@livedesk/hub 0.1.65 → 0.1.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "VuvoDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",
@@ -12,11 +12,11 @@
     "dev": "node src/server.js",
     "start": "node src/server.js",
     "check": "node --check src/server.js && node --check src/remote-hub.js && node --check src/remote-clipboard-contract.mjs && node --check src/console-direct.js",
-    "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
+    "prepublishOnly": "node ../../scripts/vuvodesk-release-git-gate.mjs"
   },
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.8",
+    "@livedesk/runtime-core": "0.1.9",
     "@openai/codex-sdk": "0.145.0",
     "cors": "^2.8.5",
     "express": "^4.21.2",

package/src/captures/capture-store.js

@@ -86,7 +86,7 @@ export class CaptureStore {
       throw Object.assign(new Error('capture-mime-type-unsupported'), { status: 415 });
     }
     const extension = MIME_EXTENSIONS.get(mimeType) || (kind === 'screenshot' ? '.png' : '.webm');
-    const fileNameBase = safeName(metadata.fileName, `LiveDesk_${kind}`);
+    const fileNameBase = safeName(metadata.fileName, `VuvoDesk_${kind}`);
     const fileName = fileNameBase.toLowerCase().endsWith(extension) ? fileNameBase : `${fileNameBase}${extension}`;
     const id = randomUUID();
     const folder = kind === 'screenshot' ? 'images' : kind === 'timelapse' ? 'timelapses' : 'recordings';
@@ -122,7 +122,7 @@ export class CaptureStore {
     const sessionId = randomUUID();
     const tempPath = path.join(this.root, '.tmp', `${sessionId}.webm.part`);
     await writeFile(tempPath, Buffer.alloc(0), { mode: 0o600 });
-    const fileNameBase = safeName(metadata.fileName, `LiveDesk_${kind}`);
+    const fileNameBase = safeName(metadata.fileName, `VuvoDesk_${kind}`);
     const session = {
       sessionId,
       kind,

package/src/console-direct.js

@@ -29,6 +29,7 @@ const MAX_SHARED_ASSEMBLY_BYTES = 12 * 1024 * 1024;
 const MAX_FRAME_MESSAGE_BYTES = (8 * 1024 * 1024) + DIRECT_CONSOLE_WIRE_CHUNK_BYTES;
 const MAX_PENDING_MEDIA_WIRE_MESSAGES = 8;
 const MAX_DATA_CHANNEL_BUFFERED_BYTES = 12 * 1024 * 1024;
+const CONTROL_HEADROOM_BUFFERED_BYTES = 4 * 1024 * 1024;
 const MAX_LOCAL_WS_BUFFERED_BYTES = 4 * 1024 * 1024;
 const HTTP_TIMEOUT_MS = 15_000;
 const ICE_CONNECT_TIMEOUT_MS = 10_000;
@@ -169,6 +170,7 @@ function allowedHttpRequest(method, pathname) {
     || pathname === '/api/auth/session'
     || pathname === '/api/remote/status'
     || pathname === '/api/hub/status'
+    || pathname === '/api/remote/pwa-diagnostics'
     || pathname === '/api/update/status'
     || pathname === '/api/update/apply') {
     return true;
@@ -369,6 +371,8 @@ export function createHubConsoleDirect(options = {}) {
   let lastHttpStatus = 0;
   let rejectedRelayCandidates = 0;
   let dataChannelBackpressureCloses = 0;
+  let dataChannelSendFailures = 0;
+  let lastDataChannelSendFailure = null;
   let malformedWireCloses = 0;
   let wireBudgetCleanupFailures = 0;
 
@@ -651,7 +655,7 @@ export function createHubConsoleDirect(options = {}) {
         || channelBufferedAmount(right) - channelBufferedAmount(left)
       ));
     for (const state of candidates) {
-      if (ownerBufferedAmount(owner) + requiredBytes <= MAX_DATA_CHANNEL_BUFFERED_BYTES) break;
+      if (ownerBufferedAmount(owner) + requiredBytes <= CONTROL_HEADROOM_BUFFERED_BYTES) break;
       dataChannelBackpressureCloses += 1;
       closeLogicalChannel(owner, state, {
         code: 1013,
@@ -680,8 +684,39 @@ export function createHubConsoleDirect(options = {}) {
       return false;
     }
     const wireBytes = chunks.reduce((total, chunk) => total + chunk.byteLength, 0);
+    const partialMedia = channelState.purpose === 'frame' || channelState.purpose === 'atlas';
+    if (partialMedia
+      && (wireBytes > MAX_DATA_CHANNEL_BUFFERED_BYTES
+        || ownerBufferedAmount(owner) + wireBytes > MAX_DATA_CHANNEL_BUFFERED_BYTES)) {
+      dataChannelBackpressureCloses += 1;
+      if (options.closeOnFailure !== false) {
+        closeLogicalChannel(owner, channelState, {
+          code: 1013,
+          reason: 'console-direct-datachannel-backpressure',
+          notify: false
+        });
+      }
+      return false;
+    }
+    const mediaBufferedBytes = partialMedia ? channelBufferedAmount(channelState) : 0;
+    if (partialMedia
+      && mediaBufferedBytes > 0
+      && mediaBufferedBytes + wireBytes > CONTROL_HEADROOM_BUFFERED_BYTES) {
+      // Retire only the media lane that owns the stale SCTP backlog. Its
+      // browser socket recovery requests a current key frame while the
+      // reliable peer and every healthy lane keep their own owners.
+      dataChannelBackpressureCloses += 1;
+      if (options.closeOnFailure !== false) {
+        closeLogicalChannel(owner, channelState, {
+          code: 1013,
+          reason: 'console-direct-media-headroom',
+          notify: false
+        });
+      }
+      return false;
+    }
     if (channelState === owner.control
-      && ownerBufferedAmount(owner) + wireBytes > MAX_DATA_CHANNEL_BUFFERED_BYTES) {
+      && ownerBufferedAmount(owner) + wireBytes > CONTROL_HEADROOM_BUFFERED_BYTES) {
       releaseLogicalBacklogForControl(owner, wireBytes);
     }
     if (wireBytes > MAX_DATA_CHANNEL_BUFFERED_BYTES
@@ -697,11 +732,28 @@ export function createHubConsoleDirect(options = {}) {
       }
       return false;
     }
-    for (const chunk of chunks) {
+    for (const [chunkIndex, chunk] of chunks.entries()) {
       if (!isOwnerActive(owner) || channelState.closed || !channelIsOpen(channelState.channel)) return false;
       try {
-        if (channelState.channel.sendMessageBinary(chunk) !== true) throw new Error('send-rejected');
-      } catch {
+        // Normalize the node-datachannel native boundary to its documented
+        // Node Buffer shape. Share the exact encoded bytes without copying or
+        // retaining a second application queue.
+        const nativeChunk = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+        if (channelState.channel.sendMessageBinary(nativeChunk) !== true) throw new Error('send-rejected');
+      } catch (error) {
+        dataChannelSendFailures += 1;
+        lastDataChannelSendFailure = Object.freeze({
+          purpose: channelState.purpose,
+          channelId: channelState.channelId,
+          generation: owner.generation,
+          messageId: (channelState.nextSendMessageId - 1) >>> 0,
+          chunkIndex,
+          chunkCount: chunks.length,
+          chunkBytes: chunk.byteLength,
+          bufferedBytes: channelBufferedAmount(channelState),
+          error: String(error instanceof Error ? error.message : error).slice(0, 120),
+          occurredAt: Date.now()
+        });
         if (options.closeOnFailure !== false) {
           if (channelState === owner.control) retirePeer(owner, 'console-direct-control-send-failed');
           else closeLogicalChannel(owner, channelState, {
@@ -1950,6 +2002,8 @@ export function createHubConsoleDirect(options = {}) {
         + Number(signalHeartbeatTimerActive),
       rejectedRelayCandidates,
       dataChannelBackpressureCloses,
+      dataChannelSendFailures,
+      lastDataChannelSendFailure,
       malformedWireCloses,
       wireBudgetCleanupFailures,
       lastConnectedAt,
@@ -1982,6 +2036,7 @@ export const consoleDirectContract = Object.freeze({
   maxFrameMessageBytes: MAX_FRAME_MESSAGE_BYTES,
   maxPendingMediaWireMessages: MAX_PENDING_MEDIA_WIRE_MESSAGES,
   maxBufferedBytes: MAX_DATA_CHANNEL_BUFFERED_BYTES,
+  controlHeadroomBufferedBytes: CONTROL_HEADROOM_BUFFERED_BYTES,
   maxLocalWebSocketBufferedBytes: MAX_LOCAL_WS_BUFFERED_BYTES,
   maxDefaultRetryDelayMs: DEFAULT_RETRY_DELAYS_MS.at(-1),
   accessTokenTimeoutMs: ACCESS_TOKEN_TIMEOUT_MS,

