, rtc, _):
+        state = rtc.get_property("connection-state")
+        if state == GstWebRTC.WebRTCPeerConnectionState.CONNECTED:
+            self.loop.call_soon_threadsafe(self.present)
+            self.loop.call_soon_threadsafe(self.desktop.request, False)
+        elif state in (GstWebRTC.WebRTCPeerConnectionState.FAILED, GstWebRTC.WebRTCPeerConnectionState.CLOSED):
+            self.loop.call_soon_threadsafe(self.fail, "The screen disconnected. Reconnect to try again.")
+
+    def data_channel(self, _, channel):
+        if channel.get_property("label") != "input" or self.channel:
+            channel.emit("close")
+            return
+        self.channel = channel
+        self.handlers.append((channel, channel.connect("on-message-string", lambda _, message: self.loop.call_soon_threadsafe(self.input, message))))
+
+    def input(self, raw):
+        if self.writer.is_closing():
+            return
+        try:
+            if len(raw) > 131072:
+                raise ValueError("Shorten the clipboard text, then send it again.")
+            message = json.loads(raw)
+            if not isinstance(message, dict):
+                raise ValueError("Unsupported input event.")
+            self.desktop.input(message)
+            if self.desktop.writer.transport.get_write_buffer_size() > 262144:
+                self.fail("The VM stopped accepting input. Reconnect to try again.")
+        except (ValueError, TypeError) as error:
+            self.send({"type": "error", "message": str(error)})
+
+    @property
+    def source(self):
+        return self.guest if self.guest and self.guest.pixels else self.desktop
+
+    def present(self):
+        if self.rtc.get_property("connection-state") == GstWebRTC.WebRTCPeerConnectionState.CONNECTED:
+            buffer = Gst.Buffer.new_wrapped(bytes(self.source.pixels))
+            self.frames.emit("push-buffer", buffer)
+
+    def signal(self, message):
+        if message.get("type") == "offer" and isinstance(message.get("sdp"), str):
+            if self.rtc.get_property("remote-description"):
+                raise ValueError("Reconnect to start a new screen connection.")
+            result, sdp = GstSdp.SDPMessage.new_from_text(message["sdp"])
+            if result != GstSdp.SDPResult.OK:
+                raise ValueError("Unable to connect the screen. Reconnect to try again.")
+            caps = None
+            for index in range(sdp.medias_len()):
+                media = sdp.get_media(index)
+                if media.get_media() != "video":
+                    continue
+                for format_index in range(media.formats_len()):
+                    payload = int(media.get_format(format_index))
+                    offered = media.get_caps_from_media(payload)
+                    if not offered:
+                        continue
+                    codec = offered.get_structure(0)
+                    profile = codec.get_string("profile-level-id")
+                    if codec.get_string("encoding-name") == "H264" and codec.get_string("packetization-mode") == "1" and (
+                            not profile or profile.startswith("42")):
+                        caps = offered
+                        break
+                if caps:
+                    break
+            if not caps:
+                raise ValueError("This browser doesn't support the VM's H.264 stream. Open it in a current browser.")
+            payload = caps.get_structure(0).get_value("payload")
+            caps = Gst.Caps.from_string(
+                f"application/x-rtp,media=video,encoding-name=H264,clock-rate=90000,payload={payload},"
+                "packetization-mode=(string)1,rtcp-fb-nack=(boolean)true,rtcp-fb-nack-pli=(boolean)true")
+            self.pipeline.get_by_name("pay").set_property("pt", payload)
+            self.pipeline.get_by_name("codec").set_property("caps", caps)
+            transceiver = self.rtc.get_static_pad("sink_0").get_property("transceiver")
+            transceiver.set_property("codec-preferences", caps)
+            transceiver.set_property("direction", GstWebRTC.WebRTCRTPTransceiverDirection.SENDONLY)
+            transceiver.set_property("do-nack", True)
+            description = GstWebRTC.WebRTCSessionDescription.new(GstWebRTC.WebRTCSDPType.OFFER, sdp)
+            promise = Gst.Promise.new_with_change_func(self.remote_description, None, None)
+            self.rtc.emit("set-remote-description", description, promise)
+        elif message.get("type") == "candidate":
+            line, candidate = message.get("sdpMLineIndex"), message.get("candidate")
+            if type(line) is not int or not 0 <= line <= 16 or not isinstance(candidate, str):
+                raise ValueError("Unsupported screen connection candidate.")
+            self.rtc.emit("add-ice-candidate", line, candidate)
+        else:
+            raise ValueError("Unsupported screen connection message.")
