Arcen v0.19.0

Native tablet ships, proven with a real Wacom Intuos5 on Linux X11, Linux
Wayland and macOS Piers. The pen tablet on your Mac's desk is attached to
the remote desktop as if it were plugged into the host. On a Linux Pier the
host's own tablet driver takes it, with its pressure curves and side
switches; on a macOS Pier, Arcen reads the pen of a model it knows (the
Intuos5 touch L) and posts tablet events with pressure. Every Pier reports
the pen's own position and the Deck draws a pen dot there: measured with an
emulated Intuos5 on an X11 host at one report per 41 ms round trip, the dot
reaches the Deck a median 16 ms behind the pen, against 80 ms when it
followed the X pointer. On Linux, Native tablet is an administrator opt-in.
Windows Piers keep Tablet support (Windows Ink).

Also new: the macOS Pier types text and reports Connection Health; Option
keys get an Automatic setting; a user guide for artists and editors; Stream
Statistics; official builds carry a published build ID; and the licence
exception, CLA, trademark policy and notice are final, version 1.0.

0.19.0 speaks protocol v5, like 0.17.0 and 0.18.0, and every addition is
negotiated, so 0.17.0 and 0.18.0 Decks and Piers keep working without the
new features. One exception: pen barrel buttons need an updated Deck and an
updated macOS or Windows Pier (see Known limitations).

Coming from 0.17.0

0.18.0 was not published, so 0.19.0 is the first public release since
0.17.0 and brings 0.18.0's changes too:

• Typing text on any host. Paste as Keystrokes types the Mac clipboard
  where clipboard sharing cannot reach; Characters mode sends what was typed
  whatever the host's layout.
• Mac keyboards on Windows hosts work the Windows App way: ⌘ as the
  Windows key, ⌘C as Ctrl+C, AltGr and the ISO key on European layouts.
• Real cursor images on X11 and Windows hosts with the Mac's own cursor.
• Colour check measures every decoded pixel against a known pattern.
• Test connection and arcen-deck diagnose check the way to a Pier
  without a password; Connection Health shows the Pier's own measurement of
  the network path.

0.18.0's upgrade notes apply as well: Wayland hosts re-qualify on their
first start (a few minutes); the Linux installer adds
/etc/tmpfiles.d/arcen-pier.conf; the Windows Pier injects keys by scan
code, so set the Windows user's layout to match the Mac keyboard.

Downloads

File	For
Arcen-Deck-0.19.0-macOS.zip	The Deck on an Apple-silicon Mac, macOS 12 or later
Arcen-Deck-Intel-0.19.0-macOS.zip	The Deck on an Intel Mac, macOS 12 or later
install-arcen-pier-0.19.0-linux-x86_64	The Linux Pier (Rocky Linux 9 or 10)
install-arcen-pier-0.19.0-windows-x64.exe	The Windows Pier (Windows 10 1809+, 11, Server 2022+)
ArcenPier-0.19.0.pkg	The macOS Pier preview, macOS 14.2 or later, for a signed-in user
SHA256SUMS.txt	Checksums: shasum -a 256 -c SHA256SUMS.txt --ignore-missing

Pick the Deck that matches your Mac (Apple menu → About This Mac); install
only one. Native tablet needs macOS 13 or later on the Deck, and on Intel
Macs it has not been tested with a real tablet. To check the way to a host
without signing in:

"/Applications/Arcen Deck.app/Contents/MacOS/arcen-deck" diagnose HOST 18444        # Apple silicon
"/Applications/Arcen Deck Intel.app/Contents/MacOS/arcen-deck" diagnose HOST 18444  # Intel

Upgrade, step by step

1. Deck: quit it, replace Arcen Deck (or Arcen Deck Intel) in
   Applications, and open it. If you use Native tablet, restart the Mac (or
   turn the Arcen USB helper off and on in System Settings › General › Login
   Items) so the helper starts on its new socket path.
2. Linux Pier, in a maintenance window (a restart ends running
   sessions):

   chmod +x install-arcen-pier-0.19.0-linux-x86_64          # a download is not executable
   sudo ./install-arcen-pier-0.19.0-linux-x86_64 --check     # what it will do
   sudo ./install-arcen-pier-0.19.0-linux-x86_64 --restart

   The upgrade keeps /etc/arcen/pier.json, including the Native tablet
   choice. Add --native-tablet to turn Native tablet on (on Rocky
   Linux/RHEL it installs kernel-modules-internal), --no-native-tablet
   to turn it off.
3. A Linux Pier that used ARCEN_USB_HARD_LAB: run step 2 with
   --native-tablet, then delete the systemd drop-in that sets the variable
   (systemctl cat arcen-pier names it) and run
   sudo systemctl daemon-reload. The variable is no longer read.
4. Linux X11 host, Native tablet for the first time: restart the display
   manager once while nobody is signed in at the console
   (sudo systemctl restart gdm), or reboot. Until then the Pier refuses
   Native tablet on X11 desktops and says why.
5. Windows Pier: run the installer in PowerShell as Administrator, then
   reboot.
6. macOS Pier (preview): open ArcenPier-0.19.0.pkg in Installer.app.
   On a new install, approve Screen & System Audio Recording and
   Accessibility for Arcen Agent Helper, and System Audio Recording when the
   helper asks (without it the host refuses sessions, because it cannot keep
   its own speakers silent).