package/src/console-direct.test.mjs

@@ -23,6 +23,7 @@ const CONSOLE_ID = '22222222-2222-4222-8222-222222222222';
 const CONNECTION_ONE = '33333333-3333-4333-8333-333333333333';
 const CONNECTION_TWO = '44444444-4444-4444-8444-444444444444';
 const CHANNEL_ID = '55555555-5555-4555-8555-555555555555';
+const CHANNEL_ID_TWO = '55555555-5555-4555-8555-555555555556';
 const REQUEST_ID = '66666666-6666-4666-8666-666666666666';
 const TEAM_WORKSPACE_ID = '88888888-8888-4888-8888-888888888888';
 const TEAM_OWNER_USER_ID = '99999999-9999-4999-8999-999999999999';
@@ -123,6 +124,7 @@ class FakeDataChannel {
 
   sendMessageBinary(value) {
     if (!this.isOpen()) return false;
+    if (!Buffer.isBuffer(value)) throw new TypeError('Buffer expected');
     this.sent.push(new Uint8Array(value));
     return true;
   }
@@ -627,6 +629,48 @@ test('reliable control channel bridges bounded HTTP over fragmented wire message
   direct.close();
 });
 
+test('reliable control channel admits the authenticated PWA diagnostic route', async () => {
+  let fetchCalls = 0;
+  const diagnosticBody = JSON.stringify({ schema: 'livedesk.pwa-runtime-diagnostics.v1', events: [] });
+  const { direct, signal } = await connectedDirect({
+    fetchImpl: async (url, init) => {
+      fetchCalls += 1;
+      assert.equal(url, 'http://127.0.0.1:5179/api/remote/pwa-diagnostics');
+      assert.equal(init.method, 'POST');
+      assert.equal(init.headers['content-type'], 'application/json');
+      assert.equal(Buffer.from(init.body).toString('utf8'), diagnosticBody);
+      return new Response('{"ok":true,"accepted":true}', {
+        status: 202,
+        statusText: 'Accepted',
+        headers: { 'Content-Type': 'application/json' }
+      });
+    }
+  });
+  const peer = offer(signal);
+  const control = new FakeDataChannel('livedesk-control-v1');
+  peer.emitDataChannel(control);
+  control.open();
+
+  sendWire(control, {
+    type: 'http-request',
+    requestId: REQUEST_ID,
+    method: 'POST',
+    path: '/api/remote/pwa-diagnostics',
+    headers: { 'content-type': 'application/json' },
+    bodyBase64: Buffer.from(diagnosticBody).toString('base64')
+  });
+  await settle();
+  const response = decodeWireMessages(control.sent)
+    .map(message => JSON.parse(message.data))
+    .find(message => message.type === 'http-response');
+  assert.equal(fetchCalls, 1, 'The PWA diagnostic request must reach the local Hub API.');
+  assert.equal(response.requestId, REQUEST_ID);
+  assert.equal(response.status, 202);
+  assert.equal(Buffer.from(response.bodyBase64, 'base64').toString('utf8'), '{"ok":true,"accepted":true}');
+  assert.equal(direct.inspect().pendingHttpRequests, 0);
+  direct.close();
+});
+
 test('Team Operator can use Wall and Control but cannot mutate the Hub owner runtime', async () => {
   const teamWorkspaceAccess = {
     workspaceId: TEAM_WORKSPACE_ID,
@@ -1184,6 +1228,56 @@ test('the peer-wide DataChannel buffer cap closes only the overflowing logical l
   direct.close();
 });
 
+test('media pressure retires only its stale logical lane while preserving the control peer and a healthy lane', async () => {
+  const { direct, signal } = await connectedDirect();
+  const peer = offer(signal);
+  const control = new FakeDataChannel('livedesk-control-v1');
+  peer.emitDataChannel(control);
+  control.open();
+  const lane = new FakeDataChannel(`livedesk-ws-v1:${CHANNEL_ID}:frame`);
+  peer.emitDataChannel(lane);
+  lane.open();
+  sendWire(control, {
+    type: 'ws-open',
+    connectionId: CONNECTION_ONE,
+    hubEpoch: HUB_EPOCH,
+    channelId: CHANNEL_ID,
+    purpose: 'frame',
+    path: '/api/remote/frames/ws'
+  });
+  const local = FakeLocalSocket.instances[0];
+  local.open();
+  const healthyLane = new FakeDataChannel(`livedesk-ws-v1:${CHANNEL_ID_TWO}:frame`);
+  peer.emitDataChannel(healthyLane);
+  healthyLane.open();
+  sendWire(control, {
+    type: 'ws-open',
+    connectionId: CONNECTION_ONE,
+    hubEpoch: HUB_EPOCH,
+    channelId: CHANNEL_ID_TWO,
+    purpose: 'frame',
+    path: '/api/remote/frames/ws'
+  });
+  const healthyLocal = FakeLocalSocket.instances[1];
+  healthyLocal.open();
+  lane.buffered = consoleDirectContract.controlHeadroomBufferedBytes;
+
+  healthyLocal.receive('healthy-frame');
+  assert.ok(healthyLane.sent.length > 0);
+  assert.equal(healthyLane.closed, false);
+  assert.equal(lane.closed, false);
+
+  local.receive('newest-frame');
+
+  assert.equal(lane.sent.length, 0);
+  assert.equal(lane.closed, true);
+  assert.equal(healthyLane.closed, false);
+  assert.equal(control.closed, false);
+  assert.equal(peer.closed, false);
+  assert.equal(direct.inspect().dataChannelBackpressureCloses, 1);
+  direct.close();
+});
+
 test('a reliable control response drops stale media backlog without retiring the peer', async () => {
   const { direct, signal } = await connectedDirect({
     fetchImpl: async () => new Response('{"online":true}', {
@@ -1405,7 +1499,7 @@ test('native node-datachannel peers carry the fragmented control wire over loopb
       kind: 'control'
     });
     assert.ok(chunks.length > 1);
-    for (const chunk of chunks) assert.equal(offerChannel.sendMessageBinary(chunk), true);
+    for (const chunk of chunks) assert.equal(offerChannel.sendMessageBinary(Buffer.from(chunk)), true);
     const message = await received;
     clearTimeout(messageTimer);
     messageTimer = null;

