diff --git a/README.md b/README.md
index e3e8ffb0..009983a2 100644
--- a/README.md
+++ b/README.md
@@ -77,11 +77,14 @@ simdeck studio expose "iPhone 17 Pro"
 
 The command starts or reuses the local daemon, creates an ephemeral Studio
 session, prints a unique `https://simdeck.djdev.me/simulator/...` URL, and keeps
-the outbound bridge alive until you press Ctrl-C. It uses `auto` mode by default,
-letting VideoToolbox choose the encoder. Pass `--video-codec software` when you
-need to force software encoding; Studio then defaults to the `ci-software`
-stream quality profile (`960` longest edge at `24` fps). Use
-`--stream-quality quality|balanced|smooth|economy|ci-software` to override it.
+the outbound bridge alive until you press Ctrl-C. It uses software H.264 by
+default with realtime stream settings for remote viewing, and prints the active
+codec/profile when it starts. Studio defaults to the `smooth` stream quality
+profile (`1170` longest edge, dynamic up to `60` fps). Use
+`--stream-quality quality|balanced|smooth|economy|ci-software` to override it,
+or pass `--video-codec hardware` when a dedicated hardware encoder is preferable.
+The remote viewer renders live video with the browser's native video element;
+the canvas is only used for input geometry.
 
 CLI commands automatically use the same warm daemon:
 
diff --git a/cli/XCWH264Encoder.m b/cli/XCWH264Encoder.m
index cebc68da..265157a4 100644
--- a/cli/XCWH264Encoder.m
+++ b/cli/XCWH264Encoder.m
@@ -933,8 +933,8 @@ - (BOOL)ensureCompressionSessionWithWidth:(int32_t)width height:(int32_t)height
     }
     VTSessionSetProperty(session, kVTCompressionPropertyKey_ExpectedFrameRate, (__bridge CFTypeRef)@(expectedFrameRate));
     BOOL shortKeyframeInterval = _lowLatencyMode || _realtimeStreamMode;
-    VTSessionSetProperty(session, kVTCompressionPropertyKey_MaxKeyFrameInterval, (__bridge CFTypeRef)@(shortKeyframeInterval ? expectedFrameRate : expectedFrameRate * 2));
-    VTSessionSetProperty(session, kVTCompressionPropertyKey_MaxKeyFrameIntervalDuration, (__bridge CFTypeRef)@(shortKeyframeInterval ? 1.0 : 2.0));
+    VTSessionSetProperty(session, kVTCompressionPropertyKey_MaxKeyFrameInterval, (__bridge CFTypeRef)@(shortKeyframeInterval ? MAX(1, expectedFrameRate / 2) : expectedFrameRate * 2));
+    VTSessionSetProperty(session, kVTCompressionPropertyKey_MaxKeyFrameIntervalDuration, (__bridge CFTypeRef)@(shortKeyframeInterval ? 0.5 : 2.0));
     VTSessionSetProperty(session, kVTCompressionPropertyKey_AverageBitRate, (__bridge CFTypeRef)@(averageBitRate));
     if (_realtimeStreamMode) {
         NSArray *dataRateLimits = @[
diff --git a/client/src/api/controls.ts b/client/src/api/controls.ts
index f5d0459d..8cc699ab 100644
--- a/client/src/api/controls.ts
+++ b/client/src/api/controls.ts
@@ -11,7 +11,13 @@ import type {
 
 export type ControlMessage =
   | ({ type: "touch" } & TouchPayload)
-  | ({ type: "key" } & KeyPayload);
+  | ({ type: "key" } & KeyPayload)
+  | { type: "dismissKeyboard" }
+  | { type: "home" }
+  | { type: "appSwitcher" }
+  | { type: "rotateLeft" }
+  | { type: "rotateRight" }
+  | { type: "toggleAppearance" };
 
 async function postSimulatorAction(
   udid: string,
diff --git a/client/src/api/simulators.ts b/client/src/api/simulators.ts
index af5f359c..58a80325 100644
--- a/client/src/api/simulators.ts
+++ b/client/src/api/simulators.ts
@@ -9,8 +9,10 @@ import type {
   SimulatorsResponse,
 } from "./types";
 
-export async function listSimulators(): Promise<SimulatorMetadata[]> {
-  const data = await apiRequest<SimulatorsResponse>("/api/simulators");
+export async function listSimulators(
+  options: RequestInit = {},
+): Promise<SimulatorMetadata[]> {
+  const data = await apiRequest<SimulatorsResponse>("/api/simulators", options);
   return data.simulators ?? [];
 }
 
diff --git a/client/src/app/AppShell.tsx b/client/src/app/AppShell.tsx
index 395b678b..21d7181b 100644
--- a/client/src/app/AppShell.tsx
+++ b/client/src/app/AppShell.tsx
@@ -111,6 +111,15 @@ function buildAuthenticatedAssetUrl(path: string, stamp: number): string {
   return url.toString();
 }
 
+function shouldUseRemoteStreamDefault(apiRoot: string): boolean {
+  if (apiRoot) {
+    return true;
+  }
+  return (
+    new URLSearchParams(window.location.search).get("remoteStream") === "1"
+  );
+}
+
 function shouldRenderNativeChrome(simulator: SimulatorMetadata): boolean {
   const identifier = simulator.deviceTypeIdentifier ?? "";
   const name = simulator.name ?? "";
@@ -177,6 +186,7 @@ export interface AppShellProps {
   fixedSimulatorUDID?: string | null;
   hideSimulatorSelection?: boolean;
   pairingEnabled?: boolean;
+  remoteStream?: boolean;
 }
 
 export function AppShell({
@@ -184,6 +194,7 @@ export function AppShell({
   fixedSimulatorUDID = null,
   hideSimulatorSelection = false,
   pairingEnabled = true,
+  remoteStream = shouldUseRemoteStreamDefault(apiRoot),
 }: AppShellProps = {}) {
   configureSimDeckClient({ apiRoot });
   const [initialUiState] = useState(readPersistedUiState);
@@ -201,7 +212,7 @@ export function AppShell({
     isLoading,
     refresh,
     simulators,
-  } = useSimulatorList();
+  } = useSimulatorList({ remote: remoteStream });
   const [debugVisible, setDebugVisible] = useState(false);
   const [hierarchyVisible, setHierarchyVisible] = useState(() =>
     readStoredFlag(HIERARCHY_VISIBLE_STORAGE_KEY),
@@ -370,6 +381,7 @@ export function AppShell({
     streamCanvasKey,
   } = useLiveStream({
     canvasElement: streamCanvasElement,
+    remote: remoteStream,
     simulator: selectedSimulator,
   });
 
