From 9e9eefa9e34d0067f716831ef397d23ecae5c895 Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Mon, 5 Oct 2026 19:57:26 -0700
Subject: [PATCH] Enable separate Windows surfaces and reliable native cursor
 reconnects

Add bounded Windows Graphics Capture surfaces and dirty rectangles, synchronized browser composition, cached caption dragging, and observed stream metrics. Keep the experiment opt-in on Windows 10 build 19041+ and Windows 11, with desktop fallback.

Use WebRTC congestion feedback and retransmission, coalesce video work, preserve reliable held-button input, and refresh native cursors on connect. Retire guest channels safely and release CUDA contexts when viewers close. Correct libvirt channel paths for long VM names.

Validated 25 native GStreamer/WebRTC tests, 14 VM boundary tests, Windows x86/x64/ARM64 builds and cursor sanitizer checks, frontend check/build, production Windows 10/11 composition and reconnects, GPU release, and unchanged inference processes/driver/Nomad.

Assisted-by: gpt-6.1-sol
---
 dashboard/web/components/VMConsole.tsx | 155 +++++++++-
 dashboard/web/pages/VMs.css            |   5 +-
 dashboard/web/styles.css               |   2 +-
 guest/DESIGN.md                        |  27 +-
 guest/build.py                         |   4 +-
 guest/capture.c                        | 350 ++++++++++++++++++++++
 guest/capture.h                        |   9 +
 guest/protocol.json                    |  12 +-
 guest/windows.c                        | 152 ++++++++--
 nixos/configuration.nix                |   2 +-
 tools/dashboard-vms-test.py            |  12 +
 tools/vm-screen-test.py                | 222 +++++++++++++-
 tools/vm-screen.py                     | 384 ++++++++++++++++++++++---
 tools/vms.py                           |   2 +-
 14 files changed, 1259 insertions(+), 79 deletions(-)
 create mode 100644 guest/capture.c
 create mode 100644 guest/capture.h

diff --git a/dashboard/web/components/VMConsole.tsx b/dashboard/web/components/VMConsole.tsx
index 09413ba5b00acc3f8d0136f1a404ef4106368a0b..602099de40a6935c43359cf99f3ebaf389917cbc 100644
--- a/dashboard/web/components/VMConsole.tsx
+++ b/dashboard/web/components/VMConsole.tsx
@@ -5,16 +5,30 @@ import Keyboard from "lucide-solid/icons/keyboard";
 import Clipboard from "lucide-solid/icons/clipboard";
 import Maximize from "lucide-solid/icons/maximize";
 import RefreshCw from "lucide-solid/icons/refresh-cw";
+import Check from "lucide-solid/icons/check";
 import RemoteKeyboard from "@novnc/keyboard";
 
+type WindowSurface = {
+  id: number; x: number; y: number; width: number; height: number; atlas_x: number; atlas_y: number;
+  caption_left: number; caption_top: number; caption_right: number; caption_bottom: number;
+};
+type WindowFrame = { windows: WindowSurface[]; rtpTimestamp: number };
+
 export function VMConsole(props: { name: string; enabled: boolean; active: boolean; toolbar: JSX.Element; content: (toolbar: HTMLDivElement) => JSX.Element }) {
   const enabled = createMemo(() => props.enabled);
   let attempt = 0;
   let video!: HTMLVideoElement;
+  let canvas!: HTMLCanvasElement;
   let cursorImage!: HTMLImageElement;
   let cursorInvert!: HTMLImageElement;
   let panel!: HTMLDivElement;
   let input: RTCDataChannel | undefined;
+  let movement: RTCDataChannel | undefined;
+  let pointerSequence = 0;
+  let windowFrame: WindowFrame | undefined;
+  let pendingFrames: WindowFrame[] = [];
+  let frameTimestamp: number | undefined;
+  let drag: { id: number; startX: number; startY: number; x: number; y: number; dx: number; dy: number; released: number } | undefined;
   let disconnect = () => {};
   let width = 0;
   let height = 0;
@@ -55,9 +69,38 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
   const [problem, setProblem] = createSignal("");
   const [clipboard, setClipboard] = createSignal("");
   const [showClipboard, setShowClipboard] = createSignal(false);
+  const [windowsAvailable, setWindowsAvailable] = createSignal(false);
+  const [separateWindows, setSeparateWindows] = createSignal(false);
+  const [frameSync, setFrameSync] = createSignal(false);
+  const [windowCapture, setWindowCapture] = createSignal(false);
+  const [showStats, setShowStats] = createSignal(false);
+  const [stats, setStats] = createSignal<{ fps: number; bitrate: number; lost: number; dropped: number; delay: number; rtt: number }>();
+  const [capture, setCapture] = createSignal<{ fps: number; capture: number; scan: number; write: number }>();
   const [tools, setTools] = createSignal<HTMLDivElement>();
   const send = (message: object) => { if (input?.readyState === "open") input.send(JSON.stringify(message)); };
-  const release = () => { buttons = 0; send({ type: "release" }); };
+  const compose = () => {
+    const frame = windowFrame;
+    const composed = !!frame?.windows.length;
+    video.classList.toggle("vm-video-composed", composed);
+    canvas.hidden = !composed;
+    if (!frame || !composed || !width || !height || video.readyState < 2) return;
+    if (canvas.width !== width || canvas.height !== height) { canvas.width = width; canvas.height = height; }
+    const context = canvas.getContext("2d", { alpha: false });
+    if (!context) return;
+    context.fillStyle = "#101014";
+    context.fillRect(0, 0, width, height);
+    for (const window of [...frame.windows].reverse()) {
+      let x = window.x, y = window.y;
+      if (drag?.id === window.id) {
+        const acknowledged = Math.abs(window.x - drag.x - drag.dx) <= 3 && Math.abs(window.y - drag.y - drag.dy) <= 3;
+        if (drag.released && (acknowledged || performance.now() - drag.released > 500)) drag = undefined;
+        else { x = drag.x + drag.dx; y = drag.y + drag.dy; }
+      }
+      context.drawImage(video, window.atlas_x, window.atlas_y, window.width, window.height, x, y, window.width, window.height);
+    }
+    canvas.dataset.windows = String(frame.windows.length);
+  };
+  const release = () => { buttons = 0; drag = undefined; compose(); send({ type: "release", sequence: ++pointerSequence }); };
   const connect = async () => {
     const current = ++attempt;
     disconnect();
@@ -81,6 +124,45 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       video.addEventListener("focus", focus);
       video.addEventListener("blur", blur);
       let peer: RTCPeerConnection | undefined;
+      let frameCallback: number | undefined;
+      let statsTimer: number | undefined;
+      let previousStats: { time: number; bytes: number; frames: number } | undefined;
+      const frameReady: VideoFrameRequestCallback = (_, metadata) => {
+        if (current !== attempt || disposed) return;
+        frameTimestamp = (metadata as VideoFrameCallbackMetadata & { rtpTimestamp?: number }).rtpTimestamp;
+        setFrameSync(Number.isFinite(frameTimestamp));
+        if (!frameSync()) {
+          frameTimestamp = undefined; windowFrame = undefined; pendingFrames = [];
+          if (separateWindows()) { setSeparateWindows(false); send({ type: "experiment", enabled: false }); }
+        }
+        while (pendingFrames[0] && frameTimestamp !== undefined && ((frameTimestamp - pendingFrames[0].rtpTimestamp) | 0) >= 0) {
+          windowFrame = pendingFrames.shift();
+        }
+        compose();
+        frameCallback = video.requestVideoFrameCallback(frameReady);
+      };
+      const measure = async () => {
+        if (!peer || current !== attempt || disposed) return;
+        try {
+          const report = await peer.getStats();
+          if (current !== attempt || disposed || peer.connectionState === "closed") return;
+          let rtt = 0;
+          report.forEach((value) => { if (value.type === "candidate-pair" && value.state === "succeeded" && value.nominated) rtt = (value.currentRoundTripTime ?? 0) * 1000; });
+          report.forEach((value) => {
+            if (value.type !== "inbound-rtp" || value.kind !== "video") return;
+            const elapsed = previousStats ? (value.timestamp - previousStats.time) / 1000 : 0;
+            setStats({ fps: elapsed ? (value.framesDecoded - previousStats!.frames) / elapsed : 0,
+              bitrate: elapsed ? (value.bytesReceived - previousStats!.bytes) * 8 / elapsed / 1000000 : 0,
+              lost: value.packetsLost ?? 0, dropped: value.framesDropped ?? 0,
+              delay: value.jitterBufferEmittedCount ? value.jitterBufferDelay / value.jitterBufferEmittedCount * 1000 : 0, rtt });
+            previousStats = { time: value.timestamp, bytes: value.bytesReceived, frames: value.framesDecoded };
+          });
+        } catch {
+          if (peer.connectionState !== "closed") return;
+        } finally {
+          if (current === attempt && !disposed && peer.connectionState !== "closed") statsTimer = window.setTimeout(measure, 1000);
+        }
+      };
       let pending = "";
       let messages = Promise.resolve();
       const decoder = new TextDecoder();
@@ -101,6 +183,12 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         socket.onclose = null;
         socket.close();
         peer?.close();
+        clearTimeout(statsTimer);
+        if (frameCallback !== undefined) video.cancelVideoFrameCallback(frameCallback);
+        windowFrame = undefined; pendingFrames = []; frameTimestamp = undefined; drag = undefined;
+        movement = undefined; pointerSequence = 0;
+        setFrameSync(false); setWindowsAvailable(false); setWindowCapture(false); setStats(undefined); setCapture(undefined);
+        compose();
         video.onplaying = null;
         video.srcObject = null;
         clearTimeout(cursorTimer);
@@ -125,11 +213,15 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
             if (message.type === "ready") {
               peer = new RTCPeerConnection({ iceServers: message.iceServers });
               const transceiver = peer.addTransceiver("video", { direction: "recvonly" });
-              const codecs = RTCRtpReceiver.getCapabilities("video")?.codecs.filter((codec) => codec.mimeType === "video/H264");
+              const codecs = RTCRtpReceiver.getCapabilities("video")?.codecs.filter((codec) => codec.mimeType === "video/H264" || codec.mimeType === "video/rtx");
               if (codecs?.length) transceiver.setCodecPreferences(codecs);
               input = peer.createDataChannel("input");
+              movement = peer.createDataChannel("pointer", { ordered: false, maxRetransmits: 0 });
               keyboard.onkeyevent = (key, _code, down) => send({ type: "key", key, down });
-              input.onopen = () => { if (document.activeElement === video) focus(); };
+              input.onopen = () => {
+                if (document.activeElement === video) focus();
+                if (windowsAvailable()) send({ type: "experiment", enabled: separateWindows() });
+              };
               peer.onicecandidate = ({ candidate }) => { if (candidate) signal({ type: "candidate", ...candidate.toJSON() }); };
               peer.onconnectionstatechange = () => {
                 if (peer?.connectionState === "failed" || peer?.connectionState === "disconnected") {
@@ -137,7 +229,11 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
                 }
               };
               peer.ontrack = ({ track }) => {
+                const receiver = transceiver.receiver as RTCRtpReceiver & { jitterBufferTarget?: number };
+                if ("jitterBufferTarget" in receiver) receiver.jitterBufferTarget = 0;
                 video.srcObject = new MediaStream([track]);
+                if (video.requestVideoFrameCallback) frameCallback = video.requestVideoFrameCallback(frameReady);
+                void measure();
                 void video.play().catch(() => {
                   if (current === attempt && video.srcObject) fail("The browser couldn't play the screen. Reconnect to try again.");
                 });
@@ -155,6 +251,27 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
               height = message.height;
               video.dataset.encoder = message.encoder;
               video.dataset.source = message.source ?? "qemu";
+            } else if (message.type === "capabilities") {
+              setWindowsAvailable(message.windows);
+              if (message.windows) send({ type: "experiment", enabled: separateWindows() });
+            } else if (message.type === "window-capture") {
+              setWindowCapture(message.available);
+            } else if (message.type === "windows") {
+              pendingFrames.push(message);
+              if (pendingFrames.length > 16) pendingFrames.shift();
+              if (frameTimestamp !== undefined && ((frameTimestamp - message.rtpTimestamp) | 0) >= 0) {
+                windowFrame = message; pendingFrames = []; compose();
+              }
+            } else if (message.type === "window-positions") {
+              if (windowFrame?.windows.length && windowFrame.windows.length === message.windows.length &&
+                  windowFrame.windows.every((window) => message.windows.some((next: WindowSurface) => window.id === next.id && window.width === next.width && window.height === next.height))) {
+                windowFrame = { ...windowFrame, windows: message.windows }; compose();
+              }
+            } else if (message.type === "capture-stats") {
+              setCapture({ fps: message.frames * 1000 / message.elapsed_ms,
+                capture: message.frames ? message.capture_us / message.frames / 1000 : 0,
+                scan: message.frames ? message.scan_us / message.frames / 1000 : 0,
+                write: message.frames ? message.write_us / message.frames / 1000 : 0 });
             } else if (message.type === "cursor") {
               if (message.frame === 0) {
                 clearTimeout(cursorTimer);
@@ -193,6 +310,7 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         if (current !== attempt || disposed) return;
         clearTimeout(timeout);
         setState("Connected");
+        compose();
         if (props.active) video.focus();
       };
     } catch (failure) {
@@ -225,7 +343,18 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
     cursorInside = x >= 0 && y >= 0 && x < width && y < height;
     drawCursor();
     if ((event.type === "pointerdown" || event.type === "wheel") && (x < 0 || y < 0 || x >= width || y >= height)) return false;
-    send({ type: "pointer", x, y, buttons: mask });
+    if (event.type === "pointerdown" && mask === 1) {
+      const window = windowFrame?.windows.find((window) => x >= window.x && y >= window.y && x < window.x + window.width && y < window.y + window.height);
+      if (window && x >= window.caption_left && x < window.caption_right && y >= window.caption_top && y < window.caption_bottom) {
+        drag = { id: window.id, startX: x, startY: y, x: window.x, y: window.y, dx: 0, dy: 0, released: 0 };
+      }
+    }
+    if (drag && event.type === "pointermove" && buttons === 1) { drag.dx = x - drag.startX; drag.dy = y - drag.startY; compose(); }
+    if (drag && event.type === "pointerup" && !mask) { drag.released = performance.now(); window.setTimeout(compose, 510); }
+    const message = JSON.stringify({ type: "pointer", x, y, buttons: mask, sequence: ++pointerSequence });
+    if (event.type === "pointermove" && !mask && movement?.readyState === "open") {
+      if (movement.bufferedAmount < 16384) movement.send(message);
+    } else if (input?.readyState === "open" && (event.type !== "pointermove" || input.bufferedAmount < 16384)) input.send(message);
     return true;
   };
   const ctrlAltDel = () => {
@@ -241,6 +370,12 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         <button disabled={!connected()} onClick={() => setShowClipboard(!showClipboard())}><Clipboard size={14} aria-hidden="true" />Clipboard</button>
       </VMMenu>
       <VMMenu label="View">
+        <button disabled={!connected() || !windowsAvailable() || !frameSync()} aria-pressed={separateWindows()}
+          onClick={() => { const enabled = !separateWindows(); setSeparateWindows(enabled); send({ type: "experiment", enabled }); }}>
+          <Check size={14} aria-hidden="true" style={{ visibility: separateWindows() ? "visible" : "hidden" }} />
+          Separate windows (experimental)
+        </button>
+        <button aria-pressed={showStats()} onClick={() => setShowStats(!showStats())}><Check size={14} aria-hidden="true" style={{ visibility: showStats() ? "visible" : "hidden" }} />Stream statistics</button>
         <button onClick={() => panel.requestFullscreen().catch((failure) => setProblem(reason(failure)))}><Maximize size={14} aria-hidden="true" />Fullscreen</button>
         <button disabled={!props.enabled || state() === "Connecting…"} onClick={connect}><RefreshCw size={14} aria-hidden="true" />Reconnect</button>
       </VMMenu>
@@ -248,6 +383,13 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       <span class="vm-console-status" role="status">{props.enabled ? state() : "Off"}</span>
       </Show>
     </div>
+    <Show when={props.active && showStats()}>
+      <div class="vm-stream-stats">
+        <Show when={stats()}>{(value) => <><span>{value().fps.toFixed(1)} FPS</span><span>{value().bitrate.toFixed(2)} Mbps</span><span>{value().lost} packets lost</span><span>{value().dropped} frames dropped</span><span>{value().rtt.toFixed(0)} ms round trip</span><span>{value().delay.toFixed(0)} ms buffer</span></>}</Show>
+        <Show when={capture()}>{(value) => <><span>Guest {value().fps.toFixed(1)} FPS</span><span>Desktop capture {value().capture.toFixed(1)} ms</span><span>Compare {value().scan.toFixed(1)} ms</span><span>Stream work {value().write.toFixed(1)} ms</span></>}</Show>
+        <Show when={separateWindows()}><span>{windowCapture() ? "Separate windows" : "Desktop fallback"}</span></Show>
+      </div>
+    </Show>
     <Show when={props.active && problem()}><p class="error vm-console-error" role="alert">{problem()}</p></Show>
     <Show when={props.active && showClipboard()}>
       <div class="vm-clipboard">
@@ -260,6 +402,7 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
       </div>
     </Show>
     <div class="vm-console-screen" hidden={!props.active || !props.enabled}>
+      <canvas ref={canvas} class="vm-window-canvas" hidden aria-hidden="true" />
       <video ref={video} autoplay muted playsinline tabindex="0" aria-label="VM screen"
         onContextMenu={(event) => event.preventDefault()}
         onPointerMove={pointer}
@@ -267,11 +410,13 @@ export function VMConsole(props: { name: string; enabled: boolean; active: boole
         onPointerDown={(event) => {
           event.preventDefault();
           const mask = buttons | (event.button === 0 ? 1 : event.button === 1 ? 2 : event.button === 2 ? 4 : 0);
-          if (!pointer(event, mask)) return;
+          if (!pointer(event)) return;
+          pointer(event, mask);
           buttons = mask;
           video.focus(); video.setPointerCapture(event.pointerId);
         }}
         onPointerUp={(event) => {
+          if (buttons) pointer(event);
           buttons &= ~(event.button === 0 ? 1 : event.button === 1 ? 2 : event.button === 2 ? 4 : 0);
           pointer(event);
           if (!event.buttons && video.hasPointerCapture(event.pointerId)) video.releasePointerCapture(event.pointerId);
diff --git a/dashboard/web/pages/VMs.css b/dashboard/web/pages/VMs.css
index 955f7b44908478e7a7b47ba0e710670bc83ba728..01ab01043433f1348c96df7024f8b89d5ddcca3c 100644
--- a/dashboard/web/pages/VMs.css
+++ b/dashboard/web/pages/VMs.css
@@ -93,8 +93,11 @@
 .vm-console-status { color: var(--text-2); font-size: 12px; }
 .vm-password { display: grid; gap: 6px; padding: 8px 10px; color: var(--muted); font-size: 11px; }
 .vm-password input { width: 26ch; min-width: 0; padding: 5px 6px; color: var(--text); font: 12px monospace; }
-.vm-console-screen { flex: 1; background: #101014; min-height: 0; }
+.vm-console-screen { flex: 1; background: #101014; min-height: 0; position: relative; }
 .vm-console-screen video { display: block; width: 100%; height: 100%; object-fit: contain; outline: none; touch-action: none; }
+.vm-console-screen video.vm-video-composed { opacity: 0; }
+.vm-window-canvas { position: absolute; inset: 0; width: 100%; height: 100%; object-fit: contain; pointer-events: none; }
+.vm-stream-stats { display: flex; flex-wrap: wrap; gap: 4px 16px; padding: 6px 12px; font-size: 12px; font-variant-numeric: tabular-nums; }
 .vm-cursor { display: none; position: fixed; left: 0; top: 0; pointer-events: none; }
 .vm-cursor-invert { mix-blend-mode: difference; }
 .vm-console-error { padding: 8px 12px; margin: 0; font-size: 12px; }
diff --git a/dashboard/web/styles.css b/dashboard/web/styles.css
index f531d6d2fdcd08175c0f8c71730e81ac9a22a23b..ea490d4eea643ec4dbec4bf4d9b0366b01d6389d 100644
--- a/dashboard/web/styles.css
+++ b/dashboard/web/styles.css
@@ -173,7 +173,7 @@ button { font: inherit; color: inherit; }
 .nav-item:hover { background: var(--hover); color: var(--text); }
 .nav-item.active { background: var(--accent-wash); color: var(--accent); font-weight: 600; }
 .nav-item .icon { width: 16px; height: 16px; flex: none; opacity: 0.9; }
-.nav-item .label { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.nav-item .label, .nav-sub .label { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .nav-item .badge { display: flex; gap: 8px; font-size: 11px; color: var(--muted); font-variant-numeric: tabular-nums; }
 .nav-item .tally .status-label { gap: 4px; color: var(--text-2); }
 .nav-item .tally .status { width: 8px; height: 8px; }
diff --git a/guest/DESIGN.md b/guest/DESIGN.md
index b4b773662e9bc1bd6b2e9d7923876d954843d84d..f1e4dbc8954fe9039c75e3a06a1efd7a0301e413 100644
--- a/guest/DESIGN.md
+++ b/guest/DESIGN.md
@@ -1,10 +1,10 @@
-# Guest cursor stream
+# Guest display stream
 
