Implementation reference

Codecs, transport, displays, input and current limits.

This page describes the code on the Arcen main branch at source revision eac2494, dated 13 August 2026. It separates implemented code, physical test evidence, release gates and roadmap work.

Deck
macOS, native Rust desktop application
Pier
Linux and Windows native Rust services
Transport
QUIC with TLS 1.3
High mode
HEVC 4:4:4 at up to 60 fps
Displays
1 to 4 independent monitor regions
Internet
Not required for Direct sessions

Application stack

Native Rust applications.

ComponentImplementationPlatform boundary
Arcen Deck Rust, egui 0.35, eframe 0.35, wgpu AppKit input and window integration, VideoToolbox decode, Core Graphics display identity, Core Audio playback
Linux Pier Rust service plus embedded arcen-capenc PAM authentication, dedicated Xorg sessions, NvFBC/CUDA/NVENC or X11/OpenH264, uinput
Windows Pier Rust LocalSystem service, user-session agent and Credential Provider WTS/LogonUser, DXGI/WGC capture, NVENC or Media Foundation, WASAPI, Win32 input

Transport and wire

QUIC-only Direct transport.

Carrier

Quinn 0.11 over UDP.

Cryptography

rustls 0.23, TLS 1.3, ALPN arcen-quic-v1.

Current framing

Tungstenite message framing runs over the QUIC byte stream. JSON control and binary media share the authenticated session.

Fallback

No TCP or WSS fallback is enabled in product builds. A failed QUIC connection fails closed.

Wire protocol

  • Protocol version: 3.
  • Control: bounded UTF-8 JSON messages with a type discriminator.
  • Legacy single-monitor video: 10-byte big-endian header plus Annex-B access unit.
  • Region video: 26-byte big-endian header carrying monitor ID, topology generation and stream epoch.
  • Audio: 8-byte binary header plus PCM or Opus payload.
  • Clipboard: 20-byte binary chunk header; chunks are at most 1 MiB.
  • Hard USB lab: normalized control/interrupt URBs on the reliable authenticated QUIC stream.

The shared transport crate contains reviewed stream/datagram primitives for later carrier work. Current Direct products do not send video as QUIC datagrams.

Trust and authentication

The machine is authenticated before the user credentials move.

LayerLinux PierWindows PierFailure behavior
Pier identity Operator PKI certificate chain, or Pier-generated self-signed certificate pinned by SHA-256 fingerprint. Expired, untrusted or changed identity fails before workstation authentication. There is no silent downgrade.
User authentication PAM inside the dedicated session path. LogonUserW, WTS session attachment and Credential Provider for cold first login/unlock. Arcen does not issue user accounts. The target operating system remains authoritative.
Credentials Submitted only after QUIC/TLS and Pier trust succeed. Password material is zeroized and is not serialized into saved connections. Resume is credential-free and memory-only; TLS identity, endpoint or topology changes invalidate it.
Licensing First-party signed offline Trial/Node-Locked licence bound to Pier HostID. No online licence service is required. The current production key ring is still empty, so release startup remains fail-closed until the signing ceremony and target validation.

Arcen does not operate an identity provider, certificate authority, session broker or online licence service for the Direct path.

Video pipeline

High mode preserves full chroma resolution.

Deck modeRequested codecChromaBit depthFrame-rate ceiling
HighH.265 / HEVCYUV 4:4:48-bit60 fps
StandardH.264 / AVCYUV 4:2:08-bit30 fps
High LegacyH.264 / AVCYUV 4:2:08-bit60 fps

Capture and encode by host

Host pathCaptureEncoderContract ceilingNotes
Linux NVIDIA NvFBC to CUDA NVENC H.264/H.265, 4:2:0/4:4:4 8192 x 8192, 240 fps before runtime GPU narrowing Zero host-copy hardware path; production sessions are capped by Deck policy and measured admission.
Windows NVIDIA DXGI Desktop Duplication or WGC to D3D11 NVENC H.264/H.265, 4:2:0/4:4:4 8192 x 8192, 240 fps before runtime GPU narrowing WGC is used when DXGI produces no frames, including some headless or virtualized cases.
Windows software WGC, D3D11 staging readback Inbox Media Foundation H.264 4096 x 4096 at 60 fps BGRA is converted to NV12 in Rust. Actual supported modes are driver- and MFT-dependent.
Linux software Authenticated dedicated-Xorg X11 capture Source-built OpenH264 Baseline 1920 x 1200 at 30 fps H.264, YUV 4:2:0, local cursor only. Physical performance and external distribution remain release gates.