@@ -843,9 +855,13 @@ export function AppShell({
     pairingEnabled &&
     listError === AUTH_REQUIRED_MESSAGE &&
     !accessTokenFromLocation();
+  const visibleListError =
+    remoteStream && hasFrame && listError === "Failed to fetch"
+      ? ""
+      : listError;
   const error = pairingRequired
     ? localError || streamError
-    : localError || streamError || listError;
+    : localError || streamError || visibleListError;
   const deviceTransform = `translate(${pan.x}px, ${pan.y + autoViewportOffsetY}px) scale(${effectiveZoom})`;
   const chromeScreenRect = computeChromeScreenRect(
     viewportChromeProfile,
@@ -979,11 +995,11 @@ export function AppShell({
     return state;
   }, []);
 
-  function sendControl(udid: string, message: ControlMessage) {
+  function sendControl(udid: string, message: ControlMessage): boolean {
     setLocalError("");
     const encoded = JSON.stringify(message);
     if (sendWebRtcControlMessage(encoded)) {
-      return;
+      return true;
     }
     const state = ensureControlSocket(udid);
     if (state.socket.readyState === WebSocket.OPEN) {
@@ -991,6 +1007,7 @@ export function AppShell({
     } else {
       state.pending.push(encoded);
     }
+    return true;
   }
 
   useEffect(() => closeControlSocket, [closeControlSocket]);
@@ -1281,7 +1298,14 @@ export function AppShell({
           if (!selectedSimulator) {
             return;
           }
-          void runAction(() => dismissKeyboard(selectedSimulator.udid), false);
+          if (
+            !sendControl(selectedSimulator.udid, { type: "dismissKeyboard" })
+          ) {
+            void runAction(
+              () => dismissKeyboard(selectedSimulator.udid),
+              false,
+            );
+          }
         }}
         onHome={() => {
           if (!selectedSimulator) {
@@ -1289,7 +1313,9 @@ export function AppShell({
           }
           setAccessibilitySelectedId("");
           setAccessibilityHoveredId(null);
-          void runAction(() => pressHome(selectedSimulator.udid), false);
+          if (!sendControl(selectedSimulator.udid, { type: "home" })) {
+            void runAction(() => pressHome(selectedSimulator.udid), false);
+          }
         }}
         onOpenAppSwitcher={() => {
           if (!selectedSimulator) {
@@ -1297,12 +1323,22 @@ export function AppShell({
           }
           setAccessibilitySelectedId("");
           setAccessibilityHoveredId(null);
-          void runAction(() => openAppSwitcher(selectedSimulator.udid), false);
+          if (!sendControl(selectedSimulator.udid, { type: "appSwitcher" })) {
+            void runAction(
+              () => openAppSwitcher(selectedSimulator.udid),
+              false,
+            );
+          }
         }}
         onRotateLeft={() => {
           if (!selectedSimulator) {
             return;
           }
+          if (sendControl(selectedSimulator.udid, { type: "rotateLeft" })) {
+            setRotationQuarterTurns((current) => (current + 3) % 4);
+            setStreamStamp(Date.now());
+            return;
+          }
           void runAction(async () => {
             await rotateLeft(selectedSimulator.udid);
             setRotationQuarterTurns((current) => (current + 3) % 4);
@@ -1315,6 +1351,11 @@ export function AppShell({
           if (!selectedSimulator) {
             return;
           }
+          if (sendControl(selectedSimulator.udid, { type: "rotateRight" })) {
+            setRotationQuarterTurns((current) => (current + 1) % 4);
+            setStreamStamp(Date.now());
+            return;
+          }
           void runAction(async () => {
             await rotateRight(selectedSimulator.udid);
             setRotationQuarterTurns((current) => (current + 1) % 4);
@@ -1339,7 +1380,10 @@ export function AppShell({
           if (!selectedSimulator) {
             return;
           }
-          void runAction(() => toggleAppearance(selectedSimulator.udid));
+          const encoded = JSON.stringify({ type: "toggleAppearance" });
+          if (!sendWebRtcControlMessage(encoded)) {
+            void runAction(() => toggleAppearance(selectedSimulator.udid));
+          }
         }}
         onToggleDebug={() => setDebugVisible((current) => !current)}
         onToggleHierarchy={() => {
diff --git a/client/src/features/simulators/useSimulatorList.ts b/client/src/features/simulators/useSimulatorList.ts
index dcfa0d5e..a9492742 100644
--- a/client/src/features/simulators/useSimulatorList.ts
+++ b/client/src/features/simulators/useSimulatorList.ts
@@ -1,30 +1,64 @@
-import { startTransition, useEffect, useState } from "react";
+import { startTransition, useEffect, useRef, useState } from "react";
 
 import { listSimulators } from "../../api/simulators";
 import type { SimulatorMetadata } from "../../api/types";
 