package/src/remote-hub.js

@@ -17,14 +17,15 @@ import {
     BoundedSegmentedBuffer,
     createBoundedAgentBinaryIngressLane
 } from './transport/agent-binary-ingress.js';
-import {
-    REMOTE_CLIPBOARD_FILE_ACTIONS,
+import {
+    REMOTE_CLIPBOARD_FILE_ACTIONS,
     REMOTE_CLIPBOARD_LIMITS,
     REMOTE_CLIPBOARD_PROTOCOL,
     normalizeRemoteClipboardCommandResult,
     normalizeRemoteClipboardManifest,
     remoteClipboardContentNeedsFileTransfer
-} from './remote-clipboard-contract.mjs';
+} from './remote-clipboard-contract.mjs';
+import { liveProfileSatisfiesDemand } from './shared-wall-profile-contract.mjs';
 
 const DEFAULT_REMOTE_HUB_PORT = 5197;
 const DEFAULT_REMOTE_HUB_HOST = '0.0.0.0';
@@ -9784,25 +9785,31 @@ export function createRemoteHub(options = {}) {
             return { ok: false, error: 'device-not-connected' };
         }
 
-        const command = safeString(options.command, 20000);
-        if (!command) return { ok: false, error: 'client-update-command-missing' };
-        const commandId = safeString(options.commandId, 128) || crypto.randomUUID();
-        const timeoutMs = clampNumber(options.timeoutMs, 1000, 120000, 30000);
-        const sent = writeJsonLine(device.socket, {
+        const command = safeString(options.command, 20000);
+        if (!command) return { ok: false, error: 'client-update-command-missing' };
+        const commandId = safeString(options.commandId, 128) || crypto.randomUUID();
+        const timeoutMs = clampNumber(options.timeoutMs, 1000, 120000, 30000);
+        const legacyCommandShell = ['win32', 'windows']
+            .includes(safeString(device.platform, 32).toLowerCase())
+            ? 'cmd'
+            : 'auto';
+        const sent = writeJsonLine(device.socket, {
             type: 'command',
             commandId,
-            command: 'command.run',
-            payload: {
-                command,
-                timeoutMs,
-                permissionMode: 'full-access',
+            command: 'command.run',
+            payload: {
+                command,
+                shell: legacyCommandShell,
+                timeoutMs,
+                permissionMode: 'full-access',
                 // RemoteFast releases before 0.1.170 read command.run inputs
                 // from toolArguments, while Node and current Agents accept the
                 // direct payload fields. Carry both during the update bridge.
-                toolArguments: {
-                    command,
-                    timeoutMs
-                }
+                toolArguments: {
+                    command,
+                    shell: legacyCommandShell,
+                    timeoutMs
+                }
             },
             issuedAt: new Date().toISOString()
         });
@@ -10917,23 +10924,29 @@ export function createRemoteHub(options = {}) {
         ensureLiveStreamReplacementTimers(device).set(stream.streamId, timer);
     }
 
-    function failPendingLiveStream(device, commandId, error = 'stream-start-failed') {
+    function failPendingLiveStream(device, commandId, error = 'stream-start-failed') {
         const key = safeString(commandId, 128);
         if (!device || !key) {
             return false;
         }
         const streams = ensureDeviceLiveStreams(device);
         for (const stream of streams.values()) {
-            const pending = getPendingLiveStreamDescriptor(stream);
-            if (safeString(pending?.commandId, 128) !== key) {
-                continue;
-            }
-            clearPendingLiveStreamDescriptor(device, stream);
-            emitRemoteEvent('RemoteLiveStreamRestartFailed', device, {
-                streamId: stream.streamId,
-                commandId: key,
-                error: safeString(error, 500) || 'stream-start-failed'
-            });
+            const pending = getPendingLiveStreamDescriptor(stream);
+            if (safeString(pending?.commandId, 128) !== key) {
+                continue;
+            }
+            const failedOwner = { ...pending };
+            clearPendingLiveStreamDescriptor(device, stream);
+            emitRemoteEvent('RemoteLiveStreamRestartFailed', device, {
+                streamId: stream.streamId,
+                commandId: key,
+                streamPurpose: safeString(failedOwner.streamPurpose, 24) || 'wall',
+                captureGeneration: Number(failedOwner.captureGeneration || 0),
+                monitorIndex: Number(failedOwner.monitorIndex || 0),
+                retainedCommandId: safeString(stream.commandId, 128),
+                retainedCaptureGeneration: Number(stream.captureGeneration || 0),
+                error: safeString(error, 500) || 'stream-start-failed'
+            });
             return true;
         }
         for (const stream of streams.values()) {
@@ -11270,9 +11283,23 @@ export function createRemoteHub(options = {}) {
                 === normalized.streamPurpose;
     }
 