-The executable is freestanding C99. `cursor.c` contains pixel conversion and dirty-rectangle detection; `windows.c` owns Win32 capture and transport. Zig supplies the cross compiler and Windows headers, with no Zig or C runtime in the executable. x86 and x64 target Windows 7; ARM64 targets Windows 10. PE subsystem versions and imported DLLs are checked by `python3 guest/test.py`. Runtime validation currently uses Windows 10, not a Windows 7 fixture.
+The executable is freestanding C99. `cursor.c` contains pixel conversion and dirty-rectangle detection; `windows.c` owns desktop capture and transport; `capture.c` implements optional window surfaces. Zig supplies the cross compiler and Windows headers, with no Zig or C runtime in the executable. x86 and x64 target Windows 7; ARM64 targets Windows 10. PE subsystem versions and imported DLLs are checked by `python3 guest/test.py`. Runtime validation uses Windows 10 and 11; Windows 7 runtime behavior is unverified.
 
 Build with `python3 guest/build.py --arch x86_64` (also `x86` and `aarch64`). In an elevated PowerShell session inside the logged-in administrator's desktop, run `./install.ps1 -Binary ./build/snowglobe-guest-x86_64.exe`. The installer uses Task Scheduler COM APIs available to PowerShell 2, installs into protected Program Files, and starts an elevated task at that user's logon. `-Remove` removes that task and executable. Elevation is required by the VirtIO serial driver's device ACL; capture must run in the interactive session, not session 0. The guest needs a compatible VirtIO serial driver and the channel named in `protocol.json`. A standard-user launcher requires a privileged handle broker; it is not part of this first backend.
 
-`BitBlt` copies the primary desktop into a CPU DIB without drawing the cursor. RGB comparisons ignore the unused fourth byte. Unchanged pixels produce no screen packets; changed pixels produce one bounding rectangle. Cursor polling runs every 8 ms; screen capture runs at most 30 Hz. The host's existing encoder supplies WebRTC video. Secure desktops, RDP sessions that differ from the physical console, and capture failures return the viewer to QEMU capture.
+`BitBlt` copies the primary desktop into a CPU DIB without drawing the cursor. RGB comparisons ignore the unused fourth byte. Unchanged pixels produce no screen packets; changed pixels produce one bounding rectangle. Cursor polling runs every millisecond; desktop capture targets 60 Hz. The host's existing encoder supplies WebRTC video. Secure desktops, RDP sessions that differ from the physical console, and capture failures return the viewer to QEMU capture.
 
 `GetCursorInfo` supplies the shape, visibility, and observed position. `GetIconInfo` and black/white `DrawIconEx` renders recover RGBA and binary XOR planes, including colored XOR. Nonbinary color XOR and unsupported cursor sizes explicitly fall back to the browser's default cursor, preserving video. Animation timing uses the optional `GetCursorFrameInfo` user32 export, resolved by name. Missing or unusable animation metadata falls back to a static frame. Animation starts a browser-local clock; Windows does not expose the current animation phase through this interface. Ordinary shapes use the browser cursor; XOR shapes use local layers with difference blending. Neither follows streamed positions.
 
@@ -16,10 +16,23 @@ Build with `python3 guest/build.py --arch x86_64` (also `x86` and `aarch64`). In
 - Cursor: each frame is a uint32 duration in milliseconds, width × height RGBA pixels, then one XOR bit mask byte per pixel. The schema assigns the channel bits; each selected channel inverts the underlying browser pixel. Zero dimensions and zero frames mean unsupported shape/default cursor.
 - Pointer: coordinates use signed two's-complement values in the uint32 fields. These are observations, not a cursor hit map.
 - Suspend and heartbeat have empty payloads. A heartbeat arrives at least once per second; four seconds without a packet falls back to QEMU.
-- Refresh is the only host-to-guest message and has an empty payload. The agent validates the entire request. The host requests it on every connection, including reconnects that reuse an open guest port.
+- Refresh has an empty payload. The host requests it on every connection and resends cached cursor state when WebRTC connects.
+- Stream pauses or resumes capture; heartbeats continue while paused.
+- Stop has an empty payload. The last viewer closing or service shutdown drains guest writes until the guest acknowledges stop, then closes the channel. The guest sends no further packets after its acknowledgement and closes its handle.
+- Capabilities advertises window capture and stop-handshake support. Older agents without stop support retain the original transport-close behavior; update the agent for safe channel retirement. Experiment requests enable or disable window capture.
+- Windows lists full surface dimensions, desktop position, stacking order, and native caption bounds. Surface contains tightly packed BGRx dirty rectangles; the first update is complete.
+- Capture statistics reports observed frame counts and time spent capturing, comparing, and writing.
 
-The host broker validates a running VM's libvirt-owned channel path. One guest reader fans out to that VM's viewers. Guest bytes are untrusted and bounded before decoding; viewer buffers are bounded independently. No guest network listener or GPU is required.
+Transport writes are limited to 64 KiB so each request fits the VirtIO serial DMA descriptor budget.
 
-## Later backends and surfaces
+The host broker validates a running VM's libvirt-owned channel path. One guest reader fans out to that VM's viewers. Guest bytes are untrusted and bounded before decoding; viewer buffers are bounded independently. No guest network listener or host GPU capture process is required.
 
