diff --git a/.devin/skills/ios-simulator-accessibility/SKILL.md b/.devin/skills/ios-simulator-accessibility/SKILL.md
new file mode 100644
index 0000000..d29197f
--- /dev/null
+++ b/.devin/skills/ios-simulator-accessibility/SKILL.md
@@ -0,0 +1,59 @@
+---
+name: ios-simulator-accessibility
+description: Reading the iOS Simulator accessibility tree and hit testing it — bridge delegate tokens, full-screen backdrops, app-scoped versus display-scoped results, and reaching web content that the tree cannot see. Use when working on get_tree, element picking or the inspector.
+triggers:
+  - user
+  - model
+---
+
+Reading and hit testing the simulator's accessibility tree, via `AXPTranslator`
+in `packages/accessibility-ios-sys`.
+
+The theme: failures here are **silent and look like absence**. A missed token
+returns an empty label rather than an error, so the symptom is "this element
+cannot be selected" rather than anything that points at the cause.
+
+## Hit testing needs the token applied twice
+
+`objectAtPoint:` returns a platform element whose *own* translation must also
+be given the bridge delegate token — it is not necessarily the translation you
+tokenized on the way in.
+
+Miss that and attribute reads do not fail, they silently return an empty label
+and a zero frame. `get_tree` already does this; see the matching step in
+`get_element_at_point`.
+
+## Backdrops swallow hit tests
+
+Every app has full-screen backdrops: the Application node plus one or more
+container groups. Hit testing empty space resolves to one, and highlighting it
+paints over the whole device. They are filtered out rather than drawn.
+
+## The tree and the hit test have different scopes
+
+The tree is app-scoped and the hit test is display-scoped, so the status bar
+appears in hit tests but never in `get_tree`.
+
+## Reaching web content
+
+`get_tree` walks the frontmost app and so cannot see anything in another
+process; a Safari page reports five elements of chrome. Hit testing *does*
+cross that boundary — `objectAtPoint:` resolves elements inside a `WKWebView`
+while `get_tree` returns only the host app's chrome, and there is no hierarchy
+to traverse from either end. This applies to Safari and to any embedded web
+view.
+
+So `?scan=true` marks everything the tree walk explained on a coverage grid and
+then probes the cells left over. On a real page that takes 5 elements at 4%
+coverage to 15 at 50%, using 114 probes in under half a second.
+
+Swept elements are tagged `point_grid` rather than `recursive`: they are point
+samples with no parent, no children and no document order, and should not be
+treated as equivalent to nodes the tree walk returned.
+
+Coverage is reported whether or not a scan runs, and is a useful signal on its
+own — a full web page reporting 4% describes the problem far better than an
+empty element list does.
+
+Background on the approach, and how idb solves the same problem, is in
+`docs/WEB_CONTENT_ACCESSIBILITY_PLAN.md`.
diff --git a/.devin/skills/ios-simulator-input/SKILL.md b/.devin/skills/ios-simulator-input/SKILL.md
new file mode 100644
index 0000000..f490339
--- /dev/null
+++ b/.devin/skills/ios-simulator-input/SKILL.md
@@ -0,0 +1,83 @@
+---
+name: ios-simulator-input
+description: Injecting touch, keyboard and rotation into the iOS Simulator — the two coordinate spaces, USB HID keycodes, system edge gestures and device settings. Use when working on taps, swipes, scrolling, typing, orientation or anything that drives the simulator.
+triggers:
+  - user
+  - model
+---
+
+Everything about getting input *into* the simulator. The recurring hazard is
+that wrong input is usually accepted without complaint: the event is delivered,
+it just does the wrong thing or nothing at all.
+
+## Coordinate spaces
+
+There are **two** normalized spaces and they only coincide in portrait, which
+makes conflating them very easy and the bug invisible until you rotate.
+
+- **Raw framebuffer space** — what HID input uses. The framebuffer is always
+  portrait-native: rotating the device rotates the *content* inside a
+  fixed-size surface, so pointer coordinates must be un-rotated before
+  injection.
+- **Logical space** — what accessibility uses. iOS has already applied the
+  rotation: in landscape the app reports its own bounds as 874x402 rather than
+  402x874, so normalizing against them yields upright coordinates that need no
+  further rotation.
+
+Concretely, in the web UI a tap sends raw coordinates while a hit test sends
+display coordinates, and AX rects are drawn without rotation.
+
+Normalize AX rects with `(rect.origin - app_bounds.origin) / app_bounds.size`.
+`get_screen_bounds` is only populated after a tree has been read.
+
+## HID keycodes
+
+`IndigoHIDMessageForKeyboardArbitrary` takes **USB HID usage codes**, not
+HIToolbox virtual keycodes — measured, by sending values and reading back what
+appeared in a text field. `a`-`z` are `4`-`29`, Left Shift is `225`. idb's own
+comment claiming HIToolbox is wrong.
+
+The two code spaces overlap in range and disagree on nearly every value, so
+getting it wrong types different letters rather than failing.
+
+Modifiers are ordinary key events held around the target key, so shifted
+characters are Shift-down, key-down, key-up, Shift-up. There is no shift flag
+on the Indigo message.
+
+The character-to-key table lives in `accessibility-serve/src/keymap.rs` and is
+US-ASCII only; unmappable characters fail the whole string rather than typing
+a subtly wrong one.
+
+On Xcode 27 / CoreSimulator 1155.4+ an active `dtuhidd` silently disables
+legacy Indigo keyboard events; they are delivered correctly and produce no
+text. See `docs/IDB_LEARNINGS.md`.
+
+## System edge gestures
+
+Swipe-up-to-home does not work unless the touch is flagged with the screen
+edge it started from. That edge is the 7th argument to
+`IndigoHIDMessageForMouseNSEvent`; on arm64 it lands in x4 while the `NSSize`
+argument occupies d0/d1, so a wrong declaration can silently pass zero there
+and every gesture just becomes an ordinary drag.
+
+The same edge must be supplied for every event in the gesture, and the edge is
+in *raw* framebuffer space, so it rotates with the device.
+
+## Orientation
+
+The framebuffer never changes size, so orientation cannot be recovered from
+the video. It is tracked server-side and seeded at startup from the
+accessibility bounds aspect ratio, which is the only cheap signal — and it
+only distinguishes landscape from portrait, not left from right.
+
+Rotation itself is a GSEvent mach message to `PurpleWorkspacePort`, not an
+Indigo event. It needs Simulator.app running, because the runtime alone does
+not publish that port.
+
+## Device settings
+
+`simctl ui` only implements `appearance`, `increase_contrast` and
+`content_size`. The other options in Xcode's Devices window (reduce motion,
+colour filters, transparency, VoiceOver) have no simctl verb and need a helper
+binary spawned inside the simulator that drives the private libAccessibility
+setters.
diff --git a/.devin/skills/ios-simulator-internals/SKILL.md b/.devin/skills/ios-simulator-internals/SKILL.md
new file mode 100644
index 0000000..396966c
--- /dev/null
+++ b/.devin/skills/ios-simulator-internals/SKILL.md
@@ -0,0 +1,78 @@
+---
+name: ios-simulator-internals
+description: CoreSimulator and SimulatorKit private API mechanics — remote proxies, blocks, framebuffer port discovery and IOSurface lifetime. Use when touching accessibility-ios-sys or debugging why a private call silently does nothing.
+triggers:
+  - user
+  - model
+---
+
+How to talk to the simulator's private frameworks from Rust, in
+`packages/accessibility-ios-sys`. Every note here cost real debugging time and
+none of it is obvious from the outside. The common thread is that these APIs
+tend to **fail silently** rather than error, so the symptom is usually "nothing
+happens" rather than a crash.
+
+Simulator work needs Xcode, not just Command Line Tools:
+
+```sh
+export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
+xcrun simctl list devices booted
+```
+
+`xcode-select -p` commonly points at `/Library/Developer/CommandLineTools`,
+which has no simulator frameworks, so `DEVELOPER_DIR` matters.
+
+## CoreSimulator hands back proxies
+
+IO ports and display descriptors are `ROCKRemoteProxy` objects that implement
+their interface through forwarding. `objc2::msg_send!` panics on them in debug
+builds because its verification looks the selector up with
+`class_getInstanceMethod`, which a forwarding proxy does not answer.
+
+Use the helpers in `macos/dynamic.rs`, always guarded by `responds_to`.
+
+## Blocks need a type signature
+
+ROCKit marshals block arguments across the proxy boundary by reading the
+block's ObjC type encoding, which requires `BLOCK_HAS_SIGNATURE`. `block2` does
+not emit that flag (there is a TODO in its `global.rs`), so passing an
+`RcBlock` aborts with "Block is missing signature field".
+
+`macos/blocks.c` creates the blocks with clang instead. See
+`macos/void_block.rs`.
+
+## Registering screen callbacks is load-bearing
+
+Registration is what makes SimulatorKit attach the display pipeline and
+populate `framebufferSurface`. Reading the property without registering does
+not reliably work.
+
+## Picking the right framebuffer
+
+Several ports share `com.apple.framebuffer.display` — the main screen plus
+secondary planes. Register on all of them, then pick the descriptor whose
+state reports `displayClass == 0`, falling back to the largest live surface.
+
+A booted iPhone exposes two descriptors, classes 0 and 1. Largest-area happens
+to pick correctly but is a heuristic standing in for a value the API actually
+reports, and it would choose wrong on tvOS, which renders on a non-zero class.
+
+## The framebuffer IOSurface is recycled in place
+
+Retaining the `CVPixelBuffer` does not help, because the surface mutates
+underneath it. The sink must finish with a frame, or copy it, before
+returning. The encoder's pixel transfer is what does that copy.
+
+## SimulatorKit moved in Xcode 27
+
+From `Developer/Library/PrivateFrameworks` to `Contents/SharedFrameworks`.
+Both are probed.
+
+## Verifying without a browser
+
+```sh
+cargo run -p accessibility-ios-sys --example framebuffer_probe
+```
+
+Fails loudly if no frames arrive, if no keyframe is produced, or if any access
+unit is not Annex-B framed.
diff --git a/.devin/skills/ios-simulator-video/SKILL.md b/.devin/skills/ios-simulator-video/SKILL.md
new file mode 100644
index 0000000..5b5a13a
--- /dev/null
+++ b/.devin/skills/ios-simulator-video/SKILL.md
@@ -0,0 +1,126 @@
+---
+name: ios-simulator-video
+description: Capturing, encoding, streaming and recording the iOS Simulator screen — bits per pixel, VideoToolbox rate control, pixel transfer, MP4 recording and browser-side WebCodecs. Use when working on stream quality, frame rate, the encoder or screen recording.
+triggers:
+  - user
+  - model
+---
+
+The capture and encode pipeline, and how to tell whether a change to it
+actually helped.
+
+**Measure before changing anything here.** Most of the notes below exist
+because something that sounded obviously right turned out to be wrong when
+measured.
+
+## Stream quality: read bits per pixel first
+
+`GET /api/stats` reports frames, fps, bitrate, mean frame size, keyframe
+requests, lag events and — the number that matters — **bits per pixel** against
+the *encoded* resolution.
+
+Rules of thumb for screen content:
+
+    < 0.05 bpp    heavy blocking, and the encoder starts dropping frames
+    0.10-0.20     what to aim for
+    > 0.30        wasted bandwidth
+
+## Starving the encoder costs frame rate, not just quality
+
+With low-latency rate control, VideoToolbox drops frames to stay inside its
+per-frame budget, which is `AverageBitRate / ExpectedFrameRate` regardless of
+the rate actually being achieved. Measured on a 1206x2622 device during
+scrolling:
+
+    6 Mbps    12.2 KB/frame   0.0315 bpp   33.9 fps
+    24 Mbps   32.2 KB/frame   0.0835 bpp   60.3 fps
+
+So "chunky, slow and janky" was a single root cause, not three.
+
+The fix is resolution, not bitrate. A phone framebuffer is roughly fifteen
+times the pixels the browser actually displays, so the long edge is capped at
+1280 by default (`--max-dimension`, or `--native-resolution` to disable) and
+the bitrate is derived from the encode resolution at ~0.15 bpp rather than
+being a fixed number. Same stimulus, same bandwidth:
+
+    native 3.16 MP @ 6 Mbps   4.99 Mbps   0.0297 bpp
+    588x1280 @ derived        4.95 Mbps   0.1338 bpp
+
+Raise `--max-dimension` if viewing in a large or retina window; the default
+trades sharpness for bits on the assumption of a normal-sized preview.
+
+`MaxKeyFrameInterval` counts frames, so on its own a "2 second" interval
+stretches to twenty when the device is idle at 5fps.
+`MaxKeyFrameIntervalDuration` is what actually bounds it in time; both are set.
+
+## The frame copy is a pixel transfer, not a memcpy
+
+Three things must happen between the framebuffer and the encoder, and
+`VTPixelTransferSession` does all three in one hardware pass into a pooled
+buffer: copy off the recycled live surface, convert BGRA to NV12, and
+downscale.
+
+This does not contradict the earlier finding that a plain Metal blit was
+*slower* than `memcpy` (0.517 ms against 0.377 ms on a cache-cold 12.1 MB
+surface). That measured a bare copy doing one job against a purpose-built
+transfer doing three; the transfer also removes the BGRA-to-NV12 conversion
+that `VTCompressionSession` would otherwise do internally.
+
+## Latency and quality are one choice, not two knobs
+
+`kVTCompressionPropertyKey_Quality` is **ignored** while
+`EnableLowLatencyRateControl` is set. Measured with it on, quality 1.0 gave
+0.0221 bpp and quality 0.4 gave 0.0223 — no effect whatsoever. Measured with
+it off, quality 0.3 gave 0.70 Mbps and quality 0.9 gave 11.82 Mbps, a
+sixteenfold range.
+
+So the two settings are mutually exclusive, and `Tuning` pairs them into a
+single choice rather than letting the useless combination be expressed:
+
+- `Interactive { bitrate }` — low-latency rate control and `MaxFrameDelayCount`
+  0, spending a bitrate derived from the encode resolution. Omitting
+  low-latency costs roughly 300ms of decoder buffering, so this is what any
+  live viewer wants.
+- `Recording { quality }` — no low-latency constraint, so the quality target is
+  honoured and bits go where the picture needs them. Latency is unbounded in
+  principle.
+
+## Recording
+
+`start_recording` runs a **second, independent encode** of the same frames
+rather than retuning the streaming encoder. That is what lets a recording use
+B-frames: the live path cannot, because WebRTC's payloader and the raw stream
+framing both assume the encoder emits frames in submission order. It also lets
+a recording have its own resolution and quality regardless of what the viewer
+is watching.
+
+`AVAssetWriter` does the encoding and the muxing. Feeding it pixel buffers
+through an `AVAssetWriterInputPixelBufferAdaptor`, rather than encoding
+ourselves and appending sample buffers, avoids having to order decode and
+presentation timestamps by hand — which is precisely what B-frames complicate.
+
+Verify a recording really is what it claims to be:
+
+```sh
+ffprobe -v error -select_streams v:0 -show_entries frame=pict_type \
+  -of csv=p=0 -read_intervals "%+#120" recording.mp4
+```
+
+Expect a mix of `I`, `P` and `B`. All `I` and `P` means frame reordering
+silently failed to take.
+
+Timestamps are wall-clock elapsed at nanosecond timescale, so the variable
+capture rate is recorded at the speed it actually happened. Finalizing blocks
+until the writer flushes: an MP4 has no playable index until then.
+
+## Browser-side decode
+
+Do not pass `hardwareAcceleration: "prefer-hardware"` to `VideoDecoder`.
+Despite the name it is treated as a requirement, and phone-shaped resolutions
+like 1206x2622 exceed what hardware decoders accept, making the configuration
+unsupported outright.
+
+The real WebCodecs member is `optimizeForLatency`, not `optimizeFor`.
+
+`configure()` reports success synchronously and only surfaces the failure
+through the async error callback, so check `isConfigSupported` first.
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..aace15e
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,71 @@
+# accessibility-cli
+
+Cross-platform accessibility tree reading, querying, and automation, plus a
+live iOS Simulator stream.
+
+## Build and verify
+
+```sh
+cargo build --workspace
+cargo clippy --workspace --all-targets
+cargo test --workspace --lib          # unit tests, all green
+cargo test -p accessibility-cli --test cli_smoke
+```
+
+### Tests that need a permitted GUI session
+
+`packages/accessibility-cli/tests/cli_macos.rs` drives the real macOS
+accessibility API: it launches Calculator and reads its window tree. It fails
+with "Accessibility permissions not granted" or "Calculator never opened a
+window" unless the terminal running the tests has been granted
+System Settings > Privacy & Security > Accessibility. These failures are
+environmental, not regressions.
+
+## iOS Simulator work
+
+Anything touching the simulator needs Xcode (not just Command Line Tools) and
+a booted device:
+
+```sh
+export DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer
+xcrun simctl list devices booted
+```
+
+`xcode-select -p` on this machine points at `/Library/Developer/CommandLineTools`,
+which has no simulator frameworks, so `DEVELOPER_DIR` matters.
+
+Verify the capture and encode pipeline end to end without a browser:
+
+```sh
+cargo run -p accessibility-ios-sys --example framebuffer_probe
+```
+
+Serve it:
+
+```sh
+cargo run -p accessibility-cli -- serve-sim --port 3200
+```
+
+### Hard-won specifics live in skills
+
+The simulator work depends on a lot of private-framework behaviour that fails
+silently rather than erroring. Rather than carry all of it here, it is split
+into focused skills under `.devin/skills/`, which are loaded when relevant:
+
+| Skill | Covers |
+|---|---|
+| `ios-simulator-internals` | CoreSimulator and SimulatorKit mechanics: remote proxies, block signatures, framebuffer port discovery, IOSurface lifetime |
+| `ios-simulator-input` | The two coordinate spaces, USB HID keycodes, system edge gestures, orientation, device settings |
+| `ios-simulator-video` | Bits per pixel, VideoToolbox rate control, pixel transfer, MP4 recording, browser-side WebCodecs |
+| `ios-simulator-accessibility` | Bridge delegate tokens, backdrops, app versus display scope, reaching web content |
+
+Read the relevant one before changing that area. Each is short, and every note
+in them cost real debugging time.
+
+## Longer-form notes
+
+- `docs/IDB_LEARNINGS.md` — what Meta's idb does differently and what is worth
+  taking from it
+- `docs/WEB_CONTENT_ACCESSIBILITY_PLAN.md` — why web content is invisible to
+  the tree and how the point-grid sweep addresses it
+- `docs/SERVE_SIM_BACKLOG.md` — known gaps, ordered by how soon they bite
diff --git a/Cargo.lock b/Cargo.lock
index 42fcde5..928c3d0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -31,6 +31,8 @@ name = "accessibility-cli"
 version = "0.1.0"
 dependencies = [
  "accessibility-core",
+ "accessibility-serve",
+ "anyhow",
  "assert_cmd",
  "clap",
  "ctrlc",
@@ -53,6 +55,7 @@ dependencies = [
  "accesskit",
  "anyhow",
  "async-trait",
+ "bytes",
  "cssparser",
  "euclid",
  "image",
@@ -75,12 +78,20 @@ dependencies = [
  "accesskit",
  "anyhow",
  "block2",
+ "bytes",
+ "cc",
+ "dispatch2",
  "euclid",
  "image",
  "libc",
  "objc2",
+ "objc2-av-foundation",
  "objc2-core-foundation",
+ "objc2-core-media",
+ "objc2-core-video",
  "objc2-foundation",
+ "objc2-io-surface",
+ "objc2-video-toolbox",
  "slotmap",
 ]
 
@@ -112,6 +123,24 @@ dependencies = [
  "objc2-foundation",
 ]
 
+[[package]]
+name = "accessibility-serve"
+version = "0.1.0"
+dependencies = [
+ "accessibility-core",
+ "accessibility-ios-sys",
+ "anyhow",
+ "axum",
+ "bytes",
+ "futures-util",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tower-http",
+ "tracing",
+ "webrtc",
+]
+
 [[package]]
 name = "accessibility-windows-sys"
 version = "0.1.0"
@@ -143,6 +172,41 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -250,6 +314,15 @@ version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
 
+[[package]]
+name = "arc-swap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "arg_enum_proc_macro"
 version = "0.3.4"
@@ -276,6 +349,45 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "965c2d33e53cb6b267e148a4cb0760bc01f4904c1cd4bb4002a085bb016d1490"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "assert_cmd"
 version = "2.2.1"
@@ -499,7 +611,7 @@ dependencies = [
  "num-traits",
  "pastey",
  "rayon",
- "thiserror",
+ "thiserror 2.0.18",
  "v_frame",
  "y4m",
 ]
@@ -513,7 +625,7 @@ dependencies = [
  "anyhow",
  "arrayvec",
  "log",
- "nom",
+ "nom 8.0.0",
  "num-rational",
  "v_frame",
 ]
@@ -527,18 +639,100 @@ dependencies = [
  "arrayvec",
 ]
 
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "base64",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sha1",
+ "sync_wrapper",
+ "tokio",
+ "tokio-tungstenite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bit_field"
 version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e4b40c7323adcfc0a41c4b88143ed58346ff65a288fc144329c5c45e05d70c6"
 
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
 [[package]]
 name = "bitflags"
 version = "2.11.1"
@@ -557,6 +751,24 @@ dependencies = [
  "no_std_io2",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -626,6 +838,15 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.61"
@@ -638,6 +859,18 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "ccm"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae3c82e4355234767756212c570e29833699ab63e6ffd161887314cc5b43847"
+dependencies = [
+ "aead",
+ "cipher",
+ "ctr",
+ "subtle",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -650,6 +883,41 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+dependencies = [
+ "aead",
+ "chacha20",
+ "cipher",
+ "poly1305",
+ "zeroize",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+ "zeroize",
+]
+
 [[package]]
 name = "clap"
 version = "4.6.1"
@@ -723,6 +991,36 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb8a2a1cd12ab0d987a5d5e825195d372001a4094a0376319d5a0ad71c1ba0d"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "217698eaf96b4a3f0bc4f3662aaa55bdf913cd54d7204591faa790070c6d0853"
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -763,7 +1061,7 @@ version = "0.28.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "crossterm_winapi",
  "parking_lot",
  "rustix 0.38.44",
@@ -785,6 +1083,29 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.31.2"
@@ -808,6 +1129,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "ctrlc"
 version = "3.5.2"
@@ -815,10 +1145,73 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
 dependencies = [
  "dispatch2",
- "nix",
+ "nix 0.31.2",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "der-parser"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom 7.1.3",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
 [[package]]
 name = "derive_more"
 version = "0.99.20"
@@ -836,18 +1229,77 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
 
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
 [[package]]
 name = "dispatch2"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "block2",
  "libc",
  "objc2",
 ]
 
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "dtls"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f531dd7c181beaf3cebab3716afa4d0d41ab888be85232583f56bbaf07ca208a"
+dependencies = [
+ "aes",
+ "aes-gcm",
+ "async-trait",
+ "bincode",
+ "byteorder",
+ "cbc",
+ "ccm",
+ "chacha20poly1305",
+ "der-parser",
+ "hmac",
+ "log",
+ "p256",
+ "p384",
+ "portable-atomic",
+ "rand 0.9.4",
+ "rand_core 0.6.4",
+ "rcgen",
+ "ring",
+ "rustls",
+ "sec1",
+ "serde",
+ "sha1",
+ "sha2",
+ "thiserror 1.0.69",
+ "tokio",
+ "webrtc-util",
+ "x25519-dalek",
+ "x509-parser",
+]
+
 [[package]]
 name = "dtoa"
 version = "1.0.11"
@@ -869,6 +1321,20 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
+]
+
 [[package]]
 name = "either"
 version = "1.15.0"
@@ -876,7 +1342,28 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
-name = "encode_unicode"
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "crypto-bigint",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "hkdf",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "encode_unicode"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
@@ -1022,6 +1509,22 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"
@@ -1053,6 +1556,15 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
 [[package]]
 name = "fslock"
 version = "0.2.1"
@@ -1063,6 +1575,31 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "futures"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
 [[package]]
 name = "futures-core"
 version = "0.3.32"
@@ -1099,6 +1636,23 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "futures-macro"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+
 [[package]]
 name = "futures-task"
 version = "0.3.32"
@@ -1111,8 +1665,13 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
+ "futures-channel",
  "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
  "futures-task",
+ "memchr",
  "pin-project-lite",
  "slab",
 ]
@@ -1126,6 +1685,17 @@ dependencies = [
  "byteorder",
 ]
 
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+ "zeroize",
+]
+
 [[package]]
 name = "gethostname"
 version = "1.1.0"
@@ -1174,6 +1744,16 @@ dependencies = [
  "wasip3",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "gif"
 version = "0.14.2"
@@ -1184,6 +1764,17 @@ dependencies = [
  "weezl",
 ]
 
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -1228,12 +1819,213 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
 [[package]]
 name = "id-arena"
 version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
 [[package]]
 name = "image"
 version = "0.25.10"
@@ -1304,6 +2096,37 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding",
+ "generic-array",
+]
+
+[[package]]
+name = "interceptor"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea51375727680dc15f06e8ad90fa31df75d79dd030100e8ad60eef1c27fe2c98"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures",
+ "log",
+ "portable-atomic",
+ "rand 0.9.4",
+ "rtcp",
+ "rtp",
+ "thiserror 1.0.69",
+ "tokio",
+ "waitgroup",
+ "webrtc-srtp",
+ "webrtc-util",
+]
+
 [[package]]
 name = "interpolate_name"
 version = "0.2.4"
@@ -1315,6 +2138,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -1373,7 +2202,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b750dcadc39a09dbadd74e118f6dd6598df77fa01df0cfcdc52c28dece74528a"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "serde",
  "unicode-segmentation",
 ]
@@ -1430,6 +2259,12 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -1454,6 +2289,12 @@ dependencies = [
  "imgref",
 ]
 
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
 [[package]]
 name = "matrixmultiply"
 version = "0.3.10"
@@ -1474,12 +2315,31 @@ dependencies = [
  "rayon",
 ]
 
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
 [[package]]
 name = "memchr"
 version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -1489,6 +2349,18 @@ dependencies = [
  "autocfg",
 ]
 
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -1541,13 +2413,26 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
+[[package]]
+name = "nix"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "598beaf3cc6fdd9a5dfb1630c2800c7acd31df7aaf0f565796fba2b53ca1af1b"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "pin-utils",
+]
+
 [[package]]
 name = "nix"
 version = "0.31.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5d6d0705320c1e6ba1d912b5e37cf18071b6c2e9b7fa8215a1e8a7651966f5d3"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -1562,6 +2447,16 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
 [[package]]
 name = "nom"
 version = "8.0.0"
@@ -1616,6 +2511,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
 [[package]]
 name = "num-derive"
 version = "0.4.2"
@@ -1683,7 +2584,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "block2",
  "libc",
  "objc2",
@@ -1704,7 +2605,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69282c2b5bc58fba07cb9de2113619532eb551e98efe3d8d695509ef45fbd53b"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "libc",
  "objc2",
  "objc2-core-foundation",
@@ -1714,34 +2615,89 @@ dependencies = [
 ]
 
 [[package]]
-name = "objc2-cloud-kit"
+name = "objc2-av-foundation"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
+checksum = "478ae33fcac9df0a18db8302387c666b8ef08a3e2d62b510ca4fc278a384b6c0"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
+ "block2",
+ "dispatch2",
  "objc2",
+ "objc2-avf-audio",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-image",
+ "objc2-core-media",
+ "objc2-core-video",
  "objc2-foundation",
+ "objc2-image-io",
+ "objc2-media-toolbox",
+ "objc2-quartz-core",
 ]
 
 [[package]]
-name = "objc2-core-data"
+name = "objc2-avf-audio"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
+checksum = "13a380031deed8e99db00065c45937da434ca987c034e13b87e4441f9e4090be"
 dependencies = [
- "bitflags",
  "objc2",
  "objc2-foundation",
 ]
 
 [[package]]
-name = "objc2-core-foundation"
+name = "objc2-cloud-kit"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-audio"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1eebcea8b0dbff5f7c8504f3107c68fc061a3eb44932051c8cf8a68d969c3b2"
+dependencies = [
+ "dispatch2",
+ "objc2",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-core-audio-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a89f2ec274a0cf4a32642b2991e8b351a404d290da87bb6a9a9d8632490bd1c"
+dependencies = [
+ "bitflags 2.11.1",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
+dependencies = [
+ "bitflags 2.11.1",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.11.1",
  "block2",
  "dispatch2",
  "libc",
@@ -1754,7 +2710,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "block2",
  "dispatch2",
  "libc",
@@ -1774,6 +2730,22 @@ dependencies = [
  "objc2-foundation",
 ]
 
+[[package]]
+name = "objc2-core-media"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05ec576860167a15dd9fce7fbee7512beb4e31f532159d3482d1f9c6caedf31d"
+dependencies = [
+ "bitflags 2.11.1",
+ "block2",
+ "dispatch2",
+ "objc2",
+ "objc2-core-audio",
+ "objc2-core-audio-types",
+ "objc2-core-foundation",
+ "objc2-core-video",
+]
+
 [[package]]
 name = "objc2-core-services"
 version = "0.3.2"
@@ -1792,7 +2764,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "objc2",
  "objc2-core-foundation",
  "objc2-core-graphics",
@@ -1804,11 +2776,13 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d425caf1df73233f29fd8a5c3e5edbc30d2d4307870f802d18f00d83dc5141a6"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
+ "block2",
  "objc2",
  "objc2-core-foundation",
  "objc2-core-graphics",
  "objc2-io-surface",
+ "objc2-metal",
 ]
 
 [[package]]
@@ -1823,22 +2797,47 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "block2",
  "libc",
  "objc2",
  "objc2-core-foundation",
 ]
 
+[[package]]
+name = "objc2-image-io"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b0446e98cf4a784cc7a0177715ff317eeaa8463841c616cfc78aa4f953c4ea"
+dependencies = [
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+]
+
 [[package]]
 name = "objc2-io-surface"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
+ "libc",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-media-toolbox"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edd9fdde720df3da7046bb9097811000c1e7ab5cd579fa89d96b27d56781fb30"
+dependencies = [
  "objc2",
+ "objc2-core-audio-types",
  "objc2-core-foundation",
+ "objc2-core-media",
 ]
 
 [[package]]
@@ -1847,7 +2846,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0125f776a10d00af4152d74616409f0d4a2053a6f57fa5b7d6aa2854ac04794"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "objc2",
  "objc2-foundation",
 ]
@@ -1858,7 +2857,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "objc2",
  "objc2-foundation",
 ]
@@ -1869,9 +2868,35 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "709fe137109bd1e8b5a99390f77a7d8b2961dafc1a1c5db8f2e60329ad6d895a"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-video-toolbox"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05bf9a3c14831a7d9641b0d81d87dd913ee238a012b2fde27db5a84b56f5df3e"
+dependencies = [
+ "bitflags 2.11.1",
+ "block2",
  "objc2",
  "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-media",
+ "objc2-core-video",
+ "objc2-foundation",
+ "objc2-metal",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
+dependencies = [
+ "asn1-rs",
 ]
 
 [[package]]
@@ -1886,6 +2911,12 @@ version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "ordered-stream"
 version = "0.2.0"
@@ -1905,6 +2936,30 @@ dependencies = [
  "ttf-parser",
 ]
 
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -1946,6 +3001,31 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
 
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
 [[package]]
 name = "phf"
 version = "0.10.1"
@@ -2032,6 +3112,12 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
 [[package]]
 name = "piper"
 version = "0.2.5"
@@ -2043,13 +3129,23 @@ dependencies = [
  "futures-io",
 ]
 
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "png"
 version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "crc32fast",
  "fdeflate",
  "flate2",
@@ -2070,6 +3166,50 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "poly1305"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+dependencies = [
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -2125,6 +3265,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.5.0"
@@ -2322,7 +3471,7 @@ dependencies = [
  "rand 0.9.4",
  "rand_chacha 0.9.0",
  "simd_helpers",
- "thiserror",
+ "thiserror 2.0.18",
  "v_frame",
  "wasm-bindgen",
 ]
@@ -2368,13 +3517,27 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "rcgen"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -2426,6 +3589,16 @@ version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac",
+ "subtle",
+]
+
 [[package]]
 name = "rgb"
 version = "0.8.53"
@@ -2435,13 +3608,71 @@ dependencies = [
  "bytemuck",
 ]
 
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rtcp"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81d30d1c4091644431c22acf9f8be6191b56805e0e977f15ca7104b4a6d6eaec"
+dependencies = [
+ "bytes",
+ "thiserror 1.0.69",
+ "webrtc-util",
+]
+
+[[package]]
+name = "rtp"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f126f38ea84c02480e32e547c1459a939052f74fb92117ac3eef23fdac6b023"
+dependencies = [
+ "bytes",
+ "memchr",
+ "portable-atomic",
+ "rand 0.9.4",
+ "serde",
+ "thiserror 1.0.69",
+ "webrtc-util",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom 7.1.3",
+]
+
 [[package]]
 name = "rustix"
 version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -2454,19 +3685,59 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.23.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
 [[package]]
 name = "safe_arch"
 version = "0.7.4"
@@ -2522,13 +3793,39 @@ version = "3.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
 
+[[package]]
+name = "sdp"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32c374dceda16965d541c8800ce9cc4e1c14acfd661ddf7952feeedc3411e5c6"
+dependencies = [
+ "rand 0.9.4",
+ "substring",
+ "thiserror 1.0.69",
+ "url",
+]
+
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array",
+ "pkcs8",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "selectors"
 version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4eb30575f3638fc8f6815f448d50cb1a2e255b0897985c8c59f4d37b72a07b06"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "cssparser",
  "derive_more",
  "fxhash",
@@ -2601,6 +3898,17 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_repr"
 version = "0.1.20"
@@ -2613,14 +3921,26 @@ dependencies = [
 ]
 
 [[package]]
-name = "serial_test"
-version = "3.4.0"
+name = "serde_urlencoded"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
 dependencies = [
- "fslock",
- "futures-executor",
- "futures-util",
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serial_test"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+dependencies = [
+ "fslock",
+ "futures-executor",
+ "futures-util",
  "log",
  "once_cell",
  "parking_lot",
@@ -2648,6 +3968,28 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -2664,6 +4006,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simba"
 version = "0.8.1"
@@ -2726,6 +4078,25 @@ version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
 
+[[package]]
+name = "smol_str"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd538fb6910ac1099850255cf94a94df6551fbdd602454387d0adb2d1ca6dead"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -2736,6 +4107,16 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -2754,6 +4135,40 @@ version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
+[[package]]
+name = "stun"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a512c5d501e3e3b5a4bb3e8e31462d56d54a66b95a28b8596e14422bf21c32b"
+dependencies = [
+ "base64",
+ "crc",
+ "lazy_static",
+ "md-5",
+ "rand 0.9.4",
+ "ring",
+ "subtle",
+ "thiserror 1.0.69",
+ "tokio",
+ "url",
+ "webrtc-util",
+]
+
+[[package]]
+name = "substring"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ee6433ecef213b2e72f587ef64a2f5943e7cd16fbd82dbe8bc07486c534c86"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "2.0.117"
@@ -2765,6 +4180,23 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -2793,13 +4225,33 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
 
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
 ]
 
 [[package]]
@@ -2827,6 +4279,46 @@ dependencies = [
  "zune-jpeg",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.54"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e1d5e639ff6bab73cb6885cc7e7b1de96c3f32c68ec55f3952614bec1092244"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
 [[package]]
 name = "tokio"
 version = "1.52.1"
@@ -2839,7 +4331,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.3",
  "tokio-macros",
  "tracing",
  "windows-sys 0.61.2",
@@ -2856,6 +4348,31 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "1.1.1+spec-1.1.0"
@@ -2886,12 +4403,55 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.11.1",
+ "bytes",
+ "http",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
 [[package]]
 name = "tracing"
 version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
 dependencies = [
+ "log",
  "pin-project-lite",
  "tracing-attributes",
  "tracing-core",
@@ -2923,6 +4483,43 @@ version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 
+[[package]]
+name = "tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.4",
+ "sha1",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "turn"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ed995882f66ab94238de77c62e5e778389698ab700afa4696f4754da8f457cb"
+dependencies = [
+ "async-trait",
+ "base64",
+ "futures",
+ "log",
+ "md-5",
+ "portable-atomic",
+ "rand 0.9.4",
+ "ring",
+ "stun",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-util",
+ "webrtc-util",
+]
+
 [[package]]
 name = "typenum"
 version = "1.20.0"
@@ -2935,11 +4532,17 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
- "memoffset",
+ "memoffset 0.9.1",
  "tempfile",
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -2958,6 +4561,40 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -3018,6 +4655,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "waitgroup"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1f50000a783467e6c0200f9d10642f4bc424e39efc1b770203e88b488f79292"
+dependencies = [
+ "atomic-waker",
+]
+
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -3115,12 +4761,181 @@ version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
- "bitflags",
+ "bitflags 2.11.1",
  "hashbrown 0.15.5",
  "indexmap",
  "semver",
 ]
 
+[[package]]
+name = "webrtc"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08fd686c0920ac08f3a57eacc48e31f0e4ca1ffefba4478784606f78c14e83ad"
+dependencies = [
+ "arc-swap",
+ "async-trait",
+ "bytes",
+ "dtls",
+ "hex",
+ "interceptor",
+ "lazy_static",
+ "log",
+ "portable-atomic",
+ "rand 0.9.4",
+ "rcgen",
+ "regex",
+ "ring",
+ "rtcp",
+ "rtp",
+ "sdp",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smol_str",
+ "stun",
+ "thiserror 1.0.69",
+ "tokio",
+ "turn",
+ "unicase",
+ "url",
+ "waitgroup",
+ "webrtc-data",
+ "webrtc-ice",
+ "webrtc-mdns",
+ "webrtc-media",
+ "webrtc-sctp",
+ "webrtc-srtp",
+ "webrtc-util",
+]
+
+[[package]]
+name = "webrtc-data"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "062a5438d63bb0756a221693d76cc0dd6119affee1dfdfe57abe3a2a8c8b3eea"
+dependencies = [
+ "bytes",
+ "log",
+ "portable-atomic",
+ "thiserror 1.0.69",
+ "tokio",
+ "webrtc-sctp",
+ "webrtc-util",
+]
+
+[[package]]
+name = "webrtc-ice"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cb13fd1a373e68addc4bba0c8ca058627518e54342583d024bdcbb8ae5d97d"
+dependencies = [
+ "arc-swap",
+ "async-trait",
+ "crc",
+ "log",
+ "portable-atomic",
+ "rand 0.9.4",
+ "serde",
+ "serde_json",
+ "stun",
+ "thiserror 1.0.69",
+ "tokio",
+ "turn",
+ "url",
+ "uuid",
+ "waitgroup",
+ "webrtc-mdns",
+ "webrtc-util",
+]
+
+[[package]]
+name = "webrtc-mdns"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a17279a067e75df72ce923fdeb7f04cd808f6f5aa4910dc6bcb4fbe66b396ace"
+dependencies = [
+ "log",
+ "socket2 0.5.10",
+ "thiserror 1.0.69",
+ "tokio",
+ "webrtc-util",
+]
+
+[[package]]
+name = "webrtc-media"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94a84c910fec0848fd5a0d8a5651e0ddbdedaf25a7d3ae3f0b15f71ac73a1773"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "rand 0.9.4",
+ "rtp",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "webrtc-sctp"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f985465467d8910c1f8ac4382cd64f83b1f6a1a75021a82b221546f6fb3b856f"
+dependencies = [
+ "arc-swap",
+ "async-trait",
+ "bytes",
+ "crc",
+ "log",
+ "portable-atomic",
+ "rand 0.9.4",
+ "thiserror 1.0.69",
+ "tokio",
+ "webrtc-util",
+]
+
+[[package]]
+name = "webrtc-srtp"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66d8cdc33413f1d0192670a80ce93d17cb78d57fe3a2414be30d6f6dff121123"
+dependencies = [
+ "aead",
+ "aes",
+ "aes-gcm",
+ "byteorder",
+ "bytes",
+ "ctr",
+ "hmac",
+ "log",
+ "rtcp",
+ "rtp",
+ "sha1",
+ "subtle",
+ "thiserror 1.0.69",
+ "tokio",
+ "webrtc-util",
+]
+
+[[package]]
+name = "webrtc-util"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c0c7e0c8f280f2bbfae442701465777ac07adaf46ce0c5863cd58e13fe472a"
+dependencies = [
+ "async-trait",
+ "bitflags 1.3.2",
+ "bytes",
+ "ipnet",
+ "lazy_static",
+ "log",
+ "nix 0.26.4",
+ "portable-atomic",
+ "rand 0.9.4",
+ "thiserror 1.0.69",
+ "tokio",
+ "winapi",
+]
+
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -3276,6 +5091,15 @@ dependencies = [
  "windows-link 0.1.3",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
@@ -3440,7 +5264,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
- "bitflags",
+ "bitflags 2.11.1",
  "indexmap",
  "log",
  "serde",
@@ -3470,6 +5294,12 @@ dependencies = [
  "wasmparser",
 ]
 
