Install, codecs, displays, input and current limits.

Native tablet ships. A Wacom on the Mac's desk can be attached to the remote desktop as if it were plugged into the host, so the host's own tablet driver, pressure curves and side switches apply. Each row says how far it is proven. Every addition is negotiated: v0.17.0 Decks and Piers keep working with v0.19.0, without the new features. The full notes are on the release page and in the repository's CHANGELOG.md.

Native tablet: known limitations

• Ink on X11 trails the dot on a slow link. The pen dot follows the pen's own reports, but X11 applications draw from xf86-input-wacom's smoothed pointer, which averages several samples and receives one report per network round trip.
• GNOME Wayland draws thinner lines. GNOME squares stylus pressure on its default curve; raise the stylus pressure curve in GNOME Settings › Wacom Tablet.
• A held side switch looks like "pen but no ink" on GNOME X11: pressure shows and nothing draws. Lift the pen out of range and back, or remap the switch.
• Safari reports every pen as a mouse, local or remote; test pen pages on a macOS Pier in Chrome or Firefox.
• A tablet remapped in GNOME Settings offsets the pen dot on Wayland; keep the default mapping, or use host cursor rendering.
• No pen dot positions from multi-output Wayland desktops, Windows Piers or secondary Deck viewports yet.
• Untested on an Intel Deck. Native tablet needs macOS 13 or later on the Deck.

Upgrading

• From v0.15 or v0.16: update the Deck and every Pier together. Since v0.17.0 they speak protocol v5, and a v0.16 Deck or Pier is refused with a message saying so. v0.17.0 also closed a polkit hole in every earlier Linux Pier, where a remote X11 desktop received the console's administrative rights.
• From v0.17.0: Decks and Piers of either version work together; the new features need both ends at v0.19.0. With a macOS Deck and a macOS Pier, update both together so pen barrel buttons mean the same thing at each end.
• Linux Native tablet: run the installer with --native-tablet; an upgrade keeps the current choice. On X11, restart the display manager once while nobody is signed in at the console, or reboot.
• Also in this release: 0.18.0 was not published separately, so its changes arrive with v0.19.0: a Mac keyboard on Windows hosts that behaves as Windows App makes it behave, typed text and Paste as Keystrokes on Windows and Linux hosts, the application's real cursor images, the Colour check and Test connection.

Download the files for your platforms from GitHub Releases and check them against SHA256SUMS.txt. There is no runtime to install first, no package repository to add and no service file to write.

What the host installers do

• Create the directories, generate a TLS certificate, register and start the service, and open UDP 18444 on a firewall they recognise.
• Succeed only when the Pier is proven running. On macOS, a missing privacy approval is onboarding, not an install failure.
• Write the same all-on configuration on every host. An upgrade keeps the existing configuration and certificate, so remembered Decks keep trusting the host.
• Linux and Windows flags: --dry-run shows the plan, --uninstall --purge removes everything, --extra-san <name> adds certificate names and --force replaces an existing certificate.
• Linux Native tablet: --native-tablet sets usb.native_tablet to "enabled" and, on Rocky Linux and RHEL, installs kernel-modules-internal for the running kernel; --no-native-tablet turns it off and removes that package if the installer added it. On an X11 host, restart the display manager once while nobody is signed in at the console, or reboot.
• macOS: uninstall.sh --purge also resets the privacy approvals given to Arcen.
• Configuration lives in /etc/arcen/pier.json on Linux and C:\ProgramData\Arcen\pier.json on Windows.

First connection

1. Open: start Arcen Deck on the Mac.
2. Address: enter the Pier address. The port is 18444.
3. Verify: compare the certificate fingerprint with the Pier, then choose trust and remember.
4. Sign in: use an ordinary account on the host. Arcen keeps no user list of its own.

To check a host from a terminal, run "/Applications/Arcen Deck.app/Contents/MacOS/arcen-deck" --connect <host> 18444 --credentials-stdin --frames 120 --timeout-secs 60. It reads the username and password as two lines from standard input and logs to ~/Library/Logs/Arcen/. Add --max-fps 60 to request 60 fps.

The Linux, Windows and macOS installers write identical common sections, and a shared contract check fails the build if they drift. Existing configurations are kept on upgrade.

Auto, Speed, Grading and HDR select separate capture and conversion pipelines with their own admission rules. They are not one 8-bit capture path relabelled. If a host cannot serve the requested result, it reports the lower-fidelity plan to the Deck instead of hiding it.