-Keep the core independent of an OS and add real platform implementations when their capture and cursor APIs can be tested. X11 cursor notifications, Wayland's compositor/portal permissions, and macOS capture permissions need separate backend decisions, not empty adapters. The next Windows experiment can enumerate HWNDs and attach full surfaces, geometry, stacking, and dirty regions to this transport; occlusion, layered windows, protected content, DPI, and secure desktops need explicit behavior. A window rectangle does not imply a uniform cursor: application hit testing can change the shape anywhere inside it. Region prediction should be based on validated application information or observations with invalidation, not fabricated bounding boxes.
+## Separate windows experiment
+
+Windows 10 build 19041 and later can enable separate windows from the viewer’s View menu. Windows Graphics Capture supplies full unoccluded surfaces with cursor capture disabled. Its dependencies are loaded dynamically, preserving the Windows 7 import boundary. Desktop and taskbar surfaces use `PrintWindow` because Windows Graphics Capture rejects those shell HWNDs. Changed rectangles update a single host atlas and one existing video encoder. Metadata describes the atlas and stacking; the browser composes it and moves cached surfaces immediately during native caption drags. Atlas geometry is matched to the decoded RTP frame.
+
+The experiment is off by default. Unsupported, layered, or oversized window sets fall back to desktop video. Secure desktops and session changes suspend guest capture. `PrintWindow` is synchronous; an unresponsive shell can interrupt the guest stream and trigger the host timeout. Protected content and custom caption behavior remain subject to the application’s capture support.
+
+## Later backends
+
+Keep the core independent of an OS and add real platform implementations when their capture and cursor APIs can be tested. X11 cursor notifications, Wayland's compositor/portal permissions, and macOS capture permissions need separate backend decisions, not empty adapters. A window rectangle does not imply a uniform cursor: application hit testing can change the shape anywhere inside it. Region prediction should be based on validated application information or observations with invalidation, not fabricated bounding boxes.
diff --git a/guest/build.py b/guest/build.py
index 397469e76e8110bd00a21b60787668bfd74ad7c5..354f885b9a67f1766e77ff0261cf7b5eddad8a23 100644
--- a/guest/build.py
+++ b/guest/build.py
@@ -19,6 +19,8 @@ header += [f"#define SG_XOR_{key.upper()} {value}u" for key, value in schema["xo
 for name, packet in schema["packets"].items():
     header += [f"#define SG_{name.upper()} {packet['id']}u", f"#define SG_{name.upper()}_WORDS {len(packet['fields'])}u"]
     header += [f"#define SG_{name.upper()}_{field.upper()} {index}u" for index, field in enumerate(packet["fields"])]
+header += [f"#define SG_WINDOW_WORDS {len(schema['window_fields'])}u"]
+header += [f"#define SG_WINDOW_{field.upper()} {index}u" for index, field in enumerate(schema["window_fields"])]
 header += [f'#define SG_MAGIC "{schema["magic"]}"', f'#define SG_CHANNEL L"{schema["channel"]}"', "#endif"]
 (args.output / "protocol.h").write_text("\n".join(header) + "\n")
 subsystem = "10.0" if args.arch == "aarch64" else "6.1"
@@ -29,7 +31,7 @@ subprocess.run([
     "zig", "cc", "-target", args.arch + ("-windows.win10-gnu" if args.arch == "aarch64" else "-windows.win7-gnu"), "-std=c99", "-Os", "-Wall", "-Wextra", "-Werror",
     "-ffreestanding", "-fno-stack-protector", "-nostdlib", "-D_WIN32_WINNT=0x0601", "-DWINVER=0x0601",
     "-isystem", str(library / "libc/include/any-windows-any"),
-    "-I", str(args.output), str(source / "cursor.c"), str(source / "windows.c"),
+    "-I", str(args.output), str(source / "cursor.c"), str(source / "windows.c"), str(source / "capture.c"),
     "-lkernel32", "-luser32", "-lgdi32", "-Wl,--entry,mainCRTStartup", "-Wl,--subsystem,windows",
     "-Wl,--major-subsystem-version," + subsystem.split(".")[0], "-Wl,--minor-subsystem-version," + subsystem.split(".")[1],
     "-o", str(args.output / ("snowglobe-guest-" + args.arch + ".exe")),
diff --git a/guest/capture.c b/guest/capture.c
new file mode 100644
index 0000000000000000000000000000000000000000..4cf10d863a3c2b26032b5f5372d04e3b9eb72022
--- /dev/null
+++ b/guest/capture.c
@@ -0,0 +1,350 @@
+#define WIN32_LEAN_AND_MEAN
+#define COBJMACROS
+#define UNICODE
+#define _UNICODE
+#include <windows.h>
+#include <d3d11.h>
+#include "capture.h"
+
+struct size { INT32 width, height; };
+struct object { void **vtable; };
+/* WinRT ABI calls stay here so the Win7 executable imports no newer runtime. */
+#define METHOD(o, slot, signature) ((signature)((struct object *)(o))->vtable[slot])
+typedef HRESULT (WINAPI *query_fn)(void *, const GUID *, void **);
+typedef ULONG (WINAPI *release_fn)(void *);
+typedef HRESULT (WINAPI *close_fn)(void *);
+typedef HRESULT (WINAPI *object_fn)(void *, void **);
+typedef HRESULT (WINAPI *size_fn)(void *, struct size *);
+typedef HRESULT (WINAPI *window_fn)(void *, HWND, const GUID *, void **);
+typedef HRESULT (WINAPI *pool_fn)(void *, void *, int, int, struct size, void **);
+typedef HRESULT (WINAPI *recreate_fn)(void *, void *, int, int, struct size);
+typedef HRESULT (WINAPI *session_fn)(void *, void *, void **);
+typedef HRESULT (WINAPI *bool_fn)(void *, BOOLEAN);
+typedef HRESULT (WINAPI *initialize_fn)(int);
+typedef void (WINAPI *uninitialize_fn)(void);
+typedef HRESULT (WINAPI *string_fn)(PCWSTR, UINT32, void **);
+typedef HRESULT (WINAPI *delete_string_fn)(void *);
+typedef HRESULT (WINAPI *factory_fn)(void *, const GUID *, void **);
+typedef HRESULT (WINAPI *device_fn)(IDXGIDevice *, void **);
+typedef HRESULT (WINAPI *attribute_fn)(HWND, DWORD, PVOID, DWORD);
+
+static const GUID item_iid = {0x79c3f95b,0x31f7,0x4ec2,{0xa4,0x64,0x63,0x2e,0xf5,0xd3,0x07,0x60}};
+static const GUID interop_iid = {0x3628e81b,0x3cac,0x4c60,{0xb7,0xf4,0x23,0xce,0x0e,0x0c,0x33,0x56}};
+static const GUID pool_iid = {0x589b103f,0x6bbc,0x5df5,{0xa9,0x91,0x02,0xe2,0x8b,0x3b,0x66,0xd5}};
+static const GUID cursor_iid = {0x2c39ae40,0x7d2e,0x5044,{0x80,0x4e,0x8b,0x67,0x99,0xd4,0xcf,0x9e}};
+static const GUID close_iid = {0x30d5a829,0x7fa4,0x4026,{0x83,0xbb,0xd7,0x5b,0xae,0x4e,0xa9,0x9e}};
+static const GUID dxgi_iid = {0x54ec77fa,0x1377,0x44e6,{0x8c,0x32,0x88,0xfd,0x5f,0x44,0xc8,0x4c}};
+static const GUID access_iid = {0xa9b3d012,0x3df2,0x4ee3,{0xb8,0xd1,0x86,0x95,0xf4,0x57,0xd3,0xc1}};
+static const GUID texture_iid = {0x6f15aaf2,0xd208,0x4e89,{0x9a,0xb4,0x48,0x95,0x35,0xd3,0x4f,0x9c}};
+
+struct window {
+    HWND hwnd;
+    uint32_t id, width, height;
+    struct size pool_size;
+    void *pool, *session;
+    ID3D11Texture2D *staging;
+    uint8_t *before, *bits;
+    HDC dc;
+    HBITMAP dib, selected;
+    int initial, seen, shell;
+};
+static struct window windows[SG_MAX_WINDOWS];
+static uint32_t layout[SG_WINDOWS_WORDS + SG_MAX_WINDOWS * SG_WINDOW_WORDS];
+static uint32_t prior[SG_WINDOWS_WORDS + SG_MAX_WINDOWS * SG_WINDOW_WORDS];
+static uint32_t count, next_id;
+static size_t allocated;
+static int invalid;
+static HANDLE heap;
+/* Capture workers outlive session disposal; retain their DLLs until process exit. */
+static HMODULE runtime, d3d, dwm, composition;
+static ID3D11Device *device;
+static ID3D11DeviceContext *context;
+static void *capture_device, *interop, *pool_factory;
+static string_fn create_string;
+static delete_string_fn delete_string;
+static factory_fn get_factory;
+static uninitialize_fn uninitialize;
+static attribute_fn attribute;
+static DWORD retry;
+
+static void release(void *object) {
+    if (object) METHOD(object, 2, release_fn)(object);
+}
+static void close_object(void *object) {
+    void *closable = NULL;
+    if (object && SUCCEEDED(METHOD(object, 0, query_fn)(object, &close_iid, &closable))) {
+        METHOD(closable, 6, close_fn)(closable);
+        release(closable);
+    }
+    release(object);
+}
+static void drop(struct window *window) {
+    close_object(window->session); close_object(window->pool);
+    if (window->staging) ID3D11Texture2D_Release(window->staging);
+    if (window->selected) SelectObject(window->dc, window->selected);
+    if (window->dib) DeleteObject(window->dib);
+    if (window->dc) DeleteDC(window->dc);
+    window->dc = NULL; window->dib = window->selected = NULL; window->bits = NULL;
+    if (window->before) { allocated -= (size_t)window->width * window->height; HeapFree(heap, 0, window->before); }
+    window->hwnd = NULL; window->session = window->pool = NULL;
+    window->staging = NULL; window->before = NULL;
+    window->width = window->height = 0;
+}
+static int factory(PCWSTR name, const GUID *iid, void **result) {
+    void *string = NULL;
+    UINT32 length = 0;
+    while (name[length]) ++length;
+    if (FAILED(create_string(name, length, &string))) return 0;
+    HRESULT status = get_factory(string, iid, result);
+    delete_string(string);
+    HMODULE module;
+    return SUCCEEDED(status) && GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_PIN,
+        (LPCWSTR)((struct object *)*result)->vtable[0], &module);
+}
+
+void sg_windows_stop(void) {
+    uint32_t i;
+    for (i = 0; i < SG_MAX_WINDOWS; ++i) drop(windows + i);
+    release(pool_factory); release(interop); release(capture_device);
+    if (context) ID3D11DeviceContext_Release(context);
+    if (device) ID3D11Device_Release(device);
+    pool_factory = interop = capture_device = NULL; context = NULL; device = NULL;
+    if (uninitialize) uninitialize();
+    uninitialize = NULL;
+    count = 0;
+    retry = 0;
+    for (i = 0; i < sizeof(prior) / sizeof(prior[0]); ++i) prior[i] = 0;
+}
+
+int sg_windows_start(void) {
+    initialize_fn initialize;
+    typedef HRESULT (WINAPI *create_fn)(IDXGIAdapter *, D3D_DRIVER_TYPE, HMODULE, UINT, const D3D_FEATURE_LEVEL *, UINT, UINT, ID3D11Device **, D3D_FEATURE_LEVEL *, ID3D11DeviceContext **);
+    create_fn create;
+    device_fn wrap;
+    IDXGIDevice *dxgi = NULL;
+    sg_windows_stop();
+    heap = GetProcessHeap();
+    if (!runtime) runtime = LoadLibraryW(L"combase.dll");
+    if (!d3d) d3d = LoadLibraryW(L"d3d11.dll");
+    if (!dwm) dwm = LoadLibraryW(L"dwmapi.dll");
+    if (!composition) composition = LoadLibraryW(L"dcomp.dll");
+    if (!runtime || !d3d || !dwm || !composition) goto failed;
+    initialize = (initialize_fn)GetProcAddress(runtime, "RoInitialize");
+    create_string = (string_fn)GetProcAddress(runtime, "WindowsCreateString");
+    delete_string = (delete_string_fn)GetProcAddress(runtime, "WindowsDeleteString");
+    get_factory = (factory_fn)GetProcAddress(runtime, "RoGetActivationFactory");
+    create = (create_fn)GetProcAddress(d3d, "D3D11CreateDevice");
+    wrap = (device_fn)GetProcAddress(d3d, "CreateDirect3D11DeviceFromDXGIDevice");
+    attribute = (attribute_fn)GetProcAddress(dwm, "DwmGetWindowAttribute");
+    if (!initialize || !create_string || !delete_string || !get_factory || !create || !wrap || !attribute || FAILED(initialize(1))) goto failed;
+    uninitialize = (uninitialize_fn)GetProcAddress(runtime, "RoUninitialize");
+    if (!factory(L"Windows.Graphics.Capture.GraphicsCaptureItem", &interop_iid, &interop) ||
+        !factory(L"Windows.Graphics.Capture.Direct3D11CaptureFramePool", &pool_iid, &pool_factory)) goto failed;
+    if (FAILED(create(NULL, D3D_DRIVER_TYPE_HARDWARE, NULL, D3D11_CREATE_DEVICE_BGRA_SUPPORT, NULL, 0, D3D11_SDK_VERSION, &device, NULL, &context)) &&
+        FAILED(create(NULL, D3D_DRIVER_TYPE_WARP, NULL, D3D11_CREATE_DEVICE_BGRA_SUPPORT, NULL, 0, D3D11_SDK_VERSION, &device, NULL, &context))) goto failed;
+    if (FAILED(ID3D11Device_QueryInterface(device, &dxgi_iid, (void **)&dxgi))) goto failed;
+    HRESULT status = wrap(dxgi, &capture_device);
+    IDXGIDevice_Release(dxgi);
+    if (FAILED(status)) goto failed;
+    return 1;
+failed:
+    sg_windows_stop();
+    return 0;
+}
+
+static BOOL CALLBACK enumerate(HWND hwnd, LPARAM unused) {
+    RECT rect;
+    DWORD cloaked = 0;
+    uint32_t i;
+    (void)unused;
+    if (!IsWindowVisible(hwnd) || IsIconic(hwnd)) return TRUE;
+    attribute(hwnd, 14, &cloaked, sizeof(cloaked));
+    if (cloaked || !GetWindowRect(hwnd, &rect) || rect.right <= rect.left || rect.bottom <= rect.top) return TRUE;
+    if (rect.left >= (LONG)layout[SG_WINDOWS_WIDTH] || rect.top >= (LONG)layout[SG_WINDOWS_HEIGHT] || rect.right <= 0 || rect.bottom <= 0) return TRUE;
+    if (count == SG_MAX_WINDOWS || (GetWindowLongW(hwnd, GWL_EXSTYLE) & WS_EX_LAYERED)) { invalid = 1; return FALSE; }
+    for (i = 0; i < SG_MAX_WINDOWS; ++i) if (windows[i].hwnd == hwnd) break;
+    if (i == SG_MAX_WINDOWS) {
+        for (i = 0; i < SG_MAX_WINDOWS; ++i) if (!windows[i].hwnd) break;
+        if (i == SG_MAX_WINDOWS) { invalid = 1; return FALSE; }
+        windows[i].hwnd = hwnd; windows[i].id = ++next_id; windows[i].initial = 1;
+    }
+    windows[i].seen = 1;
+    WCHAR class_name[32] = {0};
+    GetClassNameW(hwnd, class_name, 32);
+    windows[i].shell = hwnd == GetShellWindow() ||
+        !lstrcmpW(class_name, L"Shell_TrayWnd") || !lstrcmpW(class_name, L"Shell_SecondaryTrayWnd") || !lstrcmpW(class_name, L"WorkerW");
+    if (FAILED(attribute(hwnd, 9, &rect, sizeof(rect)))) GetWindowRect(hwnd, &rect);
+    uint32_t *record = layout + SG_WINDOWS_WORDS + count++ * SG_WINDOW_WORDS;
+    record[SG_WINDOW_ID] = windows[i].id;
+    record[SG_WINDOW_X] = (uint32_t)rect.left; record[SG_WINDOW_Y] = (uint32_t)rect.top;
+    record[SG_WINDOW_WIDTH] = (uint32_t)(rect.right - rect.left); record[SG_WINDOW_HEIGHT] = (uint32_t)(rect.bottom - rect.top);
+    for (i = SG_WINDOW_CAPTION_LEFT; i <= SG_WINDOW_CAPTION_BOTTOM; ++i) record[i] = 0;
+    if ((GetWindowLongW(hwnd, GWL_STYLE) & WS_CAPTION) == WS_CAPTION) {
+        TITLEBARINFO title = {0};
+        title.cbSize = sizeof(title);
+        if (GetTitleBarInfo(hwnd, &title) && title.rcTitleBar.right > title.rcTitleBar.left && !(title.rgstate[0] & STATE_SYSTEM_INVISIBLE)) {
+            record[SG_WINDOW_CAPTION_LEFT] = (uint32_t)(title.rcTitleBar.left + GetSystemMetrics(SM_CXSIZE));
+            record[SG_WINDOW_CAPTION_TOP] = (uint32_t)title.rcTitleBar.top;
+            record[SG_WINDOW_CAPTION_RIGHT] = (uint32_t)(title.rcTitleBar.right - GetSystemMetrics(SM_CXSIZE) * 3);
+            record[SG_WINDOW_CAPTION_BOTTOM] = (uint32_t)title.rcTitleBar.bottom;
+        }
+    }
+    return TRUE;
+}
+
+static int start_window(struct window *window) {
+    void *item = NULL, *cursor = NULL;
+    struct size size;
+    int success = 0;
+    if (FAILED(METHOD(interop, 3, window_fn)(interop, window->hwnd, &item_iid, &item))) goto done;
+    if (FAILED(METHOD(item, 7, size_fn)(item, &size)) || size.width <= 0 || size.height <= 0 || size.width > (INT32)SG_MAX_DIMENSION || size.height > (INT32)SG_MAX_DIMENSION) goto done;
+    if (FAILED(METHOD(pool_factory, 6, pool_fn)(pool_factory, capture_device, DXGI_FORMAT_B8G8R8A8_UNORM, 2, size, &window->pool))) goto done;
+    if (FAILED(METHOD(window->pool, 10, session_fn)(window->pool, item, &window->session))) goto done;
+    if (FAILED(METHOD(window->session, 0, query_fn)(window->session, &cursor_iid, &cursor))) goto done;
+    if (FAILED(METHOD(cursor, 7, bool_fn)(cursor, FALSE)) || FAILED(METHOD(window->session, 6, close_fn)(window->session))) goto done;
+    window->pool_size = size;
+    success = 1;
+done:
+    release(cursor); release(item);
+    return success;
+}
+
+int sg_windows_poll(sg_emit emit, int refresh) {
+    uint32_t i, n, words[SG_SURFACE_WORDS] = {0};
+    if (retry && (DWORD)(GetTickCount() - retry) < 1000 && !refresh) return 1;
+    retry = 0;
+    count = 0; invalid = 0;
+    layout[SG_WINDOWS_WIDTH] = (uint32_t)GetSystemMetrics(SM_CXSCREEN);
+    layout[SG_WINDOWS_HEIGHT] = (uint32_t)GetSystemMetrics(SM_CYSCREEN);
+    for (i = 0; i < SG_MAX_WINDOWS; ++i) windows[i].seen = 0;
+    EnumWindows(enumerate, 0);
+    for (i = 0; i < SG_MAX_WINDOWS; ++i) if (windows[i].hwnd && !windows[i].seen) drop(windows + i);
+    layout[SG_WINDOWS_COUNT] = invalid ? 0 : count;
+    n = SG_WINDOWS_WORDS + layout[SG_WINDOWS_COUNT] * SG_WINDOW_WORDS;
+    int changed = refresh;
+    for (i = 0; i < n; ++i) if (layout[i] != prior[i]) changed = 1;
+    if (changed && !emit(SG_WINDOWS, layout, n, NULL, 0)) return 0;
+    for (i = 0; i < n; ++i) prior[i] = layout[i];
+    if (invalid) return 1;
+    for (i = 0; i < SG_MAX_WINDOWS; ++i) {
+        struct window *window = windows + i;
+        void *frame = NULL, *surface = NULL, *access = NULL;
+        ID3D11Texture2D *texture = NULL;
+        D3D11_TEXTURE2D_DESC desc;
+        D3D11_MAPPED_SUBRESOURCE mapped;
+        struct size size;
+        struct sg_rect rect;
+        uint32_t y;
+        int success = 1;
+        if (!window->hwnd) continue;
+        uint32_t *record = NULL;
+        for (n = 0; n < count; ++n) {
+            uint32_t *candidate = layout + SG_WINDOWS_WORDS + n * SG_WINDOW_WORDS;
+            if (candidate[SG_WINDOW_ID] == window->id) { record = candidate; break; }
+        }
+        if (!record) continue;
+        if (window->shell) {
+            RECT bounds;
+            if (!GetWindowRect(window->hwnd, &bounds)) goto frame_failed;
+            size.width = bounds.right - bounds.left; size.height = bounds.bottom - bounds.top;
+            mapped.pData = NULL;
+        } else {
+            if (!window->pool && !start_window(window)) goto frame_failed;
+            struct size target = {(INT32)record[SG_WINDOW_WIDTH], (INT32)record[SG_WINDOW_HEIGHT]};
+            if (window->pool_size.width != target.width || window->pool_size.height != target.height) {
+                if (FAILED(METHOD(window->pool, 6, recreate_fn)(window->pool, capture_device, DXGI_FORMAT_B8G8R8A8_UNORM, 2, target))) goto frame_failed;
+                window->pool_size = target;
+                window->initial = 1;
+            }
+            if (FAILED(METHOD(window->pool, 7, object_fn)(window->pool, &frame))) goto frame_failed;
+            if (!frame) continue;
+            if (FAILED(METHOD(frame, 8, size_fn)(frame, &size))) goto frame_failed;
+            if (size.width != target.width || size.height != target.height) goto frame_done;
+            if (FAILED(METHOD(frame, 6, object_fn)(frame, &surface)) ||
+                FAILED(METHOD(surface, 0, query_fn)(surface, &access_iid, &access)) ||
+                FAILED(METHOD(access, 3, query_fn)(access, &texture_iid, (void **)&texture))) goto frame_failed;
+        }
+        if (size.width <= 0 || size.height <= 0 || size.width > (INT32)SG_MAX_DIMENSION || size.height > (INT32)SG_MAX_DIMENSION) goto frame_failed;
+        if (texture) {
+            ID3D11Texture2D_GetDesc(texture, &desc);
+            if (desc.Width < (UINT)size.width || desc.Height < (UINT)size.height) goto frame_failed;
+        }
+        if (window->width != (uint32_t)size.width || window->height != (uint32_t)size.height) {
+            if (window->staging) ID3D11Texture2D_Release(window->staging);
+            window->staging = NULL;
+            if (window->selected) SelectObject(window->dc, window->selected);
+            if (window->dib) DeleteObject(window->dib);
+            window->dib = window->selected = NULL; window->bits = NULL;
+            if (window->before) { allocated -= (size_t)window->width * window->height; HeapFree(heap, 0, window->before); window->before = NULL; }
+            if (allocated + (size_t)size.width * size.height > SG_MAX_PIXELS) goto frame_failed;
+            window->width = (uint32_t)size.width; window->height = (uint32_t)size.height;
+            window->before = HeapAlloc(heap, 0, (size_t)window->width * window->height * 4);
+            if (!window->before) goto frame_failed;
+            allocated += (size_t)window->width * window->height;
+            if (window->shell) {
+                BITMAPINFO info = {0};
+                if (!window->dc) window->dc = CreateCompatibleDC(NULL);
+                info.bmiHeader.biSize = sizeof(BITMAPINFOHEADER); info.bmiHeader.biWidth = size.width;
+                info.bmiHeader.biHeight = -size.height; info.bmiHeader.biPlanes = 1; info.bmiHeader.biBitCount = 32;
+                window->dib = CreateDIBSection(window->dc, &info, DIB_RGB_COLORS, (void **)&window->bits, NULL, 0);
+                if (!window->dc || !window->dib) goto frame_failed;
+                window->selected = SelectObject(window->dc, window->dib);
+            } else {
+                desc.Width = window->width; desc.Height = window->height;
+                desc.BindFlags = 0; desc.MiscFlags = 0; desc.Usage = D3D11_USAGE_STAGING; desc.CPUAccessFlags = D3D11_CPU_ACCESS_READ;
+                if (FAILED(ID3D11Device_CreateTexture2D(device, &desc, NULL, &window->staging))) goto frame_failed;
+            }
+            window->initial = 1;
+        }
+        if (window->shell) {
+            DWORD_PTR result;
+            if (!SendMessageTimeoutW(window->hwnd, WM_NULL, 0, 0, SMTO_ABORTIFHUNG | SMTO_BLOCK, 20, &result) || !PrintWindow(window->hwnd, window->dc, 2)) goto frame_failed;
+            GdiFlush();
+            mapped.pData = window->bits; mapped.RowPitch = window->width * 4;
+        } else {
+            D3D11_BOX box = {0, 0, 0, window->width, window->height, 1};
+            ID3D11DeviceContext_CopySubresourceRegion(context, (ID3D11Resource *)window->staging, 0, 0, 0, 0, (ID3D11Resource *)texture, 0, &box);
+            if (FAILED(ID3D11DeviceContext_Map(context, (ID3D11Resource *)window->staging, 0, D3D11_MAP_READ, 0, &mapped))) goto frame_failed;
+        }
+        rect.x = window->width; rect.y = window->height; rect.width = rect.height = 0;
+        if (refresh || window->initial) { rect.x = rect.y = 0; rect.width = window->width; rect.height = window->height; }
+        else for (y = 0; y < window->height; ++y) {
+            struct sg_rect row;
+            if (sg_difference(window->before + (size_t)y * window->width * 4, (uint8_t *)mapped.pData + (size_t)y * mapped.RowPitch, window->width, 1, &row)) {
+                if (row.x < rect.x) rect.x = row.x;
+                if (row.x + row.width > rect.width) rect.width = row.x + row.width;
+                if (y < rect.y) rect.y = y;
+                rect.height = y + 1;
+            }
+        }
+        if (rect.width && rect.height) {
+            if (!refresh && !window->initial) { rect.width -= rect.x; rect.height -= rect.y; }
+            words[SG_SURFACE_ID] = window->id; words[SG_SURFACE_WIDTH] = window->width; words[SG_SURFACE_HEIGHT] = window->height;
+            words[SG_SURFACE_X] = rect.x; words[SG_SURFACE_Y] = rect.y; words[SG_SURFACE_RECT_WIDTH] = rect.width; words[SG_SURFACE_RECT_HEIGHT] = rect.height;
+            success = emit(SG_SURFACE, words, SG_SURFACE_WORDS, (uint8_t *)mapped.pData + (size_t)rect.y * mapped.RowPitch + rect.x * 4, mapped.RowPitch);
+            for (y = rect.y; y < rect.y + rect.height; ++y) {
+                uint32_t x;
+                uint8_t *src = (uint8_t *)mapped.pData + (size_t)y * mapped.RowPitch + rect.x * 4;
+                uint8_t *dst = window->before + ((size_t)y * window->width + rect.x) * 4;
+                for (x = 0; x < rect.width * 4; ++x) dst[x] = src[x];
+            }
+            window->initial = 0;
+        }
+        if (texture) ID3D11DeviceContext_Unmap(context, (ID3D11Resource *)window->staging, 0);
+        goto frame_done;
+frame_failed:
+        invalid = 1;
+frame_done:
+        if (texture) ID3D11Texture2D_Release(texture);
+        release(access); release(surface); close_object(frame);
+        if (!success) return 0;
+        if (invalid) { drop(window); break; }
+    }
+    if (invalid) {
+        retry = GetTickCount();
+        uint32_t disabled[SG_WINDOWS_WORDS] = {layout[SG_WINDOWS_WIDTH], layout[SG_WINDOWS_HEIGHT], 0};
+        if (!emit(SG_WINDOWS, disabled, SG_WINDOWS_WORDS, NULL, 0)) return 0;
+        prior[SG_WINDOWS_COUNT] = 0;
+    }
+    return 1;
+}
diff --git a/guest/capture.h b/guest/capture.h
new file mode 100644
index 0000000000000000000000000000000000000000..206b1d4783f0f94e5cd0773050c902c3ec95ef4f
--- /dev/null
+++ b/guest/capture.h
@@ -0,0 +1,9 @@
+#ifndef SG_CAPTURE_H
+#define SG_CAPTURE_H
+#include "cursor.h"
+
+typedef int (*sg_emit)(uint32_t type, const uint32_t *words, uint32_t count, const uint8_t *pixels, uint32_t stride);
+int sg_windows_start(void);
+int sg_windows_poll(sg_emit emit, int refresh);
+void sg_windows_stop(void);
+#endif
diff --git a/guest/protocol.json b/guest/protocol.json
index 902cd72501c51dba5c7be61dc677e5904cc3445f..de6ebe0a6221292a1d34978b094ed2d7fec52544 100644
--- a/guest/protocol.json
+++ b/guest/protocol.json
@@ -2,13 +2,21 @@
   "magic": "SGV1",
   "channel": "net.paperclover.snowglobe.0",
   "xor_bits": {"red": 1, "green": 2, "blue": 4},
-  "limits": {"dimension": 4096, "pixels": 8294400, "cursor_size": 128, "cursor_frames": 64, "packet_bytes": 33554456},
+  "limits": {"dimension": 4096, "pixels": 8294400, "cursor_size": 128, "cursor_frames": 64, "packet_bytes": 33554460, "windows": 32},
+  "window_fields": ["id", "x", "y", "width", "height", "caption_left", "caption_top", "caption_right", "caption_bottom"],
   "packets": {
     "screen": {"id": 1, "fields": ["width", "height", "x", "y", "rect_width", "rect_height"]},
     "cursor": {"id": 2, "fields": ["id", "width", "height", "hot_x", "hot_y", "frames"]},
     "pointer": {"id": 3, "fields": ["id", "x", "y", "visible"]},
     "suspend": {"id": 4, "fields": []},
     "refresh": {"id": 5, "fields": []},
-    "heartbeat": {"id": 6, "fields": []}
+    "heartbeat": {"id": 6, "fields": []},
+    "experiment": {"id": 7, "fields": ["enabled"]},
+    "windows": {"id": 8, "fields": ["width", "height", "count"]},
+    "surface": {"id": 9, "fields": ["id", "width", "height", "x", "y", "rect_width", "rect_height"]},
+    "capture_stats": {"id": 10, "fields": ["elapsed_ms", "frames", "capture_us", "scan_us", "write_us"]},
+    "capabilities": {"id": 11, "fields": ["windows", "stop"]},
+    "stream": {"id": 12, "fields": ["enabled"]},
+    "stop": {"id": 13, "fields": []}
   }
 }
diff --git a/guest/windows.c b/guest/windows.c
index bbf790c606b91b6b82c3aea5c932520023fd4c32..a35a5b7d516f232fda1563777502409e032512e3 100644
--- a/guest/windows.c
+++ b/guest/windows.c
@@ -3,19 +3,29 @@
 #define _UNICODE
 #include <windows.h>
 #include "cursor.h"
+#include "capture.h"
 