Known limitations

• Pen barrel buttons: update the Deck and the Pier together. With mixed
  versions an application reading -[NSEvent buttonMask] on a macOS Pier
  sees the wrong bits. On a Windows Pier the upper barrel button works only
  with the 0.19.0 Pier (older Piers inject it as a second pointer button,
  which Windows ignores for a pen); the lower one works on any version.
  Linux Piers of any version get both right with an updated Deck.
• Application ink on X11 follows xf86-input-wacom's smoothed pointer,
  so on a slow link it trails the Deck's pen dot.
• GNOME Wayland draws thinner lines with Native tablet: Mutter squares
  stylus pressure on its default curve. Raise the curve in GNOME Settings ›
  Wacom Tablet.
• A held side switch looks like "pen but no ink" on GNOME X11. Lift the
  pen out of range and back, or remap the switch.
• Safari reports every pen as a mouse; test pen pages on a macOS Pier in
  Chrome or Firefox.
• A macOS Pier refuses tablet models it does not know (today it knows the
  Wacom Intuos5 touch L); the Deck keeps the tablet for Tablet support.
• No host pen positions on multi-output Wayland desktops, Windows Piers
  or secondary Deck viewports yet.
• The macOS Pier is a preview: the cold-boot login window and
  multi-display on physical hardware are unqualified.

Licence

Arcen is free software under the GNU AGPL 3.0 only with the Arcen Store
Distribution Exception. The exception, the
CLA,
TRADEMARKS.md
and NOTICE are
final, version 1.0, effective 2026-11-12. Contributors accept the CLA with a
statement in their first pull request. The exception grants no rights in
third-party components: the macOS Deck statically links libusb, which stays
under the LGPL-2.1-or-later
(third-party notices).

More

• Everything in this release, including the full 0.18.0 list:
  CHANGELOG.md
• Installing and first connection:
  README,
  installing in detail
• Pen and Native tablet:
  pen and tablet guide

All changes since the previous public release:
v0.17.0...v0.19.0

Arcen v0.17.0

The Linux Pier now serves Wayland as well as X11. On a host without an Xorg
server each sign-in gets its own GNOME Shell/Mutter desktop, proven on that
host before anything is served; on stock GNOME a Wayland desktop can also run
natively on its own logind seat, which gives the Deck's pen real pressure and
tilt there. This release also closes a polkit hole in every earlier Linux
release: a remote X11 desktop received the console's administrative rights
(see Security).

Deck and Pier must be updated together: 0.17.0 speaks protocol v5 on
isolated QUIC lanes, and a 0.16 Deck or Pier is refused with a message saying
to update both to the same release. Linux operators: read the upgrade notes
first.

Upgrade notes

• Linux hosts become muted by default. The Linux Pier now honours
  audio.local_playback, and its default, muted, silences the host's own
  speakers for the whole session. On X11, an Arcen sink becomes the default
  of the user's audio server, every other sink is muted and every stream is
  moved onto it; on Wayland, the session's private audio graph has no
  speaker in it. A host that cannot prove the silence refuses the session and
  tells the Deck why. Set audio.local_playback to audible to keep the
  speakers playing. If the same user is also signed in at an X11 host's
  console, that console is silent during the remote session too.
• X11 desktop depth is auto (new key video.x11_desktop_depth). An
  Xorg desktop is now created at depth 30 only for a Grading or HDR session
  (or a declared rec2100-pq desktop), and at depth 24 otherwise, because
  at depth 30 Firefox and Chrome render without the GPU. The depth is fixed
  for the desktop's life: Grading or HDR on a desktop created for Auto or
  Speed is served visibly as Auto (eight_bit_source), and the Deck says
  how to get a ten-bit desktop — sign out and reconnect with Grading, or have
  the host pinned. Grading hosts (Flame, Resolve) should set
  video.x11_desktop_depth to 30, which restores the earlier behaviour.
• One X11 desktop per host. An X11 desktop makes its own session the
  active one on the console seat. Sign every user out of the old build's
  desktops before upgrading: a desktop still held by the previous Pier, or by
  a second Pier on the same host, stops the next one from starting
  (session launcher protocol failed).
• Wayland hosts re-qualify themselves. The qualification record moves to
  schema 3, and an update that makes the record stale (Pier, GNOME/Mutter,
  PipeWire or GPU driver) is now re-qualified by the service at start instead
  of refusing (capture.wayland_auto_requalify, default true; bounded; a
  failure on the same stack is not retried for 6 hours). Expect one
  re-qualification after this update. false refuses and names the command.
  The Pier handles SIGHUP (logrotate) and SIGTERM from the start of
  start-up: a reload during the re-qualification only reopens the log, a stop
  abandons it cleanly, and an interrupted attempt is retried rather than
  counted as a failure. The unit also restarts the Pier after a death by
  SIGHUP or SIGPIPE (RestartForceExitStatus).
• A refused desktop takeover reads as one. Signing in while another
  user's desktop waits for its owner to reconnect now says so instead of
  "authentication failed: active session requires resume authentication".
• The GNOME prefix is optional. capture.wayland_compositor_prefix
  (default: the distribution's /usr) lets Arcen's Wayland sessions run a
  GNOME Shell and Mutter installed beside the system's, such as
  /opt/arcen-gnome/51, without changing the system GNOME. It is needed only
  for Grading and HDR on Wayland where the distribution ships GNOME 49 or
  older. Arcen does not ship a prefix; the Pier and the installer verify the
  whole prefix (root-owned, not writable by group or others, no link out of
  it) and refuse one that fails. See docs/operations/pier-administration.md.
• Linux hosts get a polkit rule. The installer writes
  /etc/polkit-1/rules.d/05-arcen-remote-session.rules, and the Pier
  rewrites it at every start (see Security). For a remote seated desktop it
  answers before later rules, so a site rule numbered after 05- (or a
  .pkla file) that denies such users an action, or demands an
  administrator for it, no longer reaches them: renumber site restrictions
  and deliberate grants for remote desktop users 00–04.
  arcen-pier polkit-rule status lists the later rules that may be
  affected. On polkit older than 0.106 (no JavaScript rules, for example
  Ubuntu 22.04) the rule cannot be installed: X11 desktops are still served,
  with a SECURITY: error in the log at start and at every sign-in.
• Native Wayland desktops are on where proven. wayland.session_mode
  defaults to auto: when the host's qualification (at install, or the
  automatic re-qualification) proves a native desktop, a Wayland desktop
  runs natively on its own seat, one at a time, and gets a real pen. That needs an NVIDIA GPU without display connectors
  (a vGPU or data-centre GPU) and the in-tree vkms module; anything else
  stays headless, as before. Set headless to keep every desktop headless.
  A display-manager restart while a native desktop runs freezes it; the
  installer explains this and offers --disable-gdm.
• The lab seat pen stays off. wayland.lab_seat_pen (default false)
  works only with a compositor built with the unmerged mutter!5224 and an
  Arcen lab edit, and applies only to headless desktops. Do not enable it on
  a production host; native desktops give a real pen on stock GNOME.
• The Linux release Pier links libpipewire-0.3.so.0 on every host, X11
  included, alongside libpulse and libpam; the installer names a missing
  library before writing anything. It is still built on Rocky Linux 9
  (glibc 2.34).