-    function sharedLiveProfileResult(device, activeLiveStream, normalized, extra = {}) {
-        return {
-            ok: true,
+    function sharedLiveProfileResult(
+        device,
+        activeLiveStream,
+        normalized,
+        extra = {},
+        subscriberRequestedProfile = null
+    ) {
+        const requested = subscriberRequestedProfile && typeof subscriberRequestedProfile === 'object'
+            ? {
+                fps: clampNumber(subscriberRequestedProfile.fps, 1, normalized.streamPurpose === 'control' ? 60 : 30, normalized.fps),
+                maxWidth: clampNumber(subscriberRequestedProfile.maxWidth, 320, 3840, normalized.maxWidth),
+                maxHeight: clampNumber(subscriberRequestedProfile.maxHeight, 180, 2160, normalized.maxHeight),
+                quality: clampNumber(subscriberRequestedProfile.quality, 20, 95, normalized.quality)
+            }
+            : normalized;
+        return {
+            ok: true,
             commandId: activeLiveStream.commandId,
             sessionId: device.sessionId,
             streamId: activeLiveStream.streamId,
@@ -11284,12 +11311,12 @@ export function createRemoteHub(options = {}) {
             captureGeneration: Number(activeLiveStream.captureGeneration || 0),
             ready: liveStreamHasCurrentFrame(activeLiveStream),
             reused: true,
-            sharedProfileReused: true,
-            requestedProfile: {
-                fps: normalized.fps,
-                maxWidth: normalized.maxWidth,
-                maxHeight: normalized.maxHeight,
-                quality: normalized.quality
+            sharedProfileReused: true,
+            requestedProfile: {
+                fps: requested.fps,
+                maxWidth: requested.maxWidth,
+                maxHeight: requested.maxHeight,
+                quality: requested.quality
             },
             effectiveProfile: {
                 fps: Number(activeLiveStream.fps || normalized.fps),
@@ -11500,10 +11527,11 @@ export function createRemoteHub(options = {}) {
         const pendingDescriptor = getPendingLiveStreamDescriptor(activeLiveStream);
         if (pendingDescriptor?.commandId) {
             const pendingMatchesRequest = liveStreamMatchesOptions(pendingDescriptor, normalized);
-            const pendingMatchesSharedOwner = options.forceRestart !== true
-                && options.reuseExisting === true
-                && options.reuseSharedExisting === true
-                && liveStreamMatchesOwnerIdentity(pendingDescriptor, normalized);
+            const pendingMatchesSharedOwner = options.forceRestart !== true
+                && options.reuseExisting === true
+                && options.reuseSharedExisting === true
+                && liveStreamMatchesOwnerIdentity(pendingDescriptor, normalized)
+                && liveProfileSatisfiesDemand(pendingDescriptor, normalized);
             if ((pendingMatchesRequest || pendingMatchesSharedOwner)
                 && liveStreamReplacementStillPending(activeLiveStream)) {
                 emitRemoteEvent('RemoteLiveStreamRestartPending', device, {
@@ -11513,10 +11541,10 @@ export function createRemoteHub(options = {}) {
                     reason: safeString(options.restartReason || 'duplicate-restart', 128)
                 });
                 if (pendingMatchesSharedOwner && !pendingMatchesRequest) {
-                    return sharedLiveProfileResult(device, pendingDescriptor, normalized, {
-                        ready: false,
-                        pending: true
-                    });
+                    return sharedLiveProfileResult(device, pendingDescriptor, normalized, {
+                        ready: false,
+                        pending: true
+                    }, options.subscriberRequestedProfile);
                 }
                 return {
                     ok: true,
@@ -11593,10 +11621,11 @@ export function createRemoteHub(options = {}) {
         }
         if (activeLiveStream
             && options.forceRestart !== true
-            && options.reuseExisting === true
-            && options.reuseSharedExisting === true
-            && liveStreamMatchesOwnerIdentity(activeLiveStream, normalized)
-            && liveStreamIsReusable(activeLiveStream)) {
+            && options.reuseExisting === true
+            && options.reuseSharedExisting === true
+            && liveStreamMatchesOwnerIdentity(activeLiveStream, normalized)
+            && liveStreamIsReusable(activeLiveStream)
+            && liveProfileSatisfiesDemand(activeLiveStream, normalized)) {
             emitRemoteEvent('RemoteLiveStreamSharedProfileReused', device, {
                 streamId,
                 commandId: activeLiveStream.commandId,
@@ -11608,7 +11637,13 @@ export function createRemoteHub(options = {}) {
                 effectiveMaxWidth: Number(activeLiveStream.maxWidth || normalized.maxWidth),
                 effectiveMaxHeight: Number(activeLiveStream.maxHeight || normalized.maxHeight)
             });
-            return sharedLiveProfileResult(device, activeLiveStream, normalized);
+            return sharedLiveProfileResult(
+                device,
+                activeLiveStream,
+                normalized,
+                {},
+                options.subscriberRequestedProfile
+            );
         }
         if (activeLiveStream
             && options.forceRestart !== true
@@ -11773,10 +11808,11 @@ export function createRemoteHub(options = {}) {
             fps,
             mode: transfer.mode,
             frameMode: transfer.frameMode,
-            monitorIndex,
-            captureGeneration,
-            ready: false
-        };
+            monitorIndex,
+            captureGeneration,
+            ready: false,
+            pending: replacingActiveStream
+        };
     }
 
     function stopLiveStream(deviceId, options = {}) {

package/src/server.js

@@ -35,6 +35,11 @@ import {
   isReusedLiveStreamFrameReady
 } from './live-stream-monitor-contract.js';
 import { createLiveCaptureTransitionRetryCoordinator } from './live-capture-transition-retry.mjs';
+import {
+  selectSharedWallSourceProfile,
+  shouldRetainWallOwnerUntilPendingStartCommits,
+  wallBindingMatchesFailedOwner
+} from './shared-wall-profile-contract.mjs';
 import {
   createPlanDeviceAccessSnapshot,
   partitionPlanDeviceIds,
@@ -61,7 +66,7 @@ import { LiveDeskSettingsStore, SettingsConflictError } from './settings/setting
 import { effectiveDevicePolicy } from './settings/settings-schema.js';
 import { buildEffectiveDevicePolicy } from './settings/effective-device-policy.js';
 import { CaptureStore } from './captures/capture-store.js';
-import { createLiveDeskUpdateManager } from './live-desk-update.js';
+import { createVuvoDeskUpdateManager } from './vuvodesk-update.js';
 import { createHubUdpTransport } from './transport/udp-hub-transport.js';
 import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-core/src/index.js';
 import { fetchAuthResponse, AUTH_REQUEST_TIMEOUT_MS } from '../../runtime-core/src/auth-http.js';
@@ -435,7 +440,25 @@ function handleRemoteHubEvent(type, event) {
     || type === 'RemoteLiveStreamStopped') {
     const liveStreamEventDeviceId = String(event?.deviceId || event?.device?.deviceId || '').trim();
     const liveStreamEventPurpose = readRemoteLiveStreamEventPurpose(event);
-    if ((type === 'RemoteLiveStreamStarted' || type === 'RemoteLiveStreamOpened')
+    if (type === 'RemoteLiveStreamOpened' && liveStreamEventPurpose === 'wall') {
+      const committedOwner = event?.device?.activeLiveStream;
+      if (String(committedOwner?.commandId || '').trim() === String(event?.commandId || '').trim()
+        && Number(committedOwner?.captureGeneration || 0) === Number(event?.captureGeneration || 0)) {
+        rebindSharedWallSubscribersToOwner(liveStreamEventDeviceId, {
+          ...committedOwner,
+          sessionId: event?.device?.sessionId || ''
+        }, {
+          effectiveProfile: {
+            fps: Number(committedOwner?.fps || 0),
+            maxWidth: Number(committedOwner?.maxWidth || 0),
+            maxHeight: Number(committedOwner?.maxHeight || 0),
+            quality: Number(committedOwner?.quality || 0)
+          },
+          readySent: false,
+          reason: 'shared-wall-profile-upgrade-committed'
+        });
+      }
+    } else if ((type === 'RemoteLiveStreamStarted' || type === 'RemoteLiveStreamOpened')
       && liveStreamEventPurpose === 'control') {
       readOnlyControlPresentationReconcileCoordinator
         .cancelForControlTransition(liveStreamEventDeviceId);
@@ -449,6 +472,37 @@ function handleRemoteHubEvent(type, event) {
         .scheduleAfterConfirmedStop(liveStreamEventDeviceId);
     }
   }
+  if (type === 'RemoteLiveStreamRestartFailed') {
+    const failedDeviceId = String(event?.deviceId || event?.device?.deviceId || '').trim();
+    const retainedOwner = event?.device?.activeLiveStream;
+    if (String(retainedOwner?.streamPurpose || '').trim().toLowerCase() === 'wall') {
+      const rebound = rebindSharedWallSubscribersToOwner(failedDeviceId, {
+        ...retainedOwner,
+        sessionId: event?.device?.sessionId || ''
+      }, {
+        effectiveProfile: {
+          fps: Number(retainedOwner?.fps || 0),
+          maxWidth: Number(retainedOwner?.maxWidth || 0),
+          maxHeight: Number(retainedOwner?.maxHeight || 0),
+          quality: Number(retainedOwner?.quality || 0)
+        },
+        readySent: true,
+        replaceOnlyOwner: {
+          commandId: event?.commandId || '',
+          captureGeneration: Number(event?.captureGeneration || 0)
+        },
+        reason: 'shared-wall-profile-upgrade-failed'
+      });
+      console.warn(
+        `[VuvoDesk Hub] Wall replacement failed device=${failedDeviceId} `
+        + `attemptedCommand=${String(event?.commandId || '').slice(0, 8) || '-'} `
+        + `attemptedGeneration=${Number(event?.captureGeneration || 0)} `
+        + `retainedCommand=${String(event?.retainedCommandId || retainedOwner?.commandId || '').slice(0, 8) || '-'} `
+        + `retainedGeneration=${Number(event?.retainedCaptureGeneration || retainedOwner?.captureGeneration || 0)} `
+        + `rebound=${rebound} error=${String(event?.error || 'stream-start-failed').slice(0, 160)}`
+      );
+    }
+  }
   if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
     connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
     refreshPlanDeviceAccess(type === 'RemoteDeviceConnected' ? 'device-connected' : 'device-disconnected');
@@ -1256,7 +1310,7 @@ function getLiveDeskUpdateStatus() {
 }
 