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
 [[package]]
 name = "x11rb"
 version = "0.13.2"
@@ -3487,12 +5317,74 @@ version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea6fc2961e4ef194dcbfe56bb845534d0dc8098940c7e5c012a258bfec6701bd"
 
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom 7.1.3",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror 1.0.69",
+ "time",
+]
+
 [[package]]
 name = "y4m"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a5a4b21e1a62b67a2970e6831bc091d7b87e119e7f9791aef9702e3bef04448"
 
+[[package]]
+name = "yasna"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+dependencies = [
+ "time",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
 [[package]]
 name = "zbus"
 version = "5.15.0"
@@ -3611,6 +5503,80 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "zmij"
 version = "1.0.21"
diff --git a/Cargo.toml b/Cargo.toml
index 232f1f2..985eb45 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,6 +7,7 @@ members = [
     "packages/accessibility-windows-sys",
     "packages/accessibility-ios-sys",
     "packages/accessibility-core",
+    "packages/accessibility-serve",
     "packages/accessibility-cli",
 ]
 
@@ -19,6 +20,7 @@ homepage = "https://github.com/DioxusLabs/accessibility-cli"
 
 [workspace.dependencies]
 accessibility-core = { path = "packages/accessibility-core", version = "0.1.0" }
+accessibility-serve = { path = "packages/accessibility-serve", version = "0.1.0" }
 accessibility-cli = { path = "packages/accessibility-cli", version = "0.1.0" }
 accessibility-android-sys = { path = "packages/accessibility-android-sys", version = "0.1.0" }
 accessibility-linux-sys = { path = "packages/accessibility-linux-sys", version = "0.1.0" }
@@ -30,23 +32,70 @@ accesskit = { version = "0.22", features = ["enumn", "schemars", "serde"] }
 anyhow = "1.0.100"
 async-trait = "0.1.89"
 atspi = { version = "0.29", features = ["connection", "proxies"] }
+axum = "0.8"
 atspi-common = "0.13"
+block2 = "0.6"
+bytes = "1"
 clap = { version = "4", features = ["derive"] }
 cssparser = "0.31"
+dispatch2 = "0.3"
 ctrlc = "3"
 euclid = { version = "0.22", features = ["serde"] }
 futures-lite = "2"
+futures-util = "0.3"
 image = "0.25"
 imageproc = "0.25"
 keyboard-types = "0.7"
+libc = "0.2"
+objc2 = "0.6"
+objc2-av-foundation = { version = "0.3", features = [
+    "AVAssetWriter",
+    "AVAssetWriterInput",
+    "AVMediaFormat",
+    "AVVideoSettings",
+    "objc2-core-media",
+    "objc2-core-video",
+    "block2",
+] }
+objc2-core-foundation = { version = "0.3", features = ["CFBase", "CFCGTypes"] }
+objc2-core-media = { version = "0.3", features = [
+    "CMSampleBuffer",
+    "CMTime",
+    "CMFormatDescription",
+    "CMBlockBuffer",
+    "objc2-core-video",
+] }
+objc2-core-video = { version = "0.3", features = [
+    "CVPixelBuffer",
+    "CVPixelBufferPool",
+    "CVImageBuffer",
+    "CVBuffer",
+    "CVReturn",
+    "objc2-io-surface",
+] }
+objc2-foundation = "0.3"
+objc2-io-surface = { version = "0.3", features = ["IOSurfaceRef"] }
+objc2-video-toolbox = { version = "0.3", features = [
+    "VTCompressionSession",
+    "VTCompressionProperties",
+    "VTSession",
+    "VTErrors",
+    "block2",
+    "objc2-core-media",
+    "objc2-core-video",
+] }
 quick-xml = "0.37"
 selectors = "0.25"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1"
 serial_test = { version = "3", features = ["file_locks"] }
 slotmap = { version = "1.1", features = ["serde"] }
+tower-http = "0.6"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tokio = { version = "1.49.0", features = ["full"] }
 viuer = "0.9"
+webrtc = "0.14"
 x11rb = { version = "0.13", features = ["randr"] }
 zbus = { version = "5", features = ["tokio"] }
 
diff --git a/docs/IDB_LEARNINGS.md b/docs/IDB_LEARNINGS.md
new file mode 100644
index 0000000..e210911
--- /dev/null
+++ b/docs/IDB_LEARNINGS.md
@@ -0,0 +1,122 @@
+# What idb does that we should consider
+
+From reading Meta's idb at `~/Dev/idb`. Accessibility findings are in
+`WEB_CONTENT_ACCESSIBILITY_PLAN.md`; input bugs are in
+`SERVE_SIM_BACKLOG.md`. This file covers everything else, roughly in
+descending order of value.
+
+Claims below were spot-checked against the source. Anything not verified is
+marked as such.
+
+## Video capture
+
+### Pick the main display by `displayClass`, not by area
+
+We choose the framebuffer descriptor with the largest live surface. idb reads
+the descriptor's `state` and takes `displayClass == 0`, falling back to the
+first renderable display (`FBFramebufferSurface.swift:101-129`):
+
+```swift
+// iOS exposes the main display as displayClass 0. tvOS renders only on the TVOut display (a
+// non-zero class), so prefer class 0 but fall back to the first renderable display rather than
+// throwing — otherwise screenshots and video are impossible on a target with no class-0 display.
+```
+
+Largest-area happens to work on iPhone but is a heuristic standing in for a
+value the API actually reports, and it would pick wrong on tvOS.
+
+They also require the descriptor to conform to both
+`SimDisplayIOSurfaceRenderable` and `SimDisplayRenderable`, and try
+`framebufferSurface` before falling back to the older `ioSurface` — worth
+copying for older Xcodes.
+
+### Replace the CPU memcpy with `VTPixelTransferSession`
+
+The most valuable idea here. We `memcpy` every frame to escape SimulatorKit's
+recycled IOSurface, then hand BGRA to VideoToolbox and let it convert and
+scale internally. idb does all three jobs in one GPU pass
+(`FBSimulatorVideoStream.swift:588-599, 678-691`): `VTPixelTransferSession`
+transfers the live BGRA surface into a pooled **NV12** buffer at the target
+size.
+
+That single call replaces our copy, the implicit BGRA→NV12 conversion, and the
+downscale we now want anyway. Note this does not contradict the earlier
+finding that a plain Metal blit was slower than `memcpy` — that measured a
+pure copy doing one job, against a purpose-built transfer doing three.
+
+They additionally lock the buffer read-only around the encode and compare
+`IOSurfaceGetSeed` before and after, counting torn frames rather than
+preventing them (`FBSimulatorVideoStream.swift:729-752`). Cheap diagnostic,
+worth having.
+
+### Consider quality-based rate control instead of a bitrate
+
+We target a bitrate derived from resolution. idb defaults to
+`kVTCompressionPropertyKey_Quality` at `0.75`, with the CLI overriding to
+`0.2` (`FBVideoStreamConfiguration.swift:83`, `idb/cli/commands/video.py:78`).
+
+Constant quality sidesteps the failure mode fixed earlier — where too low a
+bitrate made VideoToolbox drop frames — because there is no per-frame budget
+to exceed. Worth measuring against the current setup.
+
+### Coalesce damage events, and apply backpressure
+
+We encode on every framebuffer callback. idb separates damage notifications
+from encode pushes and offers two cadences: lazy/VFR driven by damage with an
+`AsyncStream` set to `bufferingNewest(1)` so stale triggers are dropped, or
+eager/CFR on a drift-corrected clock. It also refuses to push when a consumer
+has more than two unprocessed frames in flight
+(`FBVideoStreamWriters.swift:16-32`).
+
+### Formats we do not have
+
+H.264 and HEVC, over Annex-B, MPEG-TS or fragmented MP4, plus MJPEG, minicap
+and raw BGRA. fMP4 in particular would make the stream playable by a plain
+`<video>` via Media Source Extensions, without WebRTC or WebCodecs.
+
+## Input
+
+Full detail in the backlog. In brief: USB HID usage codes rather than
+HIToolbox, modifiers as held key events, and a second XPC transport coming for
+Xcode 27.
+
+Two smaller things worth stealing:
+
+- **Swipe sampling** (`FBSimulatorHIDEvent.swift:158-185`): interpolate at a
+  10-point default spacing, emit repeated `.down` events, and send a
+  **duplicate final down** before the up — explicitly to avoid inertial scroll
+  on Apple Silicon simulators. Our scroll synthesis does not do this.
+- **Two-finger and pinch** come free from `IndigoHIDMessageForMouseNSEvent` by
+  passing a non-null second point, which switches the message to a
+  three-payload multi-touch layout. We pass null and so cannot pinch.
+
+### One place we are ahead
+
+idb has no screen-edge parameter at all, so it cannot flag a touch as a system
+edge gesture; a swipe-up-to-home is just a coordinate path for them. We pass
+the edge as the seventh argument to `IndigoHIDMessageForMouseNSEvent`, which
+is why our swipe-to-home works reliably.
+
+## Capabilities we do not have at all
+
+From `proto/idb.proto` and `idb/cli/commands/`: media (`photos`, `media`),
+logs (`log`), app lifecycle (`app`, `launch`, `kill`), TCC
+(`approve`, `revoke`), `location`, `contacts`, `keychain`, `crash`, `dap`,
+`debugserver`, `dsym`, `dylib`, `file`, `focus`, `framework`, `instruments`,
+`memory`, `notification`, `screenshot`, `settings`, `shell`, `xctest`.
+
+The ones that fit a browser-based simulator tool, in rough order of value:
+log streaming, media add, TCC approval, app launch/terminate, and
+`notification` for push payloads.
+
+## Direction of travel
+
+An Objective-C to Swift migration is underway across the HID and video
+subsystems, `FBFuture` is being replaced by async/await, and the newest work
+is the DTUHID transport for Xcode 27. The relevant signal for us is that Apple
+is moving simulator input from Indigo to a CoreDevice XPC service, and idb is
+following.
+
+Not verified: a subagent produced a list of recent video-stream commits from
+web search rather than from `git log`, so those specific hashes and messages
+should be re-checked locally before being relied on.
diff --git a/docs/SERVE_SIM_BACKLOG.md b/docs/SERVE_SIM_BACKLOG.md
new file mode 100644
index 0000000..da47dca
--- /dev/null
+++ b/docs/SERVE_SIM_BACKLOG.md
@@ -0,0 +1,106 @@
+# serve-sim backlog
+
+Gaps found after the first working version. Ordered by how soon they bite,
+not by effort. Stream quality and performance are being worked separately.
+
+## Broken
+
+### Xcode 27 will silently break keyboard input
+
+On Xcode 27 / CoreSimulator 1155.4+, an active `dtuhidd` disconnects the
+legacy `ExternalKeyboardService`. Indigo keyboard events are still delivered
+byte-correctly and still produce no text. idb detects this and throws rather
+than typing into the void (`FBSimulatorHIDSelection.swift:17-43`): gate on the
+loaded CoreSimulator version being >= 1155.4 and on a `dtuhidd` subprocess
+existing for the UDID.
+
+Their workaround is a whole second transport, `FBSimulatorDTUHIDTransport`,
+which speaks plain XPC to `com.apple.coredevice.feature.remote.hid.digitizer`,
+building the connection from the simulator's Mach port via private `_4sim`
+symbols resolved with `dlsym` and marking it sim-to-host with
+`xpc_connection_enable_sim2host_4sim`. They are adding capabilities to it one
+commit at a time, which is a fair signal of where this is all heading.
+
+Least we should do now: detect the condition and report it, instead of
+appearing to work.
+
+## Misleading
+
+### `--fps` does not throttle anything
+
+It only sets `ExpectedFrameRate`, which is a rate-control hint. Capture is
+event-driven and unthrottled. Measured with `--fps 10` during animation: a
+median inter-frame gap of 17.2 ms, roughly 58fps.
+
+Either implement a capture-side throttle or rename it `--encoder-fps`.
+
+## Missing for remote use
+
+### No downscale
+
+Streams the native 1206x2622 with no way to reduce it. Fine on loopback,
+unpleasant over a tunnel. See the stream quality work — this overlaps.
+
+## Cheap and high value
+
+All thin wrappers over simctl:
+
+- `simctl openurl` — deep-link into apps instead of tapping through.
+- `simctl pbcopy` / `pbpaste` — pairs with the text input fix.
+- `simctl addmedia` — drag a photo or video onto the device.
+- `simctl spawn log stream` — forward device logs to the browser. serve-sim
+  does this specifically so agents can read them.
+
+## Robustness
+
+### Simulator shutdown mid-serve is untested
+
+Expected to degrade quietly: capture goes silent, HID and AX calls fail per
+request, and nothing tells the user why the screen froze. Needs a deliberate
+test and a clear error.
+
+### The inspector's accessibility tree is cached on toggle only
+
+Never refreshed, so after navigating, hover previews are stale until the
+debounced hit test corrects them.
+
+### The cached tree is app-scoped, the hit test is display-scoped
+
+`get_tree` walks the frontmost app, so it does not contain the status bar,
+which belongs to SpringBoard. `objectAtPoint:` hit tests the whole display and
+does find it. The hybrid picker papers over this — hover preview misses those
+elements, the confirming hit test catches them — but a tree-only consumer will
+not see them.
+
+## Known limitations, probably fine
+
+- Landscape left vs right cannot be detected, only landscape vs portrait, so
+  external rotation resolves to `landscape_left` until corrected.
+- `simctl ui` only implements three settings; the rest need an in-simulator
+  helper.
+- Single device per server. serve-sim offers a grid.
+- Single-touch only; no pinch or two-finger gestures.
+- No auth on the input socket. Loopback by default, so `--bind 0.0.0.0`
+  currently exposes an unauthenticated control channel.
+
+## Done since this list was written
+
+- **Text input.** Was typing the wrong characters entirely: Indigo takes USB
+  HID usages, not HIToolbox keycodes. Fixed, with modifiers, and verified by
+  typing `Test@Example.com?` verbatim on device.
+- **Web content discovery.** `?scan=true` sweeps what the tree walk cannot
+  explain. A Safari page goes from 5 elements at 4% coverage to 15 at 50%.
+- **Frame copy and display selection.** `VTPixelTransferSession` replaced the
+  memcpy; the main display is chosen by `displayClass`.
+
+## Verified working, do not re-litigate
+
+- Multi-viewer including late join: a second viewer joining mid-stream gets
+  its own parameter set and an immediate keyframe.
+- Idle cost with zero viewers: 0.4% of a core idle, ~8% while animating.
+  Gating encode on subscriber count is not worth it.
+- A plain GPU blit is slower than `memcpy` for a bare copy. The pixel
+  transfer that replaced it wins by doing the conversion and scale too.
+- Constant-quality rate control is ignored *while low-latency rate control is
+  enabled*. With it disabled the knob works and spans a 16x bitrate range,
+  which is what the `recording` tuning is for.
diff --git a/docs/WEB_CONTENT_ACCESSIBILITY_PLAN.md b/docs/WEB_CONTENT_ACCESSIBILITY_PLAN.md
new file mode 100644
index 0000000..9203fb0
--- /dev/null
+++ b/docs/WEB_CONTENT_ACCESSIBILITY_PLAN.md
@@ -0,0 +1,170 @@
+# Reaching web content in the accessibility tree
+
+Plan for exposing `WKWebView` and Safari content, which the ordinary tree walk
+cannot see.
+
+Settled by reading idb's source rather than guessing: Meta hit this exact
+problem, and the approach they landed on is grid-based hit testing. Details and
+citations below.
+
+## What was measured here
+
+Against a booted iPhone 17 running a probe page with a heading, link, button,
+text field and paragraph.
+
+**Hit testing already reaches web content.** `objectAtPoint:` resolved every
+element on the page:
+
+    Unknown   AX Probe Heading
+    Link      Probe Link Alpha
+    Button    Probe Button Bravo
+    TextInput (no label)
+    Label     Probe paragraph text content.
+
+**The tree walk does not.** `get_tree` on the same page returns five elements,
+all Safari's own chrome: Back, Page Menu, Address, refresh, More.
+
+**There is no hierarchy to traverse, in either direction.** Building a subtree
+from a hit-test result gives one node at any depth. Climbing
+`accessibilityParent` from the link reaches an `AXGroup` covering the web area
+(438x714) — and that group reports `children = 0`. So the content is
+individually addressable but not enumerable.
+
+**Hit tests are cheap**: 3.2 ms median, 4.0 ms p90, measured over HTTP
+including the round trip.
+
+## How this affects WebView apps
+
+Identically, and this matters more than the Safari case.
+
+Safari's content area *is* a `WKWebView` backed by a separate WebContent
+process. An app embedding `WKWebView` gets the same architecture — there is no
+in-process mode. So the measurements above apply unchanged to React Native
+`WebView`, Capacitor and Cordova apps, in-app browsers,
+`SFSafariViewController`, and any embedded web view.
+
+| capability | native UI | web content |
+|---|---|---|
+| inspector picking | works | **works** (hit test) |
+| inspector hover preview | instant | lags to the hit test, ~110 ms |
+| `get_tree` / `--llm` output | works | **blind** |
+| CSS-like selectors, `--click`, `--query` | works | **blind** |
+| tapping by coordinate | works | works |
+
+A hybrid app is therefore drivable by an agent that can see the screen, and
+invisible to one that reasons over the tree. For a Capacitor app that is
+essentially the whole UI.
+
+## What idb does, and what that settles
+
+Read from a clone of idb at `~/Dev/idb`.
+
+### SimulatorBridge is dead — they deleted it
+
+`accessibilityElementsWithDisplayId:` exists **only** in
+`PrivateHeaders/SimulatorBridge/SimulatorBridge-Protocol.h:19`. Nothing in idb
+calls it. `git log -S accessibilityElementsWithDisplayId` tells the whole
+story:
+
+    d821fc904 Add SimulatorBridge Headers
+    a12a016b2 Add Accessiblity Elements API for Simulators
+    276435588 Delete FBSimulatorBridge
+
+The only surviving trace is the output *format*, kept for compatibility —
+`FBSimulatorAccessibilitySerializer.swift:78` notes the values "mirror the old
+SimulatorBridge implementation for downstream compatibility". `SimulatorBridge`
+is otherwise referenced only to restart `com.apple.CoreSimulator.bridge` as
+SpringBoard-crash remediation, which we already do.
+
+**So option B is dead.** Had we built it, we would have reimplemented
+something its own authors removed.
+
+### idb's current mechanism is the same as ours
+
+`FBSimulatorAccessibilityCommands.swift:114`:
+
+```swift
+// Uses the CoreSimulator accessibility API via
+// -[SimDevice sendAccessibilityRequestAsync:completionQueue:completionHandler:].
+```
+
+`AXPTranslator` with a `bridgeTokenDelegate`, and exactly two request kinds —
+`.frontmostApplication` and `.point(point)`. That is our implementation. It
+would inherit the identical blindness.
+
+### And they solve web content by grid hit testing
+
+`FBControlCore/Commands/FBAccessibilityRequestOptions.swift:11`:
+
+```swift
+/// Options for fetching remote process elements (e.g., WebView content).
+/// Remote elements are in separate processes and require grid-based hit-testing.
+```
+
+That is first-party confirmation that no better API exists. The implementation
+is `discoverRemoteElements` in `FBSimulatorControl/Commands/FBAXTranslationRequest.swift:160-247`,
+and it is more careful than a naive sweep in four ways worth copying:
+
+1. **A coverage grid, populated during the ordinary recursive traversal**
+   (`FBAccessibilityCoverageGrid.swift`, cell-based `markFilled` / `isFilled`).
+   Probe points that already sit on a natively-discovered element are skipped
+   entirely, so the sweep only pays for the parts of the screen the tree walk
+   could not explain.
+2. **Remote content is identified by pid.** Hits whose pid was already seen in
+   the traversal, or which belong to the frontmost app, are discarded. A
+   different pid *is* the signal that something came from another process.
+3. **Dedup by frame**, since a 50pt grid lands on a large element repeatedly.
+4. **Provenance is recorded.** Every element carries a discovery method of
+   `"recursive"` or `"point_grid"` plus an `isRemote` flag, and the response
+   reports frame coverage before and after. Consumers can tell exact results
+   from sampled ones.
+
+Defaults: `gridStepSize = 50.0` points, full-screen region, `maxPoints = 0`
+(unlimited).
+
+### Why the experiment would have misled us
+
+`remoteContentOptions` defaults to `nil`, meaning **remote content is not
+fetched unless explicitly requested**, and the option is not plumbed through
+the proto or the Python CLI at all — `grep` for `remote_content` across
+`proto/` and `idb/` returns nothing.
+
+So `idb ui describe-all` on a web page would have shown no web content, and we
+would have concluded idb could not see it either. Reading the source was the
+right call.
+
+## Plan
+
+Option A, following idb's design.
+
+1. **Build the coverage grid during the existing tree walk.** Cheap, useful on
+   its own: the coverage ratio is a direct measure of how much of the screen
+   the tree explains, which is the diagnostic that would have made this whole
+   problem obvious months earlier.
+2. **Add a sweep over uncovered regions**, skipping filled cells, filtering by
+   pid, deduping by frame. Start at a 50pt step to match idb. At the measured
+   3.2 ms per probe, a full-screen 50pt grid on a 402x874 point device is
+   ~8x17 = 136 points worst case, or ~0.44 s, and far less once covered cells
+   are skipped.
+3. **Tag provenance** — `recursive` vs `point_grid`, and a coverage figure on
+   the response. Do not let sampled results masquerade as exact ones.
+4. **Expose it as opt-in**, not as part of every `get_tree`. A `--scan` flag on
+   the CLI and a query parameter on `/api/ax/tree`.
+5. **Independently, fix the inspector's hover preview** by caching hit-test
+   results as the pointer moves. Picking already works on web content; only the
+   instant preview is missing. Smallest useful change here and unblocked by
+   everything above.
+
+## What not to do
+
+Do not make `get_tree` sweep transparently. It would turn a fast call into a
+half-second one and silently return a flat, approximate list under the same
+shape as the exact hierarchy returned for native apps.
+
+Do not implement SimulatorBridge. See above.
+
+## Remaining unknown
+
+Whether a 50pt grid is right for phone-sized screens, and whether adaptive
+refinement (denser probing where returned frames are small) is worth it. idb
+ships a fixed step, which is evidence that fixed is good enough.
diff --git a/packages/accessibility-cli/Cargo.toml b/packages/accessibility-cli/Cargo.toml
index da7911e..d1cf5ea 100644
--- a/packages/accessibility-cli/Cargo.toml
+++ b/packages/accessibility-cli/Cargo.toml
@@ -9,6 +9,7 @@ homepage.workspace = true
 
 [dependencies]
 accessibility-core.workspace = true
+anyhow.workspace = true
 clap.workspace = true
 ctrlc.workspace = true
 serde_json.workspace = true
@@ -22,3 +23,6 @@ serial_test.workspace = true
 [[bin]]
 name = "accessibility-cli"
 path = "src/main.rs"
+
+[target.'cfg(target_os = "macos")'.dependencies]
+accessibility-serve.workspace = true
diff --git a/packages/accessibility-cli/src/lib.rs b/packages/accessibility-cli/src/lib.rs
index 15cef63..05c1795 100644
--- a/packages/accessibility-cli/src/lib.rs
+++ b/packages/accessibility-cli/src/lib.rs
@@ -1389,6 +1389,10 @@ Examples:
 )]
 #[command(version)]
 pub struct Cli {
+    /// Subcommand to run. Omit to use the flag-driven query interface above.
+    #[command(subcommand)]
+    pub command: Option<Command>,
+
     /// Target platform (defaults to current OS)
     #[arg(long, short = 'p', value_enum, default_value_t = PlatformType::default())]
     pub platform: PlatformType,
@@ -1842,6 +1846,72 @@ fn parse_long_press(s: &str) -> Result<(f64, f64, u64), String> {
     Ok((x, y, duration_ms))
 }
 
+/// Subcommands that do something other than query an accessibility tree.
+#[derive(clap::Subcommand)]
+pub enum Command {
+    /// Serve the iOS Simulator in a browser: live video, input, and element
+    /// inspection.
+    ServeSim(ServeSimArgs),
+}
+
+#[derive(clap::Args)]
+pub struct ServeSimArgs {
+    /// Simulator to serve. Defaults to the first booted device.
+    #[arg(long)]
+    pub udid: Option<String>,
+
+    /// Port to listen on.
+    #[arg(long, default_value_t = 3200)]
+    pub port: u16,
+
+    /// Address to bind. Defaults to loopback; use 0.0.0.0 to expose on the LAN.
+    #[arg(long, default_value = "127.0.0.1")]
+    pub bind: std::net::IpAddr,
+
+    /// Transport the browser should prefer: webrtc or h264.
+    #[arg(long, default_value = "webrtc")]
+    pub transport: String,
+
+    /// Encoder frame rate ceiling. The simulator only paints on change, so
+    /// this is an upper bound rather than a target.
+    #[arg(long, default_value_t = 60)]
+    pub fps: u32,
+
+    /// What the encoder should optimize for.
+    ///
+    /// `interactive` keeps latency low and spends a fixed bitrate.
+    /// `recording` drops the low-latency constraint so a quality target is
+    /// honoured, at the cost of latency — wrong for anyone watching live.
+    #[arg(long, default_value = "interactive")]
+    pub tuning: String,
+
+    /// Target bitrate in bits per second, for interactive tuning. Defaults to
+    /// a value derived from the encode resolution.
+    #[arg(long, conflicts_with = "quality")]
+    pub bitrate: Option<u32>,
+
+    /// Target quality from 0 to 1, for recording tuning.
+    #[arg(long, default_value_t = 0.75)]
+    pub quality: f64,
+
+    /// Longest edge to encode at. The device framebuffer is scaled down to
+    /// fit, which is where most of the quality-per-bit comes from.
+    #[arg(long, default_value_t = 1280)]
+    pub max_dimension: u32,
+
+    /// Encode at the device's native resolution instead of downscaling.
+    #[arg(long)]
+    pub native_resolution: bool,
+
+    /// Seconds between scheduled keyframes.
+    #[arg(long, default_value_t = 2)]
+    pub keyframe_interval: u32,
+
+    /// ICE server URL, repeatable. Only needed to traverse a NAT.
+    #[arg(long = "ice-server")]
+    pub ice_servers: Vec<String>,
+}
+
 /// Run the CLI using process arguments.
 pub fn run() {
     let cli = Cli::parse();
@@ -1852,9 +1922,65 @@ pub fn run() {
             std::process::exit(1);
         }
     };
+
+    if let Some(command) = &cli.command {
+        runtime.block_on(run_command(command));
+        return;
+    }
+
     runtime.block_on(run_cli(&cli));
 }
 
+async fn run_command(command: &Command) {
+    let result = match command {
+        Command::ServeSim(args) => run_serve_sim(args).await,
+    };
+    if let Err(error) = result {
+        eprintln!("Error: {error:#}");
+        std::process::exit(1);
+    }
+}
+
+#[cfg(target_os = "macos")]
+async fn run_serve_sim(args: &ServeSimArgs) -> anyhow::Result<()> {
+    use accessibility_core::video::VideoConfig;
+    use accessibility_serve::{ServeConfig, Transport, serve};
+
+    let transport: Transport = args.transport.parse()?;
+    serve(ServeConfig {
+        udid: args.udid.clone(),
+        address: std::net::SocketAddr::new(args.bind, args.port),
+        transport,
+        video: VideoConfig {
+            fps: args.fps,
+            tuning: match args.tuning.as_str() {
+                "interactive" => accessibility_core::video::Tuning::Interactive {
+                    bitrate: args.bitrate,
+                },
+                "recording" => accessibility_core::video::Tuning::Recording {
+                    quality: args.quality,
+                },
+                other => anyhow::bail!(
+                    "unknown tuning '{other}' (expected interactive or recording)"
+                ),
+            },
+            max_dimension: (!args.native_resolution).then_some(args.max_dimension),
+            keyframe_interval_secs: args.keyframe_interval,
+            // WebRTC needs Annex-B; the raw H.264 transport converts on the
+            // way out so a single encoder feeds both.
+            nal_format: accessibility_core::video::NalFormat::AnnexB,
+            ..Default::default()
+        },
+        ice_servers: args.ice_servers.clone(),
+    })
+    .await
+}
+
+#[cfg(not(target_os = "macos"))]
+async fn run_serve_sim(_args: &ServeSimArgs) -> anyhow::Result<()> {
+    anyhow::bail!("serve-sim requires macOS with Xcode and a booted iOS Simulator")
+}
+
 /// Build a TreeFilter from CommonArgs
 fn build_filter(common: &CommonArgs) -> TreeFilter {
     TreeFilter {
diff --git a/packages/accessibility-core/Cargo.toml b/packages/accessibility-core/Cargo.toml
index 2a9f89b..d46c75b 100644
--- a/packages/accessibility-core/Cargo.toml
+++ b/packages/accessibility-core/Cargo.toml
@@ -16,6 +16,7 @@ accessibility-android-sys.workspace = true
 accesskit.workspace = true
 anyhow.workspace = true
 async-trait.workspace = true
+bytes.workspace = true
 cssparser.workspace = true
 euclid.workspace = true
 image.workspace = true
diff --git a/packages/accessibility-core/src/accessibility/mod.rs b/packages/accessibility-core/src/accessibility/mod.rs
index 2cda6bb..ec3e53c 100644
--- a/packages/accessibility-core/src/accessibility/mod.rs
+++ b/packages/accessibility-core/src/accessibility/mod.rs
@@ -106,6 +106,23 @@ pub trait AccessibilityReader {
         async { anyhow::bail!("Screen bounds not supported on this platform") }
     }
 
+    /// Start a live video capture session, pushing encoded frames to `sink`.
+    ///
+    /// This is the streaming counterpart to [`Self::capture_screen`]. Only the
+    /// iOS Simulator implements it today.
+    fn start_video_capture(
+        &self,
+        _config: &crate::video::VideoConfig,
+        _sink: crate::video::FrameSink,
+    ) -> Result<Box<dyn crate::video::VideoCapture>> {
+        crate::video::unsupported(self.platform_name())
+    }
+
+    /// Whether [`Self::start_video_capture`] is expected to succeed.
+    fn supports_video_capture(&self) -> bool {
+        false
+    }
+
     /// Get the platform name (e.g., "macOS", "Windows", "Linux", "iOS").
     fn platform_name(&self) -> &'static str {
         "Unknown"
diff --git a/packages/accessibility-core/src/lib.rs b/packages/accessibility-core/src/lib.rs
index 365f0c0..ea1cc70 100644
--- a/packages/accessibility-core/src/lib.rs
+++ b/packages/accessibility-core/src/lib.rs
@@ -4,3 +4,4 @@ pub mod accessibility;
 pub mod api;
 pub mod input;
 pub mod platform;
+pub mod video;
diff --git a/packages/accessibility-core/src/platform/ios_simulator.rs b/packages/accessibility-core/src/platform/ios_simulator.rs
index 38b26b6..9232731 100644
--- a/packages/accessibility-core/src/platform/ios_simulator.rs
+++ b/packages/accessibility-core/src/platform/ios_simulator.rs
@@ -7,6 +7,7 @@
 
 use std::collections::HashMap;
 use std::future;
+use std::sync::Arc;
 
 use accessibility_ios_sys as sys;
 use accesskit::{Action, Role};
@@ -17,6 +18,10 @@ use crate::accessibility::{
     AccessibilityReader, Element, ElementCache, ElementKey, ElementTree, Point, Rect, Screenshot,
     Size, Target, TreeFilter,
 };
+use crate::video::{
+    EncodedFrame, FrameKind, FrameSink, NalFormat, Recording, RecordingConfig, ScreenGeometry,
+    Tuning, VideoCapture, VideoConfig,
+};
 
 pub use sys::{ButtonDirection, HardwareButton};
 
@@ -294,6 +299,113 @@ impl AccessibilityReader for IOSSimulatorAccessibility {
     fn supports_hit_test(&self) -> bool {
         true
     }
+
+    fn start_video_capture(
+        &self,
+        config: &VideoConfig,
+        sink: FrameSink,
+    ) -> Result<Box<dyn VideoCapture>> {
+        let session = SimulatorVideoCapture::start(self.device_udid(), config, sink)?;
+        Ok(Box::new(session))
+    }
+
+    fn supports_video_capture(&self) -> bool {
+        true
+    }
+}
+
+/// Live framebuffer capture for the simulator, wrapping `accessibility-ios-sys`.
+pub struct SimulatorVideoCapture {
+    inner: sys::SimVideoStream,
+}
+
+impl SimulatorVideoCapture {
+    /// Start capturing the given device.
+    ///
+    /// The returned session owns the SimulatorKit registration; dropping it
+    /// tears the capture pipeline down.
+    pub fn start(udid: &str, config: &VideoConfig, sink: FrameSink) -> Result<Self> {
+        let sys_config = sys::EncoderConfig {
+            fps: config.fps,
+            tuning: match config.tuning {
+                Tuning::Interactive { bitrate } => sys::Tuning::Interactive { bitrate },
+                Tuning::Recording { quality } => sys::Tuning::Recording { quality },
+            },
+            max_dimension: config.max_dimension,
+            keyframe_interval_secs: config.keyframe_interval_secs,
+            nal_format: match config.nal_format {
+                NalFormat::AnnexB => sys::NalFormat::AnnexB,
+                NalFormat::Avcc => sys::NalFormat::Avcc,
+            },
+        };
+
+        let sys_sink: sys::ChunkSink = Arc::new(move |chunk: sys::EncodedChunk| {
+            sink(EncodedFrame {
+                data: chunk.data,
+                kind: match chunk.kind {
+                    sys::ChunkKind::ParameterSet => FrameKind::ParameterSet,
+                    sys::ChunkKind::Keyframe => FrameKind::Keyframe,
+                    sys::ChunkKind::Delta => FrameKind::Delta,
+                },
+            });
+        });
+
+        Ok(Self {
+            inner: sys::SimVideoStream::start(Some(udid), sys_config, sys_sink)?,
+        })
+    }
+}
+
+impl VideoCapture for SimulatorVideoCapture {
+    fn geometry(&self) -> ScreenGeometry {
+        let geometry = self.inner.geometry();
+        ScreenGeometry {
+            width: geometry.width,
+            height: geometry.height,
+        }
+    }
+
+    fn encoded_geometry(&self) -> ScreenGeometry {
+        let geometry = self.inner.encoded_geometry();
+        ScreenGeometry {
+            width: geometry.width,
+            height: geometry.height,
+        }
+    }
+
+    fn request_keyframe(&self) {
+        self.inner.request_keyframe();
+    }
+
+    fn start_recording(&self, path: &std::path::Path, config: &RecordingConfig) -> Result<()> {
+        self.inner.start_recording(
+            path,
+            sys::RecordingConfig {
+                quality: config.quality,
+                max_dimension: config.max_dimension,
+                keyframe_interval_secs: config.keyframe_interval_secs,
+            },
+        )
+    }
+
+    fn stop_recording(&self) -> Result<Recording> {
+        let recording = self.inner.stop_recording()?;
+        Ok(Recording {
+            path: recording.path,
+            frames: recording.frames,
+            duration_secs: recording.duration.as_secs_f64(),
+            width: recording.width,
+            height: recording.height,
+        })
+    }
+
+    fn recording_frames(&self) -> Option<u64> {
+        self.inner.recording_frames()
+    }
+
+    fn stop(&mut self) {
+        self.inner.stop();
+    }
 }
 
 use super::macos::IOSAdapter;
diff --git a/packages/accessibility-core/src/video/mod.rs b/packages/accessibility-core/src/video/mod.rs
new file mode 100644
index 0000000..29fa0b9
--- /dev/null
+++ b/packages/accessibility-core/src/video/mod.rs
@@ -0,0 +1,225 @@
+//! Platform-agnostic live video capture.
+//!
+//! This is the streaming counterpart to [`crate::accessibility::Screenshot`]:
+//! where a screenshot is a single decoded image, a [`VideoCapture`] is a
+//! continuous source of *encoded* frames.
+//!
+//! Deliberately encoded-frame oriented. Every platform that can do this at all
+//! has a hardware encoder sitting right next to its capture API, and handing
+//! raw surfaces across the abstraction boundary would force a copy and make
+//! the zero-copy paths unreachable.
+//!
+//! Only the iOS Simulator backend is implemented today; every other platform
+//! reports [`VideoCapture`] as unsupported.
+
+use std::sync::Arc;
+
+use anyhow::Result;
+use bytes::Bytes;
+
+/// What the encoder should optimize for.
+///
+/// A single choice rather than two knobs, because the underlying settings are
+/// mutually exclusive: constant-quality rate control is ignored while
+/// low-latency rate control is enabled. Expressing it this way makes the
+/// combination that silently does nothing impossible to ask for.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Tuning {
+    /// Live interactive streaming. Lowest latency; spends a fixed bitrate.
+    Interactive {
+        /// Target bitrate, or `None` to derive one from the encode resolution.
+        bitrate: Option<u32>,
+    },
+    /// Recording and offline capture. Targets a constant quality from 0 to 1,
+    /// letting the encoder buffer and letting the bitrate vary.
+    Recording { quality: f64 },
+}
+
+impl Default for Tuning {
+    fn default() -> Self {
+        Tuning::Interactive { bitrate: None }
+    }
+}
+
+/// Compressed video codec.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum VideoCodec {
+    #[default]
+    H264,
+}
+
+/// How H.264 NAL units are framed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum NalFormat {
+    /// `00 00 00 01` start codes. What WebRTC's H.264 payloader expects.
+    #[default]
+    AnnexB,
+    /// 4-byte big-endian length prefixes, paired with a separate parameter set
+    /// record. What the browser `VideoDecoder` API expects.
+    Avcc,
+}
+
+/// What a given [`EncodedFrame`] carries.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FrameKind {
+    /// Codec configuration (an `avcC` record for H.264). Only produced in
+    /// [`NalFormat::Avcc`]; in Annex-B the parameter sets are inline.
+    ParameterSet,
+    /// An independently decodable frame.
+    Keyframe,
+    /// A frame that depends on earlier frames.
+    Delta,
+}
+
+impl FrameKind {
+    /// Whether a client joining at this frame can start decoding.
+    pub fn is_decodable_entry_point(self) -> bool {
+        matches!(self, FrameKind::ParameterSet | FrameKind::Keyframe)
+    }
+}
+
+/// One encoded unit, ready to be put on a wire.
+#[derive(Debug, Clone)]
+pub struct EncodedFrame {
+    pub data: Bytes,
+    pub kind: FrameKind,
+}
+
+/// Pixel dimensions of the captured display.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct ScreenGeometry {
+    pub width: u32,
+    pub height: u32,
+}
+
+impl ScreenGeometry {
+    pub fn is_valid(self) -> bool {
+        self.width > 0 && self.height > 0
+    }
+}
+
+/// Encoder tuning.
+#[derive(Debug, Clone, Copy)]
+pub struct VideoConfig {
+    pub codec: VideoCodec,
+    pub nal_format: NalFormat,
+    pub fps: u32,
+    /// What to optimize for. Deriving the bitrate is usually right: a fixed
+    /// value that suits a phone framebuffer is wildly wrong for a watch, and
+    /// too low a value does not just soften the image, it makes the encoder
+    /// drop frames.
+    pub tuning: Tuning,
+    /// Longest edge to encode at; the source is scaled down to fit.
+    ///
+    /// Device framebuffers are far larger than any browser preview of them,
+    /// and every extra pixel costs bitrate that would otherwise go into
+    /// quality.
+    pub max_dimension: Option<u32>,
+    /// Seconds between scheduled keyframes. Shorter means faster recovery for
+    /// clients that join late or drop packets, at the cost of bitrate.
+    pub keyframe_interval_secs: u32,
+}
+
+impl Default for VideoConfig {
+    fn default() -> Self {
+        Self {
+            codec: VideoCodec::default(),
+            nal_format: NalFormat::default(),
+            fps: 60,
+            tuning: Tuning::default(),
+            max_dimension: Some(1280),
+            keyframe_interval_secs: 2,
+        }
+    }
+}
+
+/// Sink for encoded frames.
+///
+/// Invoked on the platform's capture thread, so implementations must not
+/// block. The expected shape is a bounded channel that drops on overflow: for
+/// interactive streaming, a stale frame is worth less than a fresh one.
+pub type FrameSink = Arc<dyn Fn(EncodedFrame) + Send + Sync>;
+
+/// Settings for a screen recording.
+#[derive(Debug, Clone, Copy)]
+pub struct RecordingConfig {
+    /// Quality from 0 to 1.
+    pub quality: f64,
+    /// Longest edge of the recording; `None` records at capture resolution.
+    pub max_dimension: Option<u32>,
+    pub keyframe_interval_secs: u32,
+}
+
+impl Default for RecordingConfig {
+    fn default() -> Self {
+        Self {
+            quality: 0.8,
+            // Recordings are watched rather than previewed in a corner, so
+            // they get more pixels than the live stream.
+            max_dimension: Some(1920),
+            keyframe_interval_secs: 4,
+        }
+    }
+}
+
+/// A finished recording.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct Recording {
+    pub path: std::path::PathBuf,
+    pub frames: u64,
+    pub duration_secs: f64,
+    pub width: u32,
+    pub height: u32,
+}
+
+/// A running video capture session.
+///
+/// `Sync` is required because a session is shared across every connected
+/// viewer. Implementations only expose atomics and locked state through
+/// `&self`; anything that mutates the pipeline takes `&mut self`.
+pub trait VideoCapture: Send + Sync {
+    /// Pixel geometry of the source. May be zero until the first frame lands.
+    fn geometry(&self) -> ScreenGeometry;
+
+    /// Geometry actually being encoded, after any downscale.
+    fn encoded_geometry(&self) -> ScreenGeometry {
+        self.geometry()
+    }
+
+    /// Request that the next encoded frame be a keyframe.
+    ///
+    /// Called when a new client subscribes, or in response to an RTCP PLI/FIR
+    /// from a WebRTC receiver.
+    fn request_keyframe(&self);
+
+    /// Stop capturing and release platform resources.
+    fn stop(&mut self);
+
+    /// Begin recording to a file.
+    ///
+    /// Independent of the live stream: a recording encodes separately so it
+    /// can use settings — B-frames above all — that would break consumers of
+    /// the live stream.
+    fn start_recording(
+        &self,
+        _path: &std::path::Path,
+        _config: &RecordingConfig,
+    ) -> Result<()> {
+        anyhow::bail!("Recording is not supported on this platform")
+    }
+
+    /// Stop recording and finalize the file.
+    fn stop_recording(&self) -> Result<Recording> {
+        anyhow::bail!("Recording is not supported on this platform")
+    }
+
+    /// Frames written so far, or `None` when nothing is being recorded.
+    fn recording_frames(&self) -> Option<u64> {
+        None
+    }
+}
+
+/// Error returned by platforms without a video backend.
+pub fn unsupported<T>(platform: &str) -> Result<T> {
+    anyhow::bail!("Video capture is not supported on {platform}")
+}
diff --git a/packages/accessibility-ios-sys/Cargo.toml b/packages/accessibility-ios-sys/Cargo.toml
index 72883f7..f02b030 100644
--- a/packages/accessibility-ios-sys/Cargo.toml
+++ b/packages/accessibility-ios-sys/Cargo.toml
@@ -13,16 +13,23 @@ categories = ["accessibility", "api-bindings", "os::macos-apis"]
 [dependencies]
 accesskit.workspace = true
 anyhow.workspace = true
+bytes.workspace = true
 euclid.workspace = true
 image.workspace = true
 slotmap.workspace = true
 