Color and stream structure

  • Chroma and bit depth are separate: 4:4:4 means no chroma subsampling; it does not imply 10-bit or 12-bit samples.
  • Current Arcen contract: HEVC Range Extensions with YUV 4:4:4 and 8-bit samples. The media planner explicitly rejects other bit depths today.
  • Not currently implemented: HEVC Main 4:4:4 10, Main 4:4:4 12, Main10, HDR transfer functions or HDR metadata.
  • Why 4:4:4: preserving chroma at every pixel improves colored text, thin lines and desktop UI compared with 4:2:0. It does not increase tonal precision beyond 8-bit.
  • Compatibility modes: H.264 4:2:0.
  • Software conversion: BGRA to NV12/I420 uses BT.709 limited-range conversion in shared safe Rust.
  • Decode: macOS VideoToolbox decodes Annex-B H.264 and H.265.
  • Latency configuration: NVENC uses the ultra-low-latency tuning path with no lookahead/B-frame path.
  • Keyframes: explicit IDR requests are used for recovery, reconnect and topology changes.
  • Bitrate planning: one per-monitor budget derived from pixel rate, clamped to 500-50,000 kbps. There is no live adaptive-bitrate feedback loop yet.

Resolution and multi-monitor

Each monitor is an independent region.

Multi-monitor is not one stitched video canvas. Deck sends the local display topology. Pier applies a host topology, assigns each monitor a nonzero session monitor ID and stream epoch, and runs independent capture, encode, queue, decode and presentation state per monitor.

LimitCurrent valueMeaning
Monitor count1-4Match My Layout uses every active Deck display up to four; admission is all-or-nothing.
Protocol geometry320 x 240 to 16384 x 8640Wire validation bound, not a performance or backend support claim.
Deck refresh requestMaximum 60 HzAll current performance modes cap the stream at 60 fps.
Linux virtual framebuffer8192 px per dimensionAggregate dedicated-Xorg topology bound.
Release hardware targets4 x 1080p60 or 2 x 4K60Targets for measured admission; not a guarantee for every host.
4 x 4KNo blanket claimAllowed only if the exact host proves the complete encoder set during admission.

How work is divided

  1. Topology: Deck reports logical placement, physical/backing size, scale, rotation and display identity.
  2. Apply: Pier binds exact host outputs and publishes the applied host-pixel rectangles.
  3. Plan: every monitor receives its own codec, chroma, encoded size, fps and bitrate budget.
  4. Measure: Pier opens the complete proposed encoder set and measures p50/p95 encode latency, queue age, delivered fps and fairness.
  5. Commit: the full roster is accepted, reassigned or rejected atomically. A partial display subset is not silently served.
  6. Route: every region frame carries monitor ID, topology generation and stream epoch before it reaches the matching decoder.

Damage and idle cadence

arcen-keel divides each region into a 16 x 16 activity grid. The grid identifies changed content; it does not divide the display into separate network resolutions. Static regions may skip conversion, encode and emission between bounded refresh deadlines. Startup frames, requested IDRs, recovery, keyframe deadlines and input/focus wake events always force service.

Keyboard, pointer and Wacom

Typed pen is current. Native USB is a lab path.

Input pathmacOS DeckLinux PierWindows PierStatus
Keyboard and mouse AppKit/egui event capture; absolute and relative pointer modes uinput keyboard and pointer devices Win32 input injection Implemented
Typed pen ("Light") Wacom driver decodes hardware; AppKit supplies semantic pen events Separate virtual tablet-tool uinput device Windows synthetic PT_PEN device Implemented and physically tested
Native Wacom USB ("Hard") Root-authorized libusb whole-device capture usb-vhci virtual host controller and native wacom.ko No importer Lab only; enumeration proven, pen-report retest pending

Typed pen contract

  • Normalized position, pressure, tilt, rotation, tip/eraser, proximity, touching and two barrel-button bits.
  • One globally ordered input sequence shared with keyboard and pointer events.
  • Only superseded hover/motion samples may coalesce; contact, tool, proximity and button edges are preserved.
  • Linux pressure maps to 0..=8191; tilt maps to whole degrees -90..=90; rotation is not advertised.
  • Windows pressure maps to the Win32 PT_PEN ceiling 0..=1024; tilt and rotation are supported through Windows Ink.
  • Windows Wintab-only applications are not covered by the synthetic PT_PEN path.
  • Tablet multi-touch is not transported. One active tablet/tool is supported per Deck session.
  • ExpressKeys and touch rings use client-side Wacom mappings to ordinary keyboard or wheel events.

Physical Wacom USB lab evidence

Revision eac2494 captures one exact Intuos5 Touch L device (056a:0317) on macOS, forwards control and interrupt URBs over the authenticated QUIC session, and enumerates native Pen, Pad and Finger devices on Linux through usb-vhci. The current lab build must run with administrator authorization. The corrected pending-interrupt behavior still requires one physical pen-report retest. This is not a production support claim or a general USB forwarding feature.