Security

• Linux Pier (X11): a remote desktop no longer gets the console's polkit
  rights. polkit counts a session with a seat as local and ignores that it
  is remote, and every X11 desktop is a session on seat0, so in every
  earlier Linux release (0.16.1 and older) its user could power off or
  reboot the host, control its networking, mount disks or set the clock
  without a password. The installer now installs
  /etc/polkit-1/rules.d/05-arcen-remote-session.rules (rewritten by the
  Pier at every start, removed by --uninstall), which gives sessions that
  logind records as remote, that an Arcen launcher opened, or that sit on an
  Arcen desktop seat each action's remote (allow_any) answer. Before
  handing a desktop over, the Pier asks polkit (pkcheck) about power off,
  reboot, suspend, network control, mounting and the clock, and refuses the
  desktop, killing its processes, on any grant; a seated desktop is also
  refused when polkit does not answer, or before launch when the rule is
  missing. Native Wayland desktops use the same rule and proof; headless
  ones are seatless and were never affected. Administrators: site
  restrictions for remote users must be numbered 00–04 (see Upgrade
  notes); on polkit older than 0.106 the rule cannot be installed, and X11
  desktops are served with a SECURITY: error logged at start and at every
  sign-in — upgrade polkit or restrict who may sign in. Reported internally;
  no CVE.
• Linux Pier: the sign-in password is wiped on every refused sign-in, not
  only on success; the session launcher reads it into a single wiped buffer
  and is no longer dumpable, and the Pier wipes its copies of the sign-in
  request.
• Linux Pier (X11): the console's keyboard and mouse no longer drive a remote
  desktop. Every earlier Linux release let the dedicated Xorg add every
  input device on the console seat, so a person at the physical keyboard, or
  anyone with the virtual machine's console, could type and click in a
  remote user's desktop; a second X11 desktop on the same host also received
  the first one's virtual input. Each desktop's virtual devices are now named
  for its display, and its X server ignores every device without Arcen's
  vendor id and that name. This stops ordinary console devices; it is not
  proof of origin (see docs/security/trust-boundaries.md). Reported
  internally; no CVE.
• Linux Pier: PrintScreen is sent as KEY_PRINT instead of KEY_SYSRQ, so
  a remote Alt+PrintScreen+key can no longer run a kernel SysRq action.
  Applications still receive Print. No Deck key maps to a power, sleep or
  wake key, and a test keeps it so.
• Linux Pier (Wayland): Native tablet (USB bridged) and the quarantined
  raw-HID passthrough are refused. A headless compositor opens no input
  devices, so a bridged tablet would have reached the machine's physical
  seat instead of the Deck's desktop. The Deck is told why and pointed to
  Tablet support.
• Linux Pier (Wayland): the sign-in password that unlocks the GNOME keyring
  is read by a non-dumpable session agent into one zeroizing buffer, never
  sits in a stdin buffer, and appears in no process's argv or environment.
• Linux Pier: clipboard helpers receive the negotiated directions, so the
  host never reads a content kind the Deck did not ask for, and a refused or
  abandoned X11 INCR copy can no longer leak a stale chunk into the next
  copy.
• Linux Pier (Wayland): the Xwayland stale-socket sweep removes a display's
  socket only while its lock is the user's own file naming the session
  compositor, so it cannot remove another live desktop's socket.

Added

• Linux Pier: headless Wayland desktops on hosts without an Xorg server.
  Each sign-in gets its own seatless logind session running a headless GNOME
  Shell/Mutter (40 or later) with a private D-Bus bus, PipeWire and
  WirePlumber; video goes through Mutter's ScreenCast into the fused capenc
  and input through the session's RemoteDesktop injector. The Pier chooses
  the provider at start from host facts (capture.provider = auto): an
  installed...

Arcen v0.16.1

Fixed

• Linux Pier: sessions on a freshly installed host no longer fail with
  dedicated Xorg failed to start. The packaged /etc/arcen/xorg.conf named
  the development lab's GPU (BusID "PCI:6:16:0"), so on any other machine the
  NVIDIA driver reported No devices detected. The template now ships without
  a BusID; the installer finds the NVIDIA GPU in sysfs and sets it (keeping
  a correct one, backing up an operator file to
  xorg.conf.before-<version>, warning when there is no NVIDIA GPU), and the
  Pier re-checks it in memory before every X server, so an existing stale file
  keeps working until the installer is rerun. The decision is the shared
  arcen_outputs::xorg_gpu.
• Linux Pier: capture opens CUDA on the dedicated X server's GPU, by PCI
  address (ARCEN_CAPTURE_GPU_PCI, logged as capture_gpu_pci=), instead of
  CUDA device 0, so a host with different GPUs cannot capture or encode on one
  the screen does not live on. Capture children use
  CUDA_DEVICE_ORDER=PCI_BUS_ID.
• Linux installer: an existing /etc/arcen/xorg.conf is repaired only when
  it is a regular root-owned file that group and other users cannot write, the
  rule the Pier itself enforces, and backups never overwrite an earlier one.
  The Pier's head-discovery probe now applies the same rule before starting its
  root X server.