+
+    def remote_description(self, promise, *_):
+        reply = promise.get_reply()
+        if reply and reply.has_field("error"):
+            logging.error("VM screen offer: %s", reply.to_string())
+            self.loop.call_soon_threadsafe(self.fail, "Unable to connect the screen. Reconnect to try again.")
+            return
+        self.rtc.emit("create-answer", None, Gst.Promise.new_with_change_func(self.answer, None, None))
+
+    def answer(self, promise, *_):
+        reply = promise.get_reply()
+        if not reply or not reply.has_field("answer"):
+            logging.error("VM screen answer: %s", reply.to_string() if reply else "missing reply")
+            self.loop.call_soon_threadsafe(self.fail, "Unable to connect the screen. Reconnect to try again.")
+            return
+        answer = reply.get_value("answer")
+        self.rtc.emit("set-local-description", answer, Gst.Promise.new())
+        self.loop.call_soon_threadsafe(self.send, {"type": "answer", "sdp": answer.sdp.as_text()})
+
+
+async def serve(reader, writer):
+    desktop = screen = task = None
+    if SLOTS.locked():
+        writer.write(b'{"type":"error","fatal":true,"message":"Four VM screens are already open. Close one, then reconnect."}\n')
+        writer.close()
+        return
+    async with SLOTS:
+        try:
+            peer = writer.get_extra_info("socket")
+            if struct.unpack("3i", peer.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12))[1] not in (0, os.getuid()):
+                return
+            name = json.loads(await asyncio.wait_for(reader.readline(), 10))["name"]
+            if not isinstance(name, str) or not name or len(name) > 63:
+                raise ValueError("Choose a VM from the list.")
+            host_reader, host_writer = await asyncio.wait_for(asyncio.open_unix_connection(
+                os.environ.get("STUDIO_HOST_SOCKET", "/run/studio-host/host.sock")), 10)
+            desktop = Desktop(host_reader, host_writer, lambda message: screen.send(message) if message["type"] != "cursor" or screen.source is desktop else None)
+            host_peer = host_writer.get_extra_info("socket")
+            if struct.unpack("3i", host_peer.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12))[1] != 0:
+                raise ValueError("The host identity couldn't be verified. Check its configuration.")
+            host_writer.write(json.dumps({"operation": "vm.console", "payload": {"name": name}}).encode() + b"\n")
+            size = struct.unpack("!I", await asyncio.wait_for(host_reader.readexactly(4), 70))[0]
+            if size > 65536:
+                raise ValueError("The host screen response was too large.")
+            result = json.loads(await host_reader.readexactly(size))
+            if "error" in result:
+                raise ValueError(result["error"])
+            await asyncio.wait_for(desktop.start(), 10)
+            screen = Screen(writer, desktop)
+            if name not in GUESTS:
+                GUESTS[name] = GuestDesktop(name)
+                GUESTS[name].task = asyncio.create_task(GUESTS[name].run())
+            screen.guest = GUESTS[name]
+            screen.guest.screens.add(screen)
+            if screen.guest.pixels:
+                screen.resize()
+                if screen.guest.pointer:
+                    screen.send(screen.guest.pointer)
+                for cursor in screen.guest.cursor:
+                    screen.send(cursor)
+            screen.send({"type": "ready", "iceServers": [{"urls": STUN.replace("stun://", "stun:")}] if STUN else []})
+            task = asyncio.create_task(desktop.read(lambda: screen.present() if screen.source is desktop else None,
+                                                     lambda: screen.resize() if screen.source is desktop else None))
+            def captured(done):
+                if done.cancelled():
+                    return
+                error = done.exception()
+                if error:
+                    logging.error("VM screen capture: %s", error)
+                    screen.fail(str(error) if isinstance(error, ValueError) else
+                                "The VM screen stopped. Check that the VM is running, then reconnect.")
+            task.add_done_callback(captured)
+            async with asyncio.timeout(8 * 3600):
+                while raw := await reader.readline():
+                    message = json.loads(raw)
+                    if not isinstance(message, dict):
+                        raise ValueError("Unsupported screen connection message.")