 [target.'cfg(target_os = "macos")'.dependencies]
-block2 = "0.6"
-libc = "0.2"
-objc2 = "0.6"
-objc2-foundation = "0.3"
-objc2-core-foundation = { version = "0.3", features = [
-    "CFBase",
-    "CFCGTypes",
-] }
+block2.workspace = true
+dispatch2.workspace = true
+libc.workspace = true
+objc2.workspace = true
+objc2-av-foundation.workspace = true
+objc2-core-foundation.workspace = true
+objc2-core-media.workspace = true
+objc2-core-video.workspace = true
+objc2-foundation.workspace = true
+objc2-io-surface.workspace = true
+objc2-video-toolbox.workspace = true
+
+[target.'cfg(target_os = "macos")'.build-dependencies]
+cc = "1"
diff --git a/packages/accessibility-ios-sys/build.rs b/packages/accessibility-ios-sys/build.rs
new file mode 100644
index 0000000..8a084a9
--- /dev/null
+++ b/packages/accessibility-ios-sys/build.rs
@@ -0,0 +1,11 @@
+fn main() {
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("macos") {
+        return;
+    }
+
+    println!("cargo:rerun-if-changed=src/macos/blocks.c");
+    cc::Build::new()
+        .file("src/macos/blocks.c")
+        .flag("-fblocks")
+        .compile("accessibility_ios_blocks");
+}
diff --git a/packages/accessibility-ios-sys/examples/framebuffer_probe.rs b/packages/accessibility-ios-sys/examples/framebuffer_probe.rs
new file mode 100644
index 0000000..d630aea
--- /dev/null
+++ b/packages/accessibility-ios-sys/examples/framebuffer_probe.rs
@@ -0,0 +1,100 @@
+//! Probe the SimulatorKit framebuffer capture and H.264 encode path.
+//!
+//! Run with: `cargo run -p accessibility-ios-sys --example framebuffer_probe`
+
+#[cfg(not(target_os = "macos"))]
+fn main() {
+    eprintln!("framebuffer_probe only runs on macOS");
+    std::process::exit(1);
+}
+
+#[cfg(target_os = "macos")]
+fn main() -> anyhow::Result<()> {
+    use accessibility_ios_sys::{
+        ChunkKind, EncodedChunk, EncoderConfig, NalFormat, SimVideoStream,
+    };
+    use std::sync::Arc;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::time::{Duration, Instant};
+
+    let keyframes = Arc::new(AtomicU64::new(0));
+    let deltas = Arc::new(AtomicU64::new(0));
+    let parameter_sets = Arc::new(AtomicU64::new(0));
+    let bytes = Arc::new(AtomicU64::new(0));
+    let first_nal_ok = Arc::new(AtomicU64::new(0));
+
+    let sink = {
+        let (keyframes, deltas, parameter_sets, bytes, first_nal_ok) = (
+            Arc::clone(&keyframes),
+            Arc::clone(&deltas),
+            Arc::clone(&parameter_sets),
+            Arc::clone(&bytes),
+            Arc::clone(&first_nal_ok),
+        );
+        Arc::new(move |chunk: EncodedChunk| {
+            bytes.fetch_add(chunk.data.len() as u64, Ordering::Relaxed);
+            match chunk.kind {
+                ChunkKind::ParameterSet => parameter_sets.fetch_add(1, Ordering::Relaxed),
+                ChunkKind::Keyframe => keyframes.fetch_add(1, Ordering::Relaxed),
+                ChunkKind::Delta => deltas.fetch_add(1, Ordering::Relaxed),
+            };
+            // Every Annex-B access unit must open with a start code.
+            if chunk.data.starts_with(&[0, 0, 0, 1]) {
+                first_nal_ok.fetch_add(1, Ordering::Relaxed);
+            }
+        })
+    };
+
+    let config = EncoderConfig {
+        nal_format: NalFormat::AnnexB,
+        ..Default::default()
+    };
+    println!(
+        "encode size for 1206x2622: {:?} (max_dimension = {:?})",
+        config.encode_size(1206, 2622),
+        config.max_dimension
+    );
+    let stream = SimVideoStream::start(None, config, sink)?;
+    println!("device udid: {}", stream.device_udid());
+
+    let started = Instant::now();
+    let deadline = started + Duration::from_secs(5);
+    while Instant::now() < deadline {
+        std::thread::sleep(Duration::from_millis(1000));
+        let stats = stream.stats();
+        println!(
+            "frames={} {}x{} classes={:?} keyframes={} deltas={} kb={}",
+            stats.frame_count,
+            stats.width,
+            stats.height,
+            stats.display_classes,
+            keyframes.load(Ordering::Relaxed),
+            deltas.load(Ordering::Relaxed),
+            bytes.load(Ordering::Relaxed) / 1024,
+        );
+    }
+
+    let total_chunks = keyframes.load(Ordering::Relaxed) + deltas.load(Ordering::Relaxed);
+    let elapsed = started.elapsed().as_secs_f64();
+
+    println!("---");
+    println!("encoded chunks : {total_chunks}");
+    println!("keyframes      : {}", keyframes.load(Ordering::Relaxed));
+    println!("annex-b valid  : {}", first_nal_ok.load(Ordering::Relaxed));
+    println!(
+        "bitrate        : {:.2} Mbps",
+        (bytes.load(Ordering::Relaxed) as f64 * 8.0) / elapsed / 1_000_000.0
+    );
+
+    if total_chunks == 0 {
+        anyhow::bail!("no encoded frames produced");
+    }
+    if keyframes.load(Ordering::Relaxed) == 0 {
+        anyhow::bail!("no keyframes produced - decoders would never start");
+    }
+    if first_nal_ok.load(Ordering::Relaxed) != total_chunks {
+        anyhow::bail!("some access units were not Annex-B framed");
+    }
+    println!("OK");
+    Ok(())
+}
diff --git a/packages/accessibility-ios-sys/examples/rotation_probe.rs b/packages/accessibility-ios-sys/examples/rotation_probe.rs
new file mode 100644
index 0000000..d413606
--- /dev/null
+++ b/packages/accessibility-ios-sys/examples/rotation_probe.rs
@@ -0,0 +1,40 @@
+//! Determine whether the framebuffer reflects device orientation.
+//!
+//! Run with: `cargo run -p accessibility-ios-sys --example rotation_probe`
+
+#[cfg(not(target_os = "macos"))]
+fn main() {
+    eprintln!("rotation_probe only runs on macOS");
+    std::process::exit(1);
+}
+
+#[cfg(target_os = "macos")]
+fn main() -> anyhow::Result<()> {
+    use accessibility_ios_sys::{Orientation, SimFramebuffer, SimulatorHID};
+    use std::time::Duration;
+
+    let mut framebuffer = SimFramebuffer::new(None)?;
+    framebuffer.start()?;
+    let hid = SimulatorHID::for_device(None)?;
+
+    let settle = |label: &str, framebuffer: &SimFramebuffer| {
+        std::thread::sleep(Duration::from_millis(2500));
+        let stats = framebuffer.stats();
+        println!("{label:<22} framebuffer = {}x{}", stats.width, stats.height);
+    };
+
+    settle("initial", &framebuffer);
+
+    for (label, orientation) in [
+        ("landscape_left", Orientation::LandscapeLeft),
+        ("landscape_right", Orientation::LandscapeRight),
+        ("portrait_upside_down", Orientation::PortraitUpsideDown),
+        ("portrait", Orientation::Portrait),
+    ] {
+        hid.set_orientation(orientation)?;
+        settle(label, &framebuffer);
+    }
+
+    framebuffer.stop();
+    Ok(())
+}
diff --git a/packages/accessibility-ios-sys/src/lib.rs b/packages/accessibility-ios-sys/src/lib.rs
index fb874b8..0036c64 100644
--- a/packages/accessibility-ios-sys/src/lib.rs
+++ b/packages/accessibility-ios-sys/src/lib.rs
@@ -30,18 +30,25 @@ pub(crate) mod frameworks {
 
     /// Load the CoreSimulator private framework.
     pub fn load_coresimulator_framework() -> Result<()> {
-        let paths: &[&[u8]] = &[
-            b"/Library/Developer/PrivateFrameworks/CoreSimulator.framework/CoreSimulator\0",
-            b"/Applications/Xcode.app/Contents/Developer/Library/PrivateFrameworks/CoreSimulator.framework/CoreSimulator\0",
-        ];
-
-        for path in paths {
-            let handle = unsafe {
-                libc::dlopen(
-                    path.as_ptr() as *const c_char,
-                    libc::RTLD_NOW | libc::RTLD_GLOBAL,
-                )
-            };
+        const SUFFIX: &str = "Library/PrivateFrameworks/CoreSimulator.framework/CoreSimulator";
+
+        // The system-wide copy is canonical and exists whenever any Xcode is
+        // installed, so it goes first.
+        let mut paths = vec![format!(
+            "/Library/Developer/PrivateFrameworks/CoreSimulator.framework/CoreSimulator"
+        )];
+
+        if let Some(dev_path) = developer_dir() {
+            paths.push(format!("{dev_path}/{SUFFIX}"));
+        }
+        paths.push(format!(
+            "/Applications/Xcode.app/Contents/Developer/{SUFFIX}"
+        ));
+
+        for path in &paths {
+            let c_path = CString::new(path.as_str())?;
+            let handle =
+                unsafe { libc::dlopen(c_path.as_ptr(), libc::RTLD_NOW | libc::RTLD_GLOBAL) };
             if !handle.is_null() {
                 return Ok(());
             }
@@ -49,31 +56,63 @@ pub(crate) mod frameworks {
 
         let error = unsafe { CStr::from_ptr(libc::dlerror()) };
         Err(anyhow!(
-            "Failed to load CoreSimulator framework: {}",
-            error.to_string_lossy()
+            "Failed to load CoreSimulator framework: {}. Tried paths: {:?}",
+            error.to_string_lossy(),
+            paths
         ))
     }
 
+    /// Candidate SimulatorKit locations for a given developer directory.
+    ///
+    /// Xcode 27 moved SimulatorKit out of `Developer/Library/PrivateFrameworks`
+    /// and into `Contents/SharedFrameworks` (a sibling of `Developer`), so both
+    /// layouts have to be probed.
+    fn simulatorkit_candidates(developer_dir: &str) -> [String; 2] {
+        [
+            format!("{developer_dir}/../SharedFrameworks/SimulatorKit.framework/SimulatorKit"),
+            format!(
+                "{developer_dir}/Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit"
+            ),
+        ]
+    }
+
+    /// Resolve the active developer directory, preferring `DEVELOPER_DIR`.
+    ///
+    /// Falls back to `xcode-select -p`, which can point at a Command Line Tools
+    /// install that has no simulator frameworks at all — callers still probe the
+    /// well-known Xcode.app locations afterwards.
+    pub fn developer_dir() -> Option<String> {
+        if let Ok(dir) = std::env::var("DEVELOPER_DIR")
+            && !dir.is_empty()
+        {
+            return Some(dir);
+        }
+
+        let output = std::process::Command::new("xcode-select")
+            .arg("-p")
+            .output()
+            .ok()?;
+        if !output.status.success() {
+            return None;
+        }
+        let dir = String::from_utf8_lossy(&output.stdout).trim().to_string();
+        (!dir.is_empty()).then_some(dir)
+    }
+
     /// Load the SimulatorKit framework from Xcode.
     pub fn load_simulatorkit_framework() -> Result<*mut c_void> {
         let mut paths_to_try: Vec<String> = Vec::new();
 
-        if let Ok(output) = std::process::Command::new("xcode-select")
-            .arg("-p")
-            .output()
-            && output.status.success()
-        {
-            let dev_path = String::from_utf8_lossy(&output.stdout).trim().to_string();
-            paths_to_try.push(format!(
-                "{}/Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit",
-                dev_path
-            ));
+        if let Some(dev_path) = developer_dir() {
+            paths_to_try.extend(simulatorkit_candidates(&dev_path));
         }
 
-        paths_to_try.extend([
-            "/Applications/Xcode.app/Contents/Developer/Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit".to_string(),
-            "/Applications/Xcode-beta.app/Contents/Developer/Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit".to_string(),
-        ]);
+        for app in [
+            "/Applications/Xcode.app/Contents/Developer",
+            "/Applications/Xcode-beta.app/Contents/Developer",
+        ] {
+            paths_to_try.extend(simulatorkit_candidates(app));
+        }
 
         for path in &paths_to_try {
             let c_path = CString::new(path.as_str()).unwrap();
@@ -105,7 +144,8 @@ mod macos;
 
 #[cfg(target_os = "macos")]
 pub use frameworks::{
-    load_axp_framework, load_coresimulator_framework, load_frameworks, load_simulatorkit_framework,
+    developer_dir, load_axp_framework, load_coresimulator_framework, load_frameworks,
+    load_simulatorkit_framework,
 };
 
 #[cfg(target_os = "macos")]
diff --git a/packages/accessibility-ios-sys/src/macos.rs b/packages/accessibility-ios-sys/src/macos.rs
index 2db586f..c0559b3 100644
--- a/packages/accessibility-ios-sys/src/macos.rs
+++ b/packages/accessibility-ios-sys/src/macos.rs
@@ -56,11 +56,25 @@ use slotmap::SecondaryMap;
 
 mod common;
 mod dispatcher;
+mod dynamic;
+mod encoder;
+mod framebuffer;
 mod hid;
+mod pixel_buffer;
 mod reader;
+mod recorder;
+mod stream;
+mod void_block;
 