-export function useSimulatorList() {
+const LOCAL_REFRESH_MS = 5000;
+const REMOTE_REFRESH_MS = 10000;
+const REMOTE_ERROR_REFRESH_MS = 15000;
+const REMOTE_REQUEST_TIMEOUT_MS = 12000;
+
+interface UseSimulatorListOptions {
+  remote?: boolean;
+}
+
+export function useSimulatorList({
+  remote = false,
+}: UseSimulatorListOptions = {}) {
   const [simulators, setSimulators] = useState<SimulatorMetadata[]>([]);
   const [isLoading, setIsLoading] = useState(true);
   const [error, setError] = useState("");
+  const inFlightRef = useRef(false);
+  const lastLoadFailedRef = useRef(false);
 
   async function loadSimulators(cancelled = false) {
+    if (inFlightRef.current) {
+      return;
+    }
+    inFlightRef.current = true;
+    const controller =
+      remote && typeof AbortController !== "undefined"
+        ? new AbortController()
+        : null;
+    const timeoutId = controller
+      ? window.setTimeout(() => controller.abort(), REMOTE_REQUEST_TIMEOUT_MS)
+      : 0;
     try {
-      const nextSimulators = await listSimulators();
+      const nextSimulators = await listSimulators(
+        controller ? { signal: controller.signal } : {},
+      );
       if (cancelled) {
         return;
       }
       startTransition(() => setSimulators(nextSimulators));
       setError("");
+      lastLoadFailedRef.current = false;
     } catch (loadError) {
       if (!cancelled) {
         setError(
-          loadError instanceof Error
-            ? loadError.message
-            : "Failed to load simulators.",
+          loadError instanceof DOMException && loadError.name === "AbortError"
+            ? "Timed out waiting for provider."
+            : loadError instanceof Error
+              ? loadError.message
+              : "Failed to load simulators.",
         );
+        lastLoadFailedRef.current = true;
       }
     } finally {
+      if (timeoutId) {
+        window.clearTimeout(timeoutId);
+      }
+      inFlightRef.current = false;
       if (!cancelled) {
         setIsLoading(false);
       }
@@ -37,17 +71,33 @@ export function useSimulatorList() {
 
   useEffect(() => {
     let cancelled = false;
+    let timeoutId = 0;
 
-    void loadSimulators();
-    const intervalId = window.setInterval(() => {
-      void loadSimulators(cancelled);
-    }, 5000);
+    const scheduleNext = () => {
+      if (cancelled) {
+        return;
+      }
+      const delay = remote
+        ? lastLoadFailedRef.current
+          ? REMOTE_ERROR_REFRESH_MS
+          : REMOTE_REFRESH_MS
+        : LOCAL_REFRESH_MS;
+      timeoutId = window.setTimeout(run, delay);
+    };
+
+    const run = () => {
+      void loadSimulators(cancelled).finally(scheduleNext);
+    };
+
+    run();
 
     return () => {
       cancelled = true;
-      clearInterval(intervalId);
+      if (timeoutId) {
+        window.clearTimeout(timeoutId);
+      }
     };
-  }, []);
+  }, [remote]);
 
   return {
     error,
diff --git a/client/src/features/stream/streamTypes.ts b/client/src/features/stream/streamTypes.ts
index b08e1a9a..5ed03b7c 100644
--- a/client/src/features/stream/streamTypes.ts
+++ b/client/src/features/stream/streamTypes.ts
@@ -1,6 +1,7 @@
 import type { Size } from "../viewport/types";
 
 export interface StreamConnectTarget {
+  remote?: boolean;
   udid: string;
 }
 
diff --git a/client/src/features/stream/streamWorkerClient.ts b/client/src/features/stream/streamWorkerClient.ts
index 2b420df3..368a1601 100644
--- a/client/src/features/stream/streamWorkerClient.ts
+++ b/client/src/features/stream/streamWorkerClient.ts
@@ -10,24 +10,44 @@ import type {
 
 const HAVE_CURRENT_DATA = 2;
 const WEBRTC_CONTROL_CHANNEL_LABEL = "simdeck-control";
+const WEBRTC_TELEMETRY_CHANNEL_LABEL = "simdeck-telemetry";
 const WEBRTC_FIRST_FRAME_TIMEOUT_MS = 10000;
 const WEBRTC_STALLED_FRAME_TIMEOUT_MS = 8000;
+const WEBRTC_REMOTE_DISCONNECTED_GRACE_MS = 3000;
 
 let activeWebRtcControlChannel: RTCDataChannel | null = null;
+let activeWebRtcTelemetryChannel: RTCDataChannel | null = null;
 let activeStreamClient: StreamWorkerClient | null = null;
 
 export type StreamBackend = "webrtc";
 
 export function sendWebRtcControlMessage(encoded: string): boolean {
-  if (activeWebRtcControlChannel?.readyState !== "open") {
+  return sendDataChannelMessage(activeWebRtcControlChannel, encoded);
+}
+
+export function sendWebRtcClientStats(stats: unknown): boolean {
+  return sendDataChannelMessage(
+    activeWebRtcTelemetryChannel,
+    JSON.stringify({ stats, type: "clientStats" }),
+  );
+}
+
+function sendDataChannelMessage(
+  channel: RTCDataChannel | null,
+  encoded: string,
+): boolean {
+  if (channel?.readyState !== "open") {
     return false;
   }
-  activeWebRtcControlChannel.send(encoded);
+  channel.send(encoded);
   return true;
 }
 
-export function buildStreamTarget(udid: string): StreamConnectTarget {
-  return { udid };
+export function buildStreamTarget(
+  udid: string,
+  options: { remote?: boolean } = {},
+): StreamConnectTarget {
+  return { remote: options.remote, udid };
 }
 