+                    screen.signal(message)
+            if task.done():
+                task.result()
+        except ValueError as error:
+            if screen:
+                screen.send({"type": "error", "message": str(error), "fatal": True})
+            else:
+                writer.write(json.dumps({"type": "error", "message": str(error), "fatal": True}).encode() + b"\n")
+        except (OSError, EOFError, TimeoutError, GLib.Error, asyncio.IncompleteReadError):
+            logging.exception("VM screen connection stopped")
+            if screen:
+                screen.send({"type": "error", "fatal": True, "message": "Unable to connect the VM screen. Reconnect to try again."})
+        finally:
+            if task:
+                task.cancel()
+                with contextlib.suppress(asyncio.CancelledError, Exception):
+                    await task
+            if screen:
+                screen.close()
+            if desktop:
+                with contextlib.suppress(OSError):
+                    desktop.input({"type": "release"})
+                desktop.writer.close()
+                try:
+                    await asyncio.wait_for(desktop.writer.wait_closed(), 2)
+                except (OSError, TimeoutError):
+                    desktop.writer.transport.abort()
+            writer.close()
+            try:
+                await asyncio.wait_for(writer.wait_closed(), 2)
+            except (OSError, TimeoutError):
+                writer.transport.abort()
+
+
+async def main():
+    Gst.init(None)
+    threading.Thread(target=GLib.MainLoop().run, daemon=True).start()
+    path = Path(os.environ.get("STUDIO_VM_SCREEN_SOCKET", "/run/studio-vm-screen/screen.sock"))
+    path.unlink(missing_ok=True)
+    server = await asyncio.start_unix_server(serve, path=str(path), limit=131072)
+    path.chmod(0o600)
+    async with server:
+        await server.serve_forever()
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/tools/vms.py b/tools/vms.py
index af1173147d3500dcd15c692ed0f14e3a81ea2602..f9f5219a2df287fd9308773e09e9ea1c91936ffd 100644
--- a/tools/vms.py
+++ b/tools/vms.py
@@ -20,6 +20,7 @@ PRESETS = Path(os.environ.get("STUDIO_VM_PRESETS_ROOT", str(IMAGES / "Presets"))
 UPLOADS = Path(os.environ.get("STUDIO_VM_UPLOADS_ROOT", str(IMAGES / "Install Disks")))
 NS = "{https://paperclover.net/studio}"
 NAME = re.compile(r"[a-z0-9][a-z0-9-]{0,62}\Z")
+GUEST_CHANNEL = json.loads((Path(__file__).resolve().parent.parent / "guest/protocol.json").read_text())["channel"]
 PROFILES = {
     "linux-x86-virtio": {
         "arch": "x86_64", "machine": "q35", "platform": "linux", "firmware": None,
@@ -30,7 +31,7 @@ PROFILES = {
         "arch": "aarch64", "machine": "virt", "platform": "linux", "firmware": "uefi",
         "disk": ("vda", "virtio"), "cd": ("sda", "scsi"), "seed": ("sdb", "scsi"),
         "network": "virtio", "usb": "qemu-xhci", "clock": "utc", "emulated": True,
-        "scsi": True,
+        "scsi": True, "video": "virtio", "keyboard": "usb", "serial": "ttyAMA0",
     },
     "windows-q35-uefi": {
         "arch": "x86_64", "machine": "q35", "platform": "windows", "firmware": "uefi",
@@ -40,7 +41,8 @@ PROFILES = {
     "windows-q35-secure": {
         "arch": "x86_64", "machine": "q35", "platform": "windows", "firmware": "uefi",
         "disk": ("sda", "sata"), "cd": ("sdb", "sata"), "network": "e1000e",
-        "usb": "qemu-xhci", "clock": "localtime", "tpm": True, "secure": True, "smm": True,
+        "usb": "qemu-xhci", "clock": "utc", "cpu_mode": "host-passthrough",
+        "tpm": True, "secure": True, "smm": True,
     },
     "windows-q35-bios": {
         "arch": "x86_64", "machine": "pc-q35-10.2", "platform": "windows", "firmware": "bios",
@@ -60,7 +62,7 @@ ACTION_FIELDS = {
     "remove": {"name", "disks"},
     "library": None, "media": {"name", "image"},
     "preset": {"name", "id", "os", "description"},
-    "console": {"name"}, "serial": {"name"}, "owner": {"name"}, "access": {"name"}, "upload": {"volume", "size"},
+    "console": {"name"}, "serial": {"name"}, "guest": {"name"}, "owner": {"name"}, "access": {"name"}, "upload": {"volume", "size"},
 }
 
 
@@ -569,7 +571,7 @@ def guest_access(directory, username, hostname):
     return password
 
 
-def linux_seed(directory, username, os_name):
+def linux_seed(directory, username, os_name, serial="ttyS0"):
     if not re.fullmatch(r"[a-z_][a-z0-9_-]{0,31}", username) or username == "root":
         raise ValueError("Use an account username suitable for a Linux guest.")