 typedef HCURSOR (WINAPI *cursor_frame_fn)(HCURSOR, DWORD, DWORD, DWORD *, DWORD *);
 static cursor_frame_fn cursor_frame;
 static HANDLE output;
 static HANDLE heap;
 static OVERLAPPED sending;
+static int modern_windows;
+
+static uint32_t microseconds(LONGLONG ticks, LONGLONG frequency) {
+    while (frequency > 0x7fffffff) { frequency >>= 1; ticks >>= 1; }
+    if (ticks > 0x7fffffff) return 0;
+    int value = MulDiv((int)ticks, 1000000, (int)frequency);
+    return value < 0 ? 0 : (uint32_t)value;
+}
 
 static int write_bytes(const void *data, DWORD length) {
     const uint8_t *bytes = data;
     DWORD written;
     while (length) {
         ResetEvent(sending.hEvent);
-        if (!WriteFile(output, bytes, length, &written, &sending)) {
+        DWORD amount = length > 65536 ? 65536 : length;
+        if (!WriteFile(output, bytes, amount, &written, &sending)) {
             if (GetLastError() != ERROR_IO_PENDING) return 0;
             if (WaitForSingleObject(sending.hEvent, 3000) != WAIT_OBJECT_0) {
                 CancelIo(output); WaitForSingleObject(sending.hEvent, INFINITE); return 0;
@@ -29,16 +39,34 @@ static int write_bytes(const void *data, DWORD length) {
 }
 
 static int packet(uint32_t type, uint32_t length, const uint32_t *words, uint32_t count) {
-    uint8_t header[12], number[4];
+    uint8_t header[12 + (SG_WINDOWS_WORDS + SG_MAX_WINDOWS * SG_WINDOW_WORDS) * 4];
     uint32_t i;
+    if (count > SG_WINDOWS_WORDS + SG_MAX_WINDOWS * SG_WINDOW_WORDS) return 0;
     header[0] = SG_MAGIC[0]; header[1] = SG_MAGIC[1]; header[2] = SG_MAGIC[2]; header[3] = SG_MAGIC[3];
     sg_word(header + 4, type); sg_word(header + 8, length);
-    if (!write_bytes(header, sizeof(header))) return 0;
-    for (i = 0; i < count; ++i) {
-        sg_word(number, words[i]);
-        if (!write_bytes(number, sizeof(number))) return 0;
+    for (i = 0; i < count; ++i) sg_word(header + 12 + i * 4, words[i]);
+    return write_bytes(header, 12 + count * 4);
+}
+
+static int emit(uint32_t type, const uint32_t *words, uint32_t count, const uint8_t *pixels, uint32_t stride) {
+    uint32_t w = 0, h = 0;
+    if (pixels) {
+        w = words[type == SG_SCREEN ? SG_SCREEN_RECT_WIDTH : SG_SURFACE_RECT_WIDTH];
+        h = words[type == SG_SCREEN ? SG_SCREEN_RECT_HEIGHT : SG_SURFACE_RECT_HEIGHT];
     }
-    return 1;
+    if (!packet(type, count * 4 + w * h * 4, words, count)) return 0;
+    if (!pixels) return 1;
+    if (stride == w * 4) return write_bytes(pixels, w * h * 4);
+    uint8_t *packed = HeapAlloc(heap, 0, (size_t)w * h * 4);
+    if (!packed) return 0;
+    for (uint32_t y = 0; y < h; ++y) {
+        const uint8_t *src = pixels + (size_t)y * stride;
+        uint8_t *dst = packed + (size_t)y * w * 4;
+        for (uint32_t x = 0; x < w * 4; ++x) dst[x] = src[x];
+    }
+    int success = write_bytes(packed, w * h * 4);
+    HeapFree(heap, 0, packed);
+    return success;
 }
 