 export function canUseWebRtc(): boolean {
@@ -48,12 +68,15 @@ class WebRtcStreamClient implements StreamClientBackend {
   private connectGeneration = 0;
   private controlChannel: RTCDataChannel | null = null;
   private diagnostics = createWebRtcDiagnostics();
+  private disconnectGraceTimeout = 0;
   private frameWatchdogTimeout = 0;
   private lastVideoFrameAt = 0;
   private peerConnection: RTCPeerConnection | null = null;
   private reconnectTimeout = 0;
+  private remoteMode = false;
   private reportedVideoConfig = false;
   private shouldReconnect = false;
+  private telemetryChannel: RTCDataChannel | null = null;
   private stats: StreamStats = createEmptyStreamStats();
   private video: HTMLVideoElement | null = null;
   private videoFrameCallback = 0;
@@ -80,6 +103,7 @@ class WebRtcStreamClient implements StreamClientBackend {
     const canvasElement = this.canvas;
     const generation = ++this.connectGeneration;
     this.shouldReconnect = true;
+    this.remoteMode = Boolean(target.remote);
     this.diagnostics = createWebRtcDiagnostics();
     this.reportedVideoConfig = false;
     this.stats = createEmptyStreamStats();
@@ -117,6 +141,20 @@ class WebRtcStreamClient implements StreamClientBackend {
           activeWebRtcControlChannel = null;
         }
       });
+      const telemetryChannel = peerConnection.createDataChannel(
+        WEBRTC_TELEMETRY_CHANNEL_LABEL,
+        {
+          maxRetransmits: 0,
+          ordered: false,
+        },
+      );
+      this.telemetryChannel = telemetryChannel;
+      activeWebRtcTelemetryChannel = telemetryChannel;
+      telemetryChannel.addEventListener("close", () => {
+        if (activeWebRtcTelemetryChannel === telemetryChannel) {
+          activeWebRtcTelemetryChannel = null;
+        }
+      });
 
       peerConnection.ontrack = (event) => {
         if (generation !== this.connectGeneration) {
@@ -171,23 +209,42 @@ class WebRtcStreamClient implements StreamClientBackend {
       peerConnection.onconnectionstatechange = () => {
         this.diagnostics.peerConnectionState = peerConnection.connectionState;
         this.postDiagnostics(target, "connectionstatechange");
-        if (
-          generation === this.connectGeneration &&
-          (peerConnection.connectionState === "failed" ||
-            peerConnection.connectionState === "disconnected")
-        ) {
-          if (peerConnection.connectionState === "failed") {
-            void this.updateSelectedCandidatePair(peerConnection, target);
+        if (generation !== this.connectGeneration) {
+          return;
+        }
+        if (peerConnection.connectionState === "connected") {
+          this.clearDisconnectGraceTimeout();
+          if (this.reportedVideoConfig) {
+            this.onMessage({
+              type: "status",
+              status: { detail: "WebRTC media connected", state: "streaming" },
+            });
           }
+          return;
+        }
+        if (peerConnection.connectionState === "disconnected") {
+          if (this.remoteMode && this.stats.renderedFrames > 0) {
+            this.scheduleRemoteDisconnectGrace(target, generation);
+            return;
+          }
+          this.handleConnectionError(
+            target,
+            generation,
+            new Error("WebRTC connection disconnected."),
+          );
+          return;
+        }
+        if (peerConnection.connectionState === "failed") {
+          void this.updateSelectedCandidatePair(peerConnection, target);
           this.handleConnectionError(
             target,
             generation,
-            new Error(`WebRTC connection ${peerConnection.connectionState}.`),
+            new Error("WebRTC connection failed."),
           );
         }
       };
 
-      const offer = await peerConnection.createOffer();
+      const offer = safariBaselineH264Offer(await peerConnection.createOffer());
       if (generation !== this.connectGeneration) {
         return;
       }
@@ -228,6 +285,7 @@ class WebRtcStreamClient implements StreamClientBackend {
     this.shouldReconnect = false;
     this.connectGeneration += 1;
     this.clearReconnectTimeout();
+    this.clearDisconnectGraceTimeout();
     this.clearFrameWatchdog();
     this.closeActiveConnection();
     this.onMessage({ type: "status", status: { state: "idle" } });
@@ -241,6 +299,7 @@ class WebRtcStreamClient implements StreamClientBackend {
     window.cancelAnimationFrame(this.animationFrame);
     this.animationFrame = 0;
     this.clearFrameWatchdog();
+    this.clearDisconnectGraceTimeout();
     this.cancelVideoFrameCallback();
     this.video?.pause();
     if (this.video) {
@@ -254,6 +313,11 @@ class WebRtcStreamClient implements StreamClientBackend {
       activeWebRtcControlChannel = null;
     }
     this.controlChannel = null;
+    this.telemetryChannel?.close();
+    if (activeWebRtcTelemetryChannel === this.telemetryChannel) {
+      activeWebRtcTelemetryChannel = null;
+    }
+    this.telemetryChannel = null;
     this.peerConnection?.close();
     this.peerConnection = null;
   }
@@ -268,13 +332,46 @@ class WebRtcStreamClient implements StreamClientBackend {
     }
     const message = error instanceof Error ? error.message : String(error);
     this.closeActiveConnection();
+    const reconnecting = this.remoteMode && this.stats.renderedFrames > 0;
     this.onMessage({
       type: "status",
-      status: { error: message, state: "error" },
+      status: reconnecting
+        ? {
+            detail: "Connection interrupted. Reconnecting...",
+            state: "connecting",
+          }
+        : { error: message, state: "error" },
     });
     this.scheduleReconnect(target, generation);
   }
 
+  private scheduleRemoteDisconnectGrace(
+    target: StreamConnectTarget,
+    generation: number,
+  ) {
+    if (this.disconnectGraceTimeout) {
+      return;
+    }
+    this.onMessage({
+      type: "status",
+      status: {
+        detail: "Connection interrupted. Reconnecting...",
+        state: "connecting",
+      },
+    });
+    this.disconnectGraceTimeout = window.setTimeout(() => {
+      this.disconnectGraceTimeout = 0;
+      if (generation !== this.connectGeneration || !this.shouldReconnect) {
+        return;
+      }
+      this.handleConnectionError(
+        target,
+        generation,
+        new Error("WebRTC connection disconnected."),
+      );
+    }, WEBRTC_REMOTE_DISCONNECTED_GRACE_MS);
+  }
+
   private scheduleReconnect(target: StreamConnectTarget, generation: number) {
     if (
       this.reconnectTimeout ||
@@ -340,6 +437,14 @@ class WebRtcStreamClient implements StreamClientBackend {
     this.reconnectTimeout = 0;
   }
 