 pub use common::{
     ButtonDirection, Element, ElementKey, ElementTree, HardwareButton, Point, Rect, ScreenSpace,
     Screenshot, Size, TreeFilter, load_frameworks,
 };
+pub use encoder::{
+    ChunkKind, ChunkSink, EncodedChunk, EncoderConfig, H264Encoder, NalFormat, Tuning,
+};
+pub use framebuffer::{CapturedFrame, FrameSink, FramebufferStats, SimFramebuffer};
+pub use hid::{Orientation, SimulatorHID, TouchEdge, TouchPhase};
 pub use reader::IOSSimulatorAccessibility;
+pub use recorder::{Recorder, Recording, RecordingConfig};
+pub use stream::{ScreenGeometry, SimVideoStream};
diff --git a/packages/accessibility-ios-sys/src/macos/blocks.c b/packages/accessibility-ios-sys/src/macos/blocks.c
new file mode 100644
index 0000000..d5edc33
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/blocks.c
@@ -0,0 +1,31 @@
+// Signature-bearing Objective-C blocks for CoreSimulator's remote proxies.
+//
+// CoreSimulator vends its IO descriptors as ROCKRemoteProxy objects, and
+// ROCKit marshals block arguments across that boundary by reading the block's
+// Objective-C type encoding out of its descriptor. That requires the
+// BLOCK_HAS_SIGNATURE flag, which the `block2` crate does not currently emit
+// (see the TODO in block2's global.rs). Clang always emits it, so the blocks
+// handed to SimulatorKit are created here instead of in Rust.
+
+#include <Block.h>
+#include <stddef.h>
+
+typedef void (*accessibility_void_callback)(void *context);
+
+// Create a heap block wrapping `callback(context)`.
+//
+// The returned block is owned by the caller and must be handed to
+// accessibility_release_block exactly once. `context` is not managed here; the
+// Rust side owns it and must outlive the block.
+void *accessibility_make_void_block(accessibility_void_callback callback, void *context) {
+    void (^block)(void) = ^{
+        callback(context);
+    };
+    return (void *)Block_copy(block);
+}
+
+void accessibility_release_block(void *block) {
+    if (block != NULL) {
+        Block_release(block);
+    }
+}
diff --git a/packages/accessibility-ios-sys/src/macos/dynamic.rs b/packages/accessibility-ios-sys/src/macos/dynamic.rs
new file mode 100644
index 0000000..2b5cb25
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/dynamic.rs
@@ -0,0 +1,111 @@
+//! Dynamic Objective-C message sends for proxied private objects.
+//!
+//! CoreSimulator vends much of its IO graph as `ROCKRemoteProxy` objects, which
+//! implement their interface through forwarding rather than real methods. That
+//! breaks `objc2::msg_send!`, whose debug-build verification looks the selector
+//! up with `class_getInstanceMethod` and panics when it is absent.
+//!
+//! These helpers call `objc_msgSend` directly so the message reaches the
+//! proxy's forwarding machinery, which is what the selector is for. Callers
+//! must guard with [`responds_to`] first — an unrecognized selector reaching
+//! forwarding is a hard crash, not a recoverable error.
+
+use std::ffi::c_void;
+
+use objc2::runtime::{AnyObject, Sel};
+use objc2::sel;
+
+/// Send a zero-argument message returning an object pointer.
+pub(super) unsafe fn send_id(receiver: *mut AnyObject, selector: Sel) -> *mut AnyObject {
+    if receiver.is_null() {
+        return std::ptr::null_mut();
+    }
+    type Imp = unsafe extern "C" fn(*mut AnyObject, Sel) -> *mut AnyObject;
+    let imp: Imp = unsafe { std::mem::transmute(objc2::ffi::objc_msgSend as *const c_void) };
+    unsafe { imp(receiver, selector) }
+}
+
+/// Send a one-argument message returning an object pointer.
+pub(super) unsafe fn send_id_with_id(
+    receiver: *mut AnyObject,
+    selector: Sel,
+    argument: *mut AnyObject,
+) -> *mut AnyObject {
+    if receiver.is_null() {
+        return std::ptr::null_mut();
+    }
+    type Imp = unsafe extern "C" fn(*mut AnyObject, Sel, *mut AnyObject) -> *mut AnyObject;
+    let imp: Imp = unsafe { std::mem::transmute(objc2::ffi::objc_msgSend as *const c_void) };
+    unsafe { imp(receiver, selector, argument) }
+}
+
+/// Send `registerScreenCallbacksWithUUID:callbackQueue:frameCallback:
+/// surfacesChangedCallback:propertiesChangedCallback:`.
+///
+/// SimulatorKit retains the three blocks for the lifetime of the registration,
+/// so the caller must keep them alive until it unregisters the same UUID.
+pub(super) unsafe fn send_register_screen_callbacks(
+    receiver: *mut AnyObject,
+    selector: Sel,
+    uuid: *mut AnyObject,
+    queue: *mut c_void,
+    frame_callback: *mut c_void,
+    surfaces_changed_callback: *mut c_void,
+    properties_changed_callback: *mut c_void,
+) {
+    type Imp = unsafe extern "C" fn(
+        *mut AnyObject,
+        Sel,
+        *mut AnyObject,
+        *mut c_void,
+        *mut c_void,
+        *mut c_void,
+        *mut c_void,
+    );
+    let imp: Imp = unsafe { std::mem::transmute(objc2::ffi::objc_msgSend as *const c_void) };
+    unsafe {
+        imp(
+            receiver,
+            selector,
+            uuid,
+            queue,
+            frame_callback,
+            surfaces_changed_callback,
+            properties_changed_callback,
+        )
+    }
+}
+
+/// Send a one-argument message returning nothing.
+pub(super) unsafe fn send_void_with_id(
+    receiver: *mut AnyObject,
+    selector: Sel,
+    argument: *mut AnyObject,
+) {
+    if receiver.is_null() {
+        return;
+    }
+    type Imp = unsafe extern "C" fn(*mut AnyObject, Sel, *mut AnyObject);
+    let imp: Imp = unsafe { std::mem::transmute(objc2::ffi::objc_msgSend as *const c_void) };
+    unsafe { imp(receiver, selector, argument) }
+}
+
+/// Send a zero-argument message returning an unsigned short.
+pub(super) unsafe fn send_u16(receiver: *mut AnyObject, selector: Sel) -> u16 {
+    if receiver.is_null() {
+        return 0;
+    }
+    type Imp = unsafe extern "C" fn(*mut AnyObject, Sel) -> u16;
+    let imp: Imp = unsafe { std::mem::transmute(objc2::ffi::objc_msgSend as *const c_void) };
+    unsafe { imp(receiver, selector) }
+}
+
+/// Whether `receiver` will handle `selector`, including via forwarding.
+pub(super) unsafe fn responds_to(receiver: *mut AnyObject, selector: Sel) -> bool {
+    if receiver.is_null() {
+        return false;
+    }
+    type Imp = unsafe extern "C" fn(*mut AnyObject, Sel, Sel) -> bool;
+    let imp: Imp = unsafe { std::mem::transmute(objc2::ffi::objc_msgSend as *const c_void) };
+    unsafe { imp(receiver, sel!(respondsToSelector:), selector) }
+}
diff --git a/packages/accessibility-ios-sys/src/macos/encoder.rs b/packages/accessibility-ios-sys/src/macos/encoder.rs
new file mode 100644
index 0000000..2f6d2b1
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/encoder.rs
@@ -0,0 +1,577 @@
+//! Hardware H.264 encoding of captured simulator frames via VideoToolbox.
+//!
+//! The encoder is deliberately driven from the capture queue: `CVPixelBuffer`
+//! and `CMSampleBuffer` are not `Send`, so encoding in place and shipping only
+//! the compressed bytes elsewhere avoids marshalling raw frames across threads.
+//!
+//! Two output framings are supported from the same session:
+//!
+//! - [`NalFormat::AnnexB`] for WebRTC, which expects start-code delimited NALs.
+//! - [`NalFormat::Avcc`] for browser `VideoDecoder`, which wants length-prefixed
+//!   NALs plus a separate `avcC` parameter-set blob.
+
+use std::ffi::c_void;
+use std::ptr::NonNull;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+
+use anyhow::{Result, anyhow};
+use block2::RcBlock;
+use bytes::Bytes;
+use objc2_core_foundation::{
+    CFBoolean, CFNumber, CFRetained, CFString, CFType, kCFAllocatorDefault,
+};
+use objc2_core_media::{
+    CMSampleBuffer, CMTime, CMVideoCodecType, CMVideoFormatDescriptionGetH264ParameterSetAtIndex,
+    kCMTimeInvalid,
+};
+use objc2_core_video::{CVImageBuffer, CVPixelBuffer};
+use objc2_video_toolbox::{VTCompressionSession, VTEncodeInfoFlags, VTSessionSetProperty};
+
+use super::pixel_buffer::{PixelTransfer, cf_dict};
+
+/// `avc1` — H.264 in a `CMVideoCodecType`.
+const CODEC_H264: CMVideoCodecType = 0x6176_6331;
+
+/// How the compressed NAL units are framed on the way out.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum NalFormat {
+    /// `00 00 00 01` start codes, with SPS/PPS inlined ahead of each IDR.
+    AnnexB,
+    /// 4-byte big-endian length prefixes, exactly as VideoToolbox emits them.
+    Avcc,
+}
+
+/// Kind of payload in an [`EncodedChunk`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ChunkKind {
+    /// An `avcC` parameter set record. Only emitted in [`NalFormat::Avcc`].
+    ParameterSet,
+    /// An IDR access unit.
+    Keyframe,
+    /// A non-IDR access unit.
+    Delta,
+}
+
+/// One encoded unit ready for the wire.
+#[derive(Debug, Clone)]
+pub struct EncodedChunk {
+    pub data: Bytes,
+    pub kind: ChunkKind,
+}
+
+/// Bits per pixel per frame to aim for when no explicit bitrate is given.
+///
+/// Screen content needs roughly 0.10-0.20 bpp to avoid visible blocking on
+/// motion. Below that VideoToolbox does not merely soften the picture: with
+/// low-latency rate control it starts *dropping frames* to stay inside its
+/// per-frame budget, so starving the encoder costs frame rate as well as
+/// quality.
+const TARGET_BITS_PER_PIXEL: f64 = 0.15;
+
+/// Longest edge to encode at when no limit is given.
+///
+/// A phone framebuffer is far larger than the browser ever displays it — an
+/// iPhone 17 is 1206x2622, roughly fifteen times the pixels of the preview —
+/// and every one of those pixels costs bitrate. Capping the long edge keeps
+/// the picture comfortably sharper than the viewport while spending a
+/// fraction of the bits.
+const DEFAULT_MAX_DIMENSION: u32 = 1280;
+
+/// What the encoder should optimize for.
+///
+/// These are not independent knobs. Constant-quality rate control is *ignored*
+/// when `EnableLowLatencyRateControl` is set — measured at 0.0221 bits per
+/// pixel for quality 1.0 against 0.0223 for quality 0.4, i.e. no effect at
+/// all. Pairing the two as one choice makes that combination unrepresentable
+/// instead of silently doing nothing.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Tuning {
+    /// Live interactive streaming. Low-latency rate control and no frame
+    /// delay, which costs perhaps 300ms of decoder buffering if omitted.
+    /// Spends a fixed bitrate; quality varies with how busy the screen is.
+    Interactive {
+        /// Target bitrate, or `None` to derive one from the encode resolution.
+        bitrate: Option<u32>,
+    },
+    /// Recording and offline capture. Drops the low-latency constraint so the
+    /// encoder honours a constant quality target and spends bits where the
+    /// picture needs them. Latency is unbounded in principle, so this is the
+    /// wrong choice for anything anyone is watching live.
+    Recording {
+        /// Target quality from 0 to 1.
+        quality: f64,
+    },
+}
+
+impl Tuning {
+    fn is_interactive(self) -> bool {
+        matches!(self, Tuning::Interactive { .. })
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct EncoderConfig {
+    pub fps: u32,
+    pub tuning: Tuning,
+    /// Longest edge of the encoded video. The source is scaled down to fit.
+    pub max_dimension: Option<u32>,
+    /// Seconds between scheduled keyframes.
+    pub keyframe_interval_secs: u32,
+    pub nal_format: NalFormat,
+}
+
+impl Default for EncoderConfig {
+    fn default() -> Self {
+        Self {
+            fps: 60,
+            tuning: Tuning::Interactive { bitrate: None },
+            max_dimension: Some(DEFAULT_MAX_DIMENSION),
+            keyframe_interval_secs: 2,
+            nal_format: NalFormat::AnnexB,
+        }
+    }
+}
+
+impl EncoderConfig {
+    /// Encode dimensions for a given source size, preserving aspect ratio.
+    ///
+    /// Both axes are rounded to even numbers because H.264 chroma is
+    /// subsampled 2x2 and odd dimensions are not representable.
+    pub fn encode_size(&self, width: i32, height: i32) -> (i32, i32) {
+        let longest = width.max(height);
+        let Some(limit) = self.max_dimension else {
+            return (even(width), even(height));
+        };
+        if longest <= limit as i32 {
+            return (even(width), even(height));
+        }
+        let scale = limit as f64 / longest as f64;
+        (
+            even((width as f64 * scale).round() as i32),
+            even((height as f64 * scale).round() as i32),
+        )
+    }
+
+    /// Bitrate for interactive tuning, derived from the encode size if unset.
+    fn resolved_bitrate(&self, bitrate: Option<u32>, width: i32, height: i32) -> u32 {
+        bitrate.unwrap_or_else(|| {
+            let pixels = (width as f64) * (height as f64);
+            (pixels * self.fps as f64 * TARGET_BITS_PER_PIXEL) as u32
+        })
+    }
+}
+
+fn even(value: i32) -> i32 {
+    (value.max(2) / 2) * 2
+}
+
+/// Sink for encoded chunks, invoked on the capture queue.
+pub type ChunkSink = Arc<dyn Fn(EncodedChunk) + Send + Sync>;
+
+pub struct H264Encoder {
+    session: Option<CFRetained<VTCompressionSession>>,
+    config: EncoderConfig,
+    /// Size of the frames coming in.
+    source_dimensions: (i32, i32),
+    /// Size we actually encode at, after any downscale.
+    dimensions: (i32, i32),
+    /// Frame index, used to synthesize presentation timestamps.
+    frame_index: i64,
+    /// Set by RTCP PLI/FIR so the next frame is forced to an IDR.
+    force_keyframe: Arc<AtomicBool>,
+    /// Whether the `avcC` record for the current session has been emitted.
+    emitted_parameter_set: Arc<Mutex<bool>>,
+    /// Copies, converts and scales each frame before it is encoded.
+    transfer: PixelTransfer,
+    sink: ChunkSink,
+}
+
+// VideoToolbox sessions are documented as thread-safe, and this one is only
+// driven from the capture queue regardless.
+unsafe impl Send for H264Encoder {}
+
+impl H264Encoder {
+    pub fn new(
+        config: EncoderConfig,
+        force_keyframe: Arc<AtomicBool>,
+        sink: ChunkSink,
+    ) -> Result<Self> {
+        Ok(Self {
+            transfer: PixelTransfer::new()?,
+            session: None,
+            config,
+            source_dimensions: (0, 0),
+            dimensions: (0, 0),
+            frame_index: 0,
+            force_keyframe,
+            emitted_parameter_set: Arc::new(Mutex::new(false)),
+            sink,
+        })
+    }
+
+    /// Encode one frame, rebuilding the session if the source resized.
+    ///
+    /// `width`/`height` describe the *source*; the session may be smaller if
+    /// the config caps the long edge, in which case VideoToolbox scales.
+    pub fn encode(&mut self, image: &CVImageBuffer, width: i32, height: i32) -> Result<()> {
+        if self.session.is_none() || self.source_dimensions != (width, height) {
+            self.source_dimensions = (width, height);
+            self.dimensions = self.config.encode_size(width, height);
+            self.rebuild_session()?;
+        }
+
+        // One hardware pass does the copy off the live framebuffer, the BGRA
+        // to NV12 conversion, and the downscale. Synchronous, so by the time
+        // it returns the encoder owns pixels the simulator cannot overwrite.
+        let (target_width, target_height) = self.dimensions;
+        let source: &CVPixelBuffer = image;
+        let prepared =
+            self.transfer
+                .transfer(source, target_width as usize, target_height as usize)?;
+        let image: &CVImageBuffer = &prepared;
+
+        let session = self.session.as_ref().expect("session built above");
+
+        let force = self.force_keyframe.swap(false, Ordering::Relaxed);
+        let frame_properties = force.then(|| {
+            cf_dict(&[(
+                unsafe { objc2_video_toolbox::kVTEncodeFrameOptionKey_ForceKeyFrame },
+                CFBoolean::new(true).as_ref(),
+            )])
+        });
+
+        let pts = unsafe { CMTime::new(self.frame_index, self.config.fps as i32) };
+        let duration = unsafe { CMTime::new(1, self.config.fps as i32) };
+        self.frame_index += 1;
+
+        let sink = Arc::clone(&self.sink);
+        let nal_format = self.config.nal_format;
+        let emitted = Arc::clone(&self.emitted_parameter_set);
+
+        let handler = RcBlock::new(
+            move |status: i32, _flags: VTEncodeInfoFlags, sample: *mut CMSampleBuffer| {
+                if status != 0 || sample.is_null() {
+                    return;
+                }
+                let sample = unsafe { &*sample };
+                for chunk in package_sample(sample, nal_format, &emitted) {
+                    sink(chunk);
+                }
+            },
+        );
+
+        let status = unsafe {
+            session.encode_frame_with_output_handler(
+                image,
+                pts,
+                duration,
+                frame_properties.as_deref(),
+                std::ptr::null_mut(),
+                RcBlock::as_ptr(&handler) as *mut _,
+            )
+        };
+        if status != 0 {
+            return Err(anyhow!("VTCompressionSessionEncodeFrame failed: {status}"));
+        }
+        Ok(())
+    }
+
+    fn rebuild_session(&mut self) -> Result<()> {
+        if let Some(session) = self.session.take() {
+            unsafe { session.invalidate() };
+        }
+        *self.emitted_parameter_set.lock().unwrap() = false;
+
+        let (width, height) = self.dimensions;
+        let mut out: *mut VTCompressionSession = std::ptr::null_mut();
+
+        // Low-latency rate control keeps the decoder's frame buffering small.
+        // Without it browsers routinely add ~300ms of latency even though we
+        // emit no B-frames. It also makes the encoder ignore any quality
+        // target, which is exactly why recording tuning omits it.
+        let interactive = self.config.tuning.is_interactive();
+        let low_latency = interactive.then(|| {
+            cf_dict(&[(
+                unsafe {
+                    objc2_video_toolbox::kVTVideoEncoderSpecification_EnableLowLatencyRateControl
+                },
+                CFBoolean::new(true).as_ref(),
+            )])
+        });
+
+        let mut status = unsafe {
+            VTCompressionSession::create(
+                kCFAllocatorDefault,
+                width,
+                height,
+                CODEC_H264,
+                low_latency.as_deref(),
+                None,
+                kCFAllocatorDefault,
+                None,
+                std::ptr::null_mut(),
+                NonNull::from(&mut out),
+            )
+        };
+        if status != 0 || out.is_null() {
+            out = std::ptr::null_mut();
+            status = unsafe {
+                VTCompressionSession::create(
+                    kCFAllocatorDefault,
+                    width,
+                    height,
+                    CODEC_H264,
+                    None,
+                    None,
+                    kCFAllocatorDefault,
+                    None,
+                    std::ptr::null_mut(),
+                    NonNull::from(&mut out),
+                )
+            };
+        }
+
+        let session = NonNull::new(out)
+            .filter(|_| status == 0)
+            .map(|p| unsafe { CFRetained::from_raw(p) })
+            .ok_or_else(|| anyhow!("VTCompressionSessionCreate failed: {status}"))?;
+
+        let keyframe_interval = self.config.fps * self.config.keyframe_interval_secs;
+        set_bool(&session, "RealTime", true);
+        // Frames stay in decode order in both tunings. B-frames would help
+        // recording quality, but every consumer downstream — WebRTC's
+        // payloader and the raw stream's framing — assumes output order
+        // matches input order.
+        set_bool(&session, "AllowFrameReordering", false);
+        if interactive {
+            // Emit each frame as soon as it is encoded rather than letting the
+            // encoder hold a pipeline of them.
+            set_i32(&session, "MaxFrameDelayCount", 0);
+        }
+        // Baseline is the safest bet for WebRTC: every browser negotiates it,
+        // and we gain nothing from High on a UI stream with no B-frames.
+        set_string(&session, "ProfileLevel", "H264_Baseline_AutoLevel");
+        set_i32(&session, "ExpectedFrameRate", self.config.fps as i32);
+        set_i32(&session, "MaxKeyFrameInterval", keyframe_interval as i32);
+        // MaxKeyFrameInterval counts *frames*, and the simulator's frame rate
+        // swings between ~5 idle and ~60 animating, so on its own it would
+        // stretch a "2 second" interval out to twenty. The duration limit is
+        // what actually bounds it in time.
+        set_f64(
+            &session,
+            "MaxKeyFrameIntervalDuration",
+            self.config.keyframe_interval_secs as f64,
+        );
+        match self.config.tuning {
+            Tuning::Interactive { bitrate } => {
+                let bitrate = self.config.resolved_bitrate(bitrate, width, height);
+                set_i32(&session, "AverageBitRate", bitrate as i32);
+            }
+            Tuning::Recording { quality } => {
+                set_f64(&session, "Quality", quality.clamp(0.0, 1.0));
+            }
+        }
+
+        self.session = Some(session);
+        self.frame_index = 0;
+        Ok(())
+    }
+}
+
+impl Drop for H264Encoder {
+    fn drop(&mut self) {
+        if let Some(session) = self.session.take() {
+            unsafe {
+                session.complete_frames(kCMTimeInvalid);
+                session.invalidate();
+            }
+        }
+    }
+}
+
+/// Turn one compressed sample into the chunks that go on the wire.
+fn package_sample(
+    sample: &CMSampleBuffer,
+    format: NalFormat,
+    emitted_parameter_set: &Mutex<bool>,
+) -> Vec<EncodedChunk> {
+    let is_keyframe = sample_is_keyframe(sample);
+    let Some(avcc) = sample_bytes(sample) else {
+        return Vec::new();
+    };
+
+    let mut chunks = Vec::new();
+    let parameter_sets = is_keyframe
+        .then(|| unsafe { sample.format_description() })
+        .flatten()
+        .and_then(|desc| extract_parameter_sets(&desc));
+
+    match format {
+        NalFormat::Avcc => {
+            // The browser needs the avcC record once per session, before the
+            // first keyframe it decodes.
+            if let Some((sps, pps)) = parameter_sets.as_ref() {
+                let mut emitted = emitted_parameter_set.lock().unwrap();
+                if !*emitted {
+                    *emitted = true;
+                    chunks.push(EncodedChunk {
+                        data: Bytes::from(build_avcc_record(sps, pps)),
+                        kind: ChunkKind::ParameterSet,
+                    });
+                }
+            }
+            chunks.push(EncodedChunk {
+                data: Bytes::from(avcc),
+                kind: if is_keyframe {
+                    ChunkKind::Keyframe
+                } else {
+                    ChunkKind::Delta
+                },
+            });
+        }
+        NalFormat::AnnexB => {
+            let mut out = Vec::with_capacity(avcc.len() + 64);
+            // SPS/PPS are only prepended to IDRs; repeating them on every
+            // delta frame is pure waste.
+            if let Some((sps, pps)) = parameter_sets.as_ref() {
+                out.extend_from_slice(&[0, 0, 0, 1]);
+                out.extend_from_slice(sps);
+                out.extend_from_slice(&[0, 0, 0, 1]);
+                out.extend_from_slice(pps);
+            }
+            append_annex_b(&avcc, &mut out);
+            chunks.push(EncodedChunk {
+                data: Bytes::from(out),
+                kind: if is_keyframe {
+                    ChunkKind::Keyframe
+                } else {
+                    ChunkKind::Delta
+                },
+            });
+        }
+    }
+
+    chunks
+}
+
+/// Rewrite AVCC length prefixes as Annex-B start codes.
+fn append_annex_b(avcc: &[u8], out: &mut Vec<u8>) {
+    let mut offset = 0usize;
+    while offset + 4 <= avcc.len() {
+        let length = u32::from_be_bytes([
+            avcc[offset],
+            avcc[offset + 1],
+            avcc[offset + 2],
+            avcc[offset + 3],
+        ]) as usize;
+        offset += 4;
+        if offset + length > avcc.len() {
+            break;
+        }
+        out.extend_from_slice(&[0, 0, 0, 1]);
+        out.extend_from_slice(&avcc[offset..offset + length]);
+        offset += length;
+    }
+}
+
+/// Build an ISO/IEC 14496-15 `avcC` record from a SPS/PPS pair.
+fn build_avcc_record(sps: &[u8], pps: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(sps.len() + pps.len() + 11);
+    out.push(0x01); // configurationVersion
+    out.extend_from_slice(&sps[1..4]); // profile, compatibility, level
+    out.push(0xFF); // reserved | lengthSizeMinusOne = 3 (4-byte lengths)
+    out.push(0xE1); // reserved | numOfSequenceParameterSets = 1
+    out.extend_from_slice(&(sps.len() as u16).to_be_bytes());
+    out.extend_from_slice(sps);
+    out.push(0x01); // numOfPictureParameterSets
+    out.extend_from_slice(&(pps.len() as u16).to_be_bytes());
+    out.extend_from_slice(pps);
+    out
+}
+
+/// A sample is a sync frame unless it is explicitly flagged `NotSync`.
+///
+/// The attachment dictionaries are untyped, so this goes through the raw CF
+/// entry point rather than the generically typed `CFDictionary` wrapper.
+fn sample_is_keyframe(sample: &CMSampleBuffer) -> bool {
+    unsafe extern "C-unwind" {
+        fn CFDictionaryContainsKey(dict: *const c_void, key: *const c_void) -> u8;
+    }
+
+    let Some(attachments) = (unsafe { sample.sample_attachments_array(false) }) else {
+        return true;
+    };
+    if attachments.count() == 0 {
+        return true;
+    }
+    let entry = unsafe { attachments.value_at_index(0) };
+    if entry.is_null() {
+        return true;
+    }
+    let key = unsafe { objc2_core_media::kCMSampleAttachmentKey_NotSync };
+    unsafe { CFDictionaryContainsKey(entry, key as *const CFString as *const c_void) == 0 }
+}
+
+/// Copy the compressed bytes out of the sample's block buffer.
+fn sample_bytes(sample: &CMSampleBuffer) -> Option<Vec<u8>> {
+    let block = unsafe { sample.data_buffer() }?;
+    let total = unsafe { block.data_length() };
+    if total == 0 {
+        return None;
+    }
+    let mut out = vec![0u8; total];
+    let destination = NonNull::new(out.as_mut_ptr() as *mut c_void)?;
+    let status = unsafe { block.copy_data_bytes(0, total, destination) };
+    (status == 0).then_some(out)
+}
+
+/// Pull SPS (index 0) and PPS (index 1) out of a format description.
+fn extract_parameter_sets(
+    description: &objc2_core_media::CMFormatDescription,
+) -> Option<(Vec<u8>, Vec<u8>)> {
+    let mut sets = Vec::with_capacity(2);
+    for index in 0..2usize {
+        let mut pointer: *const u8 = std::ptr::null();
+        let mut size: usize = 0;
+        let status = unsafe {
+            CMVideoFormatDescriptionGetH264ParameterSetAtIndex(
+                description,
+                index,
+                &mut pointer,
+                &mut size,
+                std::ptr::null_mut(),
+                std::ptr::null_mut(),
+            )
+        };
+        if status != 0 || pointer.is_null() || size == 0 {
+            return None;
+        }
+        sets.push(unsafe { std::slice::from_raw_parts(pointer, size) }.to_vec());
+    }
+    let pps = sets.pop()?;
+    let sps = sets.pop()?;
+    // The avcC record copies profile/compatibility/level out of the SPS.
+    (sps.len() >= 4).then_some((sps, pps))
+}
+
+fn set_property(session: &VTCompressionSession, key: &str, value: &CFType) {
+    let key = CFString::from_str(key);
+    unsafe { VTSessionSetProperty(session, &key, Some(value)) };
+}
+
+fn set_bool(session: &VTCompressionSession, key: &str, value: bool) {
+    set_property(session, key, CFBoolean::new(value).as_ref());
+}
+
+fn set_i32(session: &VTCompressionSession, key: &str, value: i32) {
+    set_property(session, key, CFNumber::new_i32(value).as_ref());
+}
+
+fn set_string(session: &VTCompressionSession, key: &str, value: &str) {
+    set_property(session, key, CFString::from_str(value).as_ref());
+}
+
+fn set_f64(session: &VTCompressionSession, key: &str, value: f64) {
+    set_property(session, key, CFNumber::new_f64(value).as_ref());
+}
diff --git a/packages/accessibility-ios-sys/src/macos/framebuffer.rs b/packages/accessibility-ios-sys/src/macos/framebuffer.rs
new file mode 100644
index 0000000..5cfc4a8
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/framebuffer.rs
@@ -0,0 +1,579 @@
+//! Live framebuffer capture for a booted iOS Simulator.
+//!
+//! SimulatorKit exposes the simulator's display as an `IOSurface` behind a
+//! private "device IO port" graph. This module walks that graph and registers
+//! screen callbacks so we get pushed a notification whenever the display is
+//! repainted, which is dramatically cheaper and lower latency than polling
+//! `xcrun simctl io screenshot`.
+//!
+//! The traversal is:
+//!
+//! ```text
+//! SimDevice -> [device io]        (SimDeviceIOClient)
+//!           -> updateIOPorts
+//!           -> deviceIOPorts      (filter portIdentifier == com.apple.framebuffer.display)
+//!           -> [port descriptor]
+//!           -> registerScreenCallbacksWithUUID:...
+//!           -> [descriptor framebufferSurface] -> IOSurface
+//! ```
+//!
+//! Registering the callbacks is load-bearing: it is what makes SimulatorKit
+//! attach the display pipeline to our client and populate `framebufferSurface`.
+//! Merely reading the property without registering does not reliably work.
+
+use std::ffi::c_void;
+use std::ptr::NonNull;
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::{Duration, Instant};
+
+use anyhow::{Result, anyhow};
+use dispatch2::{DispatchQueue, DispatchQueueAttr, DispatchRetained};
+use objc2::rc::Retained;
+use objc2::runtime::AnyObject;
+use objc2::{msg_send, sel};
+use objc2_core_foundation::{CFRetained, kCFAllocatorDefault};
+use objc2_core_video::{
+    CVPixelBuffer, CVPixelBufferCreateWithIOSurface, CVPixelBufferGetHeight, CVPixelBufferGetWidth,
+    kCVPixelFormatType_32BGRA,
+};
+use objc2_foundation::{NSString, NSUUID};
+use objc2_io_surface::IOSurfaceRef;
+
+use super::common::find_booted_device;
+use super::dynamic::{
+    responds_to, send_id, send_id_with_id, send_register_screen_callbacks, send_u16,
+    send_void_with_id,
+};
+use super::pixel_buffer::cf_dict_u32;
+use super::void_block::VoidBlock;
+
+/// Port identifier for the simulator's main display framebuffer.
+///
+/// Several ports can carry this identifier (main screen plus secondary planes),
+/// so every match is registered and the largest live surface wins.
+const FRAMEBUFFER_PORT_ID: &str = "com.apple.framebuffer.display";
+
+/// How often to force a repaint when the screen is otherwise idle.
+///
+/// This is not an optimization. A `multipart/x-mixed-replace` consumer will not
+/// paint a part until the *next* boundary arrives, and clients that join while
+/// the simulator is static would otherwise sit blank forever. ~5fps of forced
+/// re-emits keeps both honest.
+const IDLE_INTERVAL: Duration = Duration::from_millis(200);
+
+/// Ticks between re-wire attempts while no frame has ever been captured.
+///
+/// Descriptors are sometimes created lazily, so a registration that happened
+/// too early silently yields nothing. Rebuilding the port graph roughly once a
+/// second recovers from that.
+const REWIRE_TICKS: u64 = 5;
+
+/// A frame handed to the sink, valid only for the duration of the call.
+///
+/// The pixel buffer wraps SimulatorKit's live framebuffer surface, which is
+/// recycled in place. Anything retaining it past the call must copy first.
+pub struct CapturedFrame<'a> {
+    pub pixel_buffer: &'a CVPixelBuffer,
+    pub width: u32,
+    pub height: u32,
+    pub captured_at: Instant,
+}
+
+/// Sink invoked on the capture queue for every accepted frame.
+pub type FrameSink = Box<dyn FnMut(CapturedFrame<'_>) + Send + 'static>;
+
+#[derive(Debug, Clone, Default)]
+pub struct FramebufferStats {
+    pub frame_count: u64,
+    pub width: u32,
+    pub height: u32,
+    pub descriptor_count: usize,
+    pub rewire_count: u64,
+    /// `displayClass` of each registered descriptor, for diagnostics.
+    pub display_classes: Vec<Option<u16>>,
+}
+
+/// Wrapper making a raw Objective-C pointer movable across threads.
+///
+/// The pointers here are owned by SimulatorKit and only ever messaged from the
+/// capture queue (or from `start`/`stop`, which are externally serialized).
+#[derive(Clone, Copy)]
+struct ObjcPtr(*mut AnyObject);
+unsafe impl Send for ObjcPtr {}
+unsafe impl Sync for ObjcPtr {}
+
+impl ObjcPtr {
+    fn as_ptr(self) -> *mut AnyObject {
+        self.0
+    }
+}
+
+/// A framebuffer descriptor plus the UUID its callbacks were registered under.
+struct Registration {
+    descriptor: ObjcPtr,
+    uuid: Retained<NSUUID>,
+    /// Last `IOSurfaceGetSeed` observed, used to skip unchanged repaints.
+    last_seed: Option<u32>,
+    /// `displayClass` from the descriptor's state. iOS reports the main
+    /// display as 0; anything else is a secondary display or plane.
+    display_class: Option<u16>,
+}
+
+/// State shared between the capture queue, the idle timer, and the owner.
+///
+/// The wiring state (device, IO client, registrations, blocks) lives here
+/// rather than on [`SimFramebuffer`] so the idle timer can rebuild the whole
+/// pipeline without needing `&mut` access to the owner.
+struct CaptureState {
+    device: ObjcPtr,
+    queue: DispatchRetained<DispatchQueue>,
+    registrations: Mutex<Vec<Registration>>,
+    /// SimulatorKit retains these blocks for the lifetime of the registration.
+    /// Dropping them early is a use-after-free, not a clean failure, so they
+    /// are held until the matching unregister call.
+    blocks: Mutex<Vec<VoidBlock>>,
+    sink: Mutex<Option<FrameSink>>,
+    last_capture: Mutex<Instant>,
+    frame_count: AtomicU64,
+    rewire_count: AtomicU64,
+    width: AtomicUsize,
+    height: AtomicUsize,
+    running: AtomicBool,
+}
+
+impl CaptureState {
+    fn stats(&self) -> FramebufferStats {
+        // Lock once and finish with it. Two `lock()` calls inside one struct
+        // expression would deadlock: the temporary guard from the first lives
+        // until the end of the whole expression, so the second waits on it.
+        let registrations = self.registrations.lock().unwrap();
+        let descriptor_count = registrations.len();
+        let display_classes = registrations
+            .iter()
+            .map(|registration| registration.display_class)
+            .collect();
+        drop(registrations);
+
+        FramebufferStats {
+            frame_count: self.frame_count.load(Ordering::Relaxed),
+            width: self.width.load(Ordering::Relaxed) as u32,
+            height: self.height.load(Ordering::Relaxed) as u32,
+            descriptor_count,
+            rewire_count: self.rewire_count.load(Ordering::Relaxed),
+            display_classes,
+        }
+    }
+
+    /// Choose which descriptor to capture from.
+    ///
+    /// iOS reports the main display as `displayClass == 0`, so prefer that.
+    /// Several descriptors share the framebuffer port identifier — secondary
+    /// displays and planes — and the class is the value the API actually
+    /// provides for telling them apart. Largest live area remains the
+    /// fallback for descriptors that do not report a class, and for platforms
+    /// like tvOS that render on a non-zero class.
+    fn pick_best_surface(&self) -> Option<(usize, CFRetained<IOSurfaceRef>)> {
+        let registrations = self.registrations.lock().unwrap();
+        let mut best: Option<(usize, CFRetained<IOSurfaceRef>, usize)> = None;
+
+        for (index, registration) in registrations.iter().enumerate() {
+            let Some(surface) = (unsafe { framebuffer_surface(registration.descriptor.as_ptr()) })
+            else {
+                continue;
+            };
+            let area = surface.width() * surface.height();
+            if area == 0 {
+                continue;
+            }
+            if registration.display_class == Some(0) {
+                return Some((index, surface));
+            }
+            if best
+                .as_ref()
+                .is_none_or(|(_, _, best_area)| area > *best_area)
+            {
+                best = Some((index, surface, area));
+            }
+        }
+
+        best.map(|(index, surface, _)| (index, surface))
+    }
+
+    /// Capture one frame. `force` bypasses the unchanged-seed check.
+    fn capture(&self, force: bool) {
+        if !self.running.load(Ordering::Relaxed) {
+            return;
+        }
+
+        let Some((index, surface)) = self.pick_best_surface() else {
+            return;
+        };
+
+        // Skip repaints of an unchanged surface, but never skip the very first
+        // frame and never skip a forced idle re-emit.
+        let seed = surface.seed();
+        {
+            let mut registrations = self.registrations.lock().unwrap();
+            let Some(registration) = registrations.get_mut(index) else {
+                return;
+            };
+            let unchanged = registration.last_seed == Some(seed);
+            if unchanged && !force && self.frame_count.load(Ordering::Relaxed) > 0 {
+                return;
+            }
+            registration.last_seed = Some(seed);
+        }
+
+        let width = surface.width();
+        let height = surface.height();
+        self.width.store(width, Ordering::Relaxed);
+        self.height.store(height, Ordering::Relaxed);
+
+        let Some(live) = (unsafe { pixel_buffer_for_surface(&surface) }) else {
+            return;
+        };
+
+        *self.last_capture.lock().unwrap() = Instant::now();
+
+        self.frame_count.fetch_add(1, Ordering::Relaxed);
+
+        // Handed out live. SimulatorKit recycles this surface in place, so the
+        // sink must finish with it — or take its own copy — before returning;
+        // the encoder's pixel transfer is what does that.
+        let mut sink = self.sink.lock().unwrap();
+        if let Some(sink) = sink.as_mut() {
+            sink(CapturedFrame {
+                pixel_buffer: &live,
+                width: CVPixelBufferGetWidth(&live) as u32,
+                height: CVPixelBufferGetHeight(&live) as u32,
+                captured_at: Instant::now(),
+            });
+        }
+    }
+
+    /// Walk the IO port graph and register screen callbacks on every
+    /// framebuffer descriptor, replacing any existing registration.
+    fn wire_up(self: &Arc<Self>) -> Result<()> {
+        let io: *mut AnyObject = unsafe { msg_send![self.device.as_ptr(), io] };
+        if io.is_null() {
+            return Err(anyhow!(
+                "SimDevice returned no IO client; is the simulator still booted?"
+            ));
+        }
+
+        let _: () = unsafe { msg_send![io, updateIOPorts] };
+
+        let descriptors = unsafe { framebuffer_descriptors(io)? };
+        if descriptors.is_empty() {
+            return Err(anyhow!(
+                "No '{FRAMEBUFFER_PORT_ID}' IO ports found on the simulator"
+            ));
+        }
+
+        self.unregister_all();
+
+        let mut registrations = Vec::with_capacity(descriptors.len());
+        let mut blocks = Vec::with_capacity(descriptors.len() * 3);
+
+        for descriptor in descriptors {
+            let uuid = NSUUID::new();
+
+            let state = Arc::clone(self);
+            let frame_cb = VoidBlock::new(move || state.capture(false));
+            // `surfacesChanged` carries no payload; it just means "re-query".
+            let state = Arc::clone(self);
+            let surfaces_cb = VoidBlock::new(move || state.capture(true));
+            let props_cb = VoidBlock::new(|| {});
+
+            unsafe {
+                send_register_screen_callbacks(
+                    descriptor,
+                    sel!(registerScreenCallbacksWithUUID:callbackQueue:frameCallback:surfacesChangedCallback:propertiesChangedCallback:),
+                    &*uuid as *const NSUUID as *mut AnyObject,
+                    &*self.queue as *const DispatchQueue as *mut c_void,
+                    frame_cb.as_ptr(),
+                    surfaces_cb.as_ptr(),
+                    props_cb.as_ptr(),
+                );
+            }
+
+            blocks.push(frame_cb);
+            blocks.push(surfaces_cb);
+            blocks.push(props_cb);
+            registrations.push(Registration {
+                descriptor: ObjcPtr(descriptor),
+                uuid,
+                last_seed: None,
+                display_class: unsafe { display_class(descriptor) },
+            });
+        }
+
+        *self.registrations.lock().unwrap() = registrations;
+        *self.blocks.lock().unwrap() = blocks;
+
+        // Registration alone does not deliver a first frame; prime it.
+        self.capture(true);
+        Ok(())
+    }
+
+    fn unregister_all(&self) {
+        let mut registrations = self.registrations.lock().unwrap();
+        for registration in registrations.drain(..) {
+            let descriptor = registration.descriptor.as_ptr();
+            let selector = sel!(unregisterScreenCallbacksWithUUID:);
+            if unsafe { responds_to(descriptor, selector) } {
+                unsafe {
+                    send_void_with_id(
+                        descriptor,
+                        selector,
+                        &*registration.uuid as *const NSUUID as *mut AnyObject,
+                    );
+                }
+            }
+        }
+        drop(registrations);
+        // Only safe to release the blocks once SimulatorKit has been told to
+        // stop calling them.
+        self.blocks.lock().unwrap().clear();
+        self.width.store(0, Ordering::Relaxed);
+        self.height.store(0, Ordering::Relaxed);
+    }
+}
+
+/// Live framebuffer capture session for one simulator device.
+pub struct SimFramebuffer {
+    device_udid: String,
+    state: Arc<CaptureState>,
+    idle_thread: Option<std::thread::JoinHandle<()>>,
+}
+
+impl SimFramebuffer {
+    /// Attach to a booted simulator. `udid` of `None` picks the first booted one.
+    pub fn new(udid: Option<&str>) -> Result<Self> {
+        crate::frameworks::load_coresimulator_framework()?;
+        crate::frameworks::load_simulatorkit_framework()?;
+
+        let device = unsafe { find_booted_device(udid)? };
+        let device_udid = unsafe { device_udid_string(device)? };
+
+        Ok(Self {
+            device_udid,
+            state: Arc::new(CaptureState {
+                device: ObjcPtr(device),
+                queue: DispatchQueue::new(
+                    "com.accessibility_cli.framebuffer",
+                    DispatchQueueAttr::SERIAL,
+                ),
+                registrations: Mutex::new(Vec::new()),
+                blocks: Mutex::new(Vec::new()),
+                sink: Mutex::new(None),
+                last_capture: Mutex::new(Instant::now()),
+                frame_count: AtomicU64::new(0),
+                rewire_count: AtomicU64::new(0),
+                width: AtomicUsize::new(0),
+                height: AtomicUsize::new(0),
+                running: AtomicBool::new(false),
+            }),
+            idle_thread: None,
+        })
+    }
+
+    pub fn device_udid(&self) -> &str {
+        &self.device_udid
+    }
+
+    pub fn stats(&self) -> FramebufferStats {
+        self.state.stats()
+    }
+
+    /// Install the frame sink. Called on the capture queue, so it must be quick.
+    pub fn set_sink(&mut self, sink: Option<FrameSink>) {
+        *self.state.sink.lock().unwrap() = sink;
+    }
+
+    /// Begin capturing. Calling twice rebuilds the pipeline.
+    pub fn start(&mut self) -> Result<()> {
+        self.state.running.store(true, Ordering::Relaxed);
+        self.state.wire_up()?;
+        self.start_idle_timer();
+        Ok(())
+    }
+
+    /// Drive forced re-emits, and rebuild the pipeline while nothing arrives.
+    fn start_idle_timer(&mut self) {
+        if self.idle_thread.is_some() {
+            return;
+        }
+        let state = Arc::clone(&self.state);
+        self.idle_thread = Some(std::thread::spawn(move || {
+            let mut tick: u64 = 0;
+            while state.running.load(Ordering::Relaxed) {
+                std::thread::sleep(IDLE_INTERVAL);
+                if !state.running.load(Ordering::Relaxed) {
+                    break;
+                }
+                tick += 1;
+
+                let idle_for = state.last_capture.lock().unwrap().elapsed();
+                if idle_for >= IDLE_INTERVAL {
+                    state.capture(true);
+                }
+
+                // Self-heal only until the first frame ever lands. After that
+                // a silent pipeline means an idle screen, not a broken graph.
+                if state.frame_count.load(Ordering::Relaxed) == 0
+                    && tick.is_multiple_of(REWIRE_TICKS)
+                {
+                    state.rewire_count.fetch_add(1, Ordering::Relaxed);
+                    // Descriptors are sometimes created lazily, so a
+                    // registration that happened too early yields nothing.
+                    // Failures are expected here; the next tick retries.
+                    let _ = state.wire_up();
+                }
+            }
+        }));
+    }
+
+    pub fn stop(&mut self) {
+        self.state.running.store(false, Ordering::Relaxed);
+        if let Some(handle) = self.idle_thread.take() {
+            let _ = handle.join();
+        }
+        self.state.unregister_all();
+        *self.state.sink.lock().unwrap() = None;
+    }
+}
+
+impl Drop for SimFramebuffer {
+    fn drop(&mut self) {
+        self.stop();
+    }
+}
+
+/// Read `-framebufferSurface` off a descriptor, retaining the result.
+unsafe fn framebuffer_surface(descriptor: *mut AnyObject) -> Option<CFRetained<IOSurfaceRef>> {
+    if descriptor.is_null() {
+        return None;
+    }
+    let selector = sel!(framebufferSurface);
+    if !unsafe { responds_to(descriptor, selector) } {
+        return None;
+    }
+    let surface = unsafe { send_id(descriptor, selector) };
+    let surface = NonNull::new(surface)?.cast::<IOSurfaceRef>();
+    // The getter returns an autoreleased/unowned surface; retain it so it
+    // survives for as long as we hold it.
+    Some(unsafe { CFRetained::retain(surface) })
+}
+
+/// Wrap an IOSurface as a BGRA `CVPixelBuffer` without copying pixels.
+unsafe fn pixel_buffer_for_surface(surface: &IOSurfaceRef) -> Option<CFRetained<CVPixelBuffer>> {
+    let attrs = unsafe {
+        cf_dict_u32(
+            objc2_core_video::kCVPixelBufferPixelFormatTypeKey,
+            kCVPixelFormatType_32BGRA,
+        )
+    };
+
+    let mut out: *mut CVPixelBuffer = std::ptr::null_mut();
+    let status = unsafe {
+        CVPixelBufferCreateWithIOSurface(
+            kCFAllocatorDefault,
+            surface,
+            Some(&attrs),
+            NonNull::from(&mut out),
+        )
+    };
+    if status != 0 {
+        return None;
+    }
+    NonNull::new(out).map(|p| unsafe { CFRetained::from_raw(p) })
+}
+
+/// Collect the descriptors of every `com.apple.framebuffer.display` IO port.
+///
+/// Ports arrive as `ROCKRemoteProxy` objects that implement their interface by
+/// forwarding, so every message has to go through the dynamic helpers rather
+/// than `msg_send!`.
+unsafe fn framebuffer_descriptors(io: *mut AnyObject) -> Result<Vec<*mut AnyObject>> {
+    let key = NSString::from_str("deviceIOPorts");
+    let ports = unsafe {
+        send_id_with_id(
+            io,
+            sel!(valueForKey:),
+            &*key as *const NSString as *mut AnyObject,
+        )
+    };
+    if ports.is_null() {
+        return Err(anyhow!("SimDeviceIOClient exposed no deviceIOPorts"));
+    }
+
+    let count: usize = unsafe { msg_send![ports, count] };
+    let mut descriptors = Vec::new();
+
+    for index in 0..count {
+        let port: *mut AnyObject = unsafe { msg_send![ports, objectAtIndex: index] };
+
+        if !unsafe { responds_to(port, sel!(portIdentifier)) } {
+            continue;
+        }
+        let identifier = unsafe { send_id(port, sel!(portIdentifier)) };
+        // The identifier is usually an NSString but can be a richer object;
+        // falling back to -description matches serve-sim's stringification.
+        let Some(identifier) = (unsafe { super::common::nsstring_to_string_static(identifier) })
+            .or_else(|| unsafe { object_description(identifier) })
+        else {
+            continue;
+        };
+        if identifier != FRAMEBUFFER_PORT_ID {
+            continue;
+        }
+
+        if !unsafe { responds_to(port, sel!(descriptor)) } {
+            continue;
+        }
+        let descriptor = unsafe { send_id(port, sel!(descriptor)) };
+
+        // Not every descriptor on a framebuffer port actually vends a surface.
+        if !unsafe { responds_to(descriptor, sel!(framebufferSurface)) } {
+            continue;
+        }
+
+        descriptors.push(descriptor);
+    }
+
+    Ok(descriptors)
+}
+
+/// Read `displayClass` from a descriptor's state, if it reports one.
+///
+/// The state object is another proxied private object, so both hops go
+/// through dynamic dispatch.
+unsafe fn display_class(descriptor: *mut AnyObject) -> Option<u16> {
+    let state_selector = sel!(state);
+    if !unsafe { responds_to(descriptor, state_selector) } {
+        return None;
+    }
+    let state = unsafe { send_id(descriptor, state_selector) };
+    let class_selector = sel!(displayClass);
+    if !unsafe { responds_to(state, class_selector) } {
+        return None;
+    }
+    Some(unsafe { send_u16(state, class_selector) })
+}
+
+/// `-[NSObject description]` as a Rust string, for non-NSString identifiers.
+unsafe fn object_description(object: *mut AnyObject) -> Option<String> {
+    if !unsafe { responds_to(object, sel!(description)) } {
+        return None;
+    }
+    unsafe { super::common::nsstring_to_string_static(send_id(object, sel!(description))) }
+}
+
+unsafe fn device_udid_string(device: *mut AnyObject) -> Result<String> {
+    let udid: *mut AnyObject = unsafe { msg_send![device, UDID] };
+    let string: *mut AnyObject = unsafe { msg_send![udid, UUIDString] };
+    unsafe { super::common::nsstring_to_string_static(string) }
+        .ok_or_else(|| anyhow!("Failed to read simulator UDID"))
+}
diff --git a/packages/accessibility-ios-sys/src/macos/hid.rs b/packages/accessibility-ios-sys/src/macos/hid.rs
index 43b7745..4ee3c5b 100644
--- a/packages/accessibility-ios-sys/src/macos/hid.rs
+++ b/packages/accessibility-ios-sys/src/macos/hid.rs
@@ -11,12 +11,24 @@ use super::*;
 /// Function pointer types for Indigo message creation (loaded from SimulatorKit via dlsym).
 type IndigoMessageForButtonFn =
     unsafe extern "C" fn(source: i32, action: i32, target: i32) -> *mut c_void;
+/// `IndigoHIDMessageForMouseNSEvent(CGPoint*, CGPoint*, IndigoHIDTarget,
+///  NSEventType, NSSize, IndigoHIDEdge)`
+///
+/// On arm64 the integer and floating-point arguments are numbered
+/// independently, so the pointers, target, event type and edge land in x0-x4
+/// while the `NSSize` occupies d0/d1. Declaring the size last therefore still
+/// produces the correct register assignment.
+///
+/// Apple's Simulator.app always passes `NSSize(1.0, 1.0)`, which makes the
+/// ratio computation inside the function reduce to the point itself.
 type IndigoMessageForTouchFn = unsafe extern "C" fn(
     point0: *const objc2_core_foundation::CGPoint,
     point1: *const objc2_core_foundation::CGPoint,
     target: i32,
     event_type: i32,
-    something: Bool,
+    edge: u32,
+    size_width: f64,
+    size_height: f64,
 ) -> *mut c_void;
 type IndigoMessageForKeyboardFn = unsafe extern "C" fn(key_code: i32, action: i32) -> *mut c_void;
 
@@ -25,8 +37,45 @@ type IndigoMessageForKeyboardFn = unsafe extern "C" fn(key_code: i32, action: i3
 /// Uses the Indigo protocol via SimulatorKit's SimDeviceLegacyHIDClient
 /// to inject touch events, button presses, and keyboard input directly
 /// into the simulator's HID subsystem.
-pub(super) struct SimulatorHID {
+/// Phase of an interactive touch stream.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum TouchPhase {
+    Begin,
+    Move,
+    End,
+}
+
+/// Screen edge a touch is treated as originating from.
+///
+/// iOS only recognizes system gestures — most importantly swipe-up-to-home on
+/// Face ID devices — when the touch is flagged with the edge it started from.
+/// Without this a drag from the bottom is just an in-app drag.
+///
+/// These are edges of the *raw framebuffer*, which never rotates, so callers
+/// working in display space have to map through the current orientation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(u32)]
+pub enum TouchEdge {
+    None = 0,
+    Left = 1,
+    Top = 2,
+    Bottom = 3,
+    Right = 4,
+}
+
+/// Device orientation, using the GSEvent numbering.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[repr(u32)]
+pub enum Orientation {
+    Portrait = 1,
+    PortraitUpsideDown = 2,
+    LandscapeRight = 3,
+    LandscapeLeft = 4,
+}
+
+pub struct SimulatorHID {
     client: *mut AnyObject, // SimDeviceLegacyHIDClient
+    device: *mut AnyObject, // SimDevice, retained for GSEvent port lookup
     queue: *mut AnyObject,  // dispatch_queue_t
     screen_size: (f64, f64),
     screen_scale: f64,
@@ -122,6 +171,7 @@ impl SimulatorHID {
 
         Ok(Self {
             client,
+            device,
             queue,
             screen_size,
             screen_scale,
@@ -131,6 +181,17 @@ impl SimulatorHID {
         })
     }
 
+    /// Create a HID client for a booted device, resolving it by UDID.
+    ///
+    /// `None` picks the first booted simulator. This exists so an input path
+    /// can be opened independently of the accessibility reader, which keeps
+    /// pointer events from queueing behind slow AX tree fetches.
+    pub fn for_device(udid: Option<&str>) -> Result<Self> {
+        crate::frameworks::load_coresimulator_framework()?;
+        let device = unsafe { super::common::find_booted_device(udid)? };
+        Self::new(device)
+    }
+
     /// Get the screen size in points.
     pub fn screen_size(&self) -> (f64, f64) {
         self.screen_size
@@ -192,6 +253,115 @@ impl SimulatorHID {
         Ok(())
     }
 
+    /// Send a single interactive touch event in normalized screen space.
+    ///
+    /// Unlike [`Self::tap`] and [`Self::swipe`], this does not synthesize a
+    /// whole gesture: the caller drives the phases itself, which is what a live
+    /// pointer stream from a browser needs.
+    ///
+    /// `x` and `y` are 0..1 fractions of the screen, matching what the web UI
+    /// already computes, so no point/pixel/scale conversion is involved.
+    pub fn touch_normalized(&self, x: f64, y: f64, phase: TouchPhase) -> Result<()> {
+        self.touch_normalized_edge(x, y, phase, TouchEdge::None)
+    }
+
+    /// As [`Self::touch_normalized`], but flagged as a system edge gesture.
+    ///
+    /// The same edge must be supplied for every event in the gesture, or iOS
+    /// will not recognize it.
+    pub fn touch_normalized_edge(
+        &self,
+        x: f64,
+        y: f64,
+        phase: TouchPhase,
+        edge: TouchEdge,
+    ) -> Result<()> {
+        let x = x.clamp(0.0, 1.0);
+        let y = y.clamp(0.0, 1.0);
+        // Indigo has no distinct "move" phase; contact is maintained by
+        // repeating the down event at the new position, which is exactly what
+        // `swipe` does internally.
+        let direction = match phase {
+            TouchPhase::Begin | TouchPhase::Move => ButtonDirection::Down,
+            TouchPhase::End => ButtonDirection::Up,
+        };
+        self.send_touch_edge(x, y, direction, edge)
+    }
+
+    /// Rotate the device.
+    ///
+    /// Orientation does not travel over Indigo like touches do. It is a
+    /// GSEvent delivered by mach message to the simulator's
+    /// `PurpleWorkspacePort`, which is the same path Simulator.app itself uses
+    /// when you pick Device > Rotate.
+    pub fn set_orientation(&self, orientation: Orientation) -> Result<()> {
+        // GSEvent constants, as used by Simulator.app and idb.
+        const GSEVENT_MACH_MESSAGE_ID: i32 = 0x7B;
+        const GSEVENT_TYPE_ORIENTATION_CHANGED: u32 = 50;
+        const GSEVENT_HOST_FLAG: u32 = 0x0002_0000;
+        const MACH_MSG_TYPE_COPY_SEND: u32 = 19;
+        /// `align4(4 + 0x6B)` — a GSEvent header plus a 4-byte payload.
+        const MESSAGE_SIZE: u32 = 108;
+
+        unsafe extern "C" {
+            fn mach_msg_send(message: *mut c_void) -> i32;
+        }
+
+        let port = self.purple_workspace_port()?;
+
+        // Oversized so the 108-byte message is comfortably in bounds.
+        let mut buffer = [0u8; 112];
+        let base = buffer.as_mut_ptr();
+        unsafe {
+            // mach_msg_header_t: bits, size, remote, local, voucher, id.
+            std::ptr::write_unaligned(base.add(0x00) as *mut u32, MACH_MSG_TYPE_COPY_SEND);
+            std::ptr::write_unaligned(base.add(0x04) as *mut u32, MESSAGE_SIZE);
+            std::ptr::write_unaligned(base.add(0x08) as *mut u32, port);
+            std::ptr::write_unaligned(base.add(0x0c) as *mut u32, 0);
+            std::ptr::write_unaligned(base.add(0x10) as *mut u32, 0);
+            std::ptr::write_unaligned(base.add(0x14) as *mut i32, GSEVENT_MACH_MESSAGE_ID);
+
+            std::ptr::write_unaligned(
+                base.add(0x18) as *mut u32,
+                GSEVENT_TYPE_ORIENTATION_CHANGED | GSEVENT_HOST_FLAG,
+            );
+            // record_info_size, then the orientation itself.
+            std::ptr::write_unaligned(base.add(0x48) as *mut u32, 4);
+            std::ptr::write_unaligned(base.add(0x4c) as *mut u32, orientation as u32);
+        }
+
+        let result = unsafe { mach_msg_send(base as *mut c_void) };
+        if result != 0 {
+            return Err(anyhow!("mach_msg_send for orientation failed: {result}"));
+        }
+        Ok(())
+    }
+
+    /// Look up the simulator's `PurpleWorkspacePort` mach port.
+    fn purple_workspace_port(&self) -> Result<u32> {
+        let name = NSString::from_str("PurpleWorkspacePort");
+        let mut error: *mut AnyObject = std::ptr::null_mut();
+        let port: u32 = unsafe { msg_send![self.device, lookup: &*name, error: &mut error] };
+
+        if port == 0 {
+            let detail = unsafe {
+                (!error.is_null())
+                    .then(|| {
+                        let description: *mut AnyObject = msg_send![error, localizedDescription];
+                        nsstring_to_string_static(description)
+                    })
+                    .flatten()
+            };
+            // The port is published by Simulator.app, not by the runtime, so a
+            // headless `simctl boot` will not have one.
+            return Err(anyhow!(
+                "PurpleWorkspacePort unavailable ({}). Rotation needs Simulator.app running.",
+                detail.as_deref().unwrap_or("no error detail")
+            ));
+        }
+        Ok(port)
+    }
+
     /// Press a hardware button.
     ///
     /// # Arguments
@@ -218,19 +388,47 @@ impl SimulatorHID {
     /// # Arguments
     /// * `key_code` - The key code (from HIToolbox/Events.h)
     pub fn send_key(&self, key_code: u32) -> Result<()> {
-        // Key down
-        self.send_keyboard(key_code, ButtonDirection::Down)?;
+        self.send_key_with_modifiers(key_code, &[])
+    }
 