 const electronDesktopOwnsSelfUpdate = process.env.LIVEDESK_DESKTOP_HOST === '1';
-liveDeskUpdateManager = createLiveDeskUpdateManager({
+liveDeskUpdateManager = createVuvoDeskUpdateManager({
   remoteHub,
   currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
   currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
@@ -2591,7 +2645,7 @@ function hasOtherFrameStreamOwner(ws, deviceId, streamId, streamPurpose = '') {
   return false;
 }
 
-function hasOtherFrameStreamDemand(ws, deviceId, streamPurpose = '') {
+function hasOtherFrameStreamDemand(ws, deviceId, streamPurpose = '') {
   const normalizedPurpose = String(streamPurpose || '').trim().toLowerCase();
   if (!deviceId || !normalizedPurpose) {
     return false;
@@ -2608,8 +2662,137 @@ function hasOtherFrameStreamDemand(ws, deviceId, streamPurpose = '') {
       return true;
     }
   }
-  return false;
-}
+  return false;
+}
+
+function frameClientMonitorIndex(ws, deviceId, liveOptions = ws?.liveDeskLiveOptions || {}) {
+  return Object.prototype.hasOwnProperty.call(liveOptions.monitorSelections || {}, deviceId)
+    ? normalizeMonitorIndex(liveOptions.monitorSelections[deviceId])
+    : normalizeMonitorIndex(liveOptions.monitorIndex);
+}
+
+function resolveSharedWallSourceDemand(ws, deviceId, liveOptions, monitorIndex) {
+  const requestedMode = String(liveOptions?.frameMode || liveOptions?.mode || '').trim().toLowerCase();
+  const requestedPurpose = String(liveOptions?.streamPurpose || '').trim().toLowerCase();
+  const requestedMonitorIndex = normalizeMonitorIndex(monitorIndex);
+  const demands = [{
+    fps: liveOptions?.fps,
+    maxWidth: liveOptions?.maxWidth,
+    maxHeight: liveOptions?.maxHeight,
+    quality: liveOptions?.quality
+  }];
+  if (requestedPurpose === 'wall') {
+    for (const candidate of frameClients) {
+      const candidateOptions = candidate?.liveDeskLiveOptions;
+      if (candidate === ws
+        || candidate?.readyState !== candidate?.OPEN
+        || candidate?.liveDeskAutoStart !== true
+        || !(candidate.liveDeskDeviceIds instanceof Set)
+        || !candidate.liveDeskDeviceIds.has(deviceId)
+        || String(candidateOptions?.streamPurpose || '').trim().toLowerCase() !== 'wall'
+        || String(candidateOptions?.frameMode || candidateOptions?.mode || '').trim().toLowerCase()
+          !== requestedMode
+        || frameClientMonitorIndex(candidate, deviceId, candidateOptions) !== requestedMonitorIndex) {
+        continue;
+      }
+      demands.push({
+        fps: candidateOptions.fps,
+        maxWidth: candidateOptions.maxWidth,
+        maxHeight: candidateOptions.maxHeight,
+        quality: candidateOptions.quality
+      });
+    }
+  }
+  return {
+    ...selectSharedWallSourceProfile(demands),
+    // Keep the strongest healthy generation until the final Wall viewer
+    // releases it. This prevents a lone late low-rate refresh from undoing a
+    // 30 fps upgrade and makes start order irrelevant.
+    preserveDominantProfile: requestedPurpose === 'wall'
+  };
+}
+
+function rebindSharedWallSubscribersToOwner(deviceId, owner, {
+  effectiveProfile = null,
+  readySent = false,
+  replaceOnlyOwner = null,
+  reason = 'shared-wall-profile-owner-changed'
+} = {}) {
+  const normalizedDeviceId = String(deviceId || '').trim();
+  const sessionId = String(owner?.sessionId || owner?.device?.sessionId || '').trim();
+  const streamId = String(owner?.streamId || '').trim();
+  const commandId = String(owner?.commandId || '').trim();
+  const captureGeneration = Number(owner?.captureGeneration || 0);
+  const monitorIndex = normalizeMonitorIndex(owner?.monitorIndex);
+  const frameMode = String(owner?.frameMode || owner?.mode || '').trim().toLowerCase();
+  const streamPurpose = String(owner?.streamPurpose || '').trim().toLowerCase();
+  if (!normalizedDeviceId
+    || !sessionId
+    || !streamId
+    || !commandId
+    || !Number.isSafeInteger(captureGeneration)
+    || captureGeneration <= 0
+    || streamPurpose !== 'wall') {
+    return 0;
+  }
+  let rebound = 0;
+  const candidates = new Set([
+    ...(frameClientsByDeviceId.get(normalizedDeviceId) || []),
+    ...frameWildcardClients
+  ]);
+  for (const candidate of candidates) {
+    const candidateOptions = candidate?.liveDeskLiveOptions;
+    if (candidate?.readyState !== candidate?.OPEN
+      || candidate?.liveDeskAutoStart !== true
+      || !(candidate.liveDeskDeviceIds instanceof Set)
+      || !candidate.liveDeskDeviceIds.has(normalizedDeviceId)
+      || String(candidateOptions?.streamPurpose || '').trim().toLowerCase() !== 'wall'
+      || String(candidateOptions?.frameMode || candidateOptions?.mode || '').trim().toLowerCase()
+        !== frameMode
+      || frameClientMonitorIndex(candidate, normalizedDeviceId, candidateOptions) !== monitorIndex) {
+      continue;
+    }
+    const previousBinding = candidate.liveDeskExpectedStreamBindingsByDeviceId instanceof Map
+      ? candidate.liveDeskExpectedStreamBindingsByDeviceId.get(normalizedDeviceId)
+      : null;
+    if (!previousBinding || previousBinding.readOnlyControlBorrow === true) continue;
+    if (replaceOnlyOwner && !wallBindingMatchesFailedOwner(previousBinding, replaceOnlyOwner)) continue;
+    const nextBinding = {
+      deviceId: normalizedDeviceId,
+      sessionId,
+      streamId,
+      streamPurpose: 'wall',
+      commandId,
+      captureGeneration,
+      monitorIndex,
+      readOnlyControlBorrow: false,
+      presentationPurpose: '',
+      effectiveProfile,
+      readySent: readySent === true
+    };
+    const previousIdentity = frameLaneBindingIdentity(previousBinding);
+    const nextIdentity = replaceExpectedFrameBindingForClient(
+      candidate,
+      normalizedDeviceId,
+      nextBinding
+    );
+    if (!nextIdentity || nextIdentity === previousIdentity) continue;
+    candidate.liveDeskStreamIdsByDeviceId?.set?.(normalizedDeviceId, streamId);
+    candidate.liveDeskSharedProfileUpgradeCount = Math.max(
+      0,
+      Number(candidate.liveDeskSharedProfileUpgradeCount || 0)
+    ) + 1;
+    rebound += 1;
+  }
+  if (rebound > 0) {
+    console.log(
+      `[VuvoDesk Hub] rebound ${rebound} Wall browser lane(s) device=${normalizedDeviceId} `
+      + `generation=${captureGeneration} profile=${Number(effectiveProfile?.fps || owner?.fps || 0)}fps `
+      + `reason=${String(reason || 'shared-wall-profile-owner-changed')}`
+    );
+  }
+  return rebound;
+}
 