+  private clearDisconnectGraceTimeout() {
+    if (!this.disconnectGraceTimeout) {
+      return;
+    }
+    window.clearTimeout(this.disconnectGraceTimeout);
+    this.disconnectGraceTimeout = 0;
+  }
+
   private attachDiagnostics(
     peerConnection: RTCPeerConnection,
     target: StreamConnectTarget,
@@ -463,6 +568,9 @@ class WebRtcStreamClient implements StreamClientBackend {
       url: window.location.href,
       userAgent: window.navigator.userAgent,
     };
+    if (sendWebRtcClientStats(payload) || this.remoteMode) {
+      return;
+    }
     void fetch(
       new URL(apiUrl("/api/client-stream-stats"), window.location.href),
       {
@@ -488,8 +596,8 @@ class WebRtcStreamClient implements StreamClientBackend {
     ) {
       this.syncCanvasSize(this.video.videoWidth, this.video.videoHeight);
       this.reportVideoConfig(this.video.videoWidth, this.video.videoHeight);
-      const now = performance.now();
       const renderStartedAt = performance.now();
+      const now = performance.now();
       const latestRenderMs = performance.now() - renderStartedAt;
       this.stats.decodedFrames += 1;
       this.stats.renderedFrames += 1;
@@ -634,6 +742,26 @@ function configureReceiverCodecPreferences(transceiver: RTCRtpTransceiver) {
   ]);
 }
 
+function safariBaselineH264Offer(
+  offer: RTCSessionDescriptionInit,
+): RTCSessionDescriptionInit {
+  if (!isSafariBrowser() || !offer.sdp) {
+    return offer;
+  }
+  return {
+    ...offer,
+    sdp: offer.sdp.replace(
+      /(a=fmtp:\d+ .*profile-level-id=)[0-9a-fA-F]{6}/g,
+      "$142e01f",
+    ),
+  };
+}
+
+function isSafariBrowser(): boolean {
+  const ua = navigator.userAgent;
+  return /Safari\//.test(ua) && !/Chrome\/|Chromium\/|CriOS\/|FxiOS\//.test(ua);
+}
+
 function iceServers(health?: HealthResponse | null): RTCIceServer[] {
   const params = new URLSearchParams(window.location.search);
   const queryValue = params.get("iceServers");
diff --git a/client/src/features/stream/useLiveStream.ts b/client/src/features/stream/useLiveStream.ts
index 2ac94e45..2b17fe19 100644
--- a/client/src/features/stream/useLiveStream.ts
+++ b/client/src/features/stream/useLiveStream.ts
@@ -8,6 +8,7 @@ import { createEmptyStreamStats } from "./stats";
 import {
   buildStreamTarget,
   canUseWebRtc,
+  sendWebRtcClientStats,
   StreamWorkerClient,
   type StreamBackend,
 } from "./streamWorkerClient";
@@ -20,10 +21,12 @@ import type {
 
 const FPS_SAMPLE_INTERVAL_MS = 500;
 const CLIENT_TELEMETRY_INTERVAL_MS = 1000;
+const REMOTE_CLIENT_TELEMETRY_INTERVAL_MS = 5000;
 
 interface UseLiveStreamOptions {
   canvasElement: HTMLCanvasElement | null;
   paused?: boolean;
+  remote?: boolean;
   simulator: SimulatorMetadata | null;
 }
 
@@ -67,6 +70,7 @@ function buildClientTelemetryUrl(): string {
 export function useLiveStream({
   canvasElement,
   paused = false,
+  remote = false,
   simulator,
 }: UseLiveStreamOptions): UseLiveStreamResult {
   const clientTelemetryIdRef = useRef("");
@@ -237,11 +241,11 @@ export function useLiveStream({
       return;
     }
 
-    workerClient.connect(buildStreamTarget(simulator.udid));
+    workerClient.connect(buildStreamTarget(simulator.udid, { remote }));
     return () => {
       workerClient.disconnect();
     };
-  }, [canvasElement, simulator?.isBooted, simulator?.udid, paused]);
+  }, [canvasElement, simulator?.isBooted, simulator?.udid, paused, remote]);
 
   useEffect(() => {
     if (!simulator?.udid) {
@@ -251,21 +255,25 @@ export function useLiveStream({
     const postTelemetry = () => {
       const latestStats = latestStatsRef.current;
       const latestStatus = latestStatusRef.current;
+      const payload = {
+        ...latestStats,
+        appFps: latestFpsRef.current,
+        clientId: clientTelemetryIdRef.current,
+        focused: document.hasFocus(),
+        kind: "page",
+        pageFps: pageFpsRef.current,
+        status: latestStatus.state,
+        timestampMs: Date.now(),
+        udid: simulator.udid,
+        url: window.location.href,
+        userAgent: window.navigator.userAgent,
+        visibilityState: document.visibilityState,
+      };
+      if (sendWebRtcClientStats(payload) || remote) {
+        return;
+      }
       void fetch(buildClientTelemetryUrl(), {
-        body: JSON.stringify({
-          ...latestStats,
-          appFps: latestFpsRef.current,
-          clientId: clientTelemetryIdRef.current,
-          focused: document.hasFocus(),
-          kind: "page",
-          pageFps: pageFpsRef.current,
-          status: latestStatus.state,
-          timestampMs: Date.now(),
-          udid: simulator.udid,
-          url: window.location.href,
-          userAgent: window.navigator.userAgent,
-          visibilityState: document.visibilityState,
-        }),
+        body: JSON.stringify(payload),
         cache: "no-store",
         headers: apiHeaders(),
         method: "POST",
@@ -274,15 +282,15 @@ export function useLiveStream({
       });
     };
 
+    const intervalMs = remote
+      ? REMOTE_CLIENT_TELEMETRY_INTERVAL_MS
+      : CLIENT_TELEMETRY_INTERVAL_MS;
     postTelemetry();
-    const intervalId = window.setInterval(
-      postTelemetry,
-      CLIENT_TELEMETRY_INTERVAL_MS,
-    );
+    const intervalId = window.setInterval(postTelemetry, intervalMs);
     return () => {
       window.clearInterval(intervalId);
     };
-  }, [simulator?.udid]);
+  }, [remote, simulator?.udid]);
 
   return {
     deviceNaturalSize,
diff --git a/docs/cli/commands.md b/docs/cli/commands.md
index 99a1c3ca..99016228 100644
--- a/docs/cli/commands.md
+++ b/docs/cli/commands.md
@@ -37,6 +37,22 @@ simdeck ui [--port 4310] [--bind 127.0.0.1] [--advertise-host <host>]
 
 `--open` opens the authenticated local URL after the daemon is ready.
 