-        std::thread::sleep(std::time::Duration::from_millis(30));
+    /// Send a key press with modifier keys held down around it.
+    ///
+    /// Modifiers are ordinary key events, not a bitmask: they are pressed in
+    /// order, then the key is pressed and released, then they are released in
+    /// reverse. This is the only way to produce capitals and shifted symbols —
+    /// there is no shift flag on the Indigo message.
+    ///
+    /// `key_code` and `modifiers` are **USB HID usage codes** (page 0x07),
+    /// not HIToolbox virtual keycodes. The ranges overlap and the meanings
+    /// differ, so passing the wrong kind types different letters rather than
+    /// failing. Left Shift is 225.
+    pub fn send_key_with_modifiers(&self, key_code: u32, modifiers: &[u32]) -> Result<()> {
+        for modifier in modifiers {
+            self.send_keyboard(*modifier, ButtonDirection::Down)?;
+        }
 
-        // Key up
+        self.send_keyboard(key_code, ButtonDirection::Down)?;
+        std::thread::sleep(std::time::Duration::from_millis(12));
         self.send_keyboard(key_code, ButtonDirection::Up)?;
 
+        for modifier in modifiers.iter().rev() {
+            self.send_keyboard(*modifier, ButtonDirection::Up)?;
+        }
         Ok(())
     }
 
     /// Send a touch event at the given ratio coordinates.
     fn send_touch(&self, x_ratio: f64, y_ratio: f64, direction: ButtonDirection) -> Result<()> {
+        self.send_touch_edge(x_ratio, y_ratio, direction, TouchEdge::None)
+    }
+
+    fn send_touch_edge(
+        &self,
+        x_ratio: f64,
+        y_ratio: f64,
+        direction: ButtonDirection,
+        edge: TouchEdge,
+    ) -> Result<()> {
         // First get a template message from IndigoHIDMessageForMouseNSEvent
         let point = objc2_core_foundation::CGPoint {
             x: x_ratio,
@@ -242,8 +440,17 @@ impl SimulatorHID {
             ButtonDirection::Up => 2,
         };
 
-        let template_msg =
-            unsafe { (self.msg_for_touch)(&point, std::ptr::null(), 0x32, event_type, Bool::NO) };
+        let template_msg = unsafe {
+            (self.msg_for_touch)(
+                &point,
+                std::ptr::null(),
+                0x32,
+                event_type,
+                edge as u32,
+                1.0,
+                1.0,
+            )
+        };
 
         if template_msg.is_null() {
             return Err(anyhow!("Failed to create template touch message"));
diff --git a/packages/accessibility-ios-sys/src/macos/pixel_buffer.rs b/packages/accessibility-ios-sys/src/macos/pixel_buffer.rs
new file mode 100644
index 0000000..e95b89e
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/pixel_buffer.rs
@@ -0,0 +1,157 @@
+//! Preparing captured frames for the encoder.
+//!
+//! Three things have to happen between SimulatorKit's framebuffer and
+//! VideoToolbox, and they are all the same operation:
+//!
+//! 1. **Copy.** SimulatorKit recycles its framebuffer `IOSurface` in place, and
+//!    VideoToolbox encodes asynchronously, so the encoder must not be reading
+//!    the live surface.
+//! 2. **Convert.** The framebuffer is BGRA; H.264 encoders want NV12. Handing
+//!    BGRA to `VTCompressionSession` makes it convert internally anyway.
+//! 3. **Scale.** A phone framebuffer is far larger than anyone views it at.
+//!
+//! `VTPixelTransferSession` does all three in one hardware pass into a pooled
+//! buffer, which is why there is no CPU copy here any more. The previous
+//! implementation did a row-wise `memcpy` and left conversion and scaling to
+//! the encoder.
+//!
+//! Note this does not contradict the earlier finding that a plain Metal blit
+//! was slower than `memcpy`: that measured a bare copy doing one job against a
+//! purpose-built transfer doing three.
+
+use std::ptr::NonNull;
+
+use anyhow::{Result, anyhow};
+use objc2_core_foundation::{
+    CFDictionary, CFNumber, CFRetained, CFString, CFType, kCFAllocatorDefault,
+};
+use objc2_core_video::{
+    CVPixelBuffer, CVPixelBufferPool, kCVPixelBufferHeightKey,
+    kCVPixelBufferIOSurfacePropertiesKey, kCVPixelBufferPixelFormatTypeKey, kCVPixelBufferWidthKey,
+    kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange,
+};
+use objc2_video_toolbox::VTPixelTransferSession;
+
+/// Build an untyped `CFDictionary` from `CFString` keys to arbitrary CF values.
+pub(super) fn cf_dict(pairs: &[(&CFString, &CFType)]) -> CFRetained<CFDictionary> {
+    let keys: Vec<&CFString> = pairs.iter().map(|(k, _)| *k).collect();
+    let values: Vec<&CFType> = pairs.iter().map(|(_, v)| *v).collect();
+    let typed = CFDictionary::<CFString, CFType>::from_slices(&keys, &values);
+    // The generic parameters are purely a Rust-side convenience; the underlying
+    // CF object is the same either way.
+    unsafe { CFRetained::cast_unchecked::<CFDictionary>(typed) }
+}
+
+/// Single-entry dictionary mapping a key to a `u32`, as CoreVideo expects.
+pub(super) fn cf_dict_u32(key: &CFString, value: u32) -> CFRetained<CFDictionary> {
+    let number = CFNumber::new_i32(value as i32);
+    cf_dict(&[(key, number.as_ref())])
+}
+
+/// Copies, converts and scales frames on the way to the encoder.
+pub(super) struct PixelTransfer {
+    session: CFRetained<VTPixelTransferSession>,
+    pool: Option<CFRetained<CVPixelBufferPool>>,
+    /// Output size the current pool was built for.
+    dimensions: (usize, usize),
+}
+
+// The session and pool are only touched behind the capture state's mutex,
+// which serializes the capture queue against the idle timer.
+unsafe impl Send for PixelTransfer {}
+
+impl PixelTransfer {
+    pub(super) fn new() -> Result<Self> {
+        let mut out: *mut VTPixelTransferSession = std::ptr::null_mut();
+        let status =
+            unsafe { VTPixelTransferSession::create(kCFAllocatorDefault, NonNull::from(&mut out)) };
+        let session = NonNull::new(out)
+            .filter(|_| status == 0)
+            .map(|p| unsafe { CFRetained::from_raw(p) })
+            .ok_or_else(|| anyhow!("VTPixelTransferSessionCreate failed: {status}"))?;
+
+        Ok(Self {
+            session,
+            pool: None,
+            dimensions: (0, 0),
+        })
+    }
+
+    /// Produce an NV12 copy of `source` at the requested size.
+    ///
+    /// The returned buffer is independent of the source, so the caller may
+    /// hand it to an asynchronous encoder.
+    pub(super) fn transfer(
+        &mut self,
+        source: &CVPixelBuffer,
+        width: usize,
+        height: usize,
+    ) -> Result<CFRetained<CVPixelBuffer>> {
+        if width == 0 || height == 0 {
+            return Err(anyhow!("Target size is empty"));
+        }
+
+        if self.pool.is_none() || self.dimensions != (width, height) {
+            self.pool = Some(build_pool(width, height)?);
+            self.dimensions = (width, height);
+        }
+        let pool = self.pool.as_ref().expect("pool built above");
+
+        let mut out: *mut CVPixelBuffer = std::ptr::null_mut();
+        let status = unsafe {
+            CVPixelBufferPool::create_pixel_buffer(
+                kCFAllocatorDefault,
+                pool,
+                NonNull::from(&mut out),
+            )
+        };
+        let destination = NonNull::new(out)
+            .filter(|_| status == 0)
+            .map(|p| unsafe { CFRetained::from_raw(p) })
+            .ok_or_else(|| anyhow!("CVPixelBufferPoolCreatePixelBuffer failed: {status}"))?;
+
+        let status = unsafe { self.session.transfer_image(source, &destination) };
+        if status != 0 {
+            return Err(anyhow!(
+                "VTPixelTransferSessionTransferImage failed: {status}"
+            ));
+        }
+        Ok(destination)
+    }
+}
+
+/// Create an IOSurface-backed NV12 pool at the given size.
+fn build_pool(width: usize, height: usize) -> Result<CFRetained<CVPixelBufferPool>> {
+    let format = CFNumber::new_i32(kCVPixelFormatType_420YpCbCr8BiPlanarVideoRange as i32);
+    let width_num = CFNumber::new_i32(width as i32);
+    let height_num = CFNumber::new_i32(height as i32);
+    // An empty IOSurface-properties dictionary is the documented way to ask for
+    // IOSurface-backed buffers, which keeps VideoToolbox on the zero-copy path.
+    let io_surface_props = CFDictionary::<CFString, CFType>::empty();
+
+    let attrs = unsafe {
+        cf_dict(&[
+            (kCVPixelBufferPixelFormatTypeKey, format.as_ref()),
+            (kCVPixelBufferWidthKey, width_num.as_ref()),
+            (kCVPixelBufferHeightKey, height_num.as_ref()),
+            (
+                kCVPixelBufferIOSurfacePropertiesKey,
+                &*CFRetained::cast_unchecked::<CFType>(io_surface_props),
+            ),
+        ])
+    };
+
+    let mut out: *mut CVPixelBufferPool = std::ptr::null_mut();
+    let status = unsafe {
+        CVPixelBufferPool::create(
+            kCFAllocatorDefault,
+            None,
+            Some(&attrs),
+            NonNull::from(&mut out),
+        )
+    };
+    NonNull::new(out)
+        .filter(|_| status == 0)
+        .map(|p| unsafe { CFRetained::from_raw(p) })
+        .ok_or_else(|| anyhow!("CVPixelBufferPoolCreate failed: {status}"))
+}
diff --git a/packages/accessibility-ios-sys/src/macos/reader/actions.rs b/packages/accessibility-ios-sys/src/macos/reader/actions.rs
index cc846c9..0e18f87 100644
--- a/packages/accessibility-ios-sys/src/macos/reader/actions.rs
+++ b/packages/accessibility-ios-sys/src/macos/reader/actions.rs
@@ -229,6 +229,16 @@ impl IOSSimulatorAccessibility {
             return Ok(None);
         }
 