Arcen v0.16.0

macOS Deck

• Two Deck apps from one source, both for macOS 12 or later: Arcen Deck
  for Apple silicon (Arcen-Deck-<version>-macOS.zip) and Arcen Deck
  Intel for Intel Macs (Arcen-Deck-Intel-<version>-macOS.zip). They share
  the bundle ID deck.arcen.tech. build-deck-app.sh --arch arm64|x86_64
  builds either on either kind of Mac, so one release machine signs and
  notarizes both; every binary is checked for exactly one architecture and a
  minos equal to LSMinimumSystemVersion.
• apple-cf 0.9.3 and videotoolbox 0.18.1 are vendored with macOS 12
  patches (third_party/*-arcen1, each with ARCEN_NOTICE.md and a source
  manifest), so the Deck loads on macOS 12 and builds with Swift 5.7.
• A Deck platform profile (arcen_media::deck_platform) decides what differs
  between Apple silicon and Intel: the deck_platform label, AV1 only on
  Apple silicon with macOS 14 and only when the decode probe proves it,
  software decode expected on Intel, and native tablet only on macOS 13+.
  arcen-deck platform-report prints it without opening a window.
• The viewer takes keyboard focus when nothing else owns it, so keys work
  before the first click.
• Paced frames age against the display link's current time rather than the
  future scan-out target; on Intel/AMD with macOS 12 a ~49 ms lead had marked
  every frame stale.
• Presented-handler callbacks count as presented until a drawable reports a
  presentedTime, so graphics stacks that never timestamp are not reported as
  unpresented.
• The Deck adds the system Swift rpath to its own binaries, so native builds
  with the macOS 12 SDK load the Swift runtime.

Security and supply chain

• rustls 0.23.45 and rustls-webpki 0.103.15.
• scripts/verify-vendored-source.sh checks every vendored tree before each
  Deck build and in CI, and refuses symlinks or any entry that is not a regular
  file or directory; the apple-cf Swift bridge never follows symlinks.

Input

• Pen and tablet support is no longer tied to Wacom or to any list of tablet
  makers. Whether a device is a pen tablet is decided from its HID report
  descriptor by a new shared, bounded classifier
  (arcen_usb_bridge::classify_pen_tablet): a standard Digitizers-page pen
  with position and contact, pressure or proximity qualifies; so does a
  Digitizer or Pen collection on the vendor-defined Digitizers page 0xFF0D
  (as Intuos5-style tablets publish it, with opaque reports and unknown axes)
  unless the device also has a game-controller collection; keyboards, mice,
  gamepads, devices on other vendor pages and touch-only devices are refused
  on their own. Express keys presented as a keyboard or keypad are part of a
  pen tablet and are accepted with it.
  Vendor ids are now informational only.
• macOS Deck: Tablet support is offered for any pen tablet, USB or Bluetooth,
  whether or not one is attached when connecting, replacing the
  Wacom-USB-vendor-id check that left other tablets without typed pen input.
  Tablet presence (report descriptors in the I/O Registry, or a pen sample
  AppKit already delivered) is shown in the Tablet Monitor. Settings, help, Tablet Monitor, logs and errors
  say "tablet" instead of "Wacom".
• Pressure, tilt and rotation conversions are shared
  (arcen_input::pen_axes). The Linux virtual pen's ABS_PRESSURE range is
  now 0..=65535 instead of Wacom's 0..=8191; Windows keeps the Windows Ink
  0..=1024 API range through the same shared scaling.
• macOS Pier: the virtual pen's tablet-proximity vendor id is 0xFFFF
  (reserved, Arcen's id for synthetic devices) instead of Wacom's.
• Native tablet (USB bridged), lab builds: the privileged USB helper captures
  any attached device whose report descriptors classify as a pen tablet. It
  reads them from the I/O Registry rather than opening every HID device, and
  sends a USB request only for an undescribed interface of a registry-proven
  digitizer without a boot keyboard. It sends those descriptors with the
  device facts
  (UsbHardDeviceMsg.hid_report_descriptors, additive). The Linux Pier
  classifies them again before creating the usb-vhci device (replacing its
  single Intuos5 identity allowlist) and checks every descriptor the device
  later returns against the authorization: device, configuration and report
  descriptors must keep the authorized class, identity, HID-only interfaces
  and report bytes, or the attachment ends. The whole tablet is bridged,
  express keys (keyboard/keypad interfaces) included: the authenticated Deck
  can already send any keystroke, so this grants nothing new. A device with a
  joystick, gamepad or multi-axis controller collection at any nesting depth,
  or with no pen digitizer, is never bridged; a configuration must advertise
  each interface's full claimed report-descriptor length and the device must
  serve it whole, and claimed descriptors are bounded to 12 KiB so the helper
  never seizes a device it cannot describe. Compatibility: a 0.15 Deck
  sends no descriptors, so a 0.16 Linux Pier refuses its Native tablet
  request with an explicit reason; Tablet support is unaffected.
• Experimental raw-HID passthrough (quarantined, default off): the Deck
  matches digitizer collections by usage page and descriptor instead of five
  vendor ids, and the Linux Pier admits devices through
  arcen_usb_bridge::RawHidAdmission instead of a vendor allowlist.

Protocol

• Rust names are vendor-neutral (TabletModeMsg::UsbTabletBridge,
  TabletModeCapabilitiesMsg::usb_tablet_bridge, arcen_input::TabletMode:: UsbTabletBridge), but the wire keeps the 0.15 token and key
  wacom_usb_bridge (serde rename), so 0.15 and 0.16 peers interoperate
  unchanged. The neutral usb_tablet_bridge is accepted on input only. See
  shared/protocol/WIRE.md, "Tablet mode split".