+### `studio expose`
+
+Expose one local simulator through SimDeck Studio:
+
+```sh
+simdeck studio expose [simulator] [--studio-url https://simdeck.djdev.me]
+                      [--port 4310] [--bind 127.0.0.1]
+                      [--video-codec auto|hardware|software]
+                      [--low-latency] [--stream-quality <profile>]
+```
+
+Studio expose defaults to software H.264, realtime stream delivery, and the
+`smooth` stream quality profile. The process prints the Studio URL plus the
+active codec/profile, and keeps the outbound bridge alive until Ctrl-C.
+`--video-codec hardware` opts back into the hardware encoder when that is preferable.
+
 ### `daemon start`
 
 Start or reuse the project daemon without opening the browser:
diff --git a/docs/cli/flags.md b/docs/cli/flags.md
index 314bbf3f..fafa451a 100644
--- a/docs/cli/flags.md
+++ b/docs/cli/flags.md
@@ -39,6 +39,9 @@ Targets a specific running SimDeck daemon for commands that support the HTTP fas
 | `--stream-quality` | auto/default          | Optional realtime stream quality profile: `quality`, `balanced`, `smooth`, `economy`, or `ci-software`. |
 | `--open`           | `false`               | `ui` only. Open the browser after the daemon is ready.                                                  |
 
+`studio expose` defaults to software H.264. Pass `--video-codec hardware` to
+opt into the hardware encoder when that is preferable.
+
 The public commands generate an access token automatically. Use `simdeck daemon status` to read it for direct API callers.
 
 ## `describe`
diff --git a/docs/guide/video.md b/docs/guide/video.md
index 631e9902..edcef475 100644
--- a/docs/guide/video.md
+++ b/docs/guide/video.md
@@ -79,7 +79,10 @@ A few practical guidelines:
 
 - **Start on the default for local preview.** `auto` lets VideoToolbox choose without requiring the shared hardware encoder.
 - **Switch to `software` when the hardware encoder stalls or is unavailable.** The encoder scales the longest edge to 1600 pixels, can climb toward 60 fps, and backs off dynamically under encode latency.
-- **Use `--stream-quality ci-software` for Studio providers on virtualized CI Macs when hardware encode is unavailable.** This profile uses software H.264 at a 960-pixel longest edge, targets 24 fps, lowers bitrate pressure, and favors fresh frames over full-resolution sharpness.
+- **Studio providers default to software H.264 plus `--stream-quality smooth`.** This profile uses a 1170-pixel longest edge, allows up to 60 fps, raises the bitrate budget to reduce compression artifacts, and lets multiple provider sessions share CPU cores without depending on one hardware encoder.
+- **The remote browser renders the live stream as a native `<video>` element.** The canvas remains for input geometry, but it is not in the live per-frame render path and does not preserve stale frames during reconnects.
+- **Use `--stream-quality ci-software` for denser virtualized CI Macs.** This profile uses software H.264 at a 960-pixel longest edge, targets 24 fps, lowers bitrate pressure, and favors fresh frames over full-resolution sharpness.
+- **Use `simdeck studio expose --video-codec hardware` only when a dedicated hardware encoder is preferable.** The normal Studio default stays on software H.264 so future multi-simulator provider hosts can scale across CPU cores.
 - **Use `software --low-latency` only when you need the older extra-conservative software profile.** It caps at 15 fps, uses a single pending frame, reduces the longest edge to 1170 pixels, and backs off before software encode latency turns into seconds of stream delay.
 
 ## Tuning with metrics
diff --git a/packages/simdeck-test/dist/index.d.ts b/packages/simdeck-test/dist/index.d.ts
index 68aa018d..b0a02fff 100644
--- a/packages/simdeck-test/dist/index.d.ts
+++ b/packages/simdeck-test/dist/index.d.ts
@@ -4,7 +4,7 @@ export type SimDeckLaunchOptions = {
   keepDaemon?: boolean;
   isolated?: boolean;
   port?: number;
-  videoCodec?: "hevc" | "h264" | "h264-software";
+  videoCodec?: "auto" | "hardware" | "software" | "h264-software";
 };
 export type QueryOptions = {
   source?: "auto" | "nativescript" | "uikit" | "native-ax";
diff --git a/packages/simdeck-test/dist/index.js b/packages/simdeck-test/dist/index.js
index e76e527f..0259c11d 100644
--- a/packages/simdeck-test/dist/index.js
+++ b/packages/simdeck-test/dist/index.js
@@ -200,7 +200,7 @@ async function startIsolatedDaemon(cliPath, options) {
       "--access-token",
       accessToken,
       "--video-codec",
-      options.videoCodec ?? "h264-software",
+      options.videoCodec ?? "software",
     ],
     {
       cwd: options.projectRoot,
diff --git a/packages/simdeck-test/src/index.ts b/packages/simdeck-test/src/index.ts
index a92628bc..3e786b34 100644
--- a/packages/simdeck-test/src/index.ts
+++ b/packages/simdeck-test/src/index.ts
@@ -12,7 +12,7 @@ export type SimDeckLaunchOptions = {
   keepDaemon?: boolean;
   isolated?: boolean;
   port?: number;
-  videoCodec?: "hevc" | "h264" | "h264-software";
+  videoCodec?: "auto" | "hardware" | "software" | "h264-software";
 };
 