+        // The platform element carries its own translation, which is not
+        // necessarily the one we just tokenized. Without the token on *that*
+        // object every attribute read is routed through a delegate that
+        // cannot reach the device, so the element comes back with an empty
+        // label and a zero frame rather than failing outright.
+        let element_translation: *mut AnyObject = msg_send![element, translation];
+        if !element_translation.is_null() {
+            let _: () = msg_send![element_translation, setBridgeDelegateToken: &*token_ns];
+        }
+
         // Build element (as a leaf - no children)
         let filter = TreeFilter {
             max_depth: Some(0),
diff --git a/packages/accessibility-ios-sys/src/macos/recorder.rs b/packages/accessibility-ios-sys/src/macos/recorder.rs
new file mode 100644
index 0000000..7ddad25
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/recorder.rs
@@ -0,0 +1,360 @@
+//! Recording the simulator screen to an MP4.
+//!
+//! Deliberately a *second* encoder rather than a retuning of the streaming
+//! one. The live path cannot use B-frames — WebRTC's payloader and the raw
+//! stream framing both assume the encoder emits frames in the order they were
+//! submitted — but a recording has no such constraint and B-frames are where
+//! most of the quality-per-bit comes from. Running a separate encode is also
+//! what lets a recording be a different resolution and quality from whatever
+//! the viewer happens to be watching.
+//!
+//! `AVAssetWriter` does the encoding and the muxing. Handing it pixel buffers
+//! rather than encoding ourselves and appending samples avoids having to order
+//! decode and presentation timestamps by hand, which is exactly the part that
+//! B-frames complicate.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Duration;
+
+use anyhow::{Context, Result, anyhow};
+use objc2::rc::Retained;
+use objc2::runtime::{AnyObject, ProtocolObject};
+use objc2_av_foundation::{
+    AVAssetWriter, AVAssetWriterInput, AVAssetWriterInputPixelBufferAdaptor,
+    AVFileTypeMPEG4, AVMediaTypeVideo, AVVideoAllowFrameReorderingKey, AVVideoCodecKey,
+    AVVideoCodecTypeH264, AVVideoCompressionPropertiesKey, AVVideoHeightKey,
+    AVVideoMaxKeyFrameIntervalKey, AVVideoProfileLevelKey, AVVideoQualityKey,
+    AVVideoWidthKey,
+};
+use objc2_core_media::CMTime;
+use objc2_core_video::CVPixelBuffer;
+use objc2_foundation::{NSMutableDictionary, NSNumber, NSString, NSURL};
+
+use super::pixel_buffer::PixelTransfer;
+
+/// Timescale for presentation timestamps. Nanoseconds, so wall-clock elapsed
+/// time converts exactly and variable frame rates need no rounding.
+const TIMESCALE: i32 = 1_000_000_000;
+
+#[derive(Debug, Clone, Copy)]
+pub struct RecordingConfig {
+    /// Quality from 0 to 1.
+    pub quality: f64,
+    /// Longest edge of the recording. `None` records at capture resolution.
+    pub max_dimension: Option<u32>,
+    /// Seconds between keyframes. Longer is smaller, at the cost of seek
+    /// granularity, and a recording is not being seeked while it is written.
+    pub keyframe_interval_secs: u32,
+}
+
+impl Default for RecordingConfig {
+    fn default() -> Self {
+        Self {
+            quality: 0.8,
+            // Recordings are watched, not previewed in a corner, so they get
+            // more pixels than the live stream's 1280.
+            max_dimension: Some(1920),
+            keyframe_interval_secs: 4,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct Recording {
+    pub path: PathBuf,
+    pub frames: u64,
+    pub duration: Duration,
+    pub width: u32,
+    pub height: u32,
+}
+
+pub struct Recorder {
+    writer: Retained<AVAssetWriter>,
+    input: Retained<AVAssetWriterInput>,
+    adaptor: Retained<AVAssetWriterInputPixelBufferAdaptor>,
+    transfer: PixelTransfer,
+    path: PathBuf,
+    dimensions: (usize, usize),
+    frames: AtomicU64,
+    /// Set on the first appended frame; timestamps are relative to it.
+    started_at: Option<std::time::Instant>,
+    last_timestamp: Duration,
+}
+
+// Only ever touched behind the capture state's mutex.
+unsafe impl Send for Recorder {}
+
+impl Recorder {
+    /// Begin a recording of a `source_width` x `source_height` capture.
+    pub fn start(
+        path: &Path,
+        source_width: u32,
+        source_height: u32,
+        config: RecordingConfig,
+    ) -> Result<Self> {
+        let (width, height) = recording_size(source_width, source_height, config.max_dimension);
+
+        // AVAssetWriter refuses to overwrite, so clear any previous file.
+        let _ = std::fs::remove_file(path);
+        if let Some(parent) = path.parent() {
+            std::fs::create_dir_all(parent).ok();
+        }
+
+        let url = NSURL::fileURLWithPath(&NSString::from_str(&path.to_string_lossy()));
+        let file_type = unsafe { AVFileTypeMPEG4 }
+            .ok_or_else(|| anyhow!("AVFileTypeMPEG4 unavailable"))?;
+        let writer = unsafe { AVAssetWriter::assetWriterWithURL_fileType_error(&url, file_type) }
+            .map_err(|error| anyhow!("AVAssetWriter creation failed: {error}"))?;
+
+        let settings = video_settings(width, height, &config)?;
+        let media_type = unsafe { AVMediaTypeVideo }
+            .ok_or_else(|| anyhow!("AVMediaTypeVideo unavailable"))?;
+        let input = unsafe {
+            AVAssetWriterInput::assetWriterInputWithMediaType_outputSettings(
+                media_type,
+                Some(&settings),
+            )
+        };
+        // The simulator paints when it feels like it, so frames arrive in real
+        // time and the writer should not wait for a full pipeline.
+        unsafe { input.setExpectsMediaDataInRealTime(true) };
+
+        let adaptor = unsafe {
+            AVAssetWriterInputPixelBufferAdaptor::
+                assetWriterInputPixelBufferAdaptorWithAssetWriterInput_sourcePixelBufferAttributes(
+                    &input, None,
+                )
+        };
+
+        if !unsafe { writer.canAddInput(&input) } {
+            return Err(anyhow!("AVAssetWriter rejected the video input"));
+        }
+        unsafe { writer.addInput(&input) };
+
+        if !unsafe { writer.startWriting() } {
+            let error = unsafe { writer.error() };
+            return Err(anyhow!(
+                "AVAssetWriter failed to start: {}",
+                error
+                    .map(|e| e.localizedDescription().to_string())
+                    .unwrap_or_else(|| "unknown".into())
+            ));
+        }
+        unsafe { writer.startSessionAtSourceTime(CMTime::new(0, TIMESCALE)) };
+
+        Ok(Self {
+            writer,
+            input,
+            adaptor,
+            transfer: PixelTransfer::new()?,
+            path: path.to_path_buf(),
+            dimensions: (width as usize, height as usize),
+            frames: AtomicU64::new(0),
+            started_at: None,
+            last_timestamp: Duration::ZERO,
+        })
+    }
+
+    /// Append a captured frame.
+    ///
+    /// Frames the writer is not ready for are dropped rather than queued: a
+    /// recording that falls behind should lose frames, not unbounded memory.
+    pub fn append(&mut self, source: &CVPixelBuffer) -> Result<()> {
+        let started_at = *self.started_at.get_or_insert_with(std::time::Instant::now);
+
+        if !unsafe { self.input.isReadyForMoreMediaData() } {
+            return Ok(());
+        }
+
+        let (width, height) = self.dimensions;
+        let prepared = self.transfer.transfer(source, width, height)?;
+
+        // Wall-clock elapsed, so a variable capture rate is recorded at the
+        // speed it actually happened rather than being played back wrong.
+        let elapsed = started_at.elapsed();
+        let timestamp = unsafe { CMTime::new(elapsed.as_nanos() as i64, TIMESCALE) };
+        self.last_timestamp = elapsed;
+
+        let appended = unsafe {
+            self.adaptor
+                .appendPixelBuffer_withPresentationTime(&prepared, timestamp)
+        };
+        if !appended {
+            let error = unsafe { self.writer.error() };
+            return Err(anyhow!(
+                "appending a frame failed: {}",
+                error
+                    .map(|e| e.localizedDescription().to_string())
+                    .unwrap_or_else(|| "unknown".into())
+            ));
+        }
+        self.frames.fetch_add(1, Ordering::Relaxed);
+        Ok(())
+    }
+
+    pub fn frames(&self) -> u64 {
+        self.frames.load(Ordering::Relaxed)
+    }
+
+    /// Finish writing and return the completed file.
+    ///
+    /// Blocks until the writer has flushed; an MP4 is unplayable without its
+    /// trailing index, so returning early would hand back a broken file.
+    pub fn finish(self) -> Result<Recording> {
+        unsafe { self.input.markAsFinished() };
+
+        let done = std::sync::Arc::new((std::sync::Mutex::new(false), std::sync::Condvar::new()));
+        let signal = std::sync::Arc::clone(&done);
+        let handler = block2::RcBlock::new(move || {
+            let (lock, notify) = &*signal;
+            *lock.lock().unwrap() = true;
+            notify.notify_all();
+        });
+        unsafe { self.writer.finishWritingWithCompletionHandler(&handler) };
+
+        let (lock, notify) = &*done;
+        let mut finished = lock.lock().unwrap();
+        while !*finished {
+            let (guard, timeout) = notify
+                .wait_timeout(finished, Duration::from_secs(30))
+                .expect("recording completion mutex poisoned");
+            finished = guard;
+            if timeout.timed_out() {
+                return Err(anyhow!("timed out waiting for the recording to finalize"));
+            }
+        }
+
+        if let Some(error) = unsafe { self.writer.error() } {
+            return Err(anyhow!(
+                "recording failed: {}",
+                error.localizedDescription()
+            ));
+        }
+
+        let metadata = std::fs::metadata(&self.path)
+            .with_context(|| format!("recording file missing at {}", self.path.display()))?;
+        if metadata.len() == 0 {
+            return Err(anyhow!("recording produced an empty file"));
+        }
+
+        Ok(Recording {
+            path: self.path,
+            frames: self.frames.load(Ordering::Relaxed),
+            duration: self.last_timestamp,
+            width: self.dimensions.0 as u32,
+            height: self.dimensions.1 as u32,
+        })
+    }
+}
+
+/// Recording dimensions, preserving aspect and rounded to even numbers.
+fn recording_size(width: u32, height: u32, max_dimension: Option<u32>) -> (u32, u32) {
+    let longest = width.max(height);
+    let scale = match max_dimension {
+        Some(limit) if longest > limit => limit as f64 / longest as f64,
+        _ => 1.0,
+    };
+    let even = |value: f64| ((value.round() as u32).max(2) / 2) * 2;
+    (even(width as f64 * scale), even(height as f64 * scale))
+}
+
+fn video_settings(
+    width: u32,
+    height: u32,
+    config: &RecordingConfig,
+) -> Result<Retained<NSMutableDictionary<NSString, AnyObject>>> {
+    let compression: Retained<NSMutableDictionary<NSString, AnyObject>> =
+        NSMutableDictionary::new();
+
+    // The whole reason recording has its own encoder: B-frames buy real
+    // quality per bit and are unusable on the live path, where every consumer
+    // assumes output order matches input order.
+    put(
+        &compression,
+        unsafe { AVVideoAllowFrameReorderingKey },
+        NSNumber::new_bool(true).as_ref(),
+    )?;
+    put(
+        &compression,
+        unsafe { AVVideoQualityKey },
+        NSNumber::new_f64(config.quality.clamp(0.0, 1.0)).as_ref(),
+    )?;
+    put(
+        &compression,
+        unsafe { AVVideoMaxKeyFrameIntervalKey },
+        NSNumber::new_i32((config.keyframe_interval_secs * 60) as i32).as_ref(),
+    )?;
+    // High profile is worth taking here. The browser-compatibility reasoning
+    // that pins the live stream to Baseline does not apply to a file.
+    put(
+        &compression,
+        unsafe { AVVideoProfileLevelKey },
+        NSString::from_str("H264_High_AutoLevel").as_ref(),
+    )?;
+
+    let settings: Retained<NSMutableDictionary<NSString, AnyObject>> = NSMutableDictionary::new();
+    let codec = unsafe { AVVideoCodecTypeH264 }
+        .ok_or_else(|| anyhow!("H.264 codec unavailable"))?;
+    put(&settings, unsafe { AVVideoCodecKey }, codec.as_ref())?;
+    put(
+        &settings,
+        unsafe { AVVideoWidthKey },
+        NSNumber::new_u32(width).as_ref(),
+    )?;
+    put(
+        &settings,
+        unsafe { AVVideoHeightKey },
+        NSNumber::new_u32(height).as_ref(),
+    )?;
+    put(
+        &settings,
+        unsafe { AVVideoCompressionPropertiesKey },
+        compression.as_ref(),
+    )?;
+
+    Ok(settings)
+}
+
+/// Insert into an AVFoundation settings dictionary.
+///
+/// The keys are optional statics because the framework may not vend them, so
+/// every one is checked rather than unwrapped.
+fn put(
+    dictionary: &NSMutableDictionary<NSString, AnyObject>,
+    key: Option<&'static NSString>,
+    value: &AnyObject,
+) -> Result<()> {
+    let key = key.ok_or_else(|| anyhow!("an AVFoundation video settings key was unavailable"))?;
+    unsafe { dictionary.setObject_forKey(value, ProtocolObject::from_ref(key)) };
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn recording_size_preserves_aspect_and_parity() {
+        // A phone framebuffer capped at 1920 on its long edge.
+        let (width, height) = recording_size(1206, 2622, Some(1920));
+        assert_eq!(height, 1920);
+        // 1206 * 1920/2622 is 883.1, rounded down to the nearest even number.
+        assert_eq!(width, 882);
+        assert_eq!(width % 2, 0, "H.264 chroma needs even dimensions");
+        assert_eq!(height % 2, 0);
+        let aspect_error =
+            ((width as f64 / height as f64) - (1206.0 / 2622.0)).abs();
+        assert!(aspect_error < 0.002, "aspect drifted by {aspect_error}");
+    }
+
+    #[test]
+    fn recording_size_does_not_upscale() {
+        assert_eq!(recording_size(588, 1280, Some(1920)), (588, 1280));
+    }
+
+    #[test]
+    fn recording_size_unbounded_keeps_native_resolution() {
+        assert_eq!(recording_size(1206, 2622, None), (1206, 2622));
+    }
+}
diff --git a/packages/accessibility-ios-sys/src/macos/stream.rs b/packages/accessibility-ios-sys/src/macos/stream.rs
new file mode 100644
index 0000000..da7ddf3
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/stream.rs
@@ -0,0 +1,163 @@
+//! Capture + encode pipeline for a booted simulator.
+//!
+//! Ties [`SimFramebuffer`] to [`H264Encoder`], keeping the encode step on the
+//! capture queue so that only compressed bytes ever cross a thread boundary.
+
+use std::path::Path;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex};
+
+use anyhow::Result;
+use objc2_core_video::CVImageBuffer;
+
+use super::encoder::{ChunkSink, EncoderConfig, H264Encoder};
+use super::framebuffer::{FramebufferStats, SimFramebuffer};
+use super::recorder::{Recorder, Recording, RecordingConfig};
+
+/// Pixel geometry of the captured display.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct ScreenGeometry {
+    pub width: u32,
+    pub height: u32,
+}
+
+/// A running capture-and-encode session.
+pub struct SimVideoStream {
+    framebuffer: SimFramebuffer,
+    force_keyframe: Arc<AtomicBool>,
+    config: EncoderConfig,
+    /// Set while a recording is running. Shared with the capture queue, which
+    /// appends to it, so starting and stopping is just swapping this slot.
+    recorder: Arc<Mutex<Option<Recorder>>>,
+}
+
+impl SimVideoStream {
+    /// Start capturing `udid` and pushing encoded chunks to `sink`.
+    ///
+    /// `sink` runs on the capture queue, so it must not block; the intended
+    /// use is a bounded channel that drops on overflow.
+    pub fn start(udid: Option<&str>, config: EncoderConfig, sink: ChunkSink) -> Result<Self> {
+        let mut framebuffer = SimFramebuffer::new(udid)?;
+        let force_keyframe = Arc::new(AtomicBool::new(false));
+
+        let mut encoder = H264Encoder::new(config, Arc::clone(&force_keyframe), sink)?;
+        let recorder: Arc<Mutex<Option<Recorder>>> = Arc::new(Mutex::new(None));
+        let recorder_for_sink = Arc::clone(&recorder);
+
+        framebuffer.set_sink(Some(Box::new(move |frame| {
+            // `CVPixelBuffer` derefs to `CVImageBuffer`, which is what
+            // VideoToolbox wants.
+            let image: &CVImageBuffer = frame.pixel_buffer;
+            if let Err(error) = encoder.encode(image, frame.width as i32, frame.height as i32) {
+                eprintln!("[capture] encode failed: {error}");
+            }
+
+            // A recording is a second, independent encode of the same frame,
+            // which is what lets it use B-frames and its own resolution
+            // without disturbing whatever the live viewer is watching.
+            if let Ok(mut recorder) = recorder_for_sink.lock()
+                && let Some(active) = recorder.as_mut()
+                && let Err(error) = active.append(frame.pixel_buffer)
+            {
+                eprintln!("[record] dropping frame: {error}");
+            }
+        })));
+
+        framebuffer.start()?;
+        Ok(Self {
+            framebuffer,
+            force_keyframe,
+            config,
+            recorder,
+        })
+    }
+
+    pub fn device_udid(&self) -> &str {
+        self.framebuffer.device_udid()
+    }
+
+    pub fn stats(&self) -> FramebufferStats {
+        self.framebuffer.stats()
+    }
+
+    pub fn geometry(&self) -> ScreenGeometry {
+        let stats = self.framebuffer.stats();
+        ScreenGeometry {
+            width: stats.width,
+            height: stats.height,
+        }
+    }
+
+    /// Geometry actually handed to the encoder, after any downscale.
+    pub fn encoded_geometry(&self) -> ScreenGeometry {
+        let source = self.geometry();
+        if source.width == 0 || source.height == 0 {
+            return source;
+        }
+        let (width, height) = self
+            .config
+            .encode_size(source.width as i32, source.height as i32);
+        ScreenGeometry {
+            width: width as u32,
+            height: height as u32,
+        }
+    }
+
+    /// Ask the encoder to make the next frame an IDR.
+    ///
+    /// Driven by RTCP PLI/FIR from WebRTC receivers, and by new subscribers on
+    /// the raw stream endpoints.
+    pub fn request_keyframe(&self) {
+        self.force_keyframe.store(true, Ordering::Relaxed);
+    }
+
+    /// Begin recording to `path`. Fails if one is already running.
+    pub fn start_recording(&self, path: &Path, config: RecordingConfig) -> Result<()> {
+        let geometry = self.geometry();
+        if geometry.width == 0 || geometry.height == 0 {
+            anyhow::bail!("no frames captured yet; cannot size a recording");
+        }
+
+        let mut slot = self.recorder.lock().unwrap();
+        if slot.is_some() {
+            anyhow::bail!("a recording is already in progress");
+        }
+        *slot = Some(Recorder::start(
+            path,
+            geometry.width,
+            geometry.height,
+            config,
+        )?);
+        Ok(())
+    }
+
+    /// Stop the running recording and finalize the file.
+    pub fn stop_recording(&self) -> Result<Recording> {
+        let recorder = self
+            .recorder
+            .lock()
+            .unwrap()
+            .take()
+            .ok_or_else(|| anyhow::anyhow!("no recording is in progress"))?;
+        // Finalizing blocks on the writer flushing, so it happens after the
+        // slot is cleared and the capture queue has stopped appending.
+        recorder.finish()
+    }
+
+    pub fn recording_frames(&self) -> Option<u64> {
+        self.recorder
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(|recorder| recorder.frames())
+    }
+
+    pub fn stop(&mut self) {
+        // Finalize before tearing the capture down, so an in-flight recording
+        // is left playable rather than truncated.
+        if self.recorder.lock().unwrap().is_some() {
+            let _ = self.stop_recording();
+        }
+        self.framebuffer.stop();
+    }
+}
diff --git a/packages/accessibility-ios-sys/src/macos/void_block.rs b/packages/accessibility-ios-sys/src/macos/void_block.rs
new file mode 100644
index 0000000..127ea54
--- /dev/null
+++ b/packages/accessibility-ios-sys/src/macos/void_block.rs
@@ -0,0 +1,63 @@
+//! Owned, signature-bearing `void (^)(void)` blocks backed by a C shim.
+//!
+//! See `blocks.c` for why these cannot be `block2::RcBlock`s.
+
+use std::ffi::c_void;
+
+unsafe extern "C" {
+    fn accessibility_make_void_block(
+        callback: unsafe extern "C" fn(*mut c_void),
+        context: *mut c_void,
+    ) -> *mut c_void;
+    fn accessibility_release_block(block: *mut c_void);
+}
+
+/// A heap Objective-C block that invokes a Rust closure when called.
+///
+/// The block and the boxed closure are released together on drop. SimulatorKit
+/// retains the block for as long as the registration is live, so a `VoidBlock`
+/// must be kept alive until the matching `unregisterScreenCallbacksWithUUID:`.
+pub(super) struct VoidBlock {
+    block: *mut c_void,
+    closure: *mut Box<dyn Fn() + Send + Sync>,
+}
+
+// The closure is `Send + Sync` and the block is invoked by GCD from an
+// arbitrary thread, so the handle is safe to move between threads.
+unsafe impl Send for VoidBlock {}
+unsafe impl Sync for VoidBlock {}
+
+impl VoidBlock {
+    pub(super) fn new<F>(closure: F) -> Self
+    where
+        F: Fn() + Send + Sync + 'static,
+    {
+        let boxed: Box<Box<dyn Fn() + Send + Sync>> = Box::new(Box::new(closure));
+        let closure = Box::into_raw(boxed);
+        let block =
+            unsafe { accessibility_make_void_block(invoke_closure, closure as *mut c_void) };
+        Self { block, closure }
+    }
+
+    /// The raw `id`-compatible block pointer to hand to Objective-C.
+    pub(super) fn as_ptr(&self) -> *mut c_void {
+        self.block
+    }
+}
+
+unsafe extern "C" fn invoke_closure(context: *mut c_void) {
+    if context.is_null() {
+        return;
+    }
+    let closure = unsafe { &*(context as *const Box<dyn Fn() + Send + Sync>) };
+    closure();
+}
+
+impl Drop for VoidBlock {
+    fn drop(&mut self) {
+        unsafe {
+            accessibility_release_block(self.block);
+            drop(Box::from_raw(self.closure));
+        }
+    }
+}
diff --git a/packages/accessibility-serve/Cargo.toml b/packages/accessibility-serve/Cargo.toml
new file mode 100644
index 0000000..b3ec46c
--- /dev/null
+++ b/packages/accessibility-serve/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "accessibility-serve"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+description = "Serve a live, interactive iOS Simulator stream over WebRTC with accessibility element inspection."
+readme = "../../README.md"
+keywords = ["accessibility", "ios", "simulator", "webrtc", "streaming"]
+categories = ["accessibility", "web-programming", "os::macos-apis"]
+
+[dependencies]
+accessibility-core.workspace = true
+anyhow.workspace = true
+axum = { workspace = true, features = ["ws"] }
+bytes.workspace = true
+futures-util.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tokio.workspace = true
+tower-http = { workspace = true, features = ["cors"] }
+tracing.workspace = true
+webrtc.workspace = true
+
+[target.'cfg(target_os = "macos")'.dependencies]
+accessibility-ios-sys.workspace = true
diff --git a/packages/accessibility-serve/src/avcc.rs b/packages/accessibility-serve/src/avcc.rs
new file mode 100644
index 0000000..1ce148f
--- /dev/null
+++ b/packages/accessibility-serve/src/avcc.rs
@@ -0,0 +1,195 @@
+//! Annex-B to AVCC conversion for browser `VideoDecoder` clients.
+//!
+//! The encoder runs in Annex-B because that is what WebRTC's H.264 payloader
+//! consumes. WebCodecs wants the other framing: 4-byte length prefixes plus a
+//! one-time `avcC` record carrying the parameter sets. Converting here means a
+//! single encoder can feed both transports at once.
+
+/// Wire framing for the raw H.264 WebSocket transport.
+///
+/// `u32` big-endian length covering the tag byte and payload, then the tag,
+/// then the payload.
+pub mod tag {
+    pub const PARAMETER_SET: u8 = 0x01;
+    pub const KEYFRAME: u8 = 0x02;
+    pub const DELTA: u8 = 0x03;
+}
+
+/// Frame a payload for the raw H.264 WebSocket transport.
+pub fn envelope(tag: u8, payload: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(payload.len() + 5);
+    out.extend_from_slice(&((payload.len() + 1) as u32).to_be_bytes());
+    out.push(tag);
+    out.extend_from_slice(payload);
+    out
+}
+
+/// Iterate the NAL units in an Annex-B stream.
+///
+/// Handles both 3- and 4-byte start codes, since VideoToolbox is consistent
+/// but the parameter sets we prepend may not be.
+pub fn nal_units(annex_b: &[u8]) -> Vec<&[u8]> {
+    let mut starts = Vec::new();
+    let mut index = 0usize;
+    while index + 3 <= annex_b.len() {
+        if annex_b[index] == 0 && annex_b[index + 1] == 0 {
+            if annex_b[index + 2] == 1 {
+                starts.push((index, 3));
+                index += 3;
+                continue;
+            }
+            if index + 4 <= annex_b.len() && annex_b[index + 2] == 0 && annex_b[index + 3] == 1 {
+                starts.push((index, 4));
+                index += 4;
+                continue;
+            }
+        }
+        index += 1;
+    }
+
+    let mut units = Vec::with_capacity(starts.len());
+    for (position, (offset, code_len)) in starts.iter().enumerate() {
+        let begin = offset + code_len;
+        let end = starts
+            .get(position + 1)
+            .map(|(next, _)| *next)
+            .unwrap_or(annex_b.len());
+        if begin < end {
+            units.push(&annex_b[begin..end]);
+        }
+    }
+    units
+}
+
+/// Rewrite an Annex-B access unit as length-prefixed AVCC.
+///
+/// Parameter set NALs are dropped: in AVCC they belong in the `avcC` record,
+/// not the bitstream.
+pub fn to_avcc(annex_b: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(annex_b.len());
+    for unit in nal_units(annex_b) {
+        if matches!(nal_type(unit), Some(7 | 8)) {
+            continue;
+        }
+        out.extend_from_slice(&(unit.len() as u32).to_be_bytes());
+        out.extend_from_slice(unit);
+    }
+    out
+}
+
+/// Pull the SPS (type 7) and PPS (type 8) out of an Annex-B access unit.
+pub fn parameter_sets(annex_b: &[u8]) -> Option<(Vec<u8>, Vec<u8>)> {
+    let mut sps = None;
+    let mut pps = None;
+    for unit in nal_units(annex_b) {
+        match nal_type(unit) {
+            Some(7) if sps.is_none() => sps = Some(unit.to_vec()),
+            Some(8) if pps.is_none() => pps = Some(unit.to_vec()),
+            _ => {}
+        }
+    }
+    let sps = sps?;
+    let pps = pps?;
+    // The avcC record copies profile/compatibility/level out of the SPS.
+    (sps.len() >= 4).then_some((sps, pps))
+}
+
+fn nal_type(unit: &[u8]) -> Option<u8> {
+    unit.first().map(|byte| byte & 0x1F)
+}
+
+/// Build an ISO/IEC 14496-15 `avcC` configuration record.
+pub fn avcc_record(sps: &[u8], pps: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(sps.len() + pps.len() + 11);
+    out.push(0x01); // configurationVersion
+    out.extend_from_slice(&sps[1..4]); // profile, compatibility, level
+    out.push(0xFF); // reserved | lengthSizeMinusOne = 3 (4-byte lengths)
+    out.push(0xE1); // reserved | numOfSequenceParameterSets = 1
+    out.extend_from_slice(&(sps.len() as u16).to_be_bytes());
+    out.extend_from_slice(sps);
+    out.push(0x01); // numOfPictureParameterSets
+    out.extend_from_slice(&(pps.len() as u16).to_be_bytes());
+    out.extend_from_slice(pps);
+    out
+}
+
+/// The `codecs` string a browser needs to configure a decoder for this SPS.
+pub fn codec_string(sps: &[u8]) -> String {
+    format!("avc1.{:02X}{:02X}{:02X}", sps[1], sps[2], sps[3])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn annex_b(units: &[&[u8]]) -> Vec<u8> {
+        let mut out = Vec::new();
+        for unit in units {
+            out.extend_from_slice(&[0, 0, 0, 1]);
+            out.extend_from_slice(unit);
+        }
+        out
+    }
+
+    #[test]
+    fn splits_four_byte_start_codes() {
+        let stream = annex_b(&[&[0x67, 1, 2, 3], &[0x68, 9], &[0x65, 7, 7]]);
+        let units = nal_units(&stream);
+        assert_eq!(units.len(), 3);
+        assert_eq!(units[0], &[0x67, 1, 2, 3]);
+        assert_eq!(units[2], &[0x65, 7, 7]);
+    }
+
+    #[test]
+    fn splits_three_byte_start_codes() {
+        let stream = vec![0, 0, 1, 0x67, 1, 2, 3, 0, 0, 1, 0x65, 9];
+        let units = nal_units(&stream);
+        assert_eq!(units.len(), 2);
+        assert_eq!(units[0], &[0x67, 1, 2, 3]);
+        assert_eq!(units[1], &[0x65, 9]);
+    }
+
+    #[test]
+    fn avcc_drops_parameter_sets_and_prefixes_lengths() {
+        let stream = annex_b(&[&[0x67, 1, 2, 3], &[0x68, 9], &[0x65, 7, 7]]);
+        let avcc = to_avcc(&stream);
+        // Only the IDR survives: 4 length bytes + 3 payload bytes.
+        assert_eq!(avcc, vec![0, 0, 0, 3, 0x65, 7, 7]);
+    }
+
+    #[test]
+    fn extracts_parameter_sets() {
+        let stream = annex_b(&[&[0x67, 0x42, 0xC0, 0x1F], &[0x68, 9], &[0x65, 7]]);
+        let (sps, pps) = parameter_sets(&stream).expect("parameter sets present");
+        assert_eq!(sps, vec![0x67, 0x42, 0xC0, 0x1F]);
+        assert_eq!(pps, vec![0x68, 9]);
+        assert_eq!(codec_string(&sps), "avc1.42C01F");
+    }
+
+    #[test]
+    fn parameter_sets_absent_on_delta_frames() {
+        let stream = annex_b(&[&[0x41, 1, 2]]);
+        assert!(parameter_sets(&stream).is_none());
+    }
+
+    #[test]
+    fn avcc_record_layout() {
+        let sps = [0x67, 0x42, 0xC0, 0x1F, 0xAA];
+        let pps = [0x68, 0xCE];
+        let record = avcc_record(&sps, &pps);
+        assert_eq!(record[0], 1);
+        assert_eq!(&record[1..4], &[0x42, 0xC0, 0x1F]);
+        assert_eq!(record[4], 0xFF);
+        assert_eq!(record[5], 0xE1);
+        assert_eq!(&record[6..8], &(sps.len() as u16).to_be_bytes());
+        assert_eq!(&record[8..8 + sps.len()], &sps);
+    }
+
+    #[test]
+    fn envelope_length_covers_tag_and_payload() {
+        let framed = envelope(tag::KEYFRAME, &[1, 2, 3]);
+        assert_eq!(&framed[0..4], &4u32.to_be_bytes());
+        assert_eq!(framed[4], tag::KEYFRAME);
+        assert_eq!(&framed[5..], &[1, 2, 3]);
+    }
+}
diff --git a/packages/accessibility-serve/src/ax.rs b/packages/accessibility-serve/src/ax.rs
new file mode 100644
index 0000000..35c3ff3
--- /dev/null
+++ b/packages/accessibility-serve/src/ax.rs
@@ -0,0 +1,453 @@
+//! Accessibility element inspection for the web UI.
+//!
+//! Two things are exposed:
+//!
+//! - A whole-tree snapshot, which the browser uses for instant hover feedback.
+//! - A live hit test, which asks the simulator what is actually at a point.
+//!
+//! The snapshot can go stale between fetches and mis-picks overlapping or
+//! transformed views; the hit test is authoritative but costs a round trip.
+//! The UI uses the snapshot while the pointer is moving and confirms with the
+//! hit test once it settles, which is why both exist.
+//!
+//! # Coordinate spaces
+//!
+//! Accessibility frames come back in points relative to the Simulator window,
+//! so every rect is converted to a 0..1 fraction of the app's own bounds
+//! before it leaves this module:
+//!
+//! ```text
+//! normalized = (ax_rect.origin - app_bounds.origin) / app_bounds.size
+//! ```
+//!
+//! That makes the values independent of the display scale factor, which is
+//! why no pixel/point conversion appears here.
+//!
+//! Crucially, these are **logical** coordinates, already rotated by iOS: in
+//! landscape the app reports its bounds as 874x402 rather than 402x874, so the
+//! normalized rects are upright and need no further rotation to be drawn.
+//!
+//! This is the opposite of the HID input path, which is in *raw framebuffer*
+//! space — the framebuffer never rotates, so pointer coordinates have to be
+//! un-rotated before injection. The two spaces coincide in portrait, which is
+//! exactly what makes the difference easy to miss.
+
+use anyhow::{Result, anyhow};
+use serde::Serialize;
+use tokio::sync::{mpsc, oneshot};
+
+use accessibility_core::accessibility::{Element, Rect, TreeFilter};
+
+use crate::coverage::CoverageGrid;
+
+/// A rectangle in normalized display space (0..1 on both axes).
+#[derive(Debug, Clone, Copy, Serialize)]
+pub struct NormalizedRect {
+    pub x: f64,
+    pub y: f64,
+    pub width: f64,
+    pub height: f64,
+}
+
+/// Fraction of the screen above which an element is treated as a backdrop
+/// rather than something you can point at.
+///
+/// Every app has an Application node and usually one or more full-bleed
+/// container groups. Hit testing an empty region resolves to one of them, and
+/// highlighting it paints a box over the entire device, which reads as "the
+/// picker is broken" rather than "there is nothing here".
+const BACKDROP_AREA: f64 = 0.9;
+
+impl NormalizedRect {
+    /// Whether this covers essentially the whole screen.
+    pub fn is_backdrop(&self) -> bool {
+        self.width * self.height >= BACKDROP_AREA
+    }
+
+    fn from_screen(rect: &Rect, app_bounds: &Rect) -> Option<Self> {
+        if app_bounds.size.width <= 0.0 || app_bounds.size.height <= 0.0 {
+            return None;
+        }
+        Some(Self {
+            x: (rect.origin.x - app_bounds.origin.x) / app_bounds.size.width,
+            y: (rect.origin.y - app_bounds.origin.y) / app_bounds.size.height,
+            width: rect.size.width / app_bounds.size.width,
+            height: rect.size.height / app_bounds.size.height,
+        })
+    }
+}
+
+/// How an element was found.
+///
+/// Worth surfacing: a swept element is a point sample with no parent, no
+/// children and no document order, so consumers should not treat it as
+/// equivalent to a node the tree walk returned.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Discovery {
+    /// Walked from the application root.
+    Recursive,
+    /// Found by hit testing a grid point the tree could not explain.
+    PointGrid,
+}
+
+/// One inspectable element, flattened for the browser.
+#[derive(Debug, Clone, Serialize)]
+pub struct ElementDetail {
+    pub id: String,
+    pub role: String,
+    pub label: Option<String>,
+    pub value: Option<String>,
+    pub identifier: Option<String>,
+    pub enabled: bool,
+    pub focused: bool,
+    pub actions: Vec<String>,
+    pub bounds: Option<NormalizedRect>,
+    /// Depth in the tree, used by the UI to prefer the innermost hit.
+    pub depth: u32,
+    /// A selector that would target this element from the CLI.
+    pub selector: String,
+    pub discovery: Discovery,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct AxSnapshot {
+    pub app_name: Option<String>,
+    pub pid: Option<u32>,
+    pub elements: Vec<ElementDetail>,
+    /// Fraction of the display explained by the tree walk alone, before any
+    /// sweep. Low numbers on a busy screen mean out-of-process content.
+    pub coverage: f64,
+    /// Coverage after sweeping, when a scan was requested.
+    pub coverage_after_scan: Option<f64>,
+    /// How many points the sweep probed. `None` when no scan was requested.
+    pub probes: Option<usize>,
+    /// Whether the app reports itself wider than tall.
+    ///
+    /// Accessibility bounds are in logical space, so this is the one cheap
+    /// signal that reveals the device's real orientation. The framebuffer
+    /// cannot provide it: it never rotates.
+    pub is_landscape: bool,
+}
+
+pub enum AxCommand {
+    Snapshot {
+        /// Also sweep the regions the tree walk cannot explain.
+        scan: bool,
+        reply: oneshot::Sender<Result<AxSnapshot>>,
+    },
+    HitTest {
+        x: f64,
+        y: f64,
+        reply: oneshot::Sender<Result<Option<ElementDetail>>>,
+    },
+}
+
+/// Build the `accessibility-cli` selector that would resolve this element.
+///
+/// Preferring the identifier keeps the selector stable across copy changes,
+/// which is the whole point of exposing it in the inspector.
+fn selector_for(element: &Element, role: &str) -> String {
+    if let Some(identifier) = element.identifier.as_deref().filter(|s| !s.is_empty()) {
+        return format!("#{identifier}");
+    }
+    if let Some(label) = element.title.as_deref().filter(|s| !s.is_empty()) {
+        return format!("{role}[label=\"{}\"]", label.replace('"', "\\\""));
+    }
+    role.to_string()
+}
+
+fn to_detail(
+    element: &Element,
+    app_bounds: &Rect,
+    depth: u32,
+    discovery: Discovery,
+) -> ElementDetail {
+    let role = format!("{:?}", element.role);
+    ElementDetail {
+        discovery,
+        id: element.id.to_string(),
+        selector: selector_for(element, &role),
+        role,
+        label: element.title.clone().filter(|s| !s.is_empty()),
+        value: element.value.clone().filter(|s| !s.is_empty()),
+        identifier: element.identifier.clone().filter(|s| !s.is_empty()),
+        enabled: element.enabled,
+        focused: element.focused,
+        actions: element.actions.clone(),
+        bounds: element
+            .bounds
+            .as_ref()
+            .and_then(|bounds| NormalizedRect::from_screen(bounds, app_bounds)),
+        depth,
+    }
+}
+
+fn flatten(element: &Element, app_bounds: &Rect, depth: u32, out: &mut Vec<ElementDetail>) {
+    out.push(to_detail(element, app_bounds, depth, Discovery::Recursive));
+    for child in &element.children {
+        flatten(child, app_bounds, depth + 1, out);
+    }
+}
+
+/// Start the accessibility worker thread and return its command channel.
+#[cfg(target_os = "macos")]
+pub fn spawn_ax_worker(udid: &str) -> Result<mpsc::UnboundedSender<AxCommand>> {
+    use accessibility_core::platform::ios_simulator::IOSSimulatorAccessibility;
+
+    let mut reader = IOSSimulatorAccessibility::new(Some(udid))?;
+    let (tx, mut rx) = mpsc::unbounded_channel::<AxCommand>();
+
+    std::thread::Builder::new()
+        .name("sim-ax".into())
+        .spawn(move || {
+            while let Some(command) = rx.blocking_recv() {
+                match command {
+                    AxCommand::Snapshot { scan, reply } => {
+                        let _ = reply.send(snapshot(&mut reader, scan));
+                    }
+                    AxCommand::HitTest { x, y, reply } => {
+                        let _ = reply.send(hit_test(&mut reader, x, y));
+                    }
+                }
+            }
+        })?;
+
+    Ok(tx)
+}
+
+#[cfg(target_os = "macos")]
+fn snapshot(
+    reader: &mut accessibility_core::platform::ios_simulator::IOSSimulatorAccessibility,
+    scan: bool,
+) -> Result<AxSnapshot> {
+    let tree = reader.get_tree(&TreeFilter::default())?;
+    // `get_screen_bounds` is only populated once a tree has been read, so it
+    // has to be queried after the fetch above.
+    let app_bounds = reader.get_screen_bounds()?;
+
+    let mut elements: Vec<ElementDetail> = Vec::with_capacity(tree.element_count);
+    flatten(&tree.root, &app_bounds, 0, &mut elements);
+
+    // Drop backdrops and anything with no usable geometry. Both are real parts
+    // of the tree but neither can be pointed at, and leaving them in makes the
+    // client's containment search pick them constantly.
+    elements.retain(|element| {
+        element
+            .bounds
+            .is_some_and(|bounds| !bounds.is_backdrop() && bounds.width > 0.0 && bounds.height > 0.0)
+    });
+
+    // Everything the tree walk explained, so the sweep can skip it.
+    let mut coverage = CoverageGrid::new();
+    for element in &elements {
+        if let Some(bounds) = element.bounds {
+            coverage.mark(&bounds);
+        }
+    }
+    let coverage_before = coverage.ratio();
+
+    let mut probes = None;
+    let mut coverage_after_scan = None;
+    if scan {
+        let swept = sweep(reader, &app_bounds, &mut coverage, &elements)?;
+        probes = Some(swept.probes);
+        elements.extend(swept.elements);
+        coverage_after_scan = Some(coverage.ratio());
+    }
+
+    Ok(AxSnapshot {
+        app_name: tree.app_name,
+        pid: tree.pid,
+        elements,
+        coverage: coverage_before,
+        coverage_after_scan,
+        probes,
+        is_landscape: app_bounds.size.width > app_bounds.size.height,
+    })
+}
+
+#[cfg(target_os = "macos")]
+fn hit_test(
+    reader: &mut accessibility_core::platform::ios_simulator::IOSSimulatorAccessibility,
+    x: f64,
+    y: f64,
+) -> Result<Option<ElementDetail>> {
+    // The hit test wants macOS screen points, so the browser's normalized
+    // coordinates are mapped back through the app's bounds.
+    let app_bounds = reader
+        .get_screen_bounds()
+        .map_err(|_| anyhow!("no accessibility snapshot yet; fetch the tree first"))?;
+
+    let screen_x = app_bounds.origin.x + x * app_bounds.size.width;
+    let screen_y = app_bounds.origin.y + y * app_bounds.size.height;
+
+    let Some(element) = reader.element_at_point(screen_x, screen_y)? else {
+        return Ok(None);
+    };
+    let detail = to_detail(&element, &app_bounds, 0, Discovery::Recursive);
+
+    // Nothing pointable here. Reporting the backdrop would highlight the whole
+    // device; reporting nothing lets the caller leave the previous selection
+    // or clear it.
+    if detail.bounds.is_none_or(|bounds| bounds.is_backdrop()) {
+        return Ok(None);
+    }
+    Ok(Some(detail))
+}
+
+#[cfg(not(target_os = "macos"))]
+pub fn spawn_ax_worker(_udid: &str) -> Result<mpsc::UnboundedSender<AxCommand>> {
+    anyhow::bail!("Simulator accessibility requires macOS")
+}
+
+/// Spacing between sweep probes, in device points.
+///
+/// idb uses 50; 40 is a little denser for phone-sized screens, where rows are
+/// around 50 points tall and a coarser grid can step straight over one. Every
+/// probe is a hit test, so this trades roughly linearly against scan time.
+#[cfg(target_os = "macos")]
+const SWEEP_STEP_POINTS: f64 = 40.0;
+
+/// Upper bound on probes, so a scan cannot run away on a large display.
+#[cfg(target_os = "macos")]
+const SWEEP_MAX_PROBES: usize = 400;
+
+#[cfg(target_os = "macos")]
+struct SweepResult {
+    elements: Vec<ElementDetail>,
+    probes: usize,
+}
+
+/// Hit test the regions the tree walk could not explain.
+///
+/// This is the only way to reach content in another process — `WKWebView` and
+/// Safari above all — because such content is individually addressable by
+/// point but has no traversable hierarchy. The result is a flat set of point
+/// samples, which is why each is tagged [`Discovery::PointGrid`].
+#[cfg(target_os = "macos")]
+fn sweep(
+    reader: &mut accessibility_core::platform::ios_simulator::IOSSimulatorAccessibility,
+    app_bounds: &Rect,
+    coverage: &mut CoverageGrid,
+    known: &[ElementDetail],
+) -> Result<SweepResult> {
+    use std::collections::HashSet;
+
+    // Elements the tree already reported, keyed by position, so a probe that
+    // lands on one does not report it twice under a different provenance.
+    let mut seen: HashSet<String> = known
+        .iter()
+        .filter_map(|element| element.bounds.map(frame_key))
+        .collect();
+
+    let mut elements = Vec::new();
+    let mut probes = 0usize;
+
+    let columns = (app_bounds.size.width / SWEEP_STEP_POINTS).floor().max(1.0) as usize;
+    let rows = (app_bounds.size.height / SWEEP_STEP_POINTS).floor().max(1.0) as usize;
+
+    for row in 0..rows {
+        for column in 0..columns {
+            if probes >= SWEEP_MAX_PROBES {
+                return Ok(SweepResult { elements, probes });
+            }
+
+            // Probe cell centres so a point never lands exactly on a boundary.
+            let x = (column as f64 + 0.5) / columns as f64;
+            let y = (row as f64 + 0.5) / rows as f64;
+
+            // Already explained by the tree; nothing to learn here.
+            if coverage.is_filled(x, y) {
+                continue;
+            }
+            probes += 1;
+
+            let screen_x = app_bounds.origin.x + x * app_bounds.size.width;
+            let screen_y = app_bounds.origin.y + y * app_bounds.size.height;
+            let Ok(Some(element)) = reader.element_at_point(screen_x, screen_y) else {
+                continue;
+            };
+
+            let detail = to_detail(&element, app_bounds, 0, Discovery::PointGrid);
+            let Some(bounds) = detail.bounds else {
+                continue;
+            };
+            if bounds.is_backdrop() || bounds.width <= 0.0 || bounds.height <= 0.0 {
+                continue;
+            }
+            // A 40 point grid lands on a large element many times over.
+            if !seen.insert(frame_key(bounds)) {
+                // Still mark it: further probes inside it are wasted.
+                coverage.mark(&bounds);
+                continue;
+            }
+
+            coverage.mark(&bounds);
+            elements.push(detail);
+        }
+    }
+
+    Ok(SweepResult { elements, probes })
+}
+
+/// Position key for deduplication, rounded so float noise does not defeat it.
+#[cfg(target_os = "macos")]
+fn frame_key(bounds: NormalizedRect) -> String {
+    format!(
+        "{:.4},{:.4},{:.4},{:.4}",
+        bounds.x, bounds.y, bounds.width, bounds.height
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use accessibility_core::accessibility::{Point, Size};
+
+    fn rect(x: f64, y: f64, w: f64, h: f64) -> Rect {
+        Rect::new(Point::new(x, y), Size::new(w, h))
+    }
+
+    #[test]
+    fn normalizes_against_app_bounds_not_the_screen() {
+        // Landscape: the app reports itself 874x402, and accessibility frames
+        // are already in that logical space.
+        let app = rect(0.0, 0.0, 874.0, 402.0);
+        let button = rect(754.5, 82.0, 27.0, 44.0);
+        let normalized = NormalizedRect::from_screen(&button, &app).expect("normalizes");
+        assert!((normalized.x - 0.863).abs() < 0.001);
+        assert!((normalized.y - 0.204).abs() < 0.001);
+        assert!((normalized.width - 0.031).abs() < 0.001);
+    }
+
+    #[test]
+    fn offsets_by_the_app_origin() {
+        let app = rect(100.0, 50.0, 400.0, 800.0);
+        let element = rect(300.0, 450.0, 200.0, 400.0);
+        let normalized = NormalizedRect::from_screen(&element, &app).expect("normalizes");
+        assert!((normalized.x - 0.5).abs() < 1e-9);
+        assert!((normalized.y - 0.5).abs() < 1e-9);
+    }
+
+    #[test]
+    fn degenerate_app_bounds_do_not_divide_by_zero() {
+        let app = rect(0.0, 0.0, 0.0, 0.0);
+        assert!(NormalizedRect::from_screen(&rect(1.0, 1.0, 2.0, 2.0), &app).is_none());
+    }
+
+    #[test]
+    fn full_screen_containers_are_backdrops() {
+        // Every app has these; highlighting one paints over the whole device.
+        assert!(NormalizedRect { x: 0.0, y: 0.0, width: 1.0, height: 1.0 }.is_backdrop());
+        assert!(NormalizedRect { x: 0.0, y: 0.0, width: 0.98, height: 0.96 }.is_backdrop());
+    }
+
+    #[test]
+    fn ordinary_controls_are_not_backdrops() {
+        // A full-width settings row is large but perfectly pointable.
+        assert!(!NormalizedRect { x: 0.05, y: 0.45, width: 0.90, height: 0.06 }.is_backdrop());
+        // So is a tall sidebar.
+        assert!(!NormalizedRect { x: 0.0, y: 0.0, width: 0.25, height: 1.0 }.is_backdrop());
+    }
+}
diff --git a/packages/accessibility-serve/src/coverage.rs b/packages/accessibility-serve/src/coverage.rs
new file mode 100644
index 0000000..3686a34
--- /dev/null
+++ b/packages/accessibility-serve/src/coverage.rs
@@ -0,0 +1,138 @@
+//! Tracking which parts of the screen the accessibility tree explains.
+//!
+//! Two jobs. It measures how much of the display is accounted for by elements
+//! the tree walk found, which is a direct health signal — a screen full of
+//! content reporting 5% coverage means most of the UI is invisible to every
+//! tree-based tool. And it tells the point-grid sweep where not to bother
+//! probing, so discovery only pays for the unexplained regions.
+
+use crate::ax::NormalizedRect;
+
+/// Cells along each axis.
+///
+/// 32x64 over a normalized display is about 12x13 points per cell on a phone —
+/// fine enough that a table row does not mark a neighbouring row as covered,
+/// coarse enough to stay a cheap bitmap.
+const COLUMNS: usize = 32;
+const ROWS: usize = 64;
+
+pub struct CoverageGrid {
+    filled: [bool; COLUMNS * ROWS],
+}
+