Arcen v0.15.0

Streaming

• macOS Pier advertises host audio again for signed-in sessions. Asking for
  helper permissions in turn (28 Sep) replaced the only call that marked audio
  available, so every hello said audio: false and the Deck never requested
  sound; it is now set on every agent and serve path before any prompt.
• Pier debug logging now makes Keel QP-map effectiveness provable live:
  Windows and Linux capenc inherit the Pier debug profile for helper
  diagnostics, and Linux XShm/NVENC stats report per-second biased/neutral
  QP-map counts plus mean dirty fraction alongside the capture damage source.
• macOS Deck native 8-bit and 10-bit video layers now use a shared
  refresh-sequence pacer driven by the window's CVDisplayLink: FIFO depth is
  capped at three, overflow drops the oldest frame, stale frames are discarded
  after coarse age caps, each submitted drawable uses a half-refresh minimum
  display duration, and telemetry separates SUBMITTED cadence from
  nonzero-presentedTime confirmations while reporting overflow/stale/hidden
  drops, source-cadence underruns, queue depth, refresh gaps and ESTIMATED
  receive-to-callback latency.
• macOS Deck no longer discards a paced frame when every drawable slot is
  still in flight: the refresh waits (slot_waits telemetry) and the frame is
  shown on the next one. A full one-refresh minimum display duration made
  presents miss their vsync and cost about one frame in four on a 60 Hz panel.
• The Deck video inbox now holds ~500 ms (30 packets) for every pipeline, so a
  Wi-Fi/VPN stall's burst is decoded instead of cleared; the old 8-packet inbox
  turned 250-300 ms stalls into a repeating keyframe loop.
• Windows Pier QP maps now use OS damage on the NVENC GPU path: Desktop
  Duplication dirty/move rects and WGC dirty regions feed Keel without CPU
  readback, and logs truthfully report damage_source plus disengage when no
  damage source exists.
• Windows Pier multi-monitor topology now programs rotated CCD outputs with
  oriented source surfaces and native target timings, so mixed
  landscape/portrait Deck layouts keep truthful READY geometry and no longer
  ask Windows to apply an impossible portrait target mode.
• Streaming pipelines now own a shared keyframe policy: hardware encoders stop
  inserting two-second periodic IDRs and rely on Deck-requested recovery, while
  software fallback keeps a longer bounded safety refresh.
• macOS Pier now honours redirection.timezone without adding a second helper:
  the launchd-managed Agent Helper validates the Deck IANA time zone against
  zoneinfo and sets TZ in its own GUI session, so newly launched apps inherit
  it. The state lives in that session (an owner-tagged ARCEN_SESSION_TZ
  sentinel), is restored on session end and SIGTERM, and dies with logout. A
  user-defined TZ is left alone. Upgrades remove the earlier root timezone
  helper and restore any system time zone it changed.
• Pipeline queue contracts now distinguish raw capture overflow from encoded
  access-unit loss: raw frame pressure is latest-wins and does not request an
  IDR, while encoded packet loss keeps the shared rate-limited keyframe
  recovery path. Windows, Linux and macOS hosts report the relevant drop
  counters without noisy per-frame diagnostics unless debug logging is enabled.
• Deck keyframe requests that arrive inside a Pier's short request guard are
  now coalesced and delivered when the guard expires instead of being dropped
  (Linux and macOS Piers; Windows already forwarded every request), and a
  recovery handoff that fails is retried on its own deadline.
• The Deck now normalizes host colour metadata through shared media before
  deciding presentation retags, so equivalent default and explicit BT.709 tags
  no longer reconfigure the presenter.
• Secondary Deck monitor windows now paint a neutral waiting placeholder before
  their first frame instead of a black surface; retained frame replay remains
  the preferred path when a frame is already available.
• macOS Pier now installs a Core Audio HAL input driver named Arcen Microphone and, when microphone_input.enabled is true and the driver Mach service is reachable, accepts Deck microphone-v1 Opus/PCM frames into that virtual 48 kHz mono Float32 input device.
• Windows Pier now makes the display HDR toggle follow the served pipeline:
  HDR sessions enable HDR on the exact capture targets, SDR pipelines disable
  it there before capture, and session/journal recovery restores the user's
  original state.
• Windows Pier NVIDIA headless HDR sessions now arm one recovery journal before
  HDR and exact timing changes, record temporary NVAPI timing ownership in that
  journal, and only record the held display after HDR is active and the exact
  mode is re-applied.
• Packaged Pier config templates now enable QP maps for Auto and Speed
  ({"auto":"on","speed":"on"}) while the built-in default remains off and
  existing installs keep their local config.
• macOS Deck dev-tools builds now support an env-gated windowed
  multi-monitor live-session test mode. ARCEN_DECK_WINDOWED_MONITORS=2|3|4
  requests a real multi-monitor layout from the Pier but presents each
  negotiated monitor as a decorated, resizable, non-fullscreen tiled window on
  one local display; production builds do not compile the mode.
• macOS Deck multi-window sessions now replay retained secondary frames when a
  secondary window becomes ready, aspect-fit secondary video with black
  letterboxing while routing input through the fitted image rect, and wrap
  display mismatch notices inside narrow viewer windows.
• macOS Deck multi-window input now ignores secondary-window clicks that start
  in letterbox bands while still delivering releases for drags that began
  inside the fitted image.
• macOS Deck windowed multi-monitor test mode now keeps the root window's
  stable title so native video layer lookup still works, and release packaging
  refuses any binary carrying the dev-tools marker even on --no-build.
• Pier configuration now accepts video.qp_map as either one
  off/neutral/on policy or a per-served-pipeline object keyed by Auto,
  Speed, Grading, HDR, Software and Custom. Linux and Windows pass the
  effective served-pipeline policy to capenc; macOS accepts the key and logs
  that VideoToolbox has no QP-map support.
• Software-only Pier refusals for Grading/HDR now carry the shared user-facing reason to the Deck instead of collapsing to a generic capture/encoder setup failure, while internal init failures remain generic.
• Linux multi-monitor sessions now aggregate the served pipeline across every started monitor encoder, so an NVENC primary with an OpenH264 fallback secondary reports and runs the Software contract instead of advertising the primary hardware preset.
• macOS Pier multi-monitor sessions now apply served-pipeline encoder bitrate start/ceiling per region and run one adaptive session rate controller from QUIC path signals, pushing live bitrate targets up to each region's operational contract ceiling without forcing idle re-encodes.
• The macOS Deck now latches native 8-bit and 10-bit presenter failures to the
  RGBA fallback for the rest of the session, and keeps recovery requests armed
  only until a non-empty RGBA fallback frame is handed to the existing texture
  path, so occluded windows do not keep idle streams polling forever.
• The macOS Deck now presents Grading and HDR root sessions through the same dedicated presenter-thread model as Auto/Speed instead of driving native video from egui repaint passes. Grading remains native xf44 HEVC Main 4:4:4 10 BT.709 SDR into an RGB10A2 Metal layer with EDR off; HDR remains PQ/BT.2020 into that layer with EDR/HDR10 metadata only when the host confirms PQ.
• HDR now keeps the conservative link-safe start but owns a 500 Mbit/s contract
  ceiling through the same shared encoder-ceiling path as Grading, plus an
  evidence-gated fast probe and HDR-scoped host/Deck queue budgets so other
  pipelines keep their existing limits.
• NVENC sessions now initialise the encoder with the resolved session frame
  rate instead of a nominal 60 fps, so 30 fps Linux and Windows sessions deliver
  their configured bitrate target rather than roughly half of it.
• Speed now keeps the proven safe 1080p30 bitrate start but owns the true
  60 fps clean-path ceiling in the shared pipeline contract. Hosts derive
  Speed's motion priority and one-frame low-latency encoder/decoder policy
  from the served pipeline contract: NVENC reports P4/ultra-low-latency,
  zero reordering, no lookahead and a one-frame VBV; macOS ScreenCaptureKit
  captures at 1/60 for Speed requests; and the Deck applies VideoToolbox
  real-time decode for Speed sessions without treating optional decoder tuning
  as fatal.
• Auto, Speed, Grading and HDR are now named in the authenticated video request
  and echoed in server_hello as the active pipeline. The shared media crate
  owns one data contract per pipeline (codec ladder, colour target, bitrate
  bounds, keel policy and degradation text), while legacy clients still resolve
  through the previous request-field inference.
• Grading keeps the conservative link-capped starting bitrate but now has a
  shared 250 Mbit/s fidelity ceiling. The host adapters carry an optional
  served-pipeline encoder ceiling into capenc generically, so future fidelity
  pipelines can reuse the same path. Linux and Windows NVENC pass the value as
  maxBitRate while sizing VBV from the active target; the macOS Pier keeps
  AverageBitRate on the active target and passes the ceiling through
  VideoToolbox DataRateLimits; Auto and Speed retain their previous encoder
  bitrate numbers on this branch.
• The Deck command line and smoke tools accept --pipeline auto|speed|grading|hdr, deriving the same request fields as the GUI presets
  and printing the host's active pipeline.
• Software fallback is now a governed VM pipeline: the sha...