Audio

Fixed 48 kHz formats with bounded queues.

DirectionFormatFramePolicy
Workstation to Deck 48 kHz, stereo, signed 16-bit PCM or Opus 20 ms Uncompressed PCM or fixed Opus 128 kbps; target playout latency 60 ms, hard decoded queue bound 200 ms.
Deck microphone to Pier 48 kHz, mono, PCM or negotiated Opus 20 ms Off by default. Requires Deck opt-in, macOS permission, negotiated support and host policy.

The Windows virtual microphone driver source exists but remains default-off pending protected driver signing, HLK/HVCI evidence and release approval. Arcen does not change the Windows default recording endpoint.

Clipboard

Host-authoritative text and PNG transfer.

  • Clipboard protocol version 1 must be negotiated by both peers.
  • Pier controls direction, allowed content and maximum encoded size.
  • Default policy is both directions, UTF-8 text and PNG, maximum 8 MiB.
  • Operator configuration accepts 1-20 MiB; 20 MiB is the protocol ceiling.
  • Wire chunks are contiguous, at most 1 MiB, sequence-numbered and expire after five seconds without progress.
  • Text truncates only at a UTF-8 boundary. Images reject rather than truncate.
  • No files, HTML, RTF or delayed rendering are transported.
  • Clipboard payloads are not logged or persisted by Arcen.

Shared component boundaries

Products consume shared crates; shared crates do not consume products.

CrateResponsibility
arcen-protocolVersioned wire messages, framing, auth state, clipboard chunks, monitor-tagged media and Hard USB URBs.
arcen-inputAbsolute/relative pointer semantics, cursor authority, ordered input, typed pen and region-coordinate transforms.
arcen-mediaCodec/chroma/bit-depth contracts, media-plan resolution, video planes, BT.709 conversion, audio policy, clipboard raster conversion and monitor topology.
arcen-keelPure 16 x 16 damage tracking and region activity classification.
arcen-transportTLS lifecycle, certificate pins, QUIC carrier contracts and bounded transport queues.
arcen-usb-bridgeExact-device policy, descriptor validation, attachment state and URB ledger for the default-off Hard USB lab.
arcen-licensingOffline signed licence verification, HostID binding, replacement state and capacity-one admission.
arcen-observabilityBounded JSON Lines logging, lifecycle events, live profile reload and nonblocking sink workers.
arcen-telemetryCorrelation IDs, privacy-bounded fields and stable lifecycle/QoS categories.
arcen-sessionRestore leases and session lifecycle contracts; authoritative floating-session features remain dormant.

Implementation and release status

Code on main is not the same as a released support claim.

AreaState at revision eac2494
Direct macOS Deck to Linux/Windows PierImplemented QUIC-only current product path.
HEVC 4:4:4 hardware pathImplemented NVIDIA NVENC path; actual capability is probed per GPU.
H.264 software fallbackConditional Windows MF proven on selected virtualized hosts; Linux OpenH264 code complete with release/performance gates open.
1-4 monitor Match My LayoutImplemented on main Per-monitor runtime, topology and measured encoder admission exist; exact hardware plans remain admission-dependent.
Typed Wacom penPhysically tested macOS to Linux and Windows for position, pressure, tilt, proximity, tip, eraser and barrel buttons.
Native Wacom USBLab only macOS-to-Linux enumeration proven; pen-report retest and production privilege/driver decisions remain open.
Offline Pier licensingImplemented core Host adapters and tests exist, but the production signing-key ring is empty and real startup fails closed until key ceremony and target validation.
Windows virtual microphoneDefault-off Driver/source path exists; signing, HLK/HVCI and release evidence remain open.
Arcen SpanPlanned Gateway is not part of the current Direct product.
AV1, 10-bit, HDRNot current No current implementation or product claim.

Known technical limits

  • Current streams are 8-bit SDR; no 10-bit or HDR pipeline is claimed.
  • H.264 4:4:4 is not used on the macOS VideoToolbox path; Arcen's 4:4:4 mode is paired with HEVC.
  • Linux software H.264 is limited to 1920 x 1200 at 30 fps.
  • Linux typed-pen rotation is not injected.
  • Windows typed pen uses Windows Ink, not Wintab.
  • Multi-monitor pointer lock is disabled because region-scoped relative input is not defined.
  • Display topology is fixed for an attachment; display changes require reconnect.
  • There is no current live adaptive-bitrate controller.
  • Native USB bridging is not general USB forwarding and excludes storage, cameras, audio devices, hubs, smart cards and network adapters.