+impl Default for CoverageGrid {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl CoverageGrid {
+    pub fn new() -> Self {
+        Self {
+            filled: [false; COLUMNS * ROWS],
+        }
+    }
+
+    /// Mark every cell a normalized rect touches.
+    pub fn mark(&mut self, rect: &NormalizedRect) {
+        // Backdrops cover everything and would leave nothing to discover.
+        if rect.is_backdrop() {
+            return;
+        }
+        let (min_col, max_col) = span(rect.x, rect.width, COLUMNS);
+        let (min_row, max_row) = span(rect.y, rect.height, ROWS);
+        for row in min_row..=max_row {
+            for column in min_col..=max_col {
+                self.filled[row * COLUMNS + column] = true;
+            }
+        }
+    }
+
+    pub fn is_filled(&self, x: f64, y: f64) -> bool {
+        let column = index(x, COLUMNS);
+        let row = index(y, ROWS);
+        self.filled[row * COLUMNS + column]
+    }
+
+    /// Fraction of the display explained so far, 0.0 to 1.0.
+    pub fn ratio(&self) -> f64 {
+        let filled = self.filled.iter().filter(|cell| **cell).count();
+        filled as f64 / self.filled.len() as f64
+    }
+}
+
+fn index(value: f64, cells: usize) -> usize {
+    ((value.clamp(0.0, 1.0) * cells as f64) as usize).min(cells - 1)
+}
+
+/// Inclusive cell range covered by an interval, clamped to the display.
+fn span(start: f64, length: f64, cells: usize) -> (usize, usize) {
+    let low = index(start, cells);
+    let high = index(start + length.max(0.0), cells);
+    (low.min(high), high.max(low))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn rect(x: f64, y: f64, width: f64, height: f64) -> NormalizedRect {
+        NormalizedRect {
+            x,
+            y,
+            width,
+            height,
+        }
+    }
+
+    #[test]
+    fn empty_grid_explains_nothing() {
+        assert_eq!(CoverageGrid::new().ratio(), 0.0);
+        assert!(!CoverageGrid::new().is_filled(0.5, 0.5));
+    }
+
+    #[test]
+    fn marking_covers_the_rect_and_not_its_surroundings() {
+        let mut grid = CoverageGrid::new();
+        grid.mark(&rect(0.4, 0.4, 0.2, 0.2));
+        assert!(grid.is_filled(0.5, 0.5));
+        assert!(!grid.is_filled(0.1, 0.1));
+        assert!(!grid.is_filled(0.9, 0.9));
+    }
+
+    #[test]
+    fn backdrops_are_ignored() {
+        // Otherwise the Application node alone would report full coverage and
+        // the sweep would never probe anywhere.
+        let mut grid = CoverageGrid::new();
+        grid.mark(&rect(0.0, 0.0, 1.0, 1.0));
+        assert_eq!(grid.ratio(), 0.0);
+    }
+
+    #[test]
+    fn ratio_grows_with_marked_area() {
+        let mut grid = CoverageGrid::new();
+        let before = grid.ratio();
+        grid.mark(&rect(0.0, 0.0, 0.5, 0.5));
+        let after = grid.ratio();
+        assert!(after > before);
+        // A quarter of the display, within one cell of rounding on each axis.
+        assert!((after - 0.25).abs() < 0.05, "ratio was {after}");
+    }
+
+    #[test]
+    fn out_of_range_rects_do_not_panic() {
+        let mut grid = CoverageGrid::new();
+        // Rows can extend past the bottom of the screen; seen in real trees.
+        grid.mark(&rect(0.9, 0.95, 0.5, 0.5));
+        grid.mark(&rect(-0.2, -0.2, 0.1, 0.1));
+        assert!(grid.is_filled(0.99, 0.99));
+    }
+
+    #[test]
+    fn thin_rects_still_mark_a_cell() {
+        let mut grid = CoverageGrid::new();
+        grid.mark(&rect(0.5, 0.5, 0.0, 0.0));
+        assert!(grid.is_filled(0.5, 0.5));
+    }
+}
diff --git a/packages/accessibility-serve/src/http.rs b/packages/accessibility-serve/src/http.rs
new file mode 100644
index 0000000..cd3506a
--- /dev/null
+++ b/packages/accessibility-serve/src/http.rs
@@ -0,0 +1,308 @@
+//! HTTP and WebSocket surface.
+
+use std::sync::Arc;
+
+use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
+use axum::extract::{Query, State};
+use axum::http::StatusCode;
+use axum::response::{Html, IntoResponse, Response};
+use axum::routing::{get, post};
+use axum::{Json, Router};
+use serde::{Deserialize, Serialize};
+
+use accessibility_core::video::FrameKind;
+
+use crate::avcc;
+use crate::input::{InputCommand, Orientation};
+use crate::session::SimSession;
+use crate::settings::{Setting, SettingKey};
+use crate::webrtc_stream::WebRtcEngine;
+
+const INDEX_HTML: &str = include_str!("../static/index.html");
+
+#[derive(Clone)]
+pub struct AppState {
+    pub session: Arc<SimSession>,
+    pub webrtc: Arc<WebRtcEngine>,
+    pub default_transport: String,
+}
+
+pub fn router(state: AppState) -> Router {
+    Router::new()
+        .route("/", get(index))
+        .route("/api/config", get(config))
+        .route("/api/ax/tree", get(ax_tree))
+        .route("/api/ax/hit", get(ax_hit))
+        .route("/api/stats", get(stats))
+        .route("/api/settings", get(settings).post(set_setting))
+        .route("/api/orientation", post(set_orientation))
+        .route("/api/recording/start", post(start_recording))
+        .route("/api/recording/stop", post(stop_recording))
+        .route("/webrtc/offer", post(webrtc_offer))
+        .route("/ws/stream", get(stream_socket))
+        .route("/ws/input", get(input_socket))
+        .with_state(state)
+}
+
+async fn index() -> Html<&'static str> {
+    Html(INDEX_HTML)
+}
+
+#[derive(Serialize)]
+struct ConfigResponse {
+    udid: String,
+    /// Raw framebuffer size. Constant regardless of orientation.
+    width: u32,
+    height: u32,
+    orientation: Orientation,
+    default_transport: String,
+    transports: Vec<&'static str>,
+    home_indicator_band: f64,
+}
+
+async fn config(State(state): State<AppState>) -> Json<ConfigResponse> {
+    let device = state.session.device_info();
+    Json(ConfigResponse {
+        udid: device.udid,
+        width: device.width,
+        height: device.height,
+        orientation: device.orientation,
+        default_transport: state.default_transport.clone(),
+        transports: vec!["webrtc", "h264"],
+        home_indicator_band: crate::input::HOME_INDICATOR_BAND,
+    })
+}
+
+async fn stats(State(state): State<AppState>) -> Json<crate::session::StatsReport> {
+    Json(state.session.stats())
+}
+
+async fn settings(State(state): State<AppState>) -> Json<Vec<Setting>> {
+    // Each read shells out to simctl, so keep it off the async worker threads.
+    let session = Arc::clone(&state.session);
+    Json(
+        tokio::task::spawn_blocking(move || session.settings())
+            .await
+            .unwrap_or_default(),
+    )
+}
+
+#[derive(Deserialize)]
+struct SettingRequest {
+    key: SettingKey,
+    value: String,
+}
+
+async fn set_setting(
+    State(state): State<AppState>,
+    Json(request): Json<SettingRequest>,
+) -> Response {
+    let session = Arc::clone(&state.session);
+    let result =
+        tokio::task::spawn_blocking(move || session.set_setting(request.key, &request.value)).await;
+
+    match result {
+        Ok(Ok(value)) => Json(serde_json::json!({ "value": value })).into_response(),
+        Ok(Err(error)) => (StatusCode::BAD_REQUEST, error.to_string()).into_response(),
+        Err(error) => internal_error(anyhow::anyhow!(error)),
+    }
+}
+
+#[derive(Deserialize, Default)]
+struct RecordingRequest {
+    /// Quality from 0 to 1.
+    quality: Option<f64>,
+    /// Longest edge of the recording.
+    max_dimension: Option<u32>,
+}
+
+async fn start_recording(
+    State(state): State<AppState>,
+    body: Option<Json<RecordingRequest>>,
+) -> Response {
+    let request = body.map(|Json(request)| request).unwrap_or_default();
+    let defaults = accessibility_core::video::RecordingConfig::default();
+    let config = accessibility_core::video::RecordingConfig {
+        quality: request.quality.unwrap_or(defaults.quality),
+        max_dimension: request.max_dimension.or(defaults.max_dimension),
+        ..defaults
+    };
+
+    // Starting touches AVFoundation and the filesystem, so keep it off the
+    // async worker threads.
+    let session = Arc::clone(&state.session);
+    match tokio::task::spawn_blocking(move || session.start_recording(config)).await {
+        Ok(Ok(path)) => Json(serde_json::json!({ "path": path })).into_response(),
+        Ok(Err(error)) => (StatusCode::CONFLICT, error.to_string()).into_response(),
+        Err(error) => internal_error(anyhow::anyhow!(error)),
+    }
+}
+
+async fn stop_recording(State(state): State<AppState>) -> Response {
+    // Finalizing blocks until the writer has flushed the file's index.
+    let session = Arc::clone(&state.session);
+    match tokio::task::spawn_blocking(move || session.stop_recording()).await {
+        Ok(Ok(recording)) => Json(recording).into_response(),
+        Ok(Err(error)) => (StatusCode::CONFLICT, error.to_string()).into_response(),
+        Err(error) => internal_error(anyhow::anyhow!(error)),
+    }
+}
+
+#[derive(Deserialize)]
+struct OrientationRequest {
+    orientation: Orientation,
+}
+
+async fn set_orientation(
+    State(state): State<AppState>,
+    Json(request): Json<OrientationRequest>,
+) -> Response {
+    state.session.set_orientation(request.orientation);
+    Json(serde_json::json!({ "orientation": request.orientation })).into_response()
+}
+
+/// Map an `anyhow` error onto a 500 with the message preserved.
+///
+/// These are developer-facing diagnostics on a locally served tool, so the
+/// detail is more useful than it would be on a public endpoint.
+fn internal_error(error: anyhow::Error) -> Response {
+    (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()).into_response()
+}
+
+#[derive(Deserialize)]
+struct TreeQuery {
+    /// Sweep the regions the tree walk cannot explain, reaching web content.
+    #[serde(default)]
+    scan: bool,
+}
+
+async fn ax_tree(State(state): State<AppState>, Query(query): Query<TreeQuery>) -> Response {
+    match state.session.ax_snapshot(query.scan).await {
+        Ok(snapshot) => Json(snapshot).into_response(),
+        Err(error) => internal_error(error),
+    }
+}
+
+#[derive(Deserialize)]
+struct HitQuery {
+    x: f64,
+    y: f64,
+}
+
+async fn ax_hit(State(state): State<AppState>, Query(query): Query<HitQuery>) -> Response {
+    match state.session.ax_hit_test(query.x, query.y).await {
+        Ok(element) => Json(element).into_response(),
+        Err(error) => internal_error(error),
+    }
+}
+
+#[derive(Deserialize)]
+struct OfferRequest {
+    sdp: String,
+}
+
+#[derive(Serialize)]
+struct AnswerResponse {
+    sdp: String,
+}
+
+async fn webrtc_offer(State(state): State<AppState>, Json(offer): Json<OfferRequest>) -> Response {
+    match state
+        .webrtc
+        .answer(Arc::clone(&state.session), offer.sdp)
+        .await
+    {
+        Ok(sdp) => Json(AnswerResponse { sdp }).into_response(),
+        Err(error) => internal_error(error),
+    }
+}
+
+async fn stream_socket(
+    State(state): State<AppState>,
+    upgrade: WebSocketUpgrade,
+) -> impl IntoResponse {
+    upgrade.on_upgrade(move |socket| pump_h264(state, socket))
+}
+
+/// Raw H.264 transport for browsers driving WebCodecs directly.
+///
+/// This is the "expose a port and point something at it" path: no signaling,
+/// no ICE, just length-prefixed frames. Also the fallback when WebRTC codec
+/// negotiation fails.
+async fn pump_h264(state: AppState, mut socket: WebSocket) {
+    let mut frames = state.session.subscribe();
+    let mut sent_parameter_set = false;
+
+    loop {
+        let frame = match frames.recv().await {
+            Ok(frame) => frame,
+            Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                state.session.note_lag();
+                state.session.request_keyframe();
+                continue;
+            }
+            Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+        };
+
+        // The encoder runs in Annex-B for WebRTC, so parameter sets arrive
+        // inline on each IDR rather than as their own frame.
+        if frame.kind == FrameKind::ParameterSet {
+            continue;
+        }
+
+        // A decoder cannot start on a delta frame, and it needs the avcC
+        // record before anything else.
+        if !sent_parameter_set {
+            let Some((sps, pps)) = avcc::parameter_sets(&frame.data) else {
+                continue;
+            };
+            let record = avcc::avcc_record(&sps, &pps);
+            let message = avcc::envelope(avcc::tag::PARAMETER_SET, &record);
+            if socket.send(Message::Binary(message.into())).await.is_err() {
+                break;
+            }
+            sent_parameter_set = true;
+        }
+
+        let tag = match frame.kind {
+            FrameKind::Keyframe => avcc::tag::KEYFRAME,
+            _ => avcc::tag::DELTA,
+        };
+        let payload = avcc::to_avcc(&frame.data);
+        if payload.is_empty() {
+            continue;
+        }
+        let message = avcc::envelope(tag, &payload);
+        if socket.send(Message::Binary(message.into())).await.is_err() {
+            break;
+        }
+    }
+}
+
+async fn input_socket(
+    State(state): State<AppState>,
+    upgrade: WebSocketUpgrade,
+) -> impl IntoResponse {
+    upgrade.on_upgrade(move |socket| pump_input(state, socket))
+}
+
+async fn pump_input(state: AppState, mut socket: WebSocket) {
+    use futures_util::StreamExt;
+
+    while let Some(Ok(message)) = socket.next().await {
+        let payload = match message {
+            Message::Text(text) => text.to_string(),
+            Message::Binary(bytes) => match String::from_utf8(bytes.to_vec()) {
+                Ok(text) => text,
+                Err(_) => continue,
+            },
+            Message::Close(_) => break,
+            _ => continue,
+        };
+
+        match serde_json::from_str::<InputCommand>(&payload) {
+            Ok(command) => state.session.send_input(command),
+            Err(error) => tracing::debug!("ignoring malformed input event: {error}"),
+        }
+    }
+}
diff --git a/packages/accessibility-serve/src/input.rs b/packages/accessibility-serve/src/input.rs
new file mode 100644
index 0000000..f6ea75b
--- /dev/null
+++ b/packages/accessibility-serve/src/input.rs
@@ -0,0 +1,345 @@
+//! Input forwarding from the browser to the simulator's HID subsystem.
+//!
+//! All coordinates on this path are normalized 0..1 fractions of the *raw*
+//! framebuffer. The browser un-rotates them before sending, so nothing here
+//! needs to know about orientation, and no points/pixels/scale conversion is
+//! involved anywhere.
+
+use std::sync::mpsc::{self, RecvTimeoutError, Sender};
+use std::time::{Duration, Instant};
+
+use anyhow::Result;
+use serde::Deserialize;
+
+/// Touches below this fraction of the screen height are tagged as originating
+/// from the bottom edge, which is what makes swipe-up-to-home work. Without
+/// the edge hint iOS treats the drag as a normal in-app gesture.
+pub const HOME_INDICATOR_BAND: f64 = 0.93;
+
+/// How far a wheel delta moves the virtual finger, as a multiple of the
+/// delta itself.
+const SCROLL_GAIN: f64 = 1.0;
+
+/// How close to an edge the virtual finger may get before the drag is
+/// restarted from the middle of the screen.
+const SCROLL_EDGE_MARGIN: f64 = 0.08;
+
+/// Quiet period after which a scroll gesture is lifted.
+const SCROLL_IDLE: Duration = Duration::from_millis(100);
+
+/// How often the worker wakes to check for an expired scroll gesture.
+const WORKER_TICK: Duration = Duration::from_millis(25);
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum TouchPhase {
+    Begin,
+    Move,
+    End,
+}
+
+/// Raw-framebuffer edge a touch is flagged as coming from.
+///
+/// Required for iOS to recognize system gestures such as swipe-up-to-home.
+/// The client decides this, because only it knows the current orientation and
+/// the framebuffer never rotates.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Default)]
+#[serde(rename_all = "lowercase")]
+pub enum TouchEdge {
+    #[default]
+    None,
+    Left,
+    Top,
+    Bottom,
+    Right,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum HardwareButton {
+    Home,
+    Lock,
+    Siri,
+    SideButton,
+    ApplePay,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, serde::Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Orientation {
+    Portrait,
+    PortraitUpsideDown,
+    LandscapeLeft,
+    LandscapeRight,
+}
+
+impl Orientation {
+    /// Whether the display is wider than it is tall in this orientation.
+    pub fn is_landscape(self) -> bool {
+        matches!(
+            self,
+            Orientation::LandscapeLeft | Orientation::LandscapeRight
+        )
+    }
+}
+
+/// A single input action to apply to the simulator.
+#[derive(Debug, Clone, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum InputCommand {
+    Touch {
+        phase: TouchPhase,
+        x: f64,
+        y: f64,
+        #[serde(default)]
+        edge: TouchEdge,
+    },
+    Button {
+        button: HardwareButton,
+    },
+    /// A single key press by USB HID usage code, with optional held modifiers.
+    ///
+    /// Used for navigation and shortcuts; text goes through [`InputCommand::Text`]
+    /// so the character-to-key table lives in one place.
+    Key {
+        key_code: u32,
+        #[serde(default)]
+        modifiers: Vec<u32>,
+    },
+    /// Type a string, expanded server-side into key presses.
+    Text {
+        text: String,
+    },
+    /// A wheel or trackpad delta, as a fraction of the display.
+    Scroll {
+        dx: f64,
+        dy: f64,
+        x: f64,
+        y: f64,
+    },
+    Rotate {
+        orientation: Orientation,
+    },
+}
+
+/// Turns a stream of wheel deltas into a touch drag.
+///
+/// iOS has no notion of a scroll wheel, so scrolling has to be a finger. The
+/// awkward part is that a real finger runs out of screen: once the virtual
+/// contact point nears an edge it is lifted and re-planted in the middle, so
+/// an unbounded wheel can keep producing motion.
+#[derive(Default)]
+struct ScrollGesture {
+    active: bool,
+    x: f64,
+    y: f64,
+    last_event: Option<Instant>,
+}
+
+impl ScrollGesture {
+    fn near_edge(&self) -> bool {
+        self.x < SCROLL_EDGE_MARGIN
+            || self.x > 1.0 - SCROLL_EDGE_MARGIN
+            || self.y < SCROLL_EDGE_MARGIN
+            || self.y > 1.0 - SCROLL_EDGE_MARGIN
+    }
+}
+
+/// Start the HID worker thread and return its command channel.
+///
+/// The worker owns the `SimulatorHID` because it is not `Sync`, and because
+/// HID sends block on a dispatch queue round trip. It wakes periodically even
+/// when idle so a scroll gesture can be lifted after the wheel stops.
+#[cfg(target_os = "macos")]
+pub fn spawn_input_worker(udid: &str) -> Result<Sender<InputCommand>> {
+    use accessibility_ios_sys::{
+        HardwareButton as SysButton, Orientation as SysOrientation, SimulatorHID,
+        TouchEdge as SysEdge, TouchPhase as SysPhase,
+    };
+
+    let hid = SimulatorHID::for_device(Some(udid))?;
+    let (tx, rx) = mpsc::channel::<InputCommand>();
+
+    std::thread::Builder::new()
+        .name("sim-input".into())
+        .spawn(move || {
+            let mut scroll = ScrollGesture::default();
+
+            loop {
+                match rx.recv_timeout(WORKER_TICK) {
+                    Ok(command) => {
+                        // Any direct touch interrupts an in-flight scroll, or
+                        // the two gestures would fight over the same finger.
+                        if !matches!(command, InputCommand::Scroll { .. }) && scroll.active {
+                            let _ = hid.touch_normalized(scroll.x, scroll.y, SysPhase::End);
+                            scroll = ScrollGesture::default();
+                        }
+
+                        let result = match command {
+                            InputCommand::Touch { phase, x, y, edge } => {
+                                let phase = match phase {
+                                    TouchPhase::Begin => SysPhase::Begin,
+                                    TouchPhase::Move => SysPhase::Move,
+                                    TouchPhase::End => SysPhase::End,
+                                };
+                                let edge = match edge {
+                                    TouchEdge::None => SysEdge::None,
+                                    TouchEdge::Left => SysEdge::Left,
+                                    TouchEdge::Top => SysEdge::Top,
+                                    TouchEdge::Bottom => SysEdge::Bottom,
+                                    TouchEdge::Right => SysEdge::Right,
+                                };
+                                hid.touch_normalized_edge(x, y, phase, edge)
+                            }
+                            InputCommand::Button { button } => {
+                                let button = match button {
+                                    HardwareButton::Home => SysButton::Home,
+                                    HardwareButton::Lock => SysButton::Lock,
+                                    HardwareButton::Siri => SysButton::Siri,
+                                    HardwareButton::SideButton => SysButton::SideButton,
+                                    HardwareButton::ApplePay => SysButton::ApplePay,
+                                };
+                                hid.press_button(button, 0)
+                            }
+                            InputCommand::Key {
+                                key_code,
+                                ref modifiers,
+                            } => hid.send_key_with_modifiers(key_code, modifiers),
+                            InputCommand::Text { ref text } => type_text(&hid, text),
+                            InputCommand::Rotate { orientation } => {
+                                hid.set_orientation(match orientation {
+                                    Orientation::Portrait => SysOrientation::Portrait,
+                                    Orientation::PortraitUpsideDown => {
+                                        SysOrientation::PortraitUpsideDown
+                                    }
+                                    Orientation::LandscapeLeft => SysOrientation::LandscapeLeft,
+                                    Orientation::LandscapeRight => SysOrientation::LandscapeRight,
+                                })
+                            }
+                            InputCommand::Scroll { dx, dy, x, y } => {
+                                apply_scroll(&hid, &mut scroll, dx, dy, x, y)
+                            }
+                        };
+
+                        if let Err(error) = result {
+                            tracing::warn!("input event failed: {error}");
+                        }
+                    }
+                    Err(RecvTimeoutError::Timeout) => {
+                        // Lift the finger once the wheel has gone quiet,
+                        // otherwise the page keeps inertial-scrolling.
+                        if scroll.active
+                            && scroll
+                                .last_event
+                                .is_some_and(|at| at.elapsed() >= SCROLL_IDLE)
+                        {
+                            let _ = hid.touch_normalized(scroll.x, scroll.y, SysPhase::End);
+                            scroll = ScrollGesture::default();
+                        }
+                    }
+                    Err(RecvTimeoutError::Disconnected) => break,
+                }
+            }
+
+            if scroll.active {
+                let _ = hid.touch_normalized(scroll.x, scroll.y, SysPhase::End);
+            }
+        })?;
+
+    Ok(tx)
+}
+
+/// Expand text into key presses and send them.
+///
+/// Rejects the whole string if any character is untypeable, so a partial or
+/// subtly wrong string is never entered.
+#[cfg(target_os = "macos")]
+fn type_text(hid: &accessibility_ios_sys::SimulatorHID, text: &str) -> Result<()> {
+    for stroke in crate::keymap::keystrokes_for(text)? {
+        hid.send_key_with_modifiers(stroke.usage, &stroke.modifiers())?;
+    }
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+fn apply_scroll(
+    hid: &accessibility_ios_sys::SimulatorHID,
+    scroll: &mut ScrollGesture,
+    dx: f64,
+    dy: f64,
+    x: f64,
+    y: f64,
+) -> Result<()> {
+    use accessibility_ios_sys::TouchPhase as SysPhase;
+
+    if !scroll.active {
+        // Plant the finger under the pointer so the gesture lands on whatever
+        // the user is actually hovering.
+        scroll.x = x.clamp(0.0, 1.0);
+        scroll.y = y.clamp(0.0, 1.0);
+        scroll.active = true;
+        hid.touch_normalized(scroll.x, scroll.y, SysPhase::Begin)?;
+    }
+
+    // Content follows the finger, so the finger moves opposite the wheel.
+    scroll.x = (scroll.x - dx * SCROLL_GAIN).clamp(0.0, 1.0);
+    scroll.y = (scroll.y - dy * SCROLL_GAIN).clamp(0.0, 1.0);
+    scroll.last_event = Some(Instant::now());
+
+    if scroll.near_edge() {
+        // Out of room: lift and re-plant in the middle so the next delta has
+        // somewhere to go.
+        hid.touch_normalized(scroll.x, scroll.y, SysPhase::End)?;
+        scroll.x = 0.5;
+        scroll.y = 0.5;
+        hid.touch_normalized(scroll.x, scroll.y, SysPhase::Begin)?;
+        return Ok(());
+    }
+
+    hid.touch_normalized(scroll.x, scroll.y, SysPhase::Move)
+}
+
+#[cfg(not(target_os = "macos"))]
+pub fn spawn_input_worker(_udid: &str) -> Result<Sender<InputCommand>> {
+    anyhow::bail!("Simulator input requires macOS")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn gesture_detects_each_edge() {
+        for (x, y) in [(0.01, 0.5), (0.99, 0.5), (0.5, 0.01), (0.5, 0.99)] {
+            let gesture = ScrollGesture {
+                active: true,
+                x,
+                y,
+                last_event: None,
+            };
+            assert!(
+                gesture.near_edge(),
+                "expected ({x}, {y}) to be near an edge"
+            );
+        }
+    }
+
+    #[test]
+    fn gesture_center_is_not_near_edge() {
+        let gesture = ScrollGesture {
+            active: true,
+            x: 0.5,
+            y: 0.5,
+            last_event: None,
+        };
+        assert!(!gesture.near_edge());
+    }
+
+    #[test]
+    fn landscape_classification() {
+        assert!(Orientation::LandscapeLeft.is_landscape());
+        assert!(Orientation::LandscapeRight.is_landscape());
+        assert!(!Orientation::Portrait.is_landscape());
+        assert!(!Orientation::PortraitUpsideDown.is_landscape());
+    }
+}
diff --git a/packages/accessibility-serve/src/keymap.rs b/packages/accessibility-serve/src/keymap.rs
new file mode 100644
index 0000000..f3d7f6a
--- /dev/null
+++ b/packages/accessibility-serve/src/keymap.rs
@@ -0,0 +1,236 @@
+//! Mapping text to simulator key presses.
+//!
+//! The simulator's keyboard takes USB HID usage codes and has no notion of a
+//! shift flag, so a capital letter or a shifted symbol is a *sequence*: hold
+//! Left Shift, press the base key, release both. This module owns that
+//! translation so the browser does not have to duplicate the table.
+//!
+//! Scope is deliberately US ASCII. There is no layout awareness and no
+//! Unicode: a character outside the table is reported as an error rather than
+//! silently dropped or turned into the wrong key, which is how the previous
+//! implementation lost every `@` and quietly lowercased every capital.
+
+use anyhow::{Result, anyhow};
+
+/// USB HID keyboard usage codes, re-exported for the input layer.
+pub mod usage {
+    pub const RETURN: u32 = 40;
+    pub const ESCAPE: u32 = 41;
+    pub const BACKSPACE: u32 = 42;
+    pub const TAB: u32 = 43;
+    pub const RIGHT_ARROW: u32 = 79;
+    pub const LEFT_ARROW: u32 = 80;
+    pub const DOWN_ARROW: u32 = 81;
+    pub const UP_ARROW: u32 = 82;
+    pub const LEFT_CONTROL: u32 = 224;
+    pub const LEFT_SHIFT: u32 = 225;
+    pub const LEFT_ALT: u32 = 226;
+    pub const LEFT_GUI: u32 = 227;
+}
+
+/// A single key press: the usage code and whether Shift is held for it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct KeyStroke {
+    pub usage: u32,
+    pub shift: bool,
+}
+
+impl KeyStroke {
+    const fn plain(usage: u32) -> Self {
+        Self {
+            usage,
+            shift: false,
+        }
+    }
+
+    const fn shifted(usage: u32) -> Self {
+        Self { usage, shift: true }
+    }
+
+    /// The modifier usages to hold while pressing this key.
+    pub fn modifiers(&self) -> Vec<u32> {
+        if self.shift {
+            vec![usage::LEFT_SHIFT]
+        } else {
+            Vec::new()
+        }
+    }
+}
+
+/// Symbols reachable without Shift, in USB HID usage order.
+const UNSHIFTED_SYMBOLS: &[(char, u32)] = &[
+    ('-', 45),
+    ('=', 46),
+    ('[', 47),
+    (']', 48),
+    ('\\', 49),
+    (';', 51),
+    ('\'', 52),
+    ('`', 53),
+    (',', 54),
+    ('.', 55),
+    ('/', 56),
+];
+
+/// Symbols produced by holding Shift over another key's usage.
+const SHIFTED_SYMBOLS: &[(char, u32)] = &[
+    ('!', 30),
+    ('@', 31),
+    ('#', 32),
+    ('$', 33),
+    ('%', 34),
+    ('^', 35),
+    ('&', 36),
+    ('*', 37),
+    ('(', 38),
+    (')', 39),
+    ('_', 45),
+    ('+', 46),
+    ('{', 47),
+    ('}', 48),
+    ('|', 49),
+    (':', 51),
+    ('"', 52),
+    ('~', 53),
+    ('<', 54),
+    ('>', 55),
+    ('?', 56),
+];
+
+/// The key press that produces `character`, if one exists on a US keyboard.
+pub fn keystroke_for(character: char) -> Option<KeyStroke> {
+    match character {
+        // Letters share a usage; case is the Shift modifier.
+        'a'..='z' => Some(KeyStroke::plain(character as u32 - 'a' as u32 + 4)),
+        'A'..='Z' => Some(KeyStroke::shifted(character as u32 - 'A' as u32 + 4)),
+        // Digits are not contiguous with zero: 1-9 are 30-38 and 0 is 39.
+        '1'..='9' => Some(KeyStroke::plain(character as u32 - '1' as u32 + 30)),
+        '0' => Some(KeyStroke::plain(39)),
+        '\n' | '\r' => Some(KeyStroke::plain(usage::RETURN)),
+        '\t' => Some(KeyStroke::plain(usage::TAB)),
+        ' ' => Some(KeyStroke::plain(44)),
+        _ => UNSHIFTED_SYMBOLS
+            .iter()
+            .find(|(c, _)| *c == character)
+            .map(|(_, usage)| KeyStroke::plain(*usage))
+            .or_else(|| {
+                SHIFTED_SYMBOLS
+                    .iter()
+                    .find(|(c, _)| *c == character)
+                    .map(|(_, usage)| KeyStroke::shifted(*usage))
+            }),
+    }
+}
+
+/// Translate a string into key presses.
+///
+/// Fails on the first unmappable character rather than typing a partial or
+/// wrong string.
+pub fn keystrokes_for(text: &str) -> Result<Vec<KeyStroke>> {
+    text.chars()
+        .map(|character| {
+            keystroke_for(character).ok_or_else(|| {
+                anyhow!(
+                    "cannot type {character:?}: only US-ASCII characters are supported \
+                     (no unicode or emoji)"
+                )
+            })
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn type_text(text: &str) -> Vec<(u32, bool)> {
+        keystrokes_for(text)
+            .expect("typeable")
+            .into_iter()
+            .map(|k| (k.usage, k.shift))
+            .collect()
+    }
+
+    #[test]
+    fn letters_use_usb_hid_usages_not_hitoolbox() {
+        // The bug this module exists to fix: 'a' is usage 4, not HIToolbox 0.
+        assert_eq!(type_text("a"), vec![(4, false)]);
+        assert_eq!(type_text("b"), vec![(5, false)]);
+        assert_eq!(type_text("z"), vec![(29, false)]);
+    }
+
+    #[test]
+    fn capitals_hold_shift_over_the_same_usage() {
+        assert_eq!(type_text("aA"), vec![(4, false), (4, true)]);
+    }
+
+    #[test]
+    fn digits_are_not_contiguous_with_zero() {
+        assert_eq!(type_text("1"), vec![(30, false)]);
+        assert_eq!(type_text("9"), vec![(38, false)]);
+        assert_eq!(type_text("0"), vec![(39, false)]);
+    }
+
+    #[test]
+    fn types_an_email_address() {
+        // The exact string the old implementation mangled into
+        // "testexample.com": @ and ? dropped, capitals lowercased.
+        let strokes = type_text("Test@Example.com?");
+        assert_eq!(strokes.len(), 17, "every character must produce a key");
+        assert_eq!(strokes[0], (23, true), "T is shifted t");
+        assert_eq!(strokes[4], (31, true), "@ is shift-2");
+        assert_eq!(strokes[16], (56, true), "? is shift-/");
+    }
+
+    #[test]
+    fn shifted_and_unshifted_symbols_share_usages() {
+        assert_eq!(type_text(";"), vec![(51, false)]);
+        assert_eq!(type_text(":"), vec![(51, true)]);
+        assert_eq!(type_text("/"), vec![(56, false)]);
+        assert_eq!(type_text("?"), vec![(56, true)]);
+    }
+
+    #[test]
+    fn whitespace_maps_to_real_keys() {
+        assert_eq!(type_text(" "), vec![(44, false)]);
+        assert_eq!(type_text("\n"), vec![(usage::RETURN, false)]);
+        assert_eq!(type_text("\t"), vec![(usage::TAB, false)]);
+    }
+
+    #[test]
+    fn unmappable_characters_fail_loudly() {
+        // Better a clear error than a silently wrong string.
+        for text in ["café", "hello 👋", "→"] {
+            let error = keystrokes_for(text).expect_err("should reject");
+            assert!(error.to_string().contains("cannot type"), "{error}");
+        }
+    }
+
+    #[test]
+    fn failure_is_reported_before_anything_is_typed() {
+        // keystrokes_for collects into a Result, so a bad character partway
+        // through yields no partial output for the caller to send.
+        assert!(keystrokes_for("ok\u{1F600}bad").is_err());
+    }
+
+    #[test]
+    fn shift_is_the_only_modifier_for_text() {
+        assert_eq!(
+            keystroke_for('A').expect("mapped").modifiers(),
+            vec![usage::LEFT_SHIFT]
+        );
+        assert!(keystroke_for('a').expect("mapped").modifiers().is_empty());
+    }
+
+    #[test]
+    fn every_printable_ascii_character_is_typeable() {
+        // If this ever regresses, some character silently becomes untypeable.
+        for byte in 0x20u8..0x7F {
+            let character = byte as char;
+            assert!(
+                keystroke_for(character).is_some(),
+                "no key for {character:?}"
+            );
+        }
+    }
+}
diff --git a/packages/accessibility-serve/src/lib.rs b/packages/accessibility-serve/src/lib.rs
new file mode 100644
index 0000000..f87f28c
--- /dev/null
+++ b/packages/accessibility-serve/src/lib.rs
@@ -0,0 +1,115 @@
+//! Serve a live, interactive iOS Simulator stream in the browser.
+//!
+//! Captures the simulator framebuffer, encodes it with VideoToolbox, and
+//! offers it over WebRTC (default) or as raw H.264 for browsers driving
+//! WebCodecs. Pointer and keyboard input flow back over a WebSocket, and the
+//! accessibility tree is exposed so the UI can inspect elements.
+
+pub mod avcc;
+pub mod ax;
+pub mod coverage;
+pub mod http;
+pub mod input;
+pub mod keymap;
+pub mod session;
+pub mod settings;
+pub mod webrtc_stream;
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+
+use accessibility_core::video::VideoConfig;
+
+pub use session::SimSession;
+
+/// Which transport the web UI should try first.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum Transport {
+    /// Real-time media track. Lowest latency, adapts to loss.
+    #[default]
+    WebRtc,
+    /// Length-prefixed H.264 over a WebSocket, decoded with WebCodecs.
+    /// Simpler to tunnel and to consume from non-browser clients.
+    H264,
+}
+
+impl Transport {
+    fn as_str(self) -> &'static str {
+        match self {
+            Transport::WebRtc => "webrtc",
+            Transport::H264 => "h264",
+        }
+    }
+}
+
+impl std::str::FromStr for Transport {
+    type Err = anyhow::Error;
+
+    fn from_str(value: &str) -> Result<Self> {
+        match value {
+            "webrtc" => Ok(Transport::WebRtc),
+            "h264" | "avcc" => Ok(Transport::H264),
+            other => anyhow::bail!("Unknown transport '{other}' (expected webrtc or h264)"),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct ServeConfig {
+    /// Simulator to serve. `None` picks the first booted device.
+    pub udid: Option<String>,
+    pub address: SocketAddr,
+    pub transport: Transport,
+    pub video: VideoConfig,
+    /// ICE servers for WebRTC. Empty means host candidates only, which is
+    /// correct for loopback and LAN use.
+    pub ice_servers: Vec<String>,
+}
+
+impl Default for ServeConfig {
+    fn default() -> Self {
+        Self {
+            udid: None,
+            address: SocketAddr::from(([127, 0, 0, 1], 3200)),
+            transport: Transport::default(),
+            video: VideoConfig::default(),
+            ice_servers: Vec::new(),
+        }
+    }
+}
+
+/// Start capturing and serve until the process is interrupted.
+pub async fn serve(config: ServeConfig) -> Result<()> {
+    let session = SimSession::start(config.udid.as_deref(), config.video)
+        .context("failed to start simulator capture")?;
+    // The framebuffer cannot reveal orientation, so ask accessibility once
+    // before serving; otherwise an already-rotated device renders sideways.
+    session.seed_orientation().await;
+    let device = session.device_info();
+
+    let webrtc = Arc::new(
+        webrtc_stream::WebRtcEngine::new(config.ice_servers.clone())
+            .context("failed to initialize WebRTC")?,
+    );
+
+    let state = http::AppState {
+        session,
+        webrtc,
+        default_transport: config.transport.as_str().to_string(),
+    };
+
+    let listener = tokio::net::TcpListener::bind(config.address)
+        .await
+        .with_context(|| format!("failed to bind {}", config.address))?;
+    let bound = listener.local_addr()?;
+
+    println!("serving simulator {}", device.udid);
+    println!("  transport : {}", config.transport.as_str());
+    println!("  preview   : http://{bound}");
+
+    axum::serve(listener, http::router(state))
+        .await
+        .context("server error")
+}
diff --git a/packages/accessibility-serve/src/session.rs b/packages/accessibility-serve/src/session.rs
new file mode 100644
index 0000000..4c9dc9f
--- /dev/null
+++ b/packages/accessibility-serve/src/session.rs
@@ -0,0 +1,348 @@
+//! Ownership of the per-device simulator resources.
+//!
+//! The simulator's Objective-C objects are not `Sync` and their calls block, so
+//! each one lives on a dedicated thread behind a command channel rather than in
+//! a mutex on the async runtime.
+//!
+//! Input and accessibility get *separate* threads on purpose: an accessibility
+//! tree fetch can take hundreds of milliseconds, and pointer events queued
+//! behind one would make the stream feel broken.
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::Instant;
+
+use anyhow::{Result, anyhow};
+use tokio::sync::{broadcast, mpsc, oneshot};
+
+use accessibility_core::video::{
+    EncodedFrame, FrameKind, Recording, RecordingConfig, VideoCapture, VideoConfig,
+};
+
+use crate::ax::{AxCommand, AxSnapshot, ElementDetail, spawn_ax_worker};
+use crate::input::{InputCommand, Orientation, spawn_input_worker};
+use crate::settings::{Setting, SettingKey};
+
+/// How many encoded frames to buffer per subscriber.
+///
+/// Small on purpose: for interactive video a dropped frame is better than a
+/// late one, and a slow client should not be able to inflate memory.
+const FRAME_BUFFER: usize = 16;
+
+/// Counters for diagnosing stream quality and pacing.
+///
+/// Cheap enough to always collect: the interesting failures here (keyframe
+/// storms, subscribers falling behind) are invisible without them and only
+/// show up under load, which is exactly when you cannot attach a profiler.
+#[derive(Default)]
+pub struct StreamStats {
+    pub frames: AtomicU64,
+    pub keyframes: AtomicU64,
+    pub bytes: AtomicU64,
+    /// Keyframes asked for by a new subscriber, an RTCP PLI, or a lagging
+    /// receiver. A high rate here starves the stream of bitrate for delta
+    /// frames and is self-reinforcing.
+    pub keyframe_requests: AtomicU64,
+    /// Times a subscriber fell far enough behind to drop frames.
+    pub lag_events: AtomicU64,
+}
+
+/// A snapshot of [`StreamStats`] with rates worked out.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct StatsReport {
+    pub uptime_secs: f64,
+    pub frames: u64,
+    pub keyframes: u64,
+    pub fps: f64,
+    pub mbps: f64,
+    pub bits_per_pixel: f64,
+    pub mean_frame_kb: f64,
+    pub keyframe_requests: u64,
+    pub lag_events: u64,
+    pub subscribers: usize,
+    /// Frames written to the current recording, or `None` when idle.
+    pub recording_frames: Option<u64>,
+    /// Capture resolution.
+    pub width: u32,
+    pub height: u32,
+    /// Resolution actually encoded, after downscaling.
+    pub encoded_width: u32,
+    pub encoded_height: u32,
+}
+
+/// Geometry and identity of the device being served.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct DeviceInfo {
+    pub udid: String,
+    /// Raw framebuffer width. Does not change with orientation.
+    pub width: u32,
+    /// Raw framebuffer height. Does not change with orientation.
+    pub height: u32,
+    pub orientation: Orientation,
+}
+
+pub struct SimSession {
+    device_udid: String,
+    capture: Box<dyn VideoCapture>,
+    frames: broadcast::Sender<EncodedFrame>,
+    /// Most recent parameter set, replayed to clients that join mid-stream.
+    latest_parameter_set: Arc<std::sync::Mutex<Option<EncodedFrame>>>,
+    stats: Arc<StreamStats>,
+    started: Instant,
+    input: std::sync::mpsc::Sender<InputCommand>,
+    ax: mpsc::UnboundedSender<AxCommand>,
+    /// Last orientation we asked for.
+    ///
+    /// The framebuffer is always portrait-native — rotating the device
+    /// rotates the *content* inside a fixed-size surface — so orientation
+    /// cannot be recovered from the video and has to be tracked here.
+    orientation: std::sync::Mutex<Orientation>,
+}
+
+impl SimSession {
+    /// Attach to a booted simulator and start capturing.
+    pub fn start(udid: Option<&str>, config: VideoConfig) -> Result<Arc<Self>> {
+        let (frames, _) = broadcast::channel(FRAME_BUFFER);
+        let latest_parameter_set = Arc::new(std::sync::Mutex::new(None));
+        let stats = Arc::new(StreamStats::default());
+
+        let sink = {
+            let frames = frames.clone();
+            let latest_parameter_set = Arc::clone(&latest_parameter_set);
+            let stats = Arc::clone(&stats);
+            Arc::new(move |frame: EncodedFrame| {
+                if frame.kind == FrameKind::ParameterSet {
+                    *latest_parameter_set.lock().unwrap() = Some(frame.clone());
+                }
+                stats.frames.fetch_add(1, Ordering::Relaxed);
+                stats.bytes.fetch_add(frame.data.len() as u64, Ordering::Relaxed);
+                if frame.kind == FrameKind::Keyframe {
+                    stats.keyframes.fetch_add(1, Ordering::Relaxed);
+                }
+                // A send error just means nobody is watching yet.
+                let _ = frames.send(frame);
+            })
+        };
+
+        let (capture, resolved_udid) = start_capture(udid, &config, sink)?;
+        let input = spawn_input_worker(&resolved_udid)?;
+        let ax = spawn_ax_worker(&resolved_udid)?;
+
+        Ok(Arc::new(Self {
+            device_udid: resolved_udid,
+            capture,
+            frames,
+            latest_parameter_set,
+            stats,
+            started: Instant::now(),
+            input,
+            ax,
+            orientation: std::sync::Mutex::new(Orientation::Portrait),
+        }))
+    }
+
+    pub fn subscribe(&self) -> broadcast::Receiver<EncodedFrame> {
+        let receiver = self.frames.subscribe();
+        #[allow(clippy::let_and_return)]
+        // A new subscriber cannot decode anything until the next keyframe, so
+        // ask for one immediately instead of making them wait out the interval.
+        self.capture.request_keyframe();
+        receiver
+    }
+
+    pub fn latest_parameter_set(&self) -> Option<EncodedFrame> {
+        self.latest_parameter_set.lock().unwrap().clone()
+    }
+
+    pub fn request_keyframe(&self) {
+        self.stats.keyframe_requests.fetch_add(1, Ordering::Relaxed);
+        self.capture.request_keyframe();
+    }
+
+    pub fn note_lag(&self) {
+        self.stats.lag_events.fetch_add(1, Ordering::Relaxed);
+    }
+
+    pub fn stats(&self) -> StatsReport {
+        let elapsed = self.started.elapsed().as_secs_f64().max(1e-6);
+        let frames = self.stats.frames.load(Ordering::Relaxed);
+        let bytes = self.stats.bytes.load(Ordering::Relaxed);
+        let geometry = self.capture.geometry();
+        let encoded = self.capture.encoded_geometry();
+        // Bits per pixel only means anything against the encoded size.
+        let pixels = (encoded.width as f64) * (encoded.height as f64);
+        let fps = frames as f64 / elapsed;
+
+        StatsReport {
+            uptime_secs: (elapsed * 10.0).round() / 10.0,
+            frames,
+            keyframes: self.stats.keyframes.load(Ordering::Relaxed),
+            fps: (fps * 10.0).round() / 10.0,
+            mbps: ((bytes as f64 * 8.0 / elapsed / 1e6) * 100.0).round() / 100.0,
+            // The headline number: anything much under 0.1 will visibly
+            // block up on motion.
+            bits_per_pixel: if pixels > 0.0 && fps > 0.0 {
+                ((bytes as f64 * 8.0 / elapsed) / (pixels * fps) * 10000.0).round() / 10000.0
+            } else {
+                0.0
+            },
+            mean_frame_kb: if frames > 0 {
+                ((bytes as f64 / frames as f64 / 1024.0) * 100.0).round() / 100.0
+            } else {
+                0.0
+            },
+            keyframe_requests: self.stats.keyframe_requests.load(Ordering::Relaxed),
+            lag_events: self.stats.lag_events.load(Ordering::Relaxed),
+            subscribers: self.frames.receiver_count(),
+            recording_frames: self.capture.recording_frames(),
+            width: geometry.width,
+            height: geometry.height,
+            encoded_width: encoded.width,
+            encoded_height: encoded.height,
+        }
+    }
+
+    pub fn device_info(&self) -> DeviceInfo {
+        let geometry = self.capture.geometry();
+        DeviceInfo {
+            udid: self.device_udid.clone(),
+            width: geometry.width,
+            height: geometry.height,
+            orientation: self.orientation(),
+        }
+    }
+
+    pub fn orientation(&self) -> Orientation {
+        *self.orientation.lock().unwrap()
+    }
+
+    /// Rotate the device and remember the new orientation.
+    pub fn set_orientation(&self, orientation: Orientation) {
+        *self.orientation.lock().unwrap() = orientation;
+        self.send_input(InputCommand::Rotate { orientation });
+    }
+
+    /// Begin recording to a file beside the system temp directory.
+    ///
+    /// Runs a second encode of the same frames, so the live stream is
+    /// unaffected and the recording can use B-frames and its own resolution.
+    pub fn start_recording(&self, config: RecordingConfig) -> Result<std::path::PathBuf> {
+        let path = std::env::temp_dir().join(format!(
+            "serve-sim-{}-{}.mp4",
+            self.device_udid,
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map(|d| d.as_secs())
+                .unwrap_or_default()
+        ));
+        self.capture.start_recording(&path, &config)?;
+        Ok(path)
+    }
+
+    pub fn stop_recording(&self) -> Result<Recording> {
+        self.capture.stop_recording()
+    }
+
+    pub fn recording_frames(&self) -> Option<u64> {
+        self.capture.recording_frames()
+    }
+
+    pub fn settings(&self) -> Vec<Setting> {
+        crate::settings::read_all(&self.device_udid)
+    }
+
+    pub fn set_setting(&self, key: SettingKey, value: &str) -> Result<String> {
+        crate::settings::write(&self.device_udid, key, value)
+    }
+
+    /// Queue an input event. Fire-and-forget: pointer events must never block
+    /// the socket reader.
+    pub fn send_input(&self, command: InputCommand) {
+        if let InputCommand::Rotate { orientation } = command {
+            *self.orientation.lock().unwrap() = orientation;
+        }
+        let _ = self.input.send(command);
+    }
+
+    /// Read the accessibility tree.
+    ///
+    /// `scan` additionally hit-tests the regions the tree walk cannot explain,
+    /// which is the only way to reach `WKWebView` and Safari content. It costs
+    /// a few hundred milliseconds, so it is opt-in.
+    pub async fn ax_snapshot(&self, scan: bool) -> Result<AxSnapshot> {