• 10-bit is not HDR: Grading is 10-bit SDR. Bit depth alone is never treated as proof of HDR.
• Genuine sources: Linux Grading reads real depth-30 Xorg codes; Windows Grading and HDR read FP16 scRGB. If WGC refuses the FP16 pool, the session fails rather than silently falling back to 8-bit.
• Linux Wayland: the same presets run as separate Mutter ScreenCast pipelines. Speed only where the host's qualification measured the rate; Grading and HDR on GNOME/Mutter 50 or newer after a per-host precision proof, on one output. Otherwise the stream is served visibly as Auto, with the reason.
• HDR white point: SDR white is mapped to 203 nits.
• Frame rate: the Deck's Standard mode requests 30 fps and High requests 60. On a macOS Pier, 60 fps cut frame age on arrival from 27 ms to 6 ms in the published measurement, at about 7.4 Mbps instead of 4.6 Mbps.

At startup, the Deck builds a real VideoToolbox decode session for each format and reports only what succeeded, separately for 4:4:4, 10-bit, 12-bit and colour range. The Pier sends only what the Deck has proven it can decode.

Three ways to run a Pier

Encoding and bitrate

• Hardware encoders: NVIDIA NVENC on Linux and Windows, VideoToolbox on the macOS Pier. AMD and Intel hardware encoders are not implemented.
• Latency tuning: NVENC runs without B-frames or lookahead.
• Software floor: source-built OpenH264, 4:2:0 8-bit only.
• Decode: macOS VideoToolbox, in hardware, for H.264, HEVC including 4:4:4 10-bit, and AV1 on M3 or later.
• Adaptive bitrate: one shared controller follows the network path on every host. QUIC uses BBR congestion control, so random Wi-Fi, cellular or VPN loss is not mistaken for congestion.
• Honest admission: when an encoder cannot sustain a preset's frame rate, the session is admitted at the best proven rate and says so rather than being refused.

Keel is the part of every Pier that decides whether a frame is worth sending. A still desktop should cost almost nothing, and a busy one should spend its bits where the picture is moving. It works at two levels, and they are easy to confuse.

Frame level: on for every hardware pipeline

An encoder submits a frame when the desktop changed, when the Deck asked for a keyframe, once more to flush NVENC's one-deep output queue, and otherwise once a second as a keepalive. A still desktop therefore costs a fraction of a megabit instead of a full stream. A Windows RTX session measured 150 to 400 kbit/s while idle and 5 to 9 Mbit/s while a video played. Each Pier gets the change signal from its own operating system.

Block level: an encoder hint, off by default

With video.qp_map set, Keel turns the same damage into an NVENC QP map so the blocks that changed get the bits. The setting takes one value (off, neutral or on) or one per pipeline, for example {"auto": "on", "speed": "on"}. The packaged Pier configuration templates turn it on for Auto and Speed; the built-in default stays off, and existing installs keep their own configuration.

• Only where damage is free: OS rectangles on Windows, and X Damage on Linux Grading and HDR. The Linux NvFBC fast path refuses the QP map rather than add a full-frame GPU readback. VideoToolbox on the macOS Pier has no QP-map support, and says so in its log.
• Provable, not assumed: every encoder logs QP map policy=… engaged=… damage_source=…, so whether it ran is never a guess. Linux also reports per-second biased and neutral block counts.
• Honest about the gain: modern codecs already code an unchanged block almost for free, so most of the saving is frames that are never encoded.
• Not done yet: Keel does not refine. A static region that arrived during motion stays at its first quality until it changes. Spending spare bits to sharpen blocks once they stop changing, the "build to lossless" behaviour other remote-desktop products use, is open work.

How frames reach the glass on the Deck

Both the 8-bit and the 10-bit streams present decoded IOSurface frames through a dedicated CAMetalLayer with no CPU copy. A shared pacer driven by the window's CVDisplayLink shows at most one new picture per refresh from a queue of at most three. It drops the oldest frame on overflow and discards anything stale after a stall. Two lessons from real sessions are built in.

The Deck logs presenter telemetry every second: received, submitted and confirmed frames, drops by cause, slot waits and refresh intervals. The host's health check compares decoded against presented frames, so a presentation problem shows up even when nobody notices it on screen. Hardware encoders also no longer insert a keyframe every two seconds. They rely on Deck-requested recovery, and the Pier coalesces requests that arrive close together instead of dropping them.