 export type QueryOptions = {
@@ -294,7 +294,7 @@ async function startIsolatedDaemon(
       "--access-token",
       accessToken,
       "--video-codec",
-      options.videoCodec ?? "h264-software",
+      options.videoCodec ?? "software",
     ],
     {
       cwd: options.projectRoot,
diff --git a/scripts/integration/cli.mjs b/scripts/integration/cli.mjs
index 4dac06e7..2fe9166b 100644
--- a/scripts/integration/cli.mjs
+++ b/scripts/integration/cli.mjs
@@ -726,7 +726,7 @@ function startServer() {
       "--access-token",
       "integration",
       "--video-codec",
-      "h264-software",
+      "software",
     ],
     {
       cwd: root,
diff --git a/scripts/integration/js-api.mjs b/scripts/integration/js-api.mjs
index 5f5806db..cf84488c 100644
--- a/scripts/integration/js-api.mjs
+++ b/scripts/integration/js-api.mjs
@@ -123,7 +123,7 @@ async function main() {
         cliPath: simdeck,
         projectRoot: root,
         isolated: true,
-        videoCodec: "h264-software",
+        videoCodec: "software",
       }),
     { phase: phaseSetup },
   );
diff --git a/scripts/studio-provider-bridge.mjs b/scripts/studio-provider-bridge.mjs
index 2233ea9a..169bc010 100644
--- a/scripts/studio-provider-bridge.mjs
+++ b/scripts/studio-provider-bridge.mjs
@@ -17,12 +17,27 @@ let localToken = process.env.SIMDECK_LOCAL_TOKEN || providerToken;
 const registerIntervalMs = Number(
   process.env.SIMDECK_PROVIDER_REGISTER_INTERVAL_MS || 15000,
 );
+const maxConcurrentRequests = Math.max(
+  1,
+  Number(process.env.SIMDECK_PROVIDER_MAX_CONCURRENT_REQUESTS || 8),
+);
+const proxyTimeoutMs = Math.max(
+  1000,
+  Number(process.env.SIMDECK_PROVIDER_PROXY_TIMEOUT_MS || 25000),
+);
+const simulatorListCacheTtlMs = Math.max(
+  0,
+  Number(process.env.SIMDECK_PROVIDER_SIMULATORS_CACHE_MS || 5000),
+);
 const providerId =
   process.env.SIMDECK_STUDIO_PROVIDER_ID || stableLocalProviderId();
 
 let stopped = false;
 let lastRegisterAt = 0;
 let registered = false;
+const activeRequests = new Set();
+const responseCache = new Map();
+const inFlightCache = new Map();
 
 if (isMainModule()) {
   for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"]) {
@@ -47,12 +62,15 @@ if (isMainModule()) {
       localToken = providerToken;
     }
 
-    console.log(`[simdeck-provider-bridge] ${publicUrl}`);
-
     await registerProvider();
+    console.log(`[simdeck-provider-bridge] ${publicUrl}`);
 
     while (!stopped) {
       try {
+        if (activeRequests.size >= maxConcurrentRequests) {
+          await Promise.race([...activeRequests, sleep(50)]);
+          continue;
+        }
         if (Date.now() - lastRegisterAt > registerIntervalMs) {
           await registerProvider();
         }
@@ -67,7 +85,7 @@ if (isMainModule()) {
           await sleep(250);
           continue;
         }
-        await handleRequest(next.request);
+        runProviderRequest(next.request);
       } catch (error) {
         console.error(
           `[simdeck-provider-bridge] ${error instanceof Error ? error.message : String(error)}`,
@@ -76,6 +94,9 @@ if (isMainModule()) {
       }
     }
   } finally {
+    if (activeRequests.size > 0) {
+      await Promise.allSettled(activeRequests);
+    }
     if (registered) {
       await markProviderExpired();
     }
@@ -93,6 +114,9 @@ async function registerProvider() {
       simulatorUdid: metadata.simulator?.udid,
       simulatorName: metadata.simulator?.name,
       runtimeName: metadata.simulator?.runtimeName,
+      videoCodec: metadata.health?.videoCodec,
+      realtimeStream: metadata.health?.realtimeStream,
+      streamQuality: metadata.health?.streamQuality,
     });
     registered = true;
     lastRegisterAt = Date.now();
@@ -131,61 +155,34 @@ async function markProviderExpired() {
 }
 
 async function localProviderMetadata() {
+  let health = null;
+  try {
+    health = await localJson("/api/health");
+  } catch {
+    health = null;
+  }
+
   try {
     const simulators = await localJson("/api/simulators");
     const selected =
       simulators.simulators?.find((simulator) => simulator.isBooted) ??
       simulators.simulators?.[0] ??
       null;
-    return { ok: true, simulator: selected };
+    return { health, ok: true, simulator: selected };
   } catch {
-    try {
-      await localJson("/api/health");
-      return { ok: true, simulator: null };
-    } catch {
-      return { ok: false, simulator: null };
+    if (health) {
+      return { health, ok: true, simulator: null };
     }
+    return { health: null, ok: false, simulator: null };
   }
 }
 
 async function handleRequest(request) {
   try {
-    const target = new URL(request.path, `${localUrl}/`);
-    if (!target.searchParams.has("simdeckToken")) {
-      target.searchParams.set("simdeckToken", localToken);
-    }
-    const headers = new Headers(request.headers || {});
-    headers.set("x-simdeck-token", localToken);
-    headers.delete("host");
-    headers.delete("content-length");
-    const response = await fetch(target, {
-      body: request.bodyBase64
-        ? Buffer.from(request.bodyBase64, "base64")
-        : undefined,
-      headers,
-      method: request.method,
-    });
-    const responseHeaders = {};
-    for (const [name, value] of response.headers.entries()) {
-      const lower = name.toLowerCase();
-      if (
-        lower === "connection" ||
-        lower === "content-encoding" ||
-        lower === "content-length" ||
-        lower === "transfer-encoding"
-      ) {
-        continue;
-      }
-      responseHeaders[name] = value;
-    }
-    const responseBodyBase64 = Buffer.from(
-      await response.arrayBuffer(),
-    ).toString("base64");
+    const responsePayload = await cachedProxyResponse(request);
     await complete({
       requestId: request.id,
-      responseStatus: response.status,
-      responseHeaders,
-      responseBodyBase64,
+      ...responsePayload,
     });
   } catch (error) {
     await complete({
@@ -195,11 +192,106 @@ async function handleRequest(request) {
   }
 }
 