Arcen v0.14.0

Arcen 0.14.0 makes multi-display automatic on every host, gives every host the same all-on configuration, and makes the macOS Pier installer explain itself and ask for its permissions in one go.

Downloads

File	For	Install
Arcen-Deck-0.14.0-macOS.zip	The client (Deck), macOS	Unzip and open. Developer ID signed, notarized and stapled.
ArcenPier-0.14.0.pkg	A macOS host (Pier), preview	Open it in Installer.app on the Mac you want to reach. The first page explains what is installed; right after installing, the helper asks for System Audio Recording, Accessibility and Screen Recording, one at a time. Signed with Developer ID Installer and notarized.
install-arcen-pier-0.14.0-windows-x64.exe	A Windows host	Run as Administrator, then reboot once before the first remote sign-in. Not code-signed, so SmartScreen will warn. Upgrades keep the host's key and configuration.
install-arcen-pier-0.14.0-linux-x86_64	A Linux host (NVIDIA GPU, Xorg)	sudo ./install-arcen-pier-0.14.0-linux-x86_64. Not signed.

Check your downloads with shasum -a 256 -c SHA256SUMS.txt.

What's new

• Multi-display just works. It is on by default on every host, and the Deck can match your display layout. The Linux Pier discovers the GPU's NVIDIA heads when the service starts. The Windows Pier picks an eligible NVIDIA adapter at start; list a GPU in excluded_adapters to keep it for other work, for example an RTX card for DaVinci Resolve while a V100D streams. The macOS Pier creates one virtual display per Deck display. advertise_enabled: false turns it off.
• One configuration, everything on. The Linux, Windows and macOS installers write the same defaults: 10-bit video, Opus audio, microphone input, clipboard both ways, time-zone redirection and multi-display. The file is for turning things off. Existing configurations are kept on upgrade.
• Bitrate follows the network. One shared controller on every host, and QUIC now uses BBR, so the random loss of Wi-Fi, cellular and VPN links is not treated as congestion. When an encoder cannot sustain a preset's frame rate, the session starts at the best proven rate and says so instead of being refused.
• macOS Pier installer.
  • The first page says what is installed and why it is more than one app: a network service running as a hidden _arcen account, and a helper in each signed-in session. The full explanation is public.
  • The helper now lives in /Library/PrivilegedHelperTools, so Applications shows one Arcen app, and the installer no longer asks where to install.
  • It asks for System Audio Recording, Accessibility and Screen Recording as soon as it starts, one at a time, so none of them appears later as a surprise.
  • The macOS Pier tells the Deck why it refused a session (for example, system audio not yet allowed) instead of resetting the connection.
• Deck. When a remembered host's identity changes and you confirm it was reinstalled, Forget and Verify reconnects at once and shows you the new fingerprint, without asking for the password again. A host's reason for closing a session is shown.
• Input. Trackpad scrolling is precise on every host, and a macOS host receives magnify, smart zoom and swipe gestures.
• Windows GPU colour conversion. Every preset converts on the GPU. The GRID/vGPU issue where virtual displays disappeared after a few sessions is fixed: each session end rolls back the outputs it provisioned.

The full list is in CHANGELOG.md.