 function frameStreamStopKey(deviceId, streamId, streamPurpose) {
   return `${deviceId}\u0000${streamId}\u0000${streamPurpose}`;
@@ -3004,8 +3187,9 @@ function snapshotFrameLaneResourceHealth() {
           maxWidth: Math.max(0, Number(ws.liveDeskLiveOptions.maxWidth || 0)),
           maxHeight: Math.max(0, Number(ws.liveDeskLiveOptions.maxHeight || 0)),
           quality: Math.max(0, Number(ws.liveDeskLiveOptions.quality || 0))
-        } : null,
-        sharedProfileReuseCount: Math.max(0, Number(ws.liveDeskSharedProfileReuseCount || 0)),
+        } : null,
+        sharedProfileReuseCount: Math.max(0, Number(ws.liveDeskSharedProfileReuseCount || 0)),
+        sharedProfileUpgradeCount: Math.max(0, Number(ws.liveDeskSharedProfileUpgradeCount || 0)),
         queueDepth: Math.max(0, Number(lane?.queue?.length || 0)),
         queueLimit: frameClientQueueLimit(ws),
         queueHighWaterPackets: Math.max(0, Number(lane?.queuedPacketsHighWater || 0)),
@@ -3810,12 +3994,33 @@ function startFrameSubscriptionLive(
       skipped.push({ deviceId, reason: device?.connected ? 'live-unavailable' : 'not-connected' });
       continue;
     }
-    const monitorIndex = Object.prototype.hasOwnProperty.call(liveOptions.monitorSelections || {}, deviceId)
-      ? liveOptions.monitorSelections[deviceId]
-      : liveOptions.monitorIndex;
+    const monitorIndex = Object.prototype.hasOwnProperty.call(liveOptions.monitorSelections || {}, deviceId)
+      ? liveOptions.monitorSelections[deviceId]
+      : liveOptions.monitorIndex;
+    const sharedWallSourceProfile = resolveSharedWallSourceDemand(
+      ws,
+      deviceId,
+      liveOptions,
+      monitorIndex
+    );
+    const sourceLiveOptions = sharedWallSourceProfile.preserveDominantProfile
+      ? {
+          ...liveOptions,
+          fps: sharedWallSourceProfile.fps,
+          maxWidth: sharedWallSourceProfile.maxWidth,
+          maxHeight: sharedWallSourceProfile.maxHeight,
+          quality: sharedWallSourceProfile.quality
+        }
+      : liveOptions;
     const result = remoteHub.startLiveStream(deviceId, {
-      ...liveOptions,
+      ...sourceLiveOptions,
       monitorIndex,
+      subscriberRequestedProfile: {
+        fps: liveOptions.fps,
+        maxWidth: liveOptions.maxWidth,
+        maxHeight: liveOptions.maxHeight,
+        quality: liveOptions.quality
+      },
       reuseExisting: liveOptions.forceRestart !== true
         && (liveOptions.reuseExisting === true || reason === 'subscribe' || reason === 'watchdog'),
       // Wall capture is one shared native encoder per device. Two open browser
@@ -3825,7 +4030,8 @@ function startFrameSubscriptionLive(
       // and forth every time either view refreshes its subscription.
       reuseSharedExisting: liveOptions.forceRestart !== true
         && String(liveOptions.streamPurpose || '').trim().toLowerCase() === 'wall'
-        && hasOtherFrameStreamDemand(ws, deviceId, 'wall'),
+        && (hasOtherFrameStreamDemand(ws, deviceId, 'wall')
+          || sharedWallSourceProfile.preserveDominantProfile === true),
       silentReuse: reason === 'watchdog' && liveOptions.forceRestart !== true
     });
     if (liveOptions.forceRestart === true) {
@@ -3834,35 +4040,71 @@ function startFrameSubscriptionLive(
         `[VuvoDesk Hub] browser frame recovery client=${String(ws.liveDeskFrameClientId || '-')} device=${deviceId} purpose=${String(liveOptions.streamPurpose || 'wall')} reason=${String(liveOptions.restartReason || reason || 'browser-stale')} token=${token ? token.slice(0, 12) : '-'} result=${result?.ok ? 'accepted' : String(result?.error || 'failed')} session=${String(result?.sessionId || device?.sessionId || '').slice(0, 8)} stream=${String(result?.streamId || '-')} generation=${Number(result?.captureGeneration || 0)} reused=${result?.reused === true}`
       );
     }
-    if (result?.ok) {
-      if (result.sharedProfileReused === true) {
+    if (result?.ok) {
+      const activeStream = device?.activeLiveStream;
+      const retainWallOwner = shouldRetainWallOwnerUntilPendingStartCommits(
+        result,
+        activeStream
+      );
+      const effectiveWallProfile = String(result.streamPurpose || liveOptions.streamPurpose || '')
+        .trim().toLowerCase() === 'wall'
+        ? {
+            fps: Number(result.effectiveProfile?.fps || sourceLiveOptions.fps || result.fps || 0),
+            maxWidth: Number(result.effectiveProfile?.maxWidth || sourceLiveOptions.maxWidth || 0),
+            maxHeight: Number(result.effectiveProfile?.maxHeight || sourceLiveOptions.maxHeight || 0),
+            quality: Number(result.effectiveProfile?.quality || sourceLiveOptions.quality || 0)
+          }
+        : result.effectiveProfile || null;
+      if (result.reused !== true
+        && retainWallOwner !== true
+        && String(result.streamPurpose || '').trim().toLowerCase() === 'wall') {
+        rebindSharedWallSubscribersToOwner(deviceId, result, {
+          effectiveProfile: effectiveWallProfile,
+          readySent: false,
+          reason: 'shared-wall-profile-upgraded'
+        });
+      }
+      if (result.sharedProfileReused === true) {
         ws.liveDeskSharedProfileReuseCount = Math.max(
           0,
           Number(ws.liveDeskSharedProfileReuseCount || 0)
         ) + 1;
       }
       frameCaptureTransitionRetries.complete(ws, deviceId, intentGeneration, 'capture-started');
+      const bindingOwner = retainWallOwner
+        ? {
+            ...activeStream,
+            sessionId: String(device?.sessionId || result.sessionId || '')
+          }
+        : result;
+      const bindingEffectiveWallProfile = retainWallOwner
+        ? {
+            fps: Number(activeStream?.fps || 0),
+            maxWidth: Number(activeStream?.maxWidth || 0),
+            maxHeight: Number(activeStream?.maxHeight || 0),
+            quality: Number(activeStream?.quality || 0)
+          }
+        : effectiveWallProfile;
       const expectedBinding = {
-        deviceId,
-        sessionId: String(result.sessionId || device.sessionId || ''),
-        streamId: String(result.streamId || ''),
-        streamPurpose: String(result.streamPurpose || liveOptions.streamPurpose || 'wall'),
-        commandId: String(result.commandId || ''),
-        captureGeneration: Number(result.captureGeneration || 0),
-        monitorIndex: Number(result.monitorIndex || 0),
-        readOnlyControlBorrow: result.readOnlyControlBorrow === true,
-        presentationPurpose: result.presentationPurpose === 'wall' ? 'wall' : '',
-        effectiveProfile: result.effectiveProfile || null,
+        deviceId,
+        sessionId: String(bindingOwner?.sessionId || device.sessionId || ''),
+        streamId: String(bindingOwner?.streamId || ''),
+        streamPurpose: String(bindingOwner?.streamPurpose || liveOptions.streamPurpose || 'wall'),
+        commandId: String(bindingOwner?.commandId || ''),
+        captureGeneration: Number(bindingOwner?.captureGeneration || 0),
+        monitorIndex: Number(bindingOwner?.monitorIndex || 0),
+        readOnlyControlBorrow: bindingOwner?.readOnlyControlBorrow === true,
+        presentationPurpose: bindingOwner?.presentationPurpose === 'wall' ? 'wall' : '',
+        effectiveProfile: bindingEffectiveWallProfile,
         readySent: false
-      };
-      const activeStream = device?.activeLiveStream;
+      };
       // A new read-only browser presentation has no decoder history from the
       // already-running Control stream. It must enter through the next exact
       // key frame even when the native owner itself is already ready.
       const reusedFrameReady = expectedBinding.readOnlyControlBorrow !== true
         && isReusedLiveStreamFrameReady(result, activeStream, expectedBinding);
       expectedBinding.readySent = reusedFrameReady;
-      ws.liveDeskStreamIdsByDeviceId.set(deviceId, result.streamId);
+      ws.liveDeskStreamIdsByDeviceId.set(deviceId, expectedBinding.streamId);
       const installedBindingIdentity = replaceExpectedFrameBindingForClient(
         ws,
         deviceId,
@@ -3871,9 +4113,9 @@ function startFrameSubscriptionLive(
       if (!installedBindingIdentity) {
         skipped.push({ deviceId, reason: 'invalid-live-stream-binding' });
         continue;
-      }
+      }
       if (expectedBinding.readOnlyControlBorrow !== true) {
-        cancelPendingFrameStreamStop(deviceId, result.streamId, expectedBinding.streamPurpose);
+        cancelPendingFrameStreamStop(deviceId, expectedBinding.streamId, expectedBinding.streamPurpose);
       }
       started.push({
         deviceId: expectedBinding.deviceId,