 static int capture_cursor(HCURSOR cursor, uint32_t id) {
@@ -108,14 +136,27 @@ static void stream(DWORD session) {
     uint32_t width = 0, height = 0, id = 0;
     HCURSOR last_cursor = NULL;
     POINT last_point = {-1, -1};
-    DWORD last_flags = ~0u, captured = GetTickCount() - 34;
+    DWORD last_flags = ~0u, cursor_retry = 0;
     DWORD heartbeat = GetTickCount(), received = 0;
+    LARGE_INTEGER frequency, now, next_capture, started, scanned, written;
+    uint32_t stats[SG_CAPTURE_STATS_WORDS] = {0};
+    HMODULE winmm = LoadLibraryW(L"winmm.dll");
+    typedef UINT (WINAPI *period_fn)(UINT);
+    period_fn begin_period = winmm ? (period_fn)GetProcAddress(winmm, "timeBeginPeriod") : NULL;
+    period_fn end_period = winmm ? (period_fn)GetProcAddress(winmm, "timeEndPeriod") : NULL;
     OVERLAPPED receiving = {0};
-    uint8_t request[12];
+    uint8_t request[16];
+    DWORD request_size = 12;
     int pending = 0;
-    int suspended = 0, initial = 1;
+    int suspended = 0, initial = 1, capturing = 1;
+    int windows_enabled = 0, windows_active = 0, cursor_supported = 1;
+    QueryPerformanceFrequency(&frequency); QueryPerformanceCounter(&next_capture);
+    if (begin_period && end_period) begin_period(1);
     receiving.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
     if (!screen || !dc || !receiving.hEvent) goto done;
+    if (frequency.QuadPart <= 0 || frequency.QuadPart > 0xffffffffu) goto done;
+    uint32_t capabilities[SG_CAPABILITIES_WORDS] = {modern_windows, 1};
+    if (!emit(SG_CAPABILITIES, capabilities, SG_CAPABILITIES_WORDS, NULL, 0)) goto done;
     for (;;) {
         if (session != WTSGetActiveConsoleSessionId()) goto done;
         CURSORINFO cursor = {sizeof(CURSORINFO), 0, NULL, {0, 0}};
@@ -125,7 +166,7 @@ static void stream(DWORD session) {
         DWORD amount = 0;
         if (!pending) {
             ResetEvent(receiving.hEvent);
-            if (!ReadFile(output, request + received, (DWORD)sizeof(request) - received, &amount, &receiving)) {
+            if (!ReadFile(output, request + received, request_size - received, &amount, &receiving)) {
                 if (GetLastError() != ERROR_IO_PENDING) goto done;
                 pending = 1;
             } else if (!GetOverlappedResult(output, &receiving, &amount, FALSE)) goto done;
@@ -134,27 +175,62 @@ static void stream(DWORD session) {
         if (!pending) {
             if (!amount) goto done;
             received += amount;
-            if (received == sizeof(request)) {
-                uint8_t expected[12] = {SG_MAGIC[0], SG_MAGIC[1], SG_MAGIC[2], SG_MAGIC[3], 0,0,0,0, 0,0,0,0};
+            if (received == 12 && request_size == 12) {
                 uint32_t i;
-                sg_word(expected + 4, SG_REFRESH);
-                for (i = 0; i < sizeof(request); ++i) if (request[i] != expected[i]) goto done;
-                received = 0; initial = 1; last_cursor = NULL; last_flags = ~0u;
+                for (i = 0; i < 4; ++i) if (request[i] != SG_MAGIC[i]) goto done;
+                if (request[4] || request[5] || request[6] || request[8] || request[9] || request[10]) goto done;
+                if (request[7] == SG_REFRESH && !request[11]) {
+                    received = 0; initial = 1; last_cursor = NULL; last_flags = ~0u;
+                    if (!emit(SG_CAPABILITIES, capabilities, SG_CAPABILITIES_WORDS, NULL, 0)) goto done;
+                } else if (request[7] == SG_STOP && !request[11]) {
+                    packet(SG_STOP, 0, NULL, 0);
+                    goto done;
+                } else if ((request[7] == SG_EXPERIMENT || request[7] == SG_STREAM) && request[11] == 4) request_size = 16;
+                else goto done;
+            }
+            if (received == 16) {
+                if (request[12] || request[13] || request[14] || request[15] > 1) goto done;
+                if (request[7] == SG_STREAM) {
+                    if (capturing != request[15]) {
+                        capturing = request[15];
+                        initial = 1; last_cursor = NULL; last_flags = ~0u;
+                        if (!capturing) { sg_windows_stop(); windows_active = 0; }
+                    }
+                } else {
+                    int enabled = request[15] && modern_windows;
+                    if (enabled != windows_enabled) { sg_windows_stop(); windows_active = 0; }
+                    windows_enabled = enabled;
+                    if (!windows_enabled) {
+                        uint32_t disabled[SG_WINDOWS_WORDS] = {0};
+                        if (!emit(SG_WINDOWS, disabled, SG_WINDOWS_WORDS, NULL, 0)) goto done;
+                    }
+                }
+                received = 0; request_size = 12;
             }
         }
         if ((DWORD)(GetTickCount() - heartbeat) >= 1000) {
+            stats[SG_CAPTURE_STATS_ELAPSED_MS] = GetTickCount() - heartbeat;
+            if (!emit(SG_CAPTURE_STATS, stats, SG_CAPTURE_STATS_WORDS, NULL, 0)) goto done;
+            for (uint32_t i = 0; i < SG_CAPTURE_STATS_WORDS; ++i) stats[i] = 0;
             if (!packet(SG_HEARTBEAT, 0, NULL, 0)) goto done;
             heartbeat = GetTickCount();
         }
+        if (!capturing) { Sleep(10); continue; }
         desktop = OpenInputDesktop(0, FALSE, DESKTOP_READOBJECTS);
         int active = desktop && GetUserObjectInformationW(desktop, UOI_NAME, name, sizeof(name), &length) && name[0] == L'D' && name[1] == L'e' && name[2] == L'f' && name[3] == L'a' && name[4] == L'u' && name[5] == L'l' && name[6] == L't' && !name[7];
         if (desktop) CloseDesktop(desktop);
         if (!active || !GetCursorInfo(&cursor)) {
             if (!suspended && !packet(SG_SUSPEND, 0, NULL, 0)) goto done;
             suspended = 1; initial = 1; last_cursor = NULL; last_flags = ~0u;
+            if (windows_active) sg_windows_stop();
+            windows_active = 0;
             Sleep(100); continue;
         }
         int changed = cursor.hCursor && cursor.hCursor != last_cursor;
+        if (suspended) {
+            if (!emit(SG_CAPABILITIES, capabilities, SG_CAPABILITIES_WORDS, NULL, 0)) goto done;
+            suspended = 0;
+        }
         if (changed) ++id;
         if (changed || cursor.flags != last_flags || cursor.ptScreenPos.x != last_point.x || cursor.ptScreenPos.y != last_point.y) {
             uint32_t words[SG_POINTER_WORDS] = {0};
@@ -163,7 +239,7 @@ static void stream(DWORD session) {
             if (!packet(SG_POINTER, sizeof(words), words, SG_POINTER_WORDS)) goto done;
             last_flags = cursor.flags; last_point = cursor.ptScreenPos;
         }
-        if (changed) {
+        if (changed || (!cursor_supported && (DWORD)(GetTickCount() - cursor_retry) >= 1000)) {
             int result = capture_cursor(cursor.hCursor, id);
             if (!result) goto done;
             if (result < 0) {
@@ -172,10 +248,14 @@ static void stream(DWORD session) {
                 if (!packet(SG_CURSOR, sizeof(words), words, SG_CURSOR_WORDS)) goto done;
             }
             last_cursor = cursor.hCursor;
+            cursor_supported = result > 0; cursor_retry = GetTickCount();
         }
-        if ((DWORD)(GetTickCount() - captured) >= 33) {
+        QueryPerformanceCounter(&now);
+        if (now.QuadPart >= next_capture.QuadPart) {
+            next_capture.QuadPart = now.QuadPart + (uint32_t)frequency.QuadPart / 60;
+            started = now;
             uint32_t w = (uint32_t)GetSystemMetrics(SM_CXSCREEN), h = (uint32_t)GetSystemMetrics(SM_CYSCREEN), y;
-            struct sg_rect rect;
+            struct sg_rect rect = {0};
             uint32_t words[SG_SCREEN_WORDS] = {0};
             if (!w || !h || w > SG_MAX_DIMENSION || h > SG_MAX_DIMENSION || w * h > SG_MAX_PIXELS) goto done;
             if (w != width || h != height) {
@@ -195,22 +275,42 @@ static void stream(DWORD session) {
                 suspended = 1; initial = 1; Sleep(100); continue;
             }
             GdiFlush();
+            QueryPerformanceCounter(&scanned);
+            ++stats[SG_CAPTURE_STATS_FRAMES];
+            stats[SG_CAPTURE_STATS_CAPTURE_US] += microseconds(scanned.QuadPart - started.QuadPart, frequency.QuadPart);
             if (initial) { rect.x = 0; rect.y = 0; rect.width = width; rect.height = height; }
-            else if (!sg_difference(before, pixels, width, height, &rect)) { captured = GetTickCount(); Sleep(8); continue; }
+            else if (!sg_difference(before, pixels, width, height, &rect)) rect.width = rect.height = 0;
+            QueryPerformanceCounter(&written);
+            stats[SG_CAPTURE_STATS_SCAN_US] += microseconds(written.QuadPart - scanned.QuadPart, frequency.QuadPart);
             words[SG_SCREEN_WIDTH] = width; words[SG_SCREEN_HEIGHT] = height;
             words[SG_SCREEN_X] = rect.x; words[SG_SCREEN_Y] = rect.y;
             words[SG_SCREEN_RECT_WIDTH] = rect.width; words[SG_SCREEN_RECT_HEIGHT] = rect.height;
-            if (!packet(SG_SCREEN, sizeof(words) + rect.width * rect.height * 4, words, SG_SCREEN_WORDS)) goto done;
+            if (rect.width && !emit(SG_SCREEN, words, SG_SCREEN_WORDS, pixels + ((size_t)rect.y * width + rect.x) * 4, width * 4)) goto done;
             for (y = rect.y; y < rect.y + rect.height; ++y) {
                 size_t offset = ((size_t)y * width + rect.x) * 4, i;
-                if (!write_bytes(pixels + offset, rect.width * 4)) goto done;
                 for (i = 0; i < rect.width * 4; ++i) before[offset + i] = pixels[offset + i];
             }
-            initial = 0; suspended = 0; captured = GetTickCount();
+            if (windows_enabled) {
+                if (!windows_active) {
+                    windows_active = sg_windows_start();
+                    if (!windows_active) {
+                        uint32_t disabled[SG_WINDOWS_WORDS] = {0};
+                        if (!emit(SG_WINDOWS, disabled, SG_WINDOWS_WORDS, NULL, 0)) goto done;
+                        windows_enabled = 0;
+                    }
+                }
+                if (windows_active && !sg_windows_poll(emit, initial)) goto done;
+            }
+            QueryPerformanceCounter(&now);
+            stats[SG_CAPTURE_STATS_WRITE_US] += microseconds(now.QuadPart - written.QuadPart, frequency.QuadPart);
+            initial = 0; suspended = 0;
         }
-        Sleep(8);
+        Sleep(1);
     }
 done:
+    sg_windows_stop();
+    if (begin_period && end_period) end_period(1);
+    if (winmm) FreeLibrary(winmm);
     CancelIo(output);
     if (pending) WaitForSingleObject(receiving.hEvent, INFINITE);
     if (receiving.hEvent) CloseHandle(receiving.hEvent);
@@ -229,6 +329,10 @@ void mainCRTStartup(void) {
     sending.hEvent = CreateEventW(NULL, TRUE, FALSE, NULL);
     if (!sending.hEvent) ExitProcess(1);
     SetProcessDPIAware();
+    typedef LONG (WINAPI *version_fn)(OSVERSIONINFOW *);
+    version_fn version = (version_fn)GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "RtlGetVersion");
+    OSVERSIONINFOW os = {0}; os.dwOSVersionInfoSize = sizeof(os);
+    modern_windows = version && !version(&os) && os.dwMajorVersion >= 10 && os.dwBuildNumber >= 19041;
     symbol = GetProcAddress(GetModuleHandleW(L"user32.dll"), "GetCursorFrameInfo");
     /* This optional user32 export supplies ANI step timing; static capture uses only documented APIs. */
     cursor_frame = (cursor_frame_fn)symbol;
diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index 2cdd4d20987c046d4571bc9fb1cd510d0f180dbc..b1ec203693e997c67f94d966c8f09b8b5b7a2050 100644
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -10,7 +10,7 @@ let
   };
   nativePkl = pkgs.callPackage ./pkl.nix { };
   screenPython = pkgs.python3.withPackages (packages: [ packages.pygobject3 packages.gst-python ]);
-  screenPlugins = (with pkgs.gst_all_1; [ (lib.getLib gstreamer) gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly ]) ++ [ (lib.getLib pkgs.libnice) ];
+  screenPlugins = (with pkgs.gst_all_1; [ (lib.getLib gstreamer) gst-plugins-base gst-plugins-good gst-plugins-bad gst-plugins-ugly gst-plugins-rs ]) ++ [ (lib.getLib pkgs.libnice) ];
   secureOvmf = pkgs.OVMF.override {
     secureBoot = true;
     msVarsTemplate = true;
diff --git a/tools/dashboard-vms-test.py b/tools/dashboard-vms-test.py
index ac821fcd4a7165141e8a35e5f6ccd4cf9274bce1..72034ffded66122394fdbdb3e09ab3c15fe60b08 100644
--- a/tools/dashboard-vms-test.py
+++ b/tools/dashboard-vms-test.py
@@ -22,6 +22,18 @@ spec.loader.exec_module(host)
 
 
 class VMTests(unittest.TestCase):
+    def test_guest_channel_uses_libvirts_truncated_domain_name(self):
+        name = 'window-stream-win11-test'
+        path = f'/run/libvirt/qemu/channel/175-{name[:20]}/{vms.GUEST_CHANNEL}'
+        xml = f'<domain id="175"><devices><channel type="unix"><source mode="bind" path="{path}"/><target name="{vms.GUEST_CHANNEL}"/></channel></devices></domain>'
+        with patch.object(sys, 'argv', ['vms.py', 'guest', json.dumps({'name': name})]), \
+                patch.object(vms, 'virsh', side_effect=lambda action, *_: xml if action == 'dumpxml' else 'running'):
+            self.assertEqual(vms.main(), {'path': path})
+            for invalid in ['/tmp/display.sock', path.replace('175-', '176-'), path.replace(name[:20], name)]:
+                with self.subTest(path=invalid), patch.object(vms, 'virsh', side_effect=lambda action, *_: xml.replace(path, invalid) if action == 'dumpxml' else 'running'):
+                    with self.assertRaises(ValueError):
+                        vms.main()
+
     def test_nested_installers_are_separate_from_prepared_guests(self):
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary).resolve()
diff --git a/tools/vm-screen-test.py b/tools/vm-screen-test.py
index df3283c5d50e54af5fe04060697d2755e8617457..b8f7a062bf6be80f88ff1bd843f172c81c7731ca 100644
--- a/tools/vm-screen-test.py
+++ b/tools/vm-screen-test.py
@@ -3,14 +3,17 @@ import asyncio
 import base64
 import importlib.util
 import json
+import os
 from pathlib import Path
 import random
 import struct
+import sys
+import tempfile
 import threading
 import unittest
 import zlib
 from types import SimpleNamespace
-from unittest.mock import Mock
+from unittest.mock import AsyncMock, Mock, patch
 
 
 spec = importlib.util.spec_from_file_location("vm_screen", Path(__file__).with_name("vm-screen.py"))
@@ -40,6 +43,34 @@ class Writer:
         self.closed = True
 
 
+class LifecycleTests(unittest.IsolatedAsyncioTestCase):
+    async def test_sigterm_closes_connected_clients(self):
+        with tempfile.TemporaryDirectory() as directory:
+            socket = str(Path(directory) / "screen.sock")
+            process = await asyncio.create_subprocess_exec(sys.executable, str(Path(__file__).with_name("vm-screen.py")),
+                env={**os.environ, "STUDIO_VM_SCREEN_SOCKET": socket})
+            writers = []
+            try:
+                async with asyncio.timeout(5):
+                    while not Path(socket).exists():
+                        await asyncio.sleep(0.01)
+                    for _ in range(4):
+                        _, writer = await asyncio.open_unix_connection(socket)
+                        writers.append(writer)
+                    reader, writer = await asyncio.open_unix_connection(socket)
+                    writers.append(writer)
+                    self.assertTrue(json.loads(await reader.readline())["fatal"])
+                process.terminate()
+                self.assertEqual(await asyncio.wait_for(process.wait(), 5), 0)
+            finally:
+                for writer in writers:
+                    writer.close()
+                    await writer.wait_closed()
+                if process.returncode is None:
+                    process.kill()
+                    await process.wait()
+
+
 class DesktopTests(unittest.IsolatedAsyncioTestCase):
     def setUp(self):
         self.reader, self.writer = asyncio.StreamReader(), Writer()
@@ -105,6 +136,47 @@ class DesktopTests(unittest.IsolatedAsyncioTestCase):
                 self.desktop.input(message)
 