Known limitations

• macOS Pier (preview): no microphone input, time-zone redirection or deskside privacy yet. Cold-boot login-window operation and multi-display with physical monitors are not qualified. The login-window agent runs as root.
• Windows: the installer is unsigned; the optional microphone driver is not included; a fresh install needs one reboot before remote sign-in.
• Linux: requires an NVIDIA GPU and the depth-30 Xorg configuration the installer provides. HDR only on a desktop declared rec2100-pq.
• Deck: with several displays, the draw loop runs more often than frames arrive, which costs CPU.

Please test and report

Tell us your host OS and GPU, how many displays you used, which preset (Auto, Speed, Grading or HDR), and whether sign-in and input worked. Please open an issue and attach the newest Deck log from ~/Library/Logs/Arcen/ if you can.

Build provenance

• Source: the snapshot in this release, exported from the development repository at revision 6c1059627d72. The build ID in every binary is 20260928T212945Z.
• Compiler: rustc 1.96.1 on all three build machines: aarch64-apple-darwin, x86_64-unknown-linux-gnu and x86_64-pc-windows-msvc.
• macOS: the Deck is Developer ID Application signed, notarized, stapled and Gatekeeper-accepted. The Pier package is Developer ID Installer signed, notarized and stapled, and carries the com.apple.developer.hid.virtual.device entitlement.
• Linux and Windows: not signed. Verify them by checksum.
• Smoke tests: each installer upgraded a lab host in place the way an administrator would (the Windows one as SYSTEM), keeping its configuration and certificate, and this release's Deck then decoded hardware-encoded video from all three: Linux (NVENC, with audio), Windows (NVENC) and macOS (VideoToolbox).

Arcen v0.13.0

Arcen 0.13.0 adds the first macOS Pier installer (preview) and HDR on Linux. Hosts now build their virtual display from the Deck's real screen. All four streaming presets (Auto, Speed, Grading, HDR) were measured end to end on the lab hosts before release.

Downloads

File	For	Install
Arcen-Deck-0.13.0-macOS.zip	The client (Deck), macOS	Unzip and open. Developer ID signed, notarized and stapled.
ArcenPier-0.13.0.pkg	A macOS host (Pier), preview	Open it in Installer.app on the Mac you want to reach, then approve Screen Recording and Accessibility when asked. Signed with Developer ID Installer and notarized.
install-arcen-pier-0.13.0-windows-x64.exe	A Windows host	Run as Administrator, then reboot once before the first remote sign-in. Not code-signed, so SmartScreen will warn. Upgrades keep the host's key, so paired Decks keep trusting it.
install-arcen-pier-0.13.0-linux-x86_64	A Linux host (NVIDIA GPU, Xorg)	sudo ./install-arcen-pier-0.13.0-linux-x86_64. Not signed. Open UDP 18444 if firewalld is active.

Check your downloads with shasum -a 256 -c SHA256SUMS.txt.

What's new

• macOS Pier (preview). It streams the login window and follows your sign-in into the desktop, with input through the entitled virtual HID keyboard and pointer. Speed, Grading (4:4:4 10-bit) and HDR (PQ/BT.2020, only when the Mac proves it has the headroom) are all available.

• The Deck tells the host about your screens. The host's virtual display takes your screen's name, size, gamut and HDR headroom. HDR is greyed out ("No HDR-capable screen found") when no connected screen can show it.

• Shortcuts on a Mac host. ⌘A, ⌘C and ⌘V reach a macOS host as Command shortcuts. To quit the Deck, hold ⌘Q for 3 s, as in Chrome; a quick tap goes to the host.

• HDR on Linux. Set video.desktop_encoding to "rec2100-pq" when a colour-managed application writes PQ into the 10-bit Xorg desktop (Autodesk Flame's HDR UI with Graphics Colour Space Rec.2100-PQ). HDR sessions then stream real PQ/BT.2020.

• Lower latency on Windows and Linux. Audio travels on its own priority stream, there is one link-capped bitrate for every host, and Linux applies backpressure instead of sending a burst of keyframes. Windows HDR now reaches its target frame rate.

• Windows hosts without NVIDIA (VMware, Citrix, Proxmox and other VMs, Intel or AMD graphics) stream with the OpenH264 software encoder on the primary display. Every preset is served as H.264 4:2:0 8-bit there; a Grading or HDR request is answered with what the host can do rather than refused.

• Windows installer. Upgrades need no flags and no second run: a key pair from an older install is taken over automatically (a CA-issued certificate is used as it is), an access entry Explorer added to ProgramData\Arcen is removed instead of failing the install, and uninstall finishes even while the sign-in screen still has the credential provider loaded. Each install keeps exactly one firewall rule and uninstall removes it. The output says what changed; --verbose shows the commands behind it.

The full list is in CHANGELOG.md.

Known limitations

• macOS Pier:
  • There is no cold-boot login window yet: someone must have logged in once since boot.
  • Multi-monitor is not hardware-qualified.
  • Screen capture at the login window needs a one-time approval from someone at the Mac.
• Windows:
  • The installer is unsigned.
  • The optional microphone driver is not included.
  • A fresh install needs one reboot before remote sign-in.
  • On an NVIDIA GRID/vGPU host with multi-monitor enabled, the virtual displays can disappear after a few sessions, and the Deck then reports "authentication failed: DXGI could not uniquely resolve ... available outputs: []" (it is not an authentication problem). Reboot the host. Fixed for the next release.
• Linux:
  • Requires an NVIDIA GPU and the depth-30 Xorg configuration the installer provides.
  • HDR works only on a desktop declared rec2100-pq. General Wayland desktop HDR is not supported yet.
  • An SDR session on a PQ-declared desktop shows the PQ values as SDR, and the Pier logs a warning.
• Health reporting: a completely static desktop may be reported as "critical", because frames are sent only when something changes. This is cosmetic; the stream is fine.