     hostname = "snowglobe-vm-" + secrets.token_hex(4)
@@ -600,7 +602,7 @@ fi
         "bootcmd": ([["rm", "-f", gdm_config]] if nixos else []) + [["sh", "-c", rename]],
         "chpasswd": {"expire": False, "users": [{"name": user, "password": hashed, "type": "hash"} for user in [username, "root"]]},
         "write_files": files,
-        "runcmd": [["systemctl", "enable", "--now", "sshd" if fedora or nixos else "ssh"], ["systemctl", "enable", "--now", "serial-getty@ttyS0.service"]],
+        "runcmd": [["systemctl", "enable", "--now", "sshd" if fedora or nixos else "ssh"], ["systemctl", "enable", "--now", f"serial-getty@{serial}.service"]],
     }
     with tempfile.TemporaryDirectory(prefix=".seed-", dir=directory) as temporary:
         files = Path(temporary)
@@ -723,7 +725,9 @@ def create(spec):
             ET.SubElement(features, "apic")
         if details_profile.get("smm"):
             ET.SubElement(features, "smm", state="on")
-        if details_profile.get("cpu"):
+        if cpu_mode := details_profile.get("cpu_mode"):
+            ET.SubElement(root, "cpu", mode=cpu_mode, check="none", migratable="on")
+        elif details_profile.get("cpu"):
             cpu = ET.SubElement(root, "cpu", mode="custom", match="exact", check="full")
             ET.SubElement(cpu, "model", fallback="forbid").text = details_profile["cpu"]
         elif root.get("type") == "qemu":
@@ -747,7 +751,7 @@ def create(spec):
         ET.SubElement(cd, "target", dev=details_profile["cd"][0], bus=details_profile["cd"][1])
         ET.SubElement(cd, "readonly")
         if preset and spec["platform"] == "linux":
-            linux_seed(directory, spec["username"], preset["os"])
+            linux_seed(directory, spec["username"], preset["os"], details_profile.get("serial", "ttyS0"))
             seed = ET.SubElement(devices, "disk", type="file", device="cdrom")
             ET.SubElement(seed, "driver", name="qemu", type="raw")
             ET.SubElement(seed, "source", file=str(directory / "seed.iso"))
@@ -762,8 +766,13 @@ def create(spec):
         ET.SubElement(nic, "source", network="default")
         ET.SubElement(nic, "model", type=details_profile["network"])
         ET.SubElement(devices, "graphics", type="vnc", port="-1", autoport="yes", listen="127.0.0.1")
-        ET.SubElement(ET.SubElement(devices, "video"), "model", type="vga", vram="16384", heads="1", primary="yes")
+        video = {"type": details_profile.get("video", "vga"), "heads": "1", "primary": "yes"}
+        if video["type"] == "vga":
+            video["vram"] = "16384"
+        ET.SubElement(ET.SubElement(devices, "video"), "model", **video)
         ET.SubElement(devices, "input", type="tablet", bus="usb")
+        if keyboard := details_profile.get("keyboard"):
+            ET.SubElement(devices, "input", type="keyboard", bus=keyboard)
         ET.SubElement(devices, "controller", type="usb", model=details_profile["usb"])
         if details_profile.get("tpm"):
             tpm = ET.SubElement(devices, "tpm", model="tpm-crb")
@@ -772,6 +781,7 @@ def create(spec):
             ET.SubElement(devices, "memballoon", model=details_profile["balloon"])
         ET.SubElement(devices, "console", type="pty")
         ET.SubElement(devices, "channel", type="unix").append(ET.Element("target", type="virtio", name="org.qemu.guest_agent.0"))
+        ET.SubElement(devices, "channel", type="unix").append(ET.Element("target", type="virtio", name=GUEST_CHANNEL))
         xml = directory / "domain.xml"
         xml.write_bytes(ET.tostring(root))
         signal.alarm(0)
@@ -817,6 +827,13 @@ def main():
         return library()
     if action == "console":
         return console_target(payload["name"])
+    if action == "guest":
+        root = ET.fromstring(virsh("dumpxml", payload["name"]))
+        source = root.find(f"./devices/channel[@type='unix']/target[@name='{GUEST_CHANNEL}']/../source")
+        expected = f"/run/libvirt/qemu/channel/{root.get('id')}-{payload['name']}/{GUEST_CHANNEL}"
+        if virsh("domstate", payload["name"]).strip() != "running" or source is None or source.get("mode") != "bind" or source.get("path") != expected:
+            raise ValueError("This VM has no guest display channel.")
+        return {"path": expected}
     if action == "serial":
         if virsh("domstate", payload["name"]).strip() not in {"running", "blocked"}:
             raise ValueError("Start this VM before opening its console.")