One to four monitors are negotiated as one topology, and the Deck can match its own display layout. Multi-display is on by default wherever the host can prove it. No installer-time allow-list is needed.

• Hardware sufficiency: each monitor is its own NVENC session on Linux and Windows. GeForce drivers cap concurrent NVENC sessions (3 on older drivers, 8 from early 2024, 12 on current ones); RTX Pro and data-centre cards have no cap. Four monitors fit within current GeForce limits, but other encoders on the same GPU, such as OBS or a transcode, share the same pool. Pier does not guess: it opens the whole encoder set and accepts the layout only when every monitor meets quality thresholds. An operator can set nvenc_session_limit as a hard ceiling.
• Measured admission: the Pier opens the complete planned encoder set and admits it only if every region meets the quality thresholds. It never guesses from the GPU model.
• Independent regions: every monitor has its own capture, encode, queue, decode and presentation state. Region frames carry a monitor ID, topology generation and stream epoch.
• Damage tracking: Keel decides per monitor which frames, and optionally which blocks, are worth encoding.

The native-tablet helper is a small root daemon registered through SMAppService with one approval in Login Items; Arcen Deck itself never runs as root, and the release Deck captures the tablet with Apple's IOUSBHost. Native tablet needs macOS 13 on the Deck and is untested on Intel Macs. Windows hosts take the pen through Windows Ink only. Webcam redirection and general USB passthrough are not supported.

Clipboard contract

• The host decides direction, content and maximum size; the client cannot override it.
• Default: both directions, UTF-8 text and PNG images, 8 MiB. Operators can set 1–20 MiB.
• No files, HTML or RTF are transported. Clipboard payloads are not logged or persisted.

• Wire protocol version: 4, defined once in arcen-protocol for every Pier and Deck.
• Network: a Deck reaches a Pier directly, on the same network or through a VPN. There is no internet gateway.
• Exposure: Arcen expects a trusted network and is not hardened against the open internet.

• User authentication: PAM on Linux and macOS; a Windows credential provider that takes part in the real login. Arcen keeps no user list.
• Credentials: sent only after QUIC/TLS and Pier trust succeed, held in memory that is wiped on release and never logged.
• Lockout: Arcen adds none. Throttling is whatever pam_faillock or Windows account-lockout policy already enforces.
• Pins: compared in constant time and changed only by the user.
• Windows headless HDR: the signed-in account must currently be a local Administrator when Arcen provisions an unused NVIDIA display ID.
• macOS Pier: the network service runs as _arcen, cannot see the screen and refuses to run as root. The login-window agent still runs as root; narrowing it is open work.
• Licence: Pier and Deck are free software under AGPL-3.0. Read the licence.

Arcen does not operate an identity provider, certificate authority, session broker or online service. Report vulnerabilities privately as described in SECURITY.md.

Eleven pure-Rust shared crates hold the logic, with no operating-system calls. CI enforces that shared crates never depend on a host, client or packaging, and that they stay light. Platform code only captures pixels, drives encoders, injects input, authenticates users and puts a window on screen.

The Linux and Windows Piers in the release matrix were Active Directory-joined, so domain credentials crossed the wire. The matrix also covered audio, keyboard and pointer input, both cursor authorities, display restore and credential-free reconnect.

Known technical limits

• Linux Wayland support is GNOME Shell/Mutter only. Grading and HDR on Wayland need GNOME/Mutter 50 or newer; Xorg serves HDR as Grading unless the operator declares a Rec.2100 PQ desktop.
• Hardware encoding is NVIDIA NVENC only on Linux and Windows. AMD and Intel encoders are not implemented.
• OpenH264 is 4:2:0 8-bit only; 4:4:4 monitors cannot fall back to software.
• Arcen streams at most four monitors per session. Old GeForce drivers with a 3-session cap cannot run four hardware-encoded monitors; eligible 4:2:0 monitors can fall back to OpenH264 at up to 1920x1200, 30 fps.
• One session per Pier.
• Direct connections only: same network or VPN. Arcen is not hardened for the open internet.
• No webcam redirection. USB passthrough is limited to Native tablet: an administrator opt-in on Linux Piers, a preview on the macOS Pier.
• There is no support. Arcen is a solo side project; see the repository's SUPPORT.md.