 
+class WindowTests(unittest.TestCase):
+    def window(self, id, x=0, y=0, width=2, height=2):
+        return dict(id=id, x=x, y=y, width=width, height=height,
+                    caption_left=x, caption_top=y, caption_right=x + width, caption_bottom=y + 1)
+
+    def surface(self, atlas, id, data, x=0, y=0, width=2, height=2):
+        atlas.update(dict(id=id, width=2, height=2, x=x, y=y, rect_width=width, rect_height=height), data)
+
+    def test_partial_surfaces_and_geometry_reuse(self):
+        atlas = screen.WindowDesktop(4, 2, [self.window(1), self.window(2)])
+        self.assertFalse(atlas.complete)
+        with self.assertRaisesRegex(ValueError, "complete first"):
+            self.surface(atlas, 1, bytes(4), width=1, height=1)
+        self.surface(atlas, 1, b"a" * 16)
+        self.surface(atlas, 2, b"b" * 16)
+        self.assertTrue(atlas.complete)
+        self.surface(atlas, 1, b"c" * 4, x=1, y=1, width=1, height=1)
+        self.assertEqual(atlas.surfaces[1][2], b"a" * 12 + b"c" * 4)
+        moved = screen.WindowDesktop(4, 2, [self.window(2), self.window(1, x=1)], atlas)
+        self.assertFalse(moved.repacked)
+        self.assertIs(moved.pixels, atlas.pixels)
+        self.assertEqual(moved.pixels, b"a" * 8 + b"b" * 8 + b"a" * 4 + b"c" * 4 + b"b" * 8)
+        removed = screen.WindowDesktop(4, 2, [self.window(1)], moved)
+        self.assertTrue(removed.repacked)
+        self.assertTrue(removed.complete)
+        self.assertEqual(removed.pixels[16:24], b"a" * 4 + b"c" * 4)
+
+    def test_untrusted_window_bounds_and_atlas_budget(self):
+        for windows in [[self.window(0)], [self.window(1), self.window(1)],
+                        [self.window(1, x=4097)], [self.window(1, width=0)]]:
+            with self.subTest(windows=windows), self.assertRaises(ValueError):
+                screen.WindowDesktop(4, 2, windows)
+        with self.assertRaises(OverflowError):
+            screen.WindowDesktop(4096, 1, [self.window(1, width=4096, height=2048), self.window(2, width=4096, height=2048)])
+        atlas = screen.WindowDesktop(4, 2, [self.window(1)])
+        for values, data in [(dict(id=99, width=2, height=2, x=0, y=0, rect_width=2, rect_height=2), bytes(16)),
+                             (dict(id=1, width=2, height=2, x=1, y=1, rect_width=2, rect_height=2), bytes(16))]:
+            with self.assertRaises(ValueError):
+                atlas.update(values, data)
+
+
 class GuestTests(unittest.IsolatedAsyncioTestCase):
     def setUp(self):
         self.guest = screen.GuestDesktop("fixture")
@@ -112,6 +184,7 @@ class GuestTests(unittest.IsolatedAsyncioTestCase):
         self.presented = self.resized = 0
         self.viewer = Mock(desktop=SimpleNamespace(cursor={"type": "cursor", "source": "qemu"}),
                                       writer=Writer(), send=self.messages.append, resize=self.resize, present=self.present)
+        self.viewer.source = self.guest
         self.guest.screens = {self.viewer}
 
     def present(self):
@@ -120,6 +193,62 @@ class GuestTests(unittest.IsolatedAsyncioTestCase):
     def resize(self):
         self.resized += 1
 
+    async def test_stop_drains_packet_before_closing_channel(self):
+        reader, writer = asyncio.StreamReader(), Writer()
+        writer.get_extra_info = Mock(return_value=Mock(getsockopt=Mock(return_value=struct.pack("3i", 1, 0, 0))))
+        writer.wait_closed = AsyncMock()
+        reader.feed_data(struct.pack("!I", 2) + b"{}")
+        reader.feed_data(struct.pack("!4sII2I", b"SGV1", screen.GUEST_PROTOCOL["packets"]["capabilities"]["id"], 8, 1, 1))
+        reader.feed_data(struct.pack("!4sII6I", b"SGV1", screen.GUEST_PROTOCOL["packets"]["screen"]["id"], 40, 2, 2, 0, 0, 2, 2) + bytes(8))
+        screen.GUESTS[self.guest.name] = self.guest
+        with patch.object(asyncio, "open_unix_connection", AsyncMock(return_value=(reader, writer))):
+            task = asyncio.create_task(self.guest.run())
+            self.guest.task = task
+            async with asyncio.timeout(1):
+                while self.guest.writer is None or self.guest.windows_available is None:
+                    await asyncio.sleep(0)
+            self.guest.stop()
+            self.guest.request(refresh=True)
+            stop = struct.pack("!4sII", b"SGV1", screen.GUEST_PROTOCOL["packets"]["stop"]["id"], 0)
+            await asyncio.sleep(0)
+            self.assertFalse(writer.closed)
+            self.assertFalse(task.done())
+            reader.feed_data(bytes(8) + stop)
+            await asyncio.wait_for(task, 1)
+        self.assertTrue(writer.closed)
+        self.assertEqual(self.presented, 2)
+        self.assertNotIn(self.guest.name, screen.GUESTS)
+
+    async def test_stop_during_broker_negotiation(self):
+        reader, writer = asyncio.StreamReader(), Writer()
+        writer.get_extra_info = Mock(return_value=Mock(getsockopt=Mock(return_value=struct.pack("3i", 1, 0, 0))))
+        writer.wait_closed = AsyncMock()
+        stop = struct.pack("!4sII", b"SGV1", screen.GUEST_PROTOCOL["packets"]["stop"]["id"], 0)
+        with patch.object(asyncio, "open_unix_connection", AsyncMock(return_value=(reader, writer))) as connect:
+            task = asyncio.create_task(self.guest.run())
+            self.guest.task = task
+            async with asyncio.timeout(1):
+                while not writer.data:
+                    await asyncio.sleep(0)
+            self.guest.stop()
+            self.assertIsNone(self.guest.writer)
+            self.assertFalse(writer.closed)
+            reader.feed_data(struct.pack("!I", 2) + b"{}" + struct.pack("!4sII2I", b"SGV1", screen.GUEST_PROTOCOL["packets"]["capabilities"]["id"], 8, 1, 1) + stop)
+            await asyncio.wait_for(task, 1)
+            connect.assert_awaited_once()
+        self.assertTrue(writer.closed)
+        self.assertTrue(writer.data.endswith(stop))
+
+    async def test_stop_before_reader_starts(self):
+        self.guest.stop()
+        with patch.object(asyncio, "open_unix_connection", AsyncMock()) as connect:
+            await self.guest.run()
+            connect.assert_not_awaited()
+
+    async def test_unsolicited_stop_is_rejected(self):
+        with self.assertRaisesRegex(ValueError, "Unexpected"):
+            await self.packets(("stop", [], b""))
+
     async def packets(self, *packets):
         reader = asyncio.StreamReader()
         for name, words, data in packets:
@@ -138,7 +267,7 @@ class GuestTests(unittest.IsolatedAsyncioTestCase):
         self.assertEqual(self.guest.pixels[24:28], b"\x01\x02\x03\0")
         self.assertEqual((self.presented, self.resized), (2, 1))
         self.assertEqual([message["duration"] for message in self.messages if message["type"] == "cursor"], [17, 33])
-        self.assertIn("invert", self.messages[0])
+        self.assertIn("invert", next(message for message in self.messages if message["type"] == "cursor"))
         self.assertEqual(self.guest.pointer["x"], -1)
 
     async def test_suspend_restores_fallback_and_requires_full_refresh(self):
@@ -171,6 +300,17 @@ class GuestTests(unittest.IsolatedAsyncioTestCase):
         self.assertFalse(self.guest.screens)
         self.assertEqual(len(self.guest.cursor), 2)
 
+    async def test_capture_pauses_without_closing_guest_channel(self):
+        self.guest.writer = Writer()
+        self.guest.windows_available = False
+        self.guest.request()
+        self.assertEqual(bytes(self.guest.writer.data), struct.pack("!4sIII", b"SGV1", 12, 4, 1))
+        self.guest.writer.data.clear()
+        self.guest.screens.clear()
+        self.guest.request()
+        self.assertEqual(bytes(self.guest.writer.data), struct.pack("!4sIII", b"SGV1", 12, 4, 0))
+        self.assertFalse(self.guest.writer.closed)
+
     async def test_missing_heartbeat_times_out_but_does_not_encode(self):
         await self.packets(("screen", [1, 1, 0, 0, 1, 1], bytes(4)), ("heartbeat", [], b""))
         self.assertEqual(self.presented, 1)
@@ -178,6 +318,33 @@ class GuestTests(unittest.IsolatedAsyncioTestCase):
         with self.assertRaises(TimeoutError):
             await self.guest.read(reader)
 
+    async def test_capabilities_and_cursor_resend_on_connected_viewer(self):
+        self.guest.writer = Writer()
+        self.viewer.experiment = True
+        await self.packets(("capabilities", [1], b""),
+                           ("screen", [1, 1, 0, 0, 1, 1], bytes(4)),
+                           ("cursor", [3, 1, 1, 0, 0, 1], struct.pack("!I", 100) + bytes(5)),
+                           ("pointer", [3, 4, 5, 1], b""))
+        self.messages.clear()
+        self.guest.sync(self.viewer)
+        self.assertEqual([m["type"] for m in self.messages], ["capabilities", "cursor-position", "cursor"])
+        self.assertEqual(self.guest.writer.data[-4:], struct.pack("!I", 1))
+
+    async def test_window_layout_waits_for_full_surfaces_and_falls_back(self):
+        self.viewer.experiment = True
+        records = [1, 0, 0, 2, 2, 0, 0, 2, 1, 2, 2, 0, 2, 2, 2, 0, 4, 1]
+        await self.packets(("screen", [4, 2, 0, 0, 4, 2], bytes(32)),
+                           ("windows", [4, 2, 2], struct.pack("!18I", *records)),
+                           ("surface", [1, 2, 2, 0, 0, 2, 2], b"a" * 16))
+        self.assertFalse(self.guest.layers.complete)
+        self.presented = 0
+        await self.packets(("surface", [2, 2, 2, 0, 0, 2, 2], b"b" * 16))
+        self.assertTrue(self.guest.layers.complete)
+        self.assertEqual(self.presented, 1)
+        await self.packets(("windows", [4, 2, 0], b""))
+        self.assertIsNone(self.guest.layers)
+        self.assertEqual(self.messages[-1], {"type": "window-capture", "available": False})
+
 
 class StreamTests(unittest.IsolatedAsyncioTestCase):
     async def asyncSetUp(self):
@@ -187,8 +354,15 @@ class StreamTests(unittest.IsolatedAsyncioTestCase):
         self.stream = screen.Screen(self.writer, desktop)
 
     async def asyncTearDown(self):
-        self.writer.close()
+        pipeline = self.stream.pipeline.weak_ref()
+        encoder = self.stream.encoder.weak_ref()
         self.stream.close()
+        self.assertIsNone(pipeline())
+        self.assertIsNone(encoder())
+        self.stream.present()
+        self.stream.resize()
+        self.stream.remote_description(None)
+        self.stream.answer(None)
 
     async def test_browser_payload_and_sending_direction(self):
         sdp = "\r\n".join([
@@ -208,6 +382,47 @@ class StreamTests(unittest.IsolatedAsyncioTestCase):
         self.assertIn("a=rtpmap:103 H264/90000", answer["sdp"])
         self.assertEqual(self.stream.pipeline.get_by_name("pay").get_property("pt"), 103)
 
+    async def test_twcc_and_retransmission_are_negotiated(self):
+        offer = "\r\n".join([
+            "v=0", "o=- 1 1 IN IP4 127.0.0.1", "s=-", "t=0 0", "a=group:BUNDLE 0",
+            "m=video 9 UDP/TLS/RTP/SAVPF 103 104", "c=IN IP4 0.0.0.0", "a=mid:0", "a=recvonly",
+            "a=rtcp-mux", "a=ice-ufrag:abcd", "a=ice-pwd:abcdefghijklmnopqrstuvwxyz",
+            "a=setup:actpass", "a=fingerprint:sha-256 " + ":".join(["00"] * 32),
+            "a=rtpmap:103 H264/90000", "a=rtpmap:104 rtx/90000", "a=fmtp:104 apt=103",
+            "a=fmtp:103 packetization-mode=1;profile-level-id=42e01f;level-asymmetry-allowed=1",
+            "a=rtcp-fb:103 nack", "a=rtcp-fb:103 nack pli", "a=rtcp-fb:103 transport-cc",
+            "a=extmap:3 " + screen.TWCC, "",
+        ])
+        self.stream.signal({"type": "offer", "sdp": offer})
+        async with asyncio.timeout(5):
+            while b'"type":"answer"' not in self.writer.data:
+                await asyncio.sleep(0.01)
+        answer = next(json.loads(line)["sdp"] for line in self.writer.data.splitlines() if json.loads(line)["type"] == "answer")
+        self.assertIn("a=rtpmap:104 rtx/90000", answer)
+        self.assertIn("a=fmtp:104 apt=103", answer)
+        primary = self.stream.pipeline.get_by_name("pay").get_property("ssrc")
+        self.assertIn(f"a=ssrc-group:FID {primary} ", answer)
+        self.assertIn(f"a=ssrc:{primary} msid:", answer)
+        self.assertIn("a=rtcp-fb:103 transport-cc", answer)
+        self.assertIsNotNone(self.stream.bwe)
+        self.stream.bwe.set_property("estimated-bitrate", 1000000)
+        self.assertEqual(self.stream.encoder.get_property("bitrate"), 1000)
+
+    async def test_unreliable_movement_cannot_restore_released_buttons(self):
+        def pointer(sequence, buttons, channel="input"):
+            self.stream.input(json.dumps(dict(type="pointer", x=1, y=1, sequence=sequence, buttons=buttons)), channel)
+        pointer(1, 1)
+        pointer(3, 0, "pointer")
+        self.assertEqual(self.stream.desktop.buttons, 1)
+        pointer(2, 0)
+        self.assertEqual(self.stream.desktop.buttons, 0)
+        before = bytes(self.stream.desktop.writer.data)
+        pointer(2, 1, "pointer")
+        self.assertEqual(self.stream.desktop.writer.data, before)
+        self.stream.input(json.dumps(dict(type="release", sequence=4)))
+        pointer(3, 1, "pointer")
+        self.assertEqual(self.stream.desktop.buttons, 0)
+
     async def test_stalled_guest_closes_and_ignores_queued_input(self):
         message = json.dumps({"type": "clipboard", "text": "a" * 65536})
         for _ in range(64):
@@ -216,6 +431,7 @@ class StreamTests(unittest.IsolatedAsyncioTestCase):
         self.assertLess(len(self.stream.desktop.writer.data), 327680)
 
     async def test_rtp_packets_fit_tunneled_network(self):
+        await self.test_twcc_and_retransmission_are_negotiated()
         Gst = screen.Gst
         pipeline = self.stream.pipeline
         pipeline.set_state(Gst.State.NULL)
diff --git a/tools/vm-screen.py b/tools/vm-screen.py
index 9a4e54b0ac414dd79a9be0dc269b98c9c393d27a..57afe790c4cfcd6d080dfa2768704d1af98ba1b7 100644
--- a/tools/vm-screen.py
+++ b/tools/vm-screen.py
@@ -2,13 +2,16 @@
 import asyncio
 import base64
 import contextlib
+from collections import deque
 import json
 import logging
 import os
 from pathlib import Path
+import signal
 import socket
 import struct
 import threading
+import time
 import zlib
 
 import gi
@@ -16,7 +19,8 @@ import gi
 gi.require_version("Gst", "1.0")
 gi.require_version("GstSdp", "1.0")
 gi.require_version("GstWebRTC", "1.0")
-from gi.repository import GLib, Gst, GstSdp, GstWebRTC
+gi.require_version("GstRtp", "1.0")
+from gi.repository import GLib, Gst, GstRtp, GstSdp, GstWebRTC
 