+        let (tx, rx) = oneshot::channel();
+        self.ax
+            .send(AxCommand::Snapshot { scan, reply: tx })
+            .map_err(|_| anyhow!("accessibility worker stopped"))?;
+        let snapshot = rx
+            .await
+            .map_err(|_| anyhow!("accessibility worker stopped"))??;
+        self.reconcile_orientation(snapshot.is_landscape);
+        Ok(snapshot)
+    }
+
+    /// Correct the tracked orientation against what the device reports.
+    ///
+    /// Orientation can change without us: the user can rotate from the
+    /// Simulator menu, an app can force an orientation, or the server can be
+    /// restarted while the device is already sideways. Accessibility bounds
+    /// are the only cheap signal, and they only reveal landscape vs portrait,
+    /// so a disagreement resolves to a sensible default of the right kind
+    /// rather than to an exact rotation.
+    fn reconcile_orientation(&self, is_landscape: bool) {
+        let mut orientation = self.orientation.lock().unwrap();
+        if orientation.is_landscape() == is_landscape {
+            return;
+        }
+        *orientation = if is_landscape {
+            Orientation::LandscapeLeft
+        } else {
+            Orientation::Portrait
+        };
+    }
+
+    /// Best-effort orientation seed at startup.
+    ///
+    /// Without this the server would assume portrait and render a sideways
+    /// device whenever it attaches to an already-rotated simulator.
+    pub async fn seed_orientation(&self) {
+        if let Ok(snapshot) = self.ax_snapshot(false).await {
+            self.reconcile_orientation(snapshot.is_landscape);
+        }
+    }
+
+    pub async fn ax_hit_test(&self, x: f64, y: f64) -> Result<Option<ElementDetail>> {
+        let (tx, rx) = oneshot::channel();
+        self.ax
+            .send(AxCommand::HitTest { x, y, reply: tx })
+            .map_err(|_| anyhow!("accessibility worker stopped"))?;
+        rx.await.map_err(|_| anyhow!("accessibility worker stopped"))?
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn start_capture(
+    udid: Option<&str>,
+    config: &VideoConfig,
+    sink: accessibility_core::video::FrameSink,
+) -> Result<(Box<dyn VideoCapture>, String)> {
+    use accessibility_core::platform::ios_simulator::SimulatorVideoCapture;
+
+    // Resolve the concrete UDID up front so the input and accessibility
+    // workers bind to the same device the video came from, even when the
+    // caller passed `None`.
+    let resolved = accessibility_ios_sys::SimFramebuffer::new(udid)?
+        .device_udid()
+        .to_string();
+    let capture = SimulatorVideoCapture::start(&resolved, config, sink)?;
+    Ok((Box::new(capture), resolved))
+}
+
+#[cfg(not(target_os = "macos"))]
+fn start_capture(
+    _udid: Option<&str>,
+    _config: &VideoConfig,
+    _sink: accessibility_core::video::FrameSink,
+) -> Result<(Box<dyn VideoCapture>, String)> {
+    anyhow::bail!("Serving an iOS Simulator requires macOS")
+}
diff --git a/packages/accessibility-serve/src/settings.rs b/packages/accessibility-serve/src/settings.rs
new file mode 100644
index 0000000..e234aa4
--- /dev/null
+++ b/packages/accessibility-serve/src/settings.rs
@@ -0,0 +1,173 @@
+//! Simulator-wide UI settings.
+//!
+//! These go through `simctl ui`, which is the same mechanism Xcode's Devices
+//! window uses. Only the three options simctl actually implements are exposed:
+//! appearance, increase contrast, and content size.
+//!
+//! The Devices window also offers reduce-motion, colour filters, transparency
+//! and VoiceOver, but simctl has no verb for those — they require a helper
+//! binary spawned *inside* the simulator that drives the private
+//! libAccessibility setters. That is a meaningfully larger piece of work and
+//! is deliberately not attempted here.
+
+use anyhow::{Context, Result, anyhow};
+use serde::{Deserialize, Serialize};
+
+/// Content size categories, smallest to largest.
+///
+/// The five `accessibility-*` entries are the extended range that only appears
+/// once a user opts into larger accessibility text.
+pub const CONTENT_SIZES: &[&str] = &[
+    "extra-small",
+    "small",
+    "medium",
+    "large",
+    "extra-large",
+    "extra-extra-large",
+    "extra-extra-extra-large",
+    "accessibility-medium",
+    "accessibility-large",
+    "accessibility-extra-large",
+    "accessibility-extra-extra-large",
+    "accessibility-extra-extra-extra-large",
+];
+
+pub const APPEARANCES: &[&str] = &["light", "dark"];
+pub const TOGGLE: &[&str] = &["enabled", "disabled"];
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SettingKey {
+    Appearance,
+    IncreaseContrast,
+    ContentSize,
+}
+
+impl SettingKey {
+    /// The `simctl ui` subcommand for this setting.
+    fn verb(self) -> &'static str {
+        match self {
+            SettingKey::Appearance => "appearance",
+            SettingKey::IncreaseContrast => "increase_contrast",
+            SettingKey::ContentSize => "content_size",
+        }
+    }
+
+    pub fn allowed_values(self) -> &'static [&'static str] {
+        match self {
+            SettingKey::Appearance => APPEARANCES,
+            SettingKey::IncreaseContrast => TOGGLE,
+            SettingKey::ContentSize => CONTENT_SIZES,
+        }
+    }
+
+    pub fn all() -> [SettingKey; 3] {
+        [
+            SettingKey::Appearance,
+            SettingKey::IncreaseContrast,
+            SettingKey::ContentSize,
+        ]
+    }
+}
+
+/// One setting and its current value, as reported by the simulator.
+#[derive(Debug, Clone, Serialize)]
+pub struct Setting {
+    pub key: SettingKey,
+    /// Current value, or `unsupported`/`unknown` if the runtime says so.
+    pub value: String,
+    pub allowed: &'static [&'static str],
+}
+
+/// Read every supported setting from the device.
+pub fn read_all(udid: &str) -> Vec<Setting> {
+    SettingKey::all()
+        .into_iter()
+        .map(|key| Setting {
+            key,
+            // A failed read is reported as unknown rather than failing the
+            // whole request; one unsupported option should not blank the UI.
+            value: read(udid, key).unwrap_or_else(|_| "unknown".to_string()),
+            allowed: key.allowed_values(),
+        })
+        .collect()
+}
+
+pub fn read(udid: &str, key: SettingKey) -> Result<String> {
+    let output = simctl(&["ui", udid, key.verb()])?;
+    Ok(output.trim().to_string())
+}
+
+pub fn write(udid: &str, key: SettingKey, value: &str) -> Result<String> {
+    // `content_size` also accepts increment/decrement, which are not in the
+    // reported value set but are the ergonomic way to drive it from a UI.
+    let stepping = matches!(key, SettingKey::ContentSize)
+        && matches!(value, "increment" | "decrement");
+
+    if !stepping && !key.allowed_values().contains(&value) {
+        return Err(anyhow!(
+            "'{value}' is not valid for {:?}; expected one of {}",
+            key,
+            key.allowed_values().join(", ")
+        ));
+    }
+
+    simctl(&["ui", udid, key.verb(), value])?;
+    read(udid, key)
+}
+
+fn simctl(args: &[&str]) -> Result<String> {
+    let output = std::process::Command::new("xcrun")
+        .arg("simctl")
+        .args(args)
+        .output()
+        .context("failed to run xcrun simctl")?;
+
+    if !output.status.success() {
+        return Err(anyhow!(
+            "simctl {} failed: {}",
+            args.join(" "),
+            String::from_utf8_lossy(&output.stderr).trim()
+        ));
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn rejects_values_outside_the_allowed_set() {
+        let error = write("no-such-device", SettingKey::Appearance, "chartreuse")
+            .expect_err("invalid appearance should be rejected");
+        // Rejected locally, without ever shelling out to simctl.
+        assert!(error.to_string().contains("chartreuse"));
+    }
+
+    #[test]
+    fn content_size_accepts_stepping_verbs() {
+        // These are not reported values, so they must be allowed explicitly.
+        assert!(!CONTENT_SIZES.contains(&"increment"));
+        for value in ["increment", "decrement"] {
+            let error = write("no-such-device", SettingKey::ContentSize, value)
+                .expect_err("no such device");
+            assert!(
+                !error.to_string().contains("is not valid"),
+                "{value} should reach simctl rather than being rejected"
+            );
+        }
+    }
+
+    #[test]
+    fn every_key_has_values_and_a_distinct_verb() {
+        let mut verbs = Vec::new();
+        for key in SettingKey::all() {
+            assert!(!key.allowed_values().is_empty());
+            verbs.push(key.verb());
+        }
+        verbs.sort_unstable();
+        verbs.dedup();
+        assert_eq!(verbs.len(), SettingKey::all().len());
+    }
+}
diff --git a/packages/accessibility-serve/src/webrtc_stream.rs b/packages/accessibility-serve/src/webrtc_stream.rs
new file mode 100644
index 0000000..e5da645
--- /dev/null
+++ b/packages/accessibility-serve/src/webrtc_stream.rs
@@ -0,0 +1,184 @@
+//! WebRTC video transport.
+//!
+//! Signaling is a single HTTP round trip: the browser posts a complete offer,
+//! we answer with a complete SDP once ICE gathering finishes. No trickle, no
+//! long-lived signaling socket. For a locally served simulator that is enough,
+//! and it keeps the browser side to about thirty lines.
+//!
+//! Each viewer gets its own peer connection and its own forwarding task, so
+//! one stalled client cannot wedge the others.
+
+use std::sync::Arc;
+
+use anyhow::{Result, anyhow};
+use webrtc::api::interceptor_registry::register_default_interceptors;
+use webrtc::api::media_engine::{MIME_TYPE_H264, MediaEngine};
+use webrtc::api::{API, APIBuilder};
+use webrtc::ice_transport::ice_server::RTCIceServer;
+use webrtc::interceptor::registry::Registry;
+use webrtc::media::Sample;
+use webrtc::peer_connection::configuration::RTCConfiguration;
+use webrtc::peer_connection::peer_connection_state::RTCPeerConnectionState;
+use webrtc::peer_connection::sdp::session_description::RTCSessionDescription;
+use webrtc::rtcp::payload_feedbacks::full_intra_request::FullIntraRequest;
+use webrtc::rtcp::payload_feedbacks::picture_loss_indication::PictureLossIndication;
+use webrtc::rtp_transceiver::rtp_codec::RTCRtpCodecCapability;
+use webrtc::track::track_local::TrackLocal;
+use webrtc::track::track_local::track_local_static_sample::TrackLocalStaticSample;
+
+use accessibility_core::video::FrameKind;
+
+use crate::session::SimSession;
+
+pub struct WebRtcEngine {
+    api: API,
+    config: RTCConfiguration,
+}
+
+impl WebRtcEngine {
+    pub fn new(ice_servers: Vec<String>) -> Result<Self> {
+        let mut media_engine = MediaEngine::default();
+        media_engine.register_default_codecs()?;
+
+        let registry = register_default_interceptors(Registry::new(), &mut media_engine)?;
+        let api = APIBuilder::new()
+            .with_media_engine(media_engine)
+            .with_interceptor_registry(registry)
+            .build();
+
+        let config = RTCConfiguration {
+            ice_servers: if ice_servers.is_empty() {
+                // A simulator served on loopback or a LAN needs no STUN; host
+                // candidates are sufficient and avoid a pointless round trip
+                // to a public server.
+                Vec::new()
+            } else {
+                vec![RTCIceServer {
+                    urls: ice_servers,
+                    ..Default::default()
+                }]
+            },
+            ..Default::default()
+        };
+
+        Ok(Self { api, config })
+    }
+
+    /// Answer a browser offer, wiring a fresh track to the capture stream.
+    pub async fn answer(&self, session: Arc<SimSession>, offer_sdp: String) -> Result<String> {
+        let peer = Arc::new(self.api.new_peer_connection(self.config.clone()).await?);
+
+        let track = Arc::new(TrackLocalStaticSample::new(
+            RTCRtpCodecCapability {
+                mime_type: MIME_TYPE_H264.to_owned(),
+                ..Default::default()
+            },
+            "video".to_owned(),
+            format!("sim-{}", session.device_info().udid),
+        ));
+
+        let sender = peer
+            .add_track(Arc::clone(&track) as Arc<dyn TrackLocal + Send + Sync>)
+            .await?;
+
+        // Sender RTCP has to be drained or feedback never gets processed. PLI
+        // and FIR both mean "I cannot decode, send me a fresh IDR".
+        {
+            let session = Arc::clone(&session);
+            tokio::spawn(async move {
+                let mut buffer = vec![0u8; 1500];
+                while let Ok((packets, _)) = sender.read(&mut buffer).await {
+                    for packet in packets {
+                        let any = packet.as_any();
+                        if any.downcast_ref::<PictureLossIndication>().is_some()
+                            || any.downcast_ref::<FullIntraRequest>().is_some()
+                        {
+                            session.request_keyframe();
+                        }
+                    }
+                }
+            });
+        }
+
+        let forwarder = spawn_forwarder(Arc::clone(&session), Arc::clone(&track));
+
+        // Tear the forwarding task down when the viewer goes away, otherwise
+        // every reconnect would leak a subscriber on the broadcast channel.
+        {
+            let forwarder = Arc::new(std::sync::Mutex::new(Some(forwarder)));
+            peer.on_peer_connection_state_change(Box::new(move |state| {
+                if matches!(
+                    state,
+                    RTCPeerConnectionState::Failed
+                        | RTCPeerConnectionState::Disconnected
+                        | RTCPeerConnectionState::Closed
+                ) && let Some(handle) = forwarder.lock().unwrap().take()
+                {
+                    handle.abort();
+                }
+                Box::pin(async {})
+            }));
+        }
+
+        peer.set_remote_description(RTCSessionDescription::offer(offer_sdp)?)
+            .await?;
+        let answer = peer.create_answer(None).await?;
+
+        let mut gathering_complete = peer.gathering_complete_promise().await;
+        peer.set_local_description(answer).await?;
+        let _ = gathering_complete.recv().await;
+
+        peer.local_description()
+            .await
+            .map(|description| description.sdp)
+            .ok_or_else(|| anyhow!("WebRTC produced no local description"))
+    }
+}
+
+/// Pump encoded frames from the capture broadcast onto a viewer's track.
+fn spawn_forwarder(
+    session: Arc<SimSession>,
+    track: Arc<TrackLocalStaticSample>,
+) -> tokio::task::JoinHandle<()> {
+    let mut frames = session.subscribe();
+
+    tokio::spawn(async move {
+        // Timestamps are derived from arrival rather than a fixed cadence,
+        // because the simulator only paints when something changes: an idle
+        // screen produces ~5fps and a busy one ~60fps.
+        let mut previous = tokio::time::Instant::now();
+
+        loop {
+            let frame = match frames.recv().await {
+                Ok(frame) => frame,
+                // Lagging just means this viewer fell behind; the next
+                // keyframe will resynchronize it.
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                    session.note_lag();
+                    session.request_keyframe();
+                    continue;
+                }
+                Err(tokio::sync::broadcast::error::RecvError::Closed) => break,
+            };
+
+            // In Annex-B the parameter sets ride inline ahead of each IDR, so
+            // there is nothing separate to send.
+            if frame.kind == FrameKind::ParameterSet {
+                continue;
+            }
+
+            let now = tokio::time::Instant::now();
+            let duration = now.duration_since(previous);
+            previous = now;
+
+            let sample = Sample {
+                data: frame.data,
+                duration,
+                ..Default::default()
+            };
+            if track.write_sample(&sample).await.is_err() {
+                break;
+            }
+        }
+    })
+}
diff --git a/packages/accessibility-serve/static/index.html b/packages/accessibility-serve/static/index.html
new file mode 100644
index 0000000..82efd5e
--- /dev/null
+++ b/packages/accessibility-serve/static/index.html
@@ -0,0 +1,867 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Simulator</title>
+<style>
+  :root {
+    --bg: #0d0f12;
+    --panel: #14171d;
+    --raised: #1e222a;
+    --border: #272c36;
+    --text: #e6e9ef;
+    --muted: #8b93a3;
+    --accent: #4c8dff;
+    --accent-soft: rgba(76, 141, 255, 0.16);
+    --good: #3fb950;
+    --bad: #f85149;
+  }
+  * { box-sizing: border-box; }
+  html, body {
+    margin: 0; height: 100%; overflow: hidden;
+    background: var(--bg); color: var(--text);
+    font: 13px/1.5 ui-sans-serif, -apple-system, "SF Pro Text", system-ui, sans-serif;
+  }
+  body { display: flex; align-items: stretch; }
+
+  /* ── device ─────────────────────────────────────────────── */
+
+  main {
+    flex: 1; min-width: 0;
+    display: flex; align-items: center; justify-content: center;
+    padding: 24px;
+  }
+  #stage {
+    position: relative;
+    background: #000;
+    border-radius: 20px;
+    overflow: hidden;
+    box-shadow: 0 20px 60px rgba(0,0,0,.6);
+  }
+  /* The framebuffer is always portrait-native; the media element is rotated
+     into place and the stage takes the resulting upright dimensions. */
+  #media {
+    position: absolute; top: 50%; left: 50%;
+    transform-origin: center center;
+    display: block;
+  }
+  #media video, #media canvas { display: block; width: 100%; height: 100%; }
+  #media canvas { display: none; }
+  #media.h264 video { display: none; }
+  #media.h264 canvas { display: block; }
+
+  #overlay { position: absolute; inset: 0; pointer-events: none; }
+  #stage.inspecting { cursor: crosshair; }
+
+  .box {
+    position: absolute;
+    border: 1.5px solid var(--accent);
+    background: var(--accent-soft);
+    border-radius: 3px;
+  }
+  .chip {
+    position: absolute;
+    background: var(--accent); color: #fff;
+    font-size: 11px; font-weight: 600;
+    padding: 2px 6px; border-radius: 4px;
+    white-space: nowrap; max-width: 92%;
+    overflow: hidden; text-overflow: ellipsis;
+  }
+
+  /* ── side ribbon ────────────────────────────────────────── */
+
+  #ribbon {
+    flex: none; width: 48px;
+    display: flex; flex-direction: column; align-items: center;
+    gap: 4px; padding: 10px 0;
+    background: var(--panel);
+    border-left: 1px solid var(--border);
+    border-right: 1px solid var(--border);
+  }
+  #ribbon .spacer { flex: 1; }
+  #ribbon .sep { width: 24px; height: 1px; background: var(--border); margin: 5px 0; }
+
+  .tool {
+    position: relative;
+    width: 34px; height: 34px;
+    display: grid; place-items: center;
+    background: transparent; color: var(--muted);
+    border: 1px solid transparent; border-radius: 8px;
+    cursor: pointer; padding: 0;
+  }
+  .tool:hover { background: var(--raised); color: var(--text); }
+  .tool[aria-pressed="true"] { background: var(--accent); border-color: var(--accent); color: #fff; }
+  .tool svg { width: 18px; height: 18px; fill: none; stroke: currentColor; stroke-width: 1.7; stroke-linecap: round; stroke-linejoin: round; }
+
+  /* Tooltips sit to the left so they never leave the viewport. */
+  .tool::after {
+    content: attr(data-label);
+    position: absolute; right: calc(100% + 8px); top: 50%;
+    transform: translateY(-50%);
+    background: #000; color: var(--text);
+    border: 1px solid var(--border); border-radius: 6px;
+    padding: 3px 8px; font-size: 11px; white-space: nowrap;
+    opacity: 0; pointer-events: none; transition: opacity .12s;
+  }
+  .tool:hover::after { opacity: 1; }
+
+  #statusDot { width: 9px; height: 9px; border-radius: 50%; background: var(--muted); }
+  #statusDot.live { background: var(--good); }
+  #statusDot.error { background: var(--bad); }
+
+  /* ── drawer ─────────────────────────────────────────────── */
+
+  aside {
+    flex: none; width: 320px;
+    background: var(--panel);
+    border-right: 1px solid var(--border);
+    padding: 16px; overflow-y: auto;
+    display: none;
+  }
+  aside.open { display: block; }
+  aside h2 { margin: 0 0 12px; font-size: 12px; text-transform: uppercase; letter-spacing: .06em; color: var(--muted); }
+  .empty { color: var(--muted); }
+
+  .role { color: var(--accent); font-weight: 600; font-size: 14px; }
+  dl { display: grid; grid-template-columns: 84px 1fr; gap: 6px 10px; margin: 12px 0 0; }
+  dt { color: var(--muted); }
+  dd { margin: 0; word-break: break-word; }
+  code {
+    display: block; margin-top: 6px; padding: 8px;
+    background: #0b0e13; border: 1px solid var(--border); border-radius: 6px;
+    font: 12px ui-monospace, SFMono-Regular, Menlo, monospace;
+    color: #a5d6ff; word-break: break-all;
+  }
+  button.wide {
+    margin-top: 8px; width: 100%;
+    background: var(--raised); color: var(--text);
+    border: 1px solid var(--border); border-radius: 7px;
+    padding: 7px; font: inherit; cursor: pointer;
+  }
+  button.wide:hover { background: #262b34; }
+
+  .field { margin-bottom: 14px; }
+  .field label { display: block; margin-bottom: 5px; color: var(--muted); }
+  .field select {
+    width: 100%; padding: 6px 8px;
+    background: var(--raised); color: var(--text);
+    border: 1px solid var(--border); border-radius: 7px;
+    font: inherit;
+  }
+  .seg { display: flex; gap: 4px; }
+  .seg button {
+    flex: 1; padding: 6px;
+    background: var(--raised); color: var(--text);
+    border: 1px solid var(--border); border-radius: 7px;
+    font: inherit; cursor: pointer;
+  }
+  .seg button[aria-pressed="true"] { background: var(--accent); border-color: var(--accent); color: #fff; }
+</style>
+</head>
+<body>
+
+<main>
+  <div id="stage">
+    <div id="media">
+      <video id="video" autoplay playsinline muted></video>
+      <canvas id="screen"></canvas>
+    </div>
+    <div id="overlay"></div>
+  </div>
+</main>
+
+<div id="ribbon">
+  <button class="tool" id="btnHome" data-label="Home">
+    <svg viewBox="0 0 24 24"><path d="M3 10.5 12 3l9 7.5"/><path d="M5.5 9.5V20h13V9.5"/></svg>
+  </button>
+  <button class="tool" id="btnLock" data-label="Lock">
+    <svg viewBox="0 0 24 24"><rect x="5" y="10.5" width="14" height="10" rx="2"/><path d="M8.5 10.5V7a3.5 3.5 0 1 1 7 0v3.5"/></svg>
+  </button>
+
+  <div class="sep"></div>
+
+  <button class="tool" id="btnRotateL" data-label="Rotate left">
+    <svg viewBox="0 0 24 24"><path d="M4 9a8 8 0 1 1 1.5 6"/><path d="M3.5 4.5V9H8"/></svg>
+  </button>
+  <button class="tool" id="btnRotateR" data-label="Rotate right">
+    <svg viewBox="0 0 24 24"><path d="M20 9a8 8 0 1 0-1.5 6"/><path d="M20.5 4.5V9H16"/></svg>
+  </button>
+
+  <div class="sep"></div>
+
+  <button class="tool" id="btnRecord" aria-pressed="false" data-label="Record video">
+    <svg viewBox="0 0 24 24" aria-hidden="true"><circle cx="12" cy="12" r="7"/></svg>
+  </button>
+
+  <button class="tool" id="btnInspect" aria-pressed="false" data-label="Inspect (hold ⌥)">
+    <svg viewBox="0 0 24 24"><path d="M4 4l6.5 16 2.5-6.5L19.5 11z"/></svg>
+  </button>
+  <button class="tool" id="btnSettings" aria-pressed="false" data-label="Device settings">
+    <svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="3"/><path d="M12 2.5v3M12 18.5v3M2.5 12h3M18.5 12h3M5.2 5.2l2.1 2.1M16.7 16.7l2.1 2.1M18.8 5.2l-2.1 2.1M7.3 16.7l-2.1 2.1"/></svg>
+  </button>
+
+  <div class="spacer"></div>
+  <div id="statusDot" title="connecting"></div>
+</div>
+
+<aside id="drawer">
+  <div id="inspectorPanel" hidden>
+    <h2>Element</h2>
+    <div id="inspectorBody" class="empty">Hover the device to inspect.</div>
+  </div>
+  <div id="settingsPanel" hidden>
+    <h2>Device settings</h2>
+    <div id="settingsBody" class="empty">Loading…</div>
+  </div>
+</aside>
+
+<script>
+"use strict";
+
+const stage = document.getElementById("stage");
+const media = document.getElementById("media");
+const video = document.getElementById("video");
+const screenCanvas = document.getElementById("screen");
+const overlay = document.getElementById("overlay");
+const drawer = document.getElementById("drawer");
+const statusDot = document.getElementById("statusDot");
+
+let config = null;
+let orientation = "portrait";
+let inputSocket = null;
+let inspecting = false;
+let axElements = [];
+let selected = null;
+let pointerDown = false;
+let openDrawer = null;
+
+const setStatus = (text, state) => {
+  statusDot.title = text;
+  statusDot.className = state || "";
+};
+
+/* ── orientation ────────────────────────────────────────────
+   The framebuffer never rotates: the simulator renders rotated content into
+   a fixed portrait surface. So the media element is rotated for display, and
+   pointer coordinates are rotated back before being sent. */
+
+const ROTATION = {
+  portrait: 0,
+  landscape_left: 90,
+  landscape_right: -90,
+  portrait_upside_down: 180,
+};
+
+const isLandscape = () =>
+  orientation === "landscape_left" || orientation === "landscape_right";
+
+/** Upright display point (0..1) to raw framebuffer point. */
+function toRawPoint(x, y) {
+  switch (orientation) {
+    case "landscape_left": return { x: y, y: 1 - x };
+    case "landscape_right": return { x: 1 - y, y: x };
+    case "portrait_upside_down": return { x: 1 - x, y: 1 - y };
+    default: return { x, y };
+  }
+}
+
+/* The display edge a point sits on, mapped into raw framebuffer edges.
+   iOS only recognizes swipe-up-to-home when the touch is flagged with the
+   edge it started from, and those edges are in raw framebuffer space, which
+   never rotates. So "bottom of what the user sees" becomes a different raw
+   edge in each orientation. */
+const BOTTOM_EDGE_BY_ORIENTATION = {
+  portrait: "bottom",
+  landscape_left: "right",
+  landscape_right: "left",
+  portrait_upside_down: "top",
+};
+
+/** The raw edge for a display point, or "none" if it is not near one. */
+function edgeForDisplayPoint(y) {
+  if (y < config.home_indicator_band) return "none";
+  return BOTTOM_EDGE_BY_ORIENTATION[orientation] || "bottom";
+}
+
+/** Rotate a delta, which has direction but no origin. */
+function toRawDelta(dx, dy) {
+  switch (orientation) {
+    case "landscape_left": return { dx: dy, dy: -dx };
+    case "landscape_right": return { dx: -dy, dy: dx };
+    case "portrait_upside_down": return { dx: -dx, dy: -dy };
+    default: return { dx, dy };
+  }
+}
+
+/* Accessibility coordinates need no rotation.
+   There are two distinct spaces here and conflating them is the easiest
+   mistake to make:
+
+   - HID input is in *raw framebuffer* space. The framebuffer is always
+     portrait-native, so pointer coordinates must be un-rotated before being
+     sent (see toRawPoint).
+   - Accessibility frames are in *logical* space, already rotated by iOS. In
+     landscape the app's own bounds are reported as 874x402 rather than
+     402x874, so normalizing against them yields upright display coordinates
+     directly.
+
+   So AX rects are drawn as-is, and hit tests are sent in display coordinates
+   while touches are sent in raw coordinates. */
+
+/** Size the stage to the upright device and rotate the media into it. */
+function layout() {
+  const fbW = config.width;
+  const fbH = config.height;
+  const uprightW = isLandscape() ? fbH : fbW;
+  const uprightH = isLandscape() ? fbW : fbH;
+
+  const available = {
+    width: window.innerWidth - document.getElementById("ribbon").offsetWidth
+      - (drawer.classList.contains("open") ? drawer.offsetWidth : 0) - 48,
+    height: window.innerHeight - 48,
+  };
+  const scale = Math.min(available.width / uprightW, available.height / uprightH);
+
+  stage.style.width = `${uprightW * scale}px`;
+  stage.style.height = `${uprightH * scale}px`;
+
+  // The media keeps the framebuffer's own aspect and is rotated on top of it.
+  media.style.width = `${fbW * scale}px`;
+  media.style.height = `${fbH * scale}px`;
+  media.style.transform =
+    `translate(-50%, -50%) rotate(${ROTATION[orientation] || 0}deg)`;
+}
+window.addEventListener("resize", () => config && layout());
+
+/* ── input ──────────────────────────────────────────────── */
+
+function connectInput() {
+  const scheme = location.protocol === "https:" ? "wss:" : "ws:";
+  inputSocket = new WebSocket(`${scheme}//${location.host}/ws/input`);
+  inputSocket.onclose = () => setTimeout(connectInput, 1000);
+}
+
+function sendInput(message) {
+  if (inputSocket && inputSocket.readyState === WebSocket.OPEN) {
+    inputSocket.send(JSON.stringify(message));
+  }
+}
+
+/** Pointer event to upright display coordinates. */
+function displayPoint(event) {
+  const rect = stage.getBoundingClientRect();
+  return {
+    x: Math.min(Math.max((event.clientX - rect.left) / rect.width, 0), 1),
+    y: Math.min(Math.max((event.clientY - rect.top) / rect.height, 0), 1),
+  };
+}
+
+// The edge is decided when the gesture starts and held for its whole life:
+// iOS ignores the gesture if the flag changes partway through.
+let activeEdge = "none";
+
+function sendTouch(phase, event) {
+  const display = displayPoint(event);
+  const raw = toRawPoint(display.x, display.y);
+  if (phase === "begin") activeEdge = edgeForDisplayPoint(display.y);
+  sendInput({ type: "touch", phase, x: raw.x, y: raw.y, edge: activeEdge });
+  if (phase === "end") activeEdge = "none";
+}
+
+stage.addEventListener("pointerdown", (event) => {
+  if (inspecting) { pick(event, true); return; }
+  pointerDown = true;
+  stage.setPointerCapture(event.pointerId);
+  sendTouch("begin", event);
+});
+
+stage.addEventListener("pointermove", (event) => {
+  if (inspecting) { hover(event); return; }
+  if (pointerDown) sendTouch("move", event);
+});
+
+const endTouch = (event) => {
+  if (!pointerDown) return;
+  pointerDown = false;
+  sendTouch("end", event);
+};
+stage.addEventListener("pointerup", endTouch);
+stage.addEventListener("pointercancel", endTouch);
+
+// Wheel deltas are sent as a fraction of the display; the server turns them
+// into a touch drag, re-planting the finger when it runs out of screen.
+stage.addEventListener("wheel", (event) => {
+  if (inspecting) return;
+  event.preventDefault();
+  const rect = stage.getBoundingClientRect();
+  const display = displayPoint(event);
+  const raw = toRawPoint(display.x, display.y);
+  const delta = toRawDelta(event.deltaX / rect.width, event.deltaY / rect.height);
+  sendInput({ type: "scroll", dx: delta.dx, dy: delta.dy, x: raw.x, y: raw.y });
+}, { passive: false });
+
+/* ── recording ─────────────────────────────────────────────────────────── */
+const btnRecord = document.getElementById("btnRecord");
+let recording = false;
+let recordingTimer = null;
+
+btnRecord.addEventListener("click", async () => {
+  btnRecord.disabled = true;
+  try {
+    if (!recording) {
+      const response = await fetch("/api/recording/start", { method: "POST" });
+      if (!response.ok) throw new Error(await response.text());
+      recording = true;
+      btnRecord.setAttribute("aria-pressed", "true");
+      const startedAt = Date.now();
+      recordingTimer = setInterval(() => {
+        const seconds = Math.floor((Date.now() - startedAt) / 1000);
+        setStatus(`recording ${Math.floor(seconds / 60)}:${String(seconds % 60).padStart(2, "0")}`);
+      }, 500);
+    } else {
+      // Finalizing flushes the file index, so it is not instant.
+      setStatus("finishing recording…");
+      const response = await fetch("/api/recording/stop", { method: "POST" });
+      if (!response.ok) throw new Error(await response.text());
+      const recorded = await response.json();
+      setStatus(`saved ${recorded.width}x${recorded.height}, ${recorded.frames} frames — ${recorded.path}`);
+      recording = false;
+      btnRecord.setAttribute("aria-pressed", "false");
+      clearInterval(recordingTimer);
+    }
+  } catch (error) {
+    setStatus(`recording failed: ${error.message}`);
+    recording = false;
+    btnRecord.setAttribute("aria-pressed", "false");
+    clearInterval(recordingTimer);
+  } finally {
+    btnRecord.disabled = false;
+  }
+});
+
+/* Keys that are not text. Values are USB HID usage codes, which is what the
+   simulator's keyboard takes — not HIToolbox virtual keycodes. Printable
+   characters are not listed here: they are sent as text and expanded to key
+   presses server-side, so the US-ASCII table lives in one tested place. */
+const NAMED_KEYS = {
+  Enter: 40, Escape: 41, Backspace: 42, Tab: 43,
+  ArrowRight: 79, ArrowLeft: 80, ArrowDown: 81, ArrowUp: 82,
+};
+const MODIFIER_USAGES = { control: 224, shift: 225, alt: 226, meta: 227 };
+
+window.addEventListener("keydown", (event) => {
+  if (event.key === "Alt" && !inspecting) { setInspecting(true, true); return; }
+  if (inspecting && event.key === "Escape") { clearSelection(); return; }
+  if (event.target.tagName === "SELECT" || event.target.tagName === "BUTTON") return;
+
+  const modifiers = [];
+  if (event.ctrlKey) modifiers.push(MODIFIER_USAGES.control);
+  if (event.altKey) modifiers.push(MODIFIER_USAGES.alt);
+  if (event.metaKey) modifiers.push(MODIFIER_USAGES.meta);
+
+  const named = NAMED_KEYS[event.key];
+  if (named !== undefined) {
+    event.preventDefault();
+    sendInput({ type: "key", key_code: named, modifiers });
+    return;
+  }
+
+  // A single printable character. Shift is implied by the character itself,
+  // so it is not added to the modifier list.
+  if ([...event.key].length === 1 && !event.metaKey && !event.ctrlKey) {
+    event.preventDefault();
+    sendInput({ type: "text", text: event.key });
+  }
+});
+window.addEventListener("keyup", (event) => {
+  if (event.key === "Alt" && momentaryInspect) setInspecting(false);
+});
+
+// Paste types the clipboard contents, which is the practical way to enter a
+// long string. Still US-ASCII only; the server rejects anything else.
+window.addEventListener("paste", (event) => {
+  const text = event.clipboardData?.getData("text");
+  if (!text) return;
+  event.preventDefault();
+  sendInput({ type: "text", text });
+});
+
+/* ── ribbon ─────────────────────────────────────────────── */
+
+const ROTATE_LEFT = { portrait: "landscape_right", landscape_right: "portrait_upside_down", portrait_upside_down: "landscape_left", landscape_left: "portrait" };
+const ROTATE_RIGHT = { portrait: "landscape_left", landscape_left: "portrait_upside_down", portrait_upside_down: "landscape_right", landscape_right: "portrait" };
+
+async function rotate(map) {
+  const next = map[orientation] || "portrait";
+  await fetch("/api/orientation", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ orientation: next }),
+  });
+  orientation = next;
+  layout();
+  if (selected) drawSelection(selected);
+}
+
+document.getElementById("btnHome").onclick = () => sendInput({ type: "button", button: "home" });
+document.getElementById("btnLock").onclick = () => sendInput({ type: "button", button: "lock" });
+document.getElementById("btnRotateL").onclick = () => rotate(ROTATE_LEFT);
+document.getElementById("btnRotateR").onclick = () => rotate(ROTATE_RIGHT);
+
+function showDrawer(name) {
+  openDrawer = openDrawer === name ? null : name;
+  drawer.classList.toggle("open", openDrawer !== null);
+  document.getElementById("inspectorPanel").hidden = openDrawer !== "inspector";
+  document.getElementById("settingsPanel").hidden = openDrawer !== "settings";
+  document.getElementById("btnSettings").setAttribute("aria-pressed", String(openDrawer === "settings"));
+  layout();
+}
+
+/* ── inspector ──────────────────────────────────────────── */
+
+const btnInspect = document.getElementById("btnInspect");
+let momentaryInspect = false;
+
+function setInspecting(on, momentary = false) {
+  inspecting = on;
+  momentaryInspect = on && momentary;
+  btnInspect.setAttribute("aria-pressed", String(on));
+  stage.classList.toggle("inspecting", on);
+  if (on) {
+    refreshTree();
+    if (openDrawer !== "inspector") showDrawer("inspector");
+  } else {
+    clearSelection();
+  }
+}
+btnInspect.onclick = () => setInspecting(!inspecting);
+document.getElementById("btnSettings").onclick = () => {
+  showDrawer("settings");
+  if (openDrawer === "settings") loadSettings();
+};
+
+async function refreshTree() {
+  try {
+    // scan=true also sweeps the regions the tree walk cannot explain, which is
+    // the only way the cached hover preview sees WKWebView and Safari content.
+    // Costs a few hundred milliseconds, which is fine on an explicit toggle.
+    const response = await fetch("/api/ax/tree?scan=true");
+    if (!response.ok) throw new Error(await response.text());
+    const snapshot = await response.json();
+    axElements = snapshot.elements.filter((e) => e.bounds);
+    const after = snapshot.coverage_after_scan ?? snapshot.coverage;
+    setStatus(`inspecting · ${axElements.length} elements · ${Math.round(after * 100)}% covered`);
+  } catch (error) {
+    console.warn("accessibility tree unavailable:", error);
+    axElements = [];
+  }
+}
+
+const area = (e) => e.bounds.width * e.bounds.height;
+
+/** Client-side pick against the cached tree: instant, but can be stale. */
+function pickCached(x, y) {
+  let best = null;
+  for (const element of axElements) {
+    const b = element.bounds;
+    if (x < b.x || y < b.y || x > b.x + b.width || y > b.y + b.height) continue;
+    // `<=` rather than `<` so that among elements sharing bounds — a Button
+    // wrapping a Label wrapping its text, which is extremely common — the
+    // last one wins. The tree arrives in document order, so later means
+    // deeper and drawn on top, which is what the pointer is actually over.
+    if (!best || area(element) <= area(best)) best = element;
+  }
+  return best;
+}
+
+let hoverTimer = null;
+
+function hover(event) {
+  const display = displayPoint(event);
+  const cached = pickCached(display.x, display.y);
+  if (cached) drawSelection(cached);
+
+  // Confirm with a real hit test once the pointer settles; the cached tree
+  // mis-picks overlapping and transformed views.
+  clearTimeout(hoverTimer);
+  hoverTimer = setTimeout(() => confirmHit(display.x, display.y), 110);
+}
+
+async function confirmHit(x, y) {
+  try {
+    const response = await fetch(`/api/ax/hit?x=${x}&y=${y}`);
+    if (!response.ok) return;
+    const element = await response.json();
+    // A null means the point is over a backdrop with nothing pointable on it.
+    // Clear rather than leaving a stale highlight sitting under the cursor.
+    if (element) drawSelection(element); else clearSelection();
+  } catch { /* hover is best-effort */ }
+}
+
+async function pick(event, sticky) {
+  const display = displayPoint(event);
+  const cached = pickCached(display.x, display.y);
+  if (cached) drawSelection(cached);
+  await confirmHit(display.x, display.y);
+  if (sticky && selected) showDetails(selected);
+}
+
+function drawSelection(element) {
+  // Nothing sensible to outline; leave whatever was there rather than
+  // painting a zero-size or full-screen box.
+  if (!element.bounds || element.bounds.width <= 0 || element.bounds.height <= 0) return;
+  selected = element;
+  const b = element.bounds;
+  overlay.innerHTML = "";
+
+  const box = document.createElement("div");
+  box.className = "box";
+  box.style.cssText =
+    `left:${b.x * 100}%;top:${b.y * 100}%;width:${b.width * 100}%;height:${b.height * 100}%`;
+  overlay.appendChild(box);
+
+  const chip = document.createElement("div");
+  chip.className = "chip";
+  chip.textContent = element.label ? `${element.role} · ${element.label}` : element.role;
+  chip.style.left = `${b.x * 100}%`;
+  // Flip below the box when there is no room above it.
+  chip.style.top = b.y > 0.04
+    ? `calc(${b.y * 100}% - 20px)`
+    : `calc(${(b.y + b.height) * 100}% + 4px)`;
+  overlay.appendChild(chip);
+}
+
+function clearSelection() {
+  selected = null;
+  overlay.innerHTML = "";
+}
+
+const orDash = (value) => (value === null || value === undefined || value === "" ? "—" : value);
+
+function showDetails(element) {
+  if (openDrawer !== "inspector") showDrawer("inspector");
+  document.getElementById("inspectorBody").innerHTML = `
+    <div class="role"></div>
+    <div class="muted" id="dLabel"></div>
+    <dl>
+      <dt>value</dt><dd id="dValue"></dd>
+      <dt>identifier</dt><dd id="dIdent"></dd>
+      <dt>enabled</dt><dd id="dEnabled"></dd>
+      <dt>actions</dt><dd id="dActions"></dd>
+    </dl>
+    <div style="margin-top:14px">
+      <label style="color:var(--muted)">CLI selector</label>
+      <code id="dSelector"></code>
+      <button class="wide" id="dCopy">Copy selector</button>
+    </div>`;
+  const body = document.getElementById("inspectorBody");
+  body.classList.remove("empty");
+  body.querySelector(".role").textContent = element.role;
+  document.getElementById("dLabel").textContent = orDash(element.label);
+  document.getElementById("dValue").textContent = orDash(element.value);
+  document.getElementById("dIdent").textContent = orDash(element.identifier);
+  document.getElementById("dEnabled").textContent = element.enabled ? "yes" : "no";
+  document.getElementById("dActions").textContent =
+    element.actions.length ? element.actions.join(", ") : "—";
+  document.getElementById("dSelector").textContent = element.selector;
+  document.getElementById("dCopy").onclick = () =>
+    navigator.clipboard.writeText(element.selector);
+}
+
+/* ── device settings ────────────────────────────────────── */
+
+const SETTING_LABELS = {
+  appearance: "Appearance",
+  increase_contrast: "Increase contrast",
+  content_size: "Text size",
+};
+
+async function loadSettings() {
+  const body = document.getElementById("settingsBody");
+  body.textContent = "Loading…";
+  const settings = await (await fetch("/api/settings")).json();
+  body.innerHTML = "";
+  body.classList.remove("empty");
+
+  for (const setting of settings) {
+    const field = document.createElement("div");
+    field.className = "field";
+    const label = document.createElement("label");
+    label.textContent = SETTING_LABELS[setting.key] || setting.key;
+    field.appendChild(label);
+
+    if (setting.value === "unsupported") {
+      const note = document.createElement("div");
+      note.className = "empty";
+      note.textContent = "Not supported by this runtime";
+      field.appendChild(note);
+    } else if (setting.allowed.length === 2) {
+      // Two-valued settings read better as a segmented control.
+      const seg = document.createElement("div");
+      seg.className = "seg";
+      for (const value of setting.allowed) {
+        const button = document.createElement("button");
+        button.textContent = value;
+        button.setAttribute("aria-pressed", String(setting.value === value));
+        button.onclick = () => applySetting(setting.key, value);
+        seg.appendChild(button);
+      }
+      field.appendChild(seg);
+    } else {
+      const select = document.createElement("select");
+      for (const value of setting.allowed) {
+        const option = document.createElement("option");
+        option.value = value;
+        option.textContent = value.replace(/-/g, " ");
+        option.selected = setting.value === value;
+        select.appendChild(option);
+      }
+      select.onchange = () => applySetting(setting.key, select.value);
+      field.appendChild(select);
+    }
+    body.appendChild(field);
+  }
+}
+
+async function applySetting(key, value) {
+  const response = await fetch("/api/settings", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ key, value }),
+  });
+  if (!response.ok) console.warn("setting failed:", await response.text());
+  loadSettings();
+}
+
+/* ── webrtc ─────────────────────────────────────────────── */
+
+async function startWebRtc() {
+  const peer = new RTCPeerConnection({ iceServers: [] });
+  peer.addTransceiver("video", { direction: "recvonly" });
+  peer.ontrack = (event) => { video.srcObject = event.streams[0]; };
+  peer.onconnectionstatechange = () => {
+    if (peer.connectionState === "connected") setStatus("live · webrtc", "live");
+    if (peer.connectionState === "failed") setStatus("webrtc failed", "error");
+  };
+
+  await peer.setLocalDescription(await peer.createOffer());
+  // Single-round-trip signaling, so wait out gathering instead of trickling.
+  await new Promise((resolve) => {
+    if (peer.iceGatheringState === "complete") return resolve();
+    peer.addEventListener("icegatheringstatechange", () => {
+      if (peer.iceGatheringState === "complete") resolve();
+    });
+    setTimeout(resolve, 2000);
+  });
+
+  const response = await fetch("/webrtc/offer", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ sdp: peer.localDescription.sdp }),
+  });
+  if (!response.ok) throw new Error(await response.text());
+  await peer.setRemoteDescription({ type: "answer", sdp: (await response.json()).sdp });
+
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("no webrtc media")), 6000);
+    video.addEventListener("loadeddata", () => { clearTimeout(timer); resolve(); }, { once: true });
+  });
+}
+
+/* ── h264 / webcodecs ───────────────────────────────────── */
+
+const TAG_PARAMETER_SET = 0x01;
+const TAG_KEYFRAME = 0x02;
+
+async function startH264() {
+  if (!("VideoDecoder" in window)) throw new Error("WebCodecs unavailable");
+
+  media.classList.add("h264");
+  // Sized from the first decoded frame rather than the capture resolution:
+  // the server downscales before encoding, and painting a small frame onto a
+  // full-resolution canvas would just cost an extra upscale.
+  const context = screenCanvas.getContext("2d");
+  let decoder = null;
+
+  // configure() reports success synchronously and only surfaces an
+  // unsupported configuration through the async error callback.
+  async function configureDecoder(cfg) {
+    if (!(await VideoDecoder.isConfigSupported(cfg)).supported) {
+      throw new Error(`${cfg.codec} not supported by this browser`);
+    }
+    decoder = new VideoDecoder({
+      output: (frame) => {
+        if (screenCanvas.width !== frame.displayWidth
+            || screenCanvas.height !== frame.displayHeight) {
+          screenCanvas.width = frame.displayWidth;
+          screenCanvas.height = frame.displayHeight;
+        }
+        context.drawImage(frame, 0, 0, screenCanvas.width, screenCanvas.height);
+        frame.close();
+      },
+      error: (error) => setStatus(`decode error: ${error.message}`, "error"),
+    });
+    decoder.configure(cfg);
+    setStatus("live · h264", "live");
+  }
+
+  const scheme = location.protocol === "https:" ? "wss:" : "ws:";
+  const socket = new WebSocket(`${scheme}//${location.host}/ws/stream`);
+  socket.binaryType = "arraybuffer";
+
+  socket.onmessage = (event) => {
+    const view = new DataView(event.data);
+    const length = view.getUint32(0);
+    const tag = view.getUint8(4);
+    const payload = new Uint8Array(event.data, 5, length - 1);
+
+    if (tag === TAG_PARAMETER_SET) {
+      const codec = `avc1.${[...payload.slice(1, 4)]
+        .map((b) => b.toString(16).padStart(2, "0")).join("").toUpperCase()}`;
+      // No hardwareAcceleration hint: despite the name "prefer-hardware" is
+      // a requirement, and phone-shaped resolutions exceed what hardware
+      // decoders accept, making the configuration unsupported outright.
+      configureDecoder({ codec, description: payload.slice(), optimizeForLatency: true })
+        .catch((error) => setStatus(`cannot decode: ${error.message}`, "error"));
+      return;
+    }
+
+    if (!decoder) return;
+    decoder.decode(new EncodedVideoChunk({
+      type: tag === TAG_KEYFRAME ? "key" : "delta",
+      timestamp: performance.now() * 1000,
+      data: payload.slice(),
+    }));
+  };
+  socket.onclose = () => setStatus("stream closed", "error");
+}
+
+/* ── boot ───────────────────────────────────────────────── */
+
+async function main() {
+  config = await (await fetch("/api/config")).json();
+  orientation = config.orientation || "portrait";
+  layout();
+  connectInput();
+
+  const preferWebRtc = config.default_transport === "webrtc";
+  const primary = preferWebRtc ? startWebRtc : startH264;
+  const fallback = preferWebRtc ? startH264 : startWebRtc;
+
+  try {
+    await primary();
+  } catch (error) {
+    console.warn("primary transport failed, falling back:", error);
+    try {
+      await fallback();
+    } catch (fallbackError) {
+      setStatus(`no stream: ${fallbackError.message}`, "error");
+    }
+  }
+}
+
+main();
+</script>
+</body>
+</html>