package/src/shared-wall-profile-contract.mjs

@@ -0,0 +1,69 @@
+function finiteProfileNumber(value, fallback = 0) {
+  const numeric = Number(value);
+  return Number.isFinite(numeric) && numeric > 0 ? numeric : fallback;
+}
+
+export function selectSharedWallSourceProfile(demands = []) {
+  const profiles = Array.isArray(demands) ? demands.filter(Boolean) : [];
+  if (profiles.length === 0) {
+    return Object.freeze({
+      fps: 0,
+      maxWidth: 0,
+      maxHeight: 0,
+      quality: 0,
+      demandCount: 0
+    });
+  }
+  const selected = profiles.reduce((profile, demand) => ({
+    fps: Math.max(profile.fps, finiteProfileNumber(demand.fps)),
+    maxWidth: Math.max(profile.maxWidth, finiteProfileNumber(demand.maxWidth)),
+    maxHeight: Math.max(profile.maxHeight, finiteProfileNumber(demand.maxHeight)),
+    quality: Math.max(profile.quality, finiteProfileNumber(demand.quality))
+  }), {
+    fps: 0,
+    maxWidth: 0,
+    maxHeight: 0,
+    quality: 0
+  });
+  return Object.freeze({
+    ...selected,
+    demandCount: profiles.length
+  });
+}
+
+export function liveProfileSatisfiesDemand(activeProfile, requestedProfile) {
+  if (!activeProfile || !requestedProfile) return false;
+  return finiteProfileNumber(activeProfile.fps) >= finiteProfileNumber(requestedProfile.fps)
+    && finiteProfileNumber(activeProfile.maxWidth) >= finiteProfileNumber(requestedProfile.maxWidth)
+    && finiteProfileNumber(activeProfile.maxHeight) >= finiteProfileNumber(requestedProfile.maxHeight)
+    && finiteProfileNumber(activeProfile.quality) >= finiteProfileNumber(requestedProfile.quality);
+}
+
+export function shouldRetainWallOwnerUntilPendingStartCommits(startResult, activeOwner) {
+  if (!startResult || startResult.pending !== true || !activeOwner) return false;
+  const startPurpose = String(startResult.streamPurpose || '').trim().toLowerCase();
+  const activePurpose = String(activeOwner.streamPurpose || '').trim().toLowerCase();
+  const startStreamId = String(startResult.streamId || '').trim();
+  const activeStreamId = String(activeOwner.streamId || '').trim();
+  const activeCommandId = String(activeOwner.commandId || '').trim();
+  const activeGeneration = Number(activeOwner.captureGeneration || 0);
+  return startPurpose === 'wall'
+    && activePurpose === 'wall'
+    && !!startStreamId
+    && startStreamId === activeStreamId
+    && !!activeCommandId
+    && Number.isSafeInteger(activeGeneration)
+    && activeGeneration > 0
+    && activeOwner.active === true;
+}
+
+export function wallBindingMatchesFailedOwner(binding, failedOwner) {
+  const commandId = String(failedOwner?.commandId || '').trim();
+  const captureGeneration = Number(failedOwner?.captureGeneration || 0);
+  return !!binding
+    && !!commandId
+    && Number.isSafeInteger(captureGeneration)
+    && captureGeneration > 0
+    && String(binding.commandId || '').trim() === commandId
+    && Number(binding.captureGeneration || 0) === captureGeneration;
+}