 
 MAX_PIXELS = 3840 * 2160
@@ -24,6 +28,69 @@ STUN = os.environ.get("STUDIO_VM_STUN_SERVER", "stun://stun.cloudflare.com:3478"
 SLOTS = asyncio.Semaphore(4)
 GUEST_PROTOCOL = json.loads(Path(os.environ.get("STUDIO_VM_GUEST_PROTOCOL", Path(__file__).resolve().parent.parent / "guest/protocol.json")).read_text())
 GUESTS = {}
+TWCC = "http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01"
+
+
+class WindowDesktop:
+    def __init__(self, width, height, windows, previous=None):
+        limits = GUEST_PROTOCOL["limits"]
+        if not 0 < width <= limits["dimension"] or not 0 < height <= limits["dimension"] or width * height > limits["pixels"] or not 0 < len(windows) <= limits["windows"]:
+            raise ValueError("Invalid guest window desktop")
+        self.windows = windows
+        self.surfaces = {}
+        self.width = max(width, *(window["width"] for window in windows))
+        x = y = row_height = 0
+        ids = set()
+        for window in sorted(windows, key=lambda window: window["id"]):
+            w, h = window["width"], window["height"]
+            if not window["id"] or window["id"] in ids or not 0 < w <= limits["dimension"] or not 0 < h <= limits["dimension"] or abs(window["x"]) > limits["dimension"] or abs(window["y"]) > limits["dimension"]:
+                raise ValueError("Invalid guest window bounds")
+            ids.add(window["id"])
+            if x + w > self.width:
+                x, y, row_height = 0, y + row_height, 0
+            window["atlas_x"], window["atlas_y"] = x, y
+            x, row_height = x + w, max(row_height, h)
+            surface = previous.surfaces.get(window["id"]) if previous else None
+            self.surfaces[window["id"]] = surface if surface and (surface[0], surface[1]) == (w, h) else (w, h, None)
+        self.height = y + row_height
+        if self.height > limits["dimension"] or self.width * self.height > limits["pixels"]:
+            raise OverflowError("Guest windows exceed the video atlas")
+        self.repacked = not previous or (self.width, self.height, [(w["id"], w["width"], w["height"]) for w in sorted(windows, key=lambda w: w["id"])]) != (
+            previous.width, previous.height, [(w["id"], w["width"], w["height"]) for w in sorted(previous.windows, key=lambda w: w["id"])])
+        self.pixels = bytearray(self.width * self.height * 4) if self.repacked else previous.pixels
+        for window in windows:
+            surface = self.surfaces[window["id"]]
+            if self.repacked and surface[2] is not None:
+                self.copy(window, 0, 0, window["width"], window["height"], surface[2])
+
+    @property
+    def complete(self):
+        return all(surface[2] is not None for surface in self.surfaces.values())
+
+    def copy(self, window, x, y, width, height, pixels):
+        for row in range(height):
+            offset = ((window["atlas_y"] + y + row) * self.width + window["atlas_x"] + x) * 4
+            self.pixels[offset:offset + width * 4] = pixels[row * width * 4:(row + 1) * width * 4]
+
+    def update(self, values, data):
+        window = next((window for window in self.windows if window["id"] == values["id"]), None)
+        if not window:
+            raise ValueError("Unknown guest window")
+        width, height = window["width"], window["height"]
+        x, y, w, h = values["x"], values["y"], values["rect_width"], values["rect_height"]
+        if (values["width"], values["height"]) != (width, height) or not w or not h or x + w > width or y + h > height or len(data) != w * h * 4:
+            raise ValueError("Invalid guest window rectangle")
+        pixels = self.surfaces[window["id"]][2]
+        if pixels is None:
+            if (x, y, w, h) != (0, 0, width, height):
+                raise ValueError("Guest window needs a complete first frame")
+            pixels = bytearray(data)
+            self.surfaces[window["id"]] = (width, height, pixels)
+        else:
+            for row in range(h):
+                offset = ((y + row) * width + x) * 4
+                pixels[offset:offset + w * 4] = data[row * w * 4:(row + 1) * w * 4]
+        self.copy(window, x, y, w, h, data)
 
 
 def png(width, height, pixels):
@@ -41,14 +108,48 @@ class GuestDesktop:
         self.pixels = bytearray()
         self.cursor = []
         self.pointer = None
+        self.layers = None
+        self.writer = None
+        self.windows_available = None
+        self.stop_supported = None
+        self.stopping = False
+
+    def request(self, refresh=False):
+        if not self.stopping and self.writer and not self.writer.is_closing():
+            if refresh:
+                self.writer.write(struct.pack("!4sII", GUEST_PROTOCOL["magic"].encode(), GUEST_PROTOCOL["packets"]["refresh"]["id"], 0))
+            if self.windows_available is not None:
+                self.writer.write(struct.pack("!4sIII", GUEST_PROTOCOL["magic"].encode(), GUEST_PROTOCOL["packets"]["stream"]["id"], 4, bool(self.screens)))
+            if self.windows_available:
+                enabled = any(screen.experiment for screen in self.screens)
+                self.writer.write(struct.pack("!4sIII", GUEST_PROTOCOL["magic"].encode(), GUEST_PROTOCOL["packets"]["experiment"]["id"], 4, enabled))
+
+    def stop(self):
+        self.stopping = True
+        if self.writer and not self.writer.is_closing():
+            if self.stop_supported:
+                self.writer.write(struct.pack("!4sII", GUEST_PROTOCOL["magic"].encode(), GUEST_PROTOCOL["packets"]["stop"]["id"], 0))
+            elif self.stop_supported is False:
+                self.writer.close()
+
+    def sync(self, screen):
+        screen.send({"type": "capabilities", "windows": bool(self.windows_available)})
+        if self.pixels:
+            if self.pointer:
+                screen.send(self.pointer)
+            for cursor in self.cursor:
+                screen.send(cursor)
 
     def suspend(self):
         active = bool(self.pixels)
         self.pixels = bytearray()
         self.cursor.clear()
         self.pointer = None
+        self.layers = None
+        for screen in tuple(self.screens):
+            screen.send({"type": "capabilities", "windows": False})
         if active:
-            for screen in self.screens:
+            for screen in tuple(self.screens):
                 screen.resize()
                 screen.send(screen.desktop.cursor or {"type": "cursor", "source": "qemu", "frame": 0, "fallback": True, "x": 0, "y": 0})
                 screen.present()
@@ -62,11 +163,17 @@ class GuestDesktop:
                 if magic != GUEST_PROTOCOL["magic"].encode() or kind not in packets or length > limits["packet_bytes"]:
                     raise ValueError("Invalid guest display packet")
                 name, fields = packets[kind]
+                if name == "capabilities" and length == 4:
+                    fields = fields[:1]
                 if length < len(fields) * 4:
                     raise ValueError("Incomplete guest display packet")
                 payload = await reader.readexactly(length)
             values = dict(zip(fields, struct.unpack("!" + "I" * len(fields), payload[:len(fields) * 4])))
             data = payload[len(fields) * 4:]
+            if self.stop_supported is None and name != "capabilities":
+                self.stop_supported = False
+                if self.stopping:
+                    return
             if name == "screen":
                 width, height = values["width"], values["height"]
                 x, y, w, h = values["x"], values["y"], values["rect_width"], values["rect_height"]
@@ -84,18 +191,16 @@ class GuestDesktop:
                 for screen in tuple(self.screens):
                     if resized:
                         screen.resize()
-                        if self.pointer:
-                            screen.send(self.pointer)
-                        for cursor in self.cursor:
-                            screen.send(cursor)
-                    screen.present()
+                        self.sync(screen)
+                    if screen.source is self:
+                        screen.present()
                     await asyncio.sleep(0)
             elif name == "cursor":
                 width, height, count = values["width"], values["height"], values["frames"]
                 if not width and not height and not count and not data and not values["hot_x"] and not values["hot_y"]:
                     self.cursor = [{"type": "cursor", "source": "guest", "id": values["id"], "width": 0, "height": 0, "frame": 0, "frames": 0, "fallback": True, "x": 0, "y": 0}]
                     if self.pixels:
-                        for screen in self.screens:
+                        for screen in tuple(self.screens):
                             screen.send(self.cursor[0])
                     continue
                 pixels = width * height
@@ -131,7 +236,7 @@ class GuestDesktop:
                 self.pointer = {"type": "cursor-position", "id": values["id"], "visible": bool(values["visible"]),
                                 "x": (values["x"] ^ 0x80000000) - 0x80000000, "y": (values["y"] ^ 0x80000000) - 0x80000000}
                 if self.pixels:
-                    for screen in self.screens:
+                    for screen in tuple(self.screens):
                         screen.send(self.pointer)
             elif name == "suspend":
                 if data:
@@ -140,11 +245,70 @@ class GuestDesktop:
             elif name == "heartbeat":
                 if data:
                     raise ValueError("Invalid guest display heartbeat")
+            elif name == "stop":
+                if data or not self.stopping:
+                    raise ValueError("Unexpected guest display stop")
+                return
+            elif name == "capabilities":
+                if data or values["windows"] > 1 or values.get("stop", 0) > 1:
+                    raise ValueError("Invalid guest display capabilities")
+                self.windows_available = bool(values["windows"])
+                self.stop_supported = bool(values.get("stop", 0))
+                for screen in tuple(self.screens):
+                    screen.send({"type": "capabilities", "windows": bool(self.windows_available)})
+                if self.stopping:
+                    self.stop()
+                else:
+                    self.request()
+            elif name == "capture_stats":
+                if data or not 0 < values["elapsed_ms"] <= 60000 or values["frames"] > 10000 or any(values[key] > 60000000 for key in ("capture_us", "scan_us", "write_us")):
+                    raise ValueError("Invalid guest capture statistics")
+                for screen in tuple(self.screens):
+                    screen.send({"type": "capture-stats", **values})
+            elif name == "windows":
+                count = values["count"]
+                fields = GUEST_PROTOCOL["window_fields"]
+                if count > limits["windows"] or len(data) != count * len(fields) * 4:
+                    raise ValueError("Invalid guest window list")
+                previous = self.layers
+                if count:
+                    records = []
+                    for record in struct.iter_unpack("!" + "I" * len(fields), data):
+                        window = dict(zip(fields, record))
+                        for key in ("x", "y", "caption_left", "caption_top", "caption_right", "caption_bottom"):
+                            window[key] = (window[key] ^ 0x80000000) - 0x80000000
+                        records.append(window)
+                    try:
+                        self.layers = WindowDesktop(values["width"], values["height"], records, previous)
+                    except OverflowError:
+                        self.layers = None
+                else:
+                    self.layers = None
+                for screen in tuple(self.screens):
+                    if screen.experiment:
+                        if self.layers and not self.layers.repacked and self.layers.complete and screen.source is self.layers:
+                            screen.send({"type": "window-positions", "windows": self.layers.windows})
+                        else:
+                            screen.resize()
+                            screen.present()
+                        screen.send({"type": "window-capture", "available": bool(self.layers)})
+            elif name == "surface":
+                if self.layers:
+                    complete = self.layers.complete
+                    self.layers.update(values, data)
+                    for screen in tuple(self.screens):
+                        if screen.experiment and self.layers.complete:
+                            if not complete:
+                                screen.resize()
+                            screen.present()
             else:
                 raise ValueError("Unexpected guest display request")
 
     async def run(self):
         while True:
+            if self.stopping:
+                GUESTS.pop(self.name, None)
+                return
             writer = None
             try:
                 reader, writer = await asyncio.wait_for(asyncio.open_unix_connection(
@@ -158,16 +322,23 @@ class GuestDesktop:
                     raise ValueError("Invalid guest display broker response")
                 response = json.loads(await reader.readexactly(size))
                 if "error" not in response:
+                    self.writer = writer
                     writer.write(struct.pack("!4sII", GUEST_PROTOCOL["magic"].encode(), GUEST_PROTOCOL["packets"]["refresh"]["id"], 0))
                     await self.read(reader)
             except (OSError, ValueError, EOFError, asyncio.IncompleteReadError, TimeoutError) as error:
                 logging.info("Guest display %s: %s", self.name, error)
             finally:
+                self.writer = None
+                self.windows_available = None
+                self.stop_supported = None
                 self.suspend()
                 if writer:
                     writer.close()
                     with contextlib.suppress(OSError, TimeoutError):
                         await asyncio.wait_for(writer.wait_closed(), 2)
+            if self.stopping or not self.screens:
+                GUESTS.pop(self.name, None)
+                return
             await asyncio.sleep(2)
 
 
@@ -176,6 +347,7 @@ class Desktop:
         self.reader, self.writer, self.notify = reader, writer, notify
         self.keys = set()
         self.pointer = (0, 0)
+        self.buttons = 0
         self.pixels = bytearray()
         self.cursor = None
 
@@ -226,11 +398,13 @@ class Desktop:
             if any(type(value) is not int for value in (x, y, buttons)) or not 0 <= buttons <= 255:
                 raise ValueError("Unsupported pointer event.")
             self.pointer = (max(0, min(x, self.width - 1)), max(0, min(y, self.height - 1)))
+            self.buttons = buttons
             self.writer.write(struct.pack("!BBHH", 5, buttons, *self.pointer))
         elif kind == "release":
             for key in self.keys:
                 self.writer.write(struct.pack("!BB2xI", 4, 0, key))
             self.keys.clear()
+            self.buttons = 0
             self.writer.write(struct.pack("!BBHH", 5, 0, *self.pointer))
         elif kind == "clipboard":
             text = message.get("text")
@@ -310,17 +484,29 @@ class Screen:
         self.writer, self.desktop = writer, desktop
         self.guest = None
         self.channel = None
+        self.pointer_channel = None
+        self.pointer_sequence = -1
+        self.experiment = False
+        self.frame_timer = None
+        self.last_frame = 0
+        self.layouts = {}
+        self.encoding_layouts = deque(maxlen=64)
+        self.last_rtp_pts = None
+        self.sent_layout = None
+        self.bwe = None
         hardware = Gst.ElementFactory.make("nvh264enc")
-        encoder = "nvh264enc name=encoder preset=p4 tune=ultra-low-latency zerolatency=true bframes=0 bitrate=6000 gop-size=30" if hardware else (
-            "x264enc name=encoder tune=zerolatency speed-preset=ultrafast bitrate=6000 key-int-max=30 bframes=0")
+        encoder = "nvh264enc name=encoder preset=p4 tune=ultra-low-latency zerolatency=true bframes=0 rc-mode=cbr bitrate=4000 gop-size=60" if hardware else (
+            "x264enc name=encoder tune=zerolatency speed-preset=ultrafast bitrate=4000 key-int-max=60 bframes=0")
         width, height = self.desktop.width, self.desktop.height
+        ssrc = struct.unpack("!I", os.urandom(4))[0] | 1
+        # TWCC and RTX headers are added after payload packetization.
         self.pipeline = Gst.parse_launch(
-            f"appsrc name=frames is-live=true format=time do-timestamp=true max-buffers=1 leaky-type=downstream "
-            f"caps=video/x-raw,format=BGRx,width={width},height={height},framerate=30/1 "
+            f"appsrc name=frames is-live=true format=time max-buffers=1 leaky-type=downstream "
+            f"caps=video/x-raw,format=BGRx,width={width},height={height},framerate=60/1 "
             f"! videoconvert ! videoscale ! capsfilter name=size caps=video/x-raw,format=NV12,width={width + width % 2},height={height + height % 2} "
             f"! {encoder} ! video/x-h264,profile=constrained-baseline ! h264parse "
-            "! rtph264pay name=pay pt=96 mtu=1200 config-interval=-1 aggregate-mode=zero-latency "
-            "! capsfilter name=codec caps=application/x-rtp,media=video,encoding-name=H264,clock-rate=90000 "
+            f"! rtph264pay name=pay pt=96 ssrc={ssrc} mtu=1190 config-interval=-1 aggregate-mode=zero-latency "
+            f"! capsfilter name=codec caps=application/x-rtp,media=video,encoding-name=H264,clock-rate=90000,ssrc=(uint){ssrc} "
             "! webrtcbin name=rtc bundle-policy=max-bundle")
         self.frames = self.pipeline.get_by_name("frames")
         self.rtc = self.pipeline.get_by_name("rtc")
@@ -335,7 +521,11 @@ class Screen:
                 self.send, {"type": "candidate", "sdpMLineIndex": line, "candidate": candidate}))),
             (self.rtc, self.rtc.connect("on-data-channel", self.data_channel)),
             (self.rtc, self.rtc.connect("notify::connection-state", self.connection_state)),
+            (self.rtc, self.rtc.connect("request-aux-sender", lambda *_: self.bwe)),
         ]
+        self.encoder = self.pipeline.get_by_name("encoder")
+        self.encoder_probe = self.encoder.get_static_pad("sink").add_probe(Gst.PadProbeType.BUFFER, self.encoding)
+        self.rtp_probe = self.pipeline.get_by_name("pay").get_static_pad("src").add_probe(Gst.PadProbeType.BUFFER, self.rtp_layout)
         self.probe = self.frames.get_static_pad("src").add_probe(Gst.PadProbeType.EVENT_UPSTREAM, self.refresh)
         self.bus = self.pipeline.get_bus()
         self.bus.add_signal_watch()
@@ -344,18 +534,25 @@ class Screen:
         self.send({"type": "display", "width": width, "height": height, "encoder": "nvenc" if hardware else "x264"})
 