Please test and report

We're especially interested in your host OS and GPU, which preset you used (Auto, Speed, Grading or HDR), whether sign-in worked, how responsive input felt, and whether HDR turned on when you expected it to. Please open an issue, and attach the newest Deck log from ~/Library/Logs/Arcen/ (arcen-client.log.*) if you can.

Build provenance

• Source: the snapshot in this release, exported from the development repository at revision fd1e72d. The build ID in every binary is 20260928T1130Z-v0.13.0.
• Compiler: rustc 1.96.1 (31fca3adb 2026-06-26), LLVM 22.1.2, on all three build machines: aarch64-apple-darwin, x86_64-unknown-linux-gnu and x86_64-pc-windows-msvc.
• macOS: the Deck is Developer ID Application signed, notarized, stapled and Gatekeeper-accepted. The Pier package is Developer ID Installer signed, notarized and stapled, and it carries the com.apple.developer.hid.virtual.device entitlement.
• Linux and Windows: not signed. Verify them by checksum.
• Smoke tests: the Linux and Windows installers were run on lab hosts the way an administrator would: dry run, upgrade in place, uninstall, reinstall, purge and fresh install (and on Windows an upgrade from 0.9.8), and this Deck streamed against each. The macOS package was checked for signature, notarization, entitlement and contents; install it by hand to see the permission prompts.

Arcen v0.10.0

Truthful, separate streaming pipelines for Auto, Speed, Grading, and HDR.

Streaming presets and pipeline separation

• Replaced independent performance/colour controls with four complete product
  presets: Auto, Speed, Grading, and HDR.
• Kept the fast 8-bit and fidelity pipelines separate. Auto/Speed do not pay
  the host-copy or conversion cost required by Grading/HDR.
• Extended negotiated session truth with primaries and transfer degradation so
  the Deck can distinguish ten-bit SDR from real HDR and show every fallback.

Windows

• Added a genuine ten-bit Grading source: WGC
  R16G16B16A16Float scRGB converted to full-range BT.709 I444 P16 before
  NVENC. FP16 refusal fails closed instead of repacking BGRA8 as ten-bit.
• Added end-to-end HDR: session-scoped NVIDIA HDR EDIDs, exact topology,
  Windows 11 distinct HDR state, DXGI PQ/BT.2020 verification, WGC FP16
  capture, linear-primary conversion, 80-nit-reference absolute ST 2084, and
  HEVC 4:4:4 10-bit output.
• Scoped HDR state changes to the exact session display targets and kept the
  pre-provision EDID recovery journal armed through lease teardown.
• Fixed forced-loss resume by atomically discarding buffered video before the
  writer is joined; credential-free reconnect now retains the desktop and
  returns to healthy media.
• Fixed Windows installer public ACL convergence on localized or previously
  installed systems.

Linux

• Preserved NvFBC → CUDA → NVENC as the device-to-device 8-bit path.
• Added a separate depth-30 Xorg/MIT-SHM pipeline for genuine RGB10 capture,
  mask-derived XBGR2101010 handling, shared P16 conversion, and one CUDA
  upload before NVENC.
• Made Xorg HDR requests resolve truthfully to Grading BT.709 SDR. Real Linux
  HDR remains gated on a future color-managed Wayland provider.
• Degraded host cursor authority to the Deck-local cursor only for the XShm
  wide path; NvFBC host cursor behavior is unchanged.

macOS Deck

• Added native VideoToolbox xf44 retention and a dedicated
  RGB10A2Unorm Metal presentation layer for Grading and HDR.
• Enabled ITU-R BT.2100 PQ, HDR10 metadata, and EDR only when the resolved host
  transfer is PQ. Normalized PQ output uses Apple's 10,000-nit optical scale.
• Preserved negotiated BT.709, sRGB, PQ, and HLG transfer metadata through
  VideoToolbox and made every 8-bit presentation fallback permanently visible.

Release validation

• Completed Windows and Linux Auto/Speed/Grading/HDR matrices with decoded
  frames, nonzero audio, keyboard/pointer input, cursor authority, display
  restore, and forced-loss credential-free resume.
• Rebuilt the Linux and Windows single-file installers and the Developer ID
  signed, notarized, stapled macOS Deck.

Arcen v0.9.8

Arcen v0.9.8 — first public release.

A Pier (host) streams a real desktop to a Deck (client) over a direct
QUIC/TLS 1.3 connection. No cloud service, no account, no telemetry, no licence
server. You install it and you host it.

What's here

Artefact	Platform
Arcen-Deck-0.9.8-macOS.zip	macOS client — signed, notarised and stapled
install-arcen-pier-0.9.8-linux-x86_64	Linux host installer
install-arcen-pier-0.9.8-windows-x64.exe	Windows host installer

Verify before installing:

shasum -a 256 -c SHA256SUMS.txt

The Windows installer is not code-signed. Windows SmartScreen will warn.

Verified on real hardware for this release

Host	Encoder	Authentication
Linux, GRID V100D-16Q, driver 570.172.08	hardware NVENC	PAM, AD-joined
Windows, GRID V100D-16Q, driver 573.48	hardware NVENC	local
Windows, no NVIDIA	OpenH264 software	Active Directory domain

Trust-on-first-use ceremony, pin persistence across a restart, 825-day host
certificates, hardware and software encode paths, and domain logon were each
exercised end to end.

Security in one paragraph

TLS 1.3 only, ALPN enforced, no 0-RTT, no session resumption tickets across
restarts. The host certificate is self-signed and pinned by SPKI on first use;
a later change of identity is a terminal failure, not a re-prompt. Credentials
go to PAM on Linux and LogonUser on Windows — Arcen stores no password.
Read SECURITY.md for the boundaries, including the ones that are not covered.

No support

This is free software published in the hope it is useful. There is no support
commitment, no SLA, and no warranty. Issues are open; expect nothing.

If it saves you money, https://wise.com/pay/me/andreasmartina

Licensed AGPL-3.0-only. If you run a modified version that others connect to
over a network, you must offer them its corresponding source.