package/src/shared-wall-profile-contract.test.mjs

@@ -0,0 +1,99 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  liveProfileSatisfiesDemand,
+  selectSharedWallSourceProfile,
+  shouldRetainWallOwnerUntilPendingStartCommits,
+  wallBindingMatchesFailedOwner
+} from './shared-wall-profile-contract.mjs';
+
+test('shared Wall source keeps the strongest field from every current viewer', () => {
+  assert.deepEqual(selectSharedWallSourceProfile([
+    { fps: 5, maxWidth: 960, maxHeight: 540, quality: 68 },
+    { fps: 30, maxWidth: 1920, maxHeight: 1080, quality: 75 }
+  ]), {
+    fps: 30,
+    maxWidth: 1920,
+    maxHeight: 1080,
+    quality: 75,
+    demandCount: 2
+  });
+  assert.deepEqual(selectSharedWallSourceProfile([
+    { fps: 5, maxWidth: 3840, maxHeight: 2160, quality: 70 },
+    { fps: 30, maxWidth: 1920, maxHeight: 1080, quality: 80 }
+  ]), {
+    fps: 30,
+    maxWidth: 3840,
+    maxHeight: 2160,
+    quality: 80,
+    demandCount: 2
+  });
+});
+
+test('a shared source is reused only when it satisfies every requested profile field', () => {
+  const high = { fps: 30, maxWidth: 1920, maxHeight: 1080, quality: 75 };
+  const low = { fps: 5, maxWidth: 960, maxHeight: 540, quality: 68 };
+  assert.equal(liveProfileSatisfiesDemand(high, low), true);
+  assert.equal(liveProfileSatisfiesDemand(low, high), false);
+  assert.equal(liveProfileSatisfiesDemand({ ...high, fps: 5 }, high), false);
+});
+
+test('a pending Wall replacement keeps the current browser owner until a real frame commits it', () => {
+  const activeOwner = {
+    active: true,
+    streamId: 'wall-device',
+    streamPurpose: 'wall',
+    commandId: 'wall-command-current',
+    captureGeneration: 41
+  };
+  const pendingStart = {
+    ok: true,
+    pending: true,
+    streamId: 'wall-device',
+    streamPurpose: 'wall',
+    commandId: 'wall-command-pending',
+    captureGeneration: 42
+  };
+  assert.equal(
+    shouldRetainWallOwnerUntilPendingStartCommits(pendingStart, activeOwner),
+    true
+  );
+  assert.equal(
+    shouldRetainWallOwnerUntilPendingStartCommits({ ...pendingStart, pending: false }, activeOwner),
+    false
+  );
+  assert.equal(
+    shouldRetainWallOwnerUntilPendingStartCommits(pendingStart, {
+      ...activeOwner,
+      streamPurpose: 'control'
+    }),
+    false
+  );
+  assert.equal(
+    shouldRetainWallOwnerUntilPendingStartCommits({
+      ...pendingStart,
+      streamId: 'wall-other'
+    }, activeOwner),
+    false
+  );
+});
+
+test('a late failed upgrade cannot rewind a newer Wall binding', () => {
+  const failedOwner = {
+    commandId: 'wall-command-42',
+    captureGeneration: 42
+  };
+  assert.equal(wallBindingMatchesFailedOwner({
+    commandId: 'wall-command-42',
+    captureGeneration: 42
+  }, failedOwner), true);
+  assert.equal(wallBindingMatchesFailedOwner({
+    commandId: 'wall-command-43',
+    captureGeneration: 43
+  }, failedOwner), false);
+  assert.equal(wallBindingMatchesFailedOwner({
+    commandId: 'wall-command-42',
+    captureGeneration: 43
+  }, failedOwner), false);
+});

package/src/{live-desk-update.js → vuvodesk-update.js}

@@ -71,6 +71,22 @@ function isDedicatedBootstrapFailure(value) {
   return /^Update worker exited before terminal proof\b/i.test(failure)
     || failure === 'invalid-update-host-environment-entry';
 }
+
+function describeCommandResultEvidence(result) {
+  const data = result?.data;
+  if (!data || typeof data !== 'object') return '';
+  const evidence = [];
+  const shell = String(data.shell || '').trim().toLowerCase();
+  if (/^[a-z0-9._-]{1,32}$/.test(shell)) evidence.push(`shell=${shell}`);
+  const exitCode = Number(data.exitCode);
+  if (Number.isInteger(exitCode) && Math.abs(exitCode) <= 0x7fffffff) evidence.push(`exit=${exitCode}`);
+  if (typeof data.timedOut === 'boolean') evidence.push(`timedOut=${data.timedOut}`);
+  const durationMs = Number(data.durationMs);
+  if (Number.isFinite(durationMs) && durationMs >= 0 && durationMs <= 24 * 60 * 60_000) {
+    evidence.push(`durationMs=${Math.round(durationMs)}`);
+  }
+  return evidence.length > 0 ? ` [${evidence.join(' ')}]` : '';
+}
 
 function encodePowerShell(value) {
   return Buffer.from(String(value || ''), 'utf16le').toString('base64');
@@ -243,7 +259,7 @@ function resetReconnectCandidate(target) {
   target.stabilityDeadlineAt = '';
 }
 
-export function createLiveDeskUpdateManager({
+export function createVuvoDeskUpdateManager({
   remoteHub,
   currentManagerVersion,
   currentClientVersion,
@@ -799,12 +815,18 @@ export function createLiveDeskUpdateManager({
     if (!target
       || target.state !== 'waiting'
       || !['dedicated', 'legacy-command-run'].includes(target.method)) return;
-    const result = event?.result;
-    if (event?.error || result?.ok === false || result?.status === 'failed' || result?.status === 'rejected') {
-      const failure = String(event.error || result?.error || result?.message || 'client-update-command-failed').slice(0, 500);
-      if (target.method === 'dedicated'
-        && target.bootstrapRetryCount === 0
-        && isDedicatedBootstrapFailure(failure)) {
+    const result = event?.result;
+    if (event?.error || result?.ok === false || result?.status === 'failed' || result?.status === 'rejected') {
+      const failureReason = String(
+        event.error || result?.error || result?.message || 'client-update-command-failed'
+      ).slice(0, 500);
+      const failure = (
+        failureReason
+        + describeCommandResultEvidence(result)
+      ).slice(0, 500);
+      if (target.method === 'dedicated'
+        && target.bootstrapRetryCount === 0
+        && isDedicatedBootstrapFailure(failureReason)) {
         const retryDevice = connectedClientDevices()
           .find(device => String(device.deviceId || '') === target.deviceId);
         const remainingMs = Date.parse(target.deadlineAt || '') - now();

package/src/wall-source-restart-runtime.test.mjs

@@ -138,7 +138,17 @@ test('a new Wall frame lane reuses a healthy exact capture', async () => {
       restartToken: 'explicit-owner-restart'
     });
     assert.equal(hardRestart.ok, true);
+    assert.equal(hardRestart.pending, true);
     assert.ok(hardRestart.captureGeneration > first.captureGeneration);
+    const pendingDevice = hub.listDevices({ includeDataUrl: false })
+      .find(device => device.deviceId === 'wall-source-device');
+    assert.equal(pendingDevice.activeLiveStream.commandId, first.commandId);
+    assert.equal(pendingDevice.activeLiveStream.captureGeneration, first.captureGeneration);
+    assert.equal(pendingDevice.activeLiveStream.pendingCommandId, hardRestart.commandId);
+    assert.equal(
+      pendingDevice.activeLiveStream.pendingCaptureGeneration,
+      hardRestart.captureGeneration
+    );
   } finally {
     socket?.destroy();
     await hub.close();