     def close(self):
+        self.writer.close()
+        if self.frame_timer:
+            self.frame_timer.cancel()
         self.desktop.notify = None
         if self.guest:
             self.guest.screens.discard(self)
-            if not self.guest.screens:
-                GUESTS.pop(self.guest.name, None)
-                self.guest.task.cancel()
+            if self.guest.screens:
+                self.guest.request()
+            else:
+                self.guest.stop()
         for element, handler in self.handlers:
             element.disconnect(handler)
         self.handlers.clear()
         self.frames.get_static_pad("src").remove_probe(self.probe)
+        self.encoder.get_static_pad("sink").remove_probe(self.encoder_probe)
+        self.pipeline.get_by_name("pay").get_static_pad("src").remove_probe(self.rtp_probe)
         self.bus.remove_signal_watch()
         self.pipeline.set_state(Gst.State.NULL)
+        self.pipeline = self.encoder = None
 
     def send(self, message):
         if not self.writer.is_closing():
@@ -373,13 +570,16 @@ class Screen:
         self.loop.call_soon_threadsafe(self.fail, "The screen stream stopped. Reconnect to try again.")
 
     def resize(self):
+        if self.writer.is_closing():
+            return
         width, height = self.source.width, self.source.height
         self.frames.set_property("caps", Gst.Caps.from_string(
-            f"video/x-raw,format=BGRx,width={width},height={height},framerate=30/1"))
+            f"video/x-raw,format=BGRx,width={width},height={height},framerate=60/1"))
         self.pipeline.get_by_name("size").set_property("caps", Gst.Caps.from_string(
             f"video/x-raw,format=NV12,width={width + width % 2},height={height + height % 2}"))
-        self.send({"type": "display", "width": width, "height": height,
-                   "source": "guest" if self.source is self.guest else "qemu",
+        self.send({"type": "display", "width": self.guest.width if self.guest and self.guest.pixels else width,
+                   "height": self.guest.height if self.guest and self.guest.pixels else height,
+                   "source": "guest" if self.guest and self.guest.pixels else "qemu",
                    "encoder": "nvenc" if self.pipeline.get_by_name("encoder").get_factory().get_name() == "nvh264enc" else "x264"})
 
     def refresh(self, _, info):
@@ -393,17 +593,24 @@ class Screen:
         if state == GstWebRTC.WebRTCPeerConnectionState.CONNECTED:
             self.loop.call_soon_threadsafe(self.present)
             self.loop.call_soon_threadsafe(self.desktop.request, False)
+            if self.guest:
+                self.loop.call_soon_threadsafe(self.guest.sync, self)
+                self.loop.call_soon_threadsafe(self.guest.request, True)
         elif state in (GstWebRTC.WebRTCPeerConnectionState.FAILED, GstWebRTC.WebRTCPeerConnectionState.CLOSED):
             self.loop.call_soon_threadsafe(self.fail, "The screen disconnected. Reconnect to try again.")
 
     def data_channel(self, _, channel):
-        if channel.get_property("label") != "input" or self.channel:
+        label = channel.get_property("label")
+        if label not in ("input", "pointer") or (self.channel if label == "input" else self.pointer_channel):
             channel.emit("close")
             return
-        self.channel = channel
-        self.handlers.append((channel, channel.connect("on-message-string", lambda _, message: self.loop.call_soon_threadsafe(self.input, message))))
+        if label == "input":
+            self.channel = channel
+        else:
+            self.pointer_channel = channel
+        self.handlers.append((channel, channel.connect("on-message-string", lambda _, message: self.loop.call_soon_threadsafe(self.input, message, label))))
 
-    def input(self, raw):
+    def input(self, raw, channel="input"):
         if self.writer.is_closing():
             return
         try:
@@ -412,6 +619,25 @@ class Screen:
             message = json.loads(raw)
             if not isinstance(message, dict):
                 raise ValueError("Unsupported input event.")
+            if channel == "pointer" and message.get("type") != "pointer":
+                raise ValueError("Unsupported pointer event.")
+            if message.get("type") == "experiment":
+                if type(message.get("enabled")) is not bool or not self.guest:
+                    raise ValueError("Unsupported window experiment.")
+                self.experiment = message["enabled"] and bool(self.guest.windows_available)
+                self.guest.request()
+                self.resize()
+                self.present()
+                return
+            if message.get("type") in ("pointer", "release") and "sequence" in message:
+                sequence = message["sequence"]
+                if type(sequence) is not int or not 0 <= sequence <= 0x1fffffffffffff:
+                    raise ValueError("Unsupported pointer event.")
+                if channel == "pointer" and sequence <= self.pointer_sequence:
+                    return
+                self.pointer_sequence = max(sequence, self.pointer_sequence)
+            if channel == "pointer":
+                message["buttons"] = self.desktop.buttons
             self.desktop.input(message)
             if self.desktop.writer.transport.get_write_buffer_size() > 262144:
                 self.fail("The VM stopped accepting input. Reconnect to try again.")
@@ -420,12 +646,47 @@ class Screen:
 
     @property
     def source(self):
+        if self.experiment and self.guest and self.guest.pixels and self.guest.layers and self.guest.layers.complete:
+            return self.guest.layers
         return self.guest if self.guest and self.guest.pixels else self.desktop
 
     def present(self):
-        if self.rtc.get_property("connection-state") == GstWebRTC.WebRTCPeerConnectionState.CONNECTED:
-            buffer = Gst.Buffer.new_wrapped(bytes(self.source.pixels))
-            self.frames.emit("push-buffer", buffer)
+        if self.writer.is_closing():
+            return
+        if self.frame_timer is None and self.rtc.get_property("connection-state") == GstWebRTC.WebRTCPeerConnectionState.CONNECTED:
+            self.frame_timer = self.loop.call_later(max(0, self.last_frame + 1 / 60 - time.monotonic()), self.push_frame)
+
+    def push_frame(self):
+        self.frame_timer = None
+        if self.writer.is_closing():
+            return
+        self.last_frame = time.monotonic()
+        source = self.source
+        buffer = Gst.Buffer.new_wrapped(bytes(source.pixels))
+        buffer.pts = self.pipeline.get_clock().get_time() - self.pipeline.get_base_time()
+        buffer.duration = Gst.SECOND // 60
+        layout = {"type": "windows", "windows": source.windows if isinstance(source, WindowDesktop) else [], "width": source.width, "height": source.height}
+        self.layouts[buffer.pts] = layout
+        while len(self.layouts) > 64:
+            del self.layouts[next(iter(self.layouts))]
+        self.frames.emit("push-buffer", buffer)
+
+    def encoding(self, _, info):
+        layout = self.layouts.pop(info.get_buffer().pts, None)
+        if layout is not None:
+            self.encoding_layouts.append(layout)
+        return Gst.PadProbeReturn.OK
+
+    def rtp_layout(self, _, info):
+        buffer = info.get_buffer()
+        if buffer.pts != self.last_rtp_pts and self.encoding_layouts:
+            self.last_rtp_pts = buffer.pts
+            layout = self.encoding_layouts.popleft()
+            if layout != self.sent_layout:
+                self.sent_layout = layout
+                timestamp = struct.unpack("!I", buffer.extract_dup(4, 4))[0]
+                self.loop.call_soon_threadsafe(self.send, {**layout, "rtpTimestamp": timestamp})
+        return Gst.PadProbeReturn.OK
 
     def signal(self, message):
         if message.get("type") == "offer" and isinstance(message.get("sdp"), str):
@@ -455,13 +716,40 @@ class Screen:
             if not caps:
                 raise ValueError("This browser doesn't support the VM's H.264 stream. Open it in a current browser.")
             payload = caps.get_structure(0).get_value("payload")
+            extension = None
+            for index in range(media.attributes_len()):
+                attribute = media.get_attribute(index)
+                if attribute.key == "extmap" and attribute.value.split()[1:2] == [TWCC]:
+                    extension = int(attribute.value.split()[0].split("/")[0])
+                    if not 1 <= extension <= 255:
+                        raise ValueError("Unsupported screen connection extension.")
+            if extension and Gst.ElementFactory.find("rtpgccbwe"):
+                self.bwe = Gst.ElementFactory.make("rtpgccbwe")
+                self.bwe.set_property("min-bitrate", 500000)
+                self.bwe.set_property("max-bitrate", 12000000)
+                self.bwe.set_property("estimated-bitrate", 4000000)
+                self.handlers.append((self.bwe, self.bwe.connect("notify::estimated-bitrate", lambda bwe, _: self.encoder.set_property("bitrate", bwe.get_property("estimated-bitrate") // 1000))))
+                header = GstRtp.RTPHeaderExtension.create_from_uri(TWCC)
+                header.set_id(extension)
+                self.pipeline.get_by_name("pay").emit("add-extension", header)
             caps = Gst.Caps.from_string(
                 f"application/x-rtp,media=video,encoding-name=H264,clock-rate=90000,payload={payload},"
+                f"ssrc=(uint){self.pipeline.get_by_name('pay').get_property('ssrc')},"
                 "packetization-mode=(string)1,rtcp-fb-nack=(boolean)true,rtcp-fb-nack-pli=(boolean)true")
+            if self.bwe:
+                caps.set_value("rtcp-fb-transport-cc", True)
+                caps.set_value(f"extmap-{extension}", TWCC)
             self.pipeline.get_by_name("pay").set_property("pt", payload)
             self.pipeline.get_by_name("codec").set_property("caps", caps)
             transceiver = self.rtc.get_static_pad("sink_0").get_property("transceiver")
-            transceiver.set_property("codec-preferences", caps)
+            preferences = caps.copy()
+            for index in range(media.formats_len()):
+                offered = media.get_caps_from_media(int(media.get_format(index)))
+                if offered:
+                    codec = offered.get_structure(0)
+                    if codec.get_string("encoding-name") == "RTX" and codec.get_string("apt") == str(payload):
+                        preferences.append(offered)
+            transceiver.set_property("codec-preferences", preferences)
             transceiver.set_property("direction", GstWebRTC.WebRTCRTPTransceiverDirection.SENDONLY)
             transceiver.set_property("do-nack", True)
             description = GstWebRTC.WebRTCSessionDescription.new(GstWebRTC.WebRTCSDPType.OFFER, sdp)
@@ -476,6 +764,8 @@ class Screen:
             raise ValueError("Unsupported screen connection message.")
 
     def remote_description(self, promise, *_):
+        if self.writer.is_closing():
+            return
         reply = promise.get_reply()
         if reply and reply.has_field("error"):
             logging.error("VM screen offer: %s", reply.to_string())
@@ -484,6 +774,8 @@ class Screen:
         self.rtc.emit("create-answer", None, Gst.Promise.new_with_change_func(self.answer, None, None))
 
     def answer(self, promise, *_):
+        if self.writer.is_closing():
+            return
         reply = promise.get_reply()
         if not reply or not reply.has_field("answer"):
             logging.error("VM screen answer: %s", reply.to_string() if reply else "missing reply")
@@ -523,6 +815,9 @@ async def serve(reader, writer):
                 raise ValueError(result["error"])
             await asyncio.wait_for(desktop.start(), 10)
             screen = Screen(writer, desktop)
+            guest = GUESTS.get(name)
+            if guest and guest.stopping:
+                await asyncio.shield(guest.task)
             if name not in GUESTS:
                 GUESTS[name] = GuestDesktop(name)
                 GUESTS[name].task = asyncio.create_task(GUESTS[name].run())
@@ -587,13 +882,36 @@ async def serve(reader, writer):
 
 async def main():
     Gst.init(None)
-    threading.Thread(target=GLib.MainLoop().run, daemon=True).start()
+    glib = GLib.MainLoop()
+    threading.Thread(target=glib.run, daemon=True).start()
+    stopped = asyncio.Event()
+    loop = asyncio.get_running_loop()
+    for signum in (signal.SIGTERM, signal.SIGINT):
+        loop.add_signal_handler(signum, stopped.set)
+    clients = set()
+    def connected(reader, writer):
+        if stopped.is_set():
+            writer.close()
+            return
+        task = asyncio.create_task(serve(reader, writer))
+        clients.add(task)
+        task.add_done_callback(clients.discard)
     path = Path(os.environ.get("STUDIO_VM_SCREEN_SOCKET", "/run/studio-vm-screen/screen.sock"))
     path.unlink(missing_ok=True)
-    server = await asyncio.start_unix_server(serve, path=str(path), limit=131072)
+    server = await asyncio.start_unix_server(connected, path=str(path), limit=131072)
     path.chmod(0o600)
-    async with server:
-        await server.serve_forever()
+    await stopped.wait()
+    server.close()
+    guests = tuple(GUESTS.values())
+    for guest in guests:
+        guest.stop()
+    tasks = tuple(clients)
+    for task in tasks:
+        task.cancel()
+    await asyncio.gather(*tasks, return_exceptions=True)
+    await server.wait_closed()
+    await asyncio.gather(*(guest.task for guest in guests), return_exceptions=True)
+    glib.quit()
 
 
 if __name__ == "__main__":
diff --git a/tools/vms.py b/tools/vms.py
index f9f5219a2df287fd9308773e09e9ea1c91936ffd..eb427e1a3b2a0564b91ee22c8a4d1e54c7a5c1c8 100644
--- a/tools/vms.py
+++ b/tools/vms.py
@@ -830,7 +830,7 @@ def main():
     if action == "guest":
         root = ET.fromstring(virsh("dumpxml", payload["name"]))
         source = root.find(f"./devices/channel[@type='unix']/target[@name='{GUEST_CHANNEL}']/../source")
-        expected = f"/run/libvirt/qemu/channel/{root.get('id')}-{payload['name']}/{GUEST_CHANNEL}"
+        expected = f"/run/libvirt/qemu/channel/{root.get('id')}-{payload['name'][:20]}/{GUEST_CHANNEL}"
         if virsh("domstate", payload["name"]).strip() != "running" or source is None or source.get("mode") != "bind" or source.get("path") != expected:
             raise ValueError("This VM has no guest display channel.")
         return {"path": expected}
-- 
2.54.0