+function runProviderRequest(request) {
+  const task = handleRequest(request).catch((error) => {
+    console.error(
+      `[simdeck-provider-bridge] request ${request.id} failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  });
+  activeRequests.add(task);
+  task.finally(() => {
+    activeRequests.delete(task);
+  });
+}
+
+async function cachedProxyResponse(request) {
+  const cacheKey = cacheKeyForRequest(request);
+  if (!cacheKey || simulatorListCacheTtlMs <= 0) {
+    return proxyLocalRequest(request);
+  }
+
+  const cached = responseCache.get(cacheKey);
+  if (cached && Date.now() - cached.updatedAt <= simulatorListCacheTtlMs) {
+    return cached.payload;
+  }
+
+  const pending = inFlightCache.get(cacheKey);
+  if (pending) {
+    return pending;
+  }
+
+  const pendingRequest = proxyLocalRequest(request)
+    .then((payload) => {
+      if (payload.responseStatus >= 200 && payload.responseStatus < 300) {
+        responseCache.set(cacheKey, { payload, updatedAt: Date.now() });
+      }
+      return payload;
+    })
+    .finally(() => {
+      inFlightCache.delete(cacheKey);
+    });
+  inFlightCache.set(cacheKey, pendingRequest);
+  return pendingRequest;
+}
+
+function cacheKeyForRequest(request) {
+  if (request.method !== "GET") {
+    return "";
+  }
+  const target = new URL(request.path, `${localUrl}/`);
+  target.searchParams.delete("simdeckToken");
+  if (target.pathname !== "/api/simulators") {
+    return "";
+  }
+  return `${target.pathname}?${target.searchParams.toString()}`;
+}
+
+async function proxyLocalRequest(request) {
+  const target = new URL(request.path, `${localUrl}/`);
+  if (!target.searchParams.has("simdeckToken")) {
+    target.searchParams.set("simdeckToken", localToken);
+  }
+  const headers = new Headers(request.headers || {});
+  headers.set("x-simdeck-token", localToken);
+  headers.delete("host");
+  headers.delete("content-length");
+  const response = await fetch(target, {
+    body: request.bodyBase64
+      ? Buffer.from(request.bodyBase64, "base64")
+      : undefined,
+    headers,
+    method: request.method,
+    signal: AbortSignal.timeout(proxyTimeoutMs),
+  });
+  const responseHeaders = {};
+  for (const [name, value] of response.headers.entries()) {
+    const lower = name.toLowerCase();
+    if (
+      lower === "connection" ||
+      lower === "content-encoding" ||
+      lower === "content-length" ||
+      lower === "transfer-encoding"
+    ) {
+      continue;
+    }
+    responseHeaders[name] = value;
+  }
+  const responseBodyBase64 = Buffer.from(await response.arrayBuffer()).toString(
+    "base64",
+  );
+  return {
+    responseStatus: response.status,
+    responseHeaders,
+    responseBodyBase64,
+  };
+}
+
 async function localJson(path) {
   const target = new URL(path, `${localUrl}/`);
   target.searchParams.set("simdeckToken", localToken);
   const response = await fetch(target, {
     headers: { "x-simdeck-token": localToken },
+    signal: AbortSignal.timeout(Math.min(proxyTimeoutMs, 5000)),
   });
   if (!response.ok) {
     throw new Error(
diff --git a/server/src/api/routes.rs b/server/src/api/routes.rs
index 30a3927e..1d2e0023 100644
--- a/server/src/api/routes.rs
+++ b/server/src/api/routes.rs
@@ -28,11 +28,13 @@ use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::TcpStream;
 use tokio::process::Command;
-use tokio::sync::mpsc;
+use tokio::sync::{mpsc, Mutex};
 use tokio::task;
 use tokio::time::timeout;
 use tower_http::trace::TraceLayer;
 
+const SIMULATOR_INVENTORY_CACHE_TTL: Duration = Duration::from_secs(5);
+
 #[derive(Clone)]
 pub struct AppState {
     pub config: Config,
@@ -40,6 +42,18 @@ pub struct AppState {
     pub logs: LogRegistry,
     pub inspectors: InspectorHub,
     pub metrics: Arc<Metrics>,
+    pub simulator_inventory: SimulatorInventoryCache,
+}
+
+#[derive(Clone, Default)]
+pub struct SimulatorInventoryCache {
+    inner: Arc<Mutex<SimulatorInventoryState>>,
+}
+
+#[derive(Default)]
+struct SimulatorInventoryState {
+    simulators: Option<Vec<crate::native::bridge::Simulator>>,
+    updated_at: Option<Instant>,
 }
 
 #[derive(Deserialize)]
@@ -115,25 +129,25 @@ const STREAM_QUALITY_PROFILES: &[StreamQualityProfile] = &[
         id: "quality",
         label: "Quality",
         max_edge: 1440,
-        fps: 30,
-        min_bitrate: 3_000_000,
-        bits_per_pixel: 4,
+        fps: 60,
+        min_bitrate: 8_000_000,
+        bits_per_pixel: 6,
     },
     StreamQualityProfile {
         id: "balanced",
         label: "Balanced",
         max_edge: 1280,
-        fps: 30,
-        min_bitrate: 2_500_000,
-        bits_per_pixel: 4,
+        fps: 60,
+        min_bitrate: 6_000_000,
+        bits_per_pixel: 5,
     },
     StreamQualityProfile {
         id: "smooth",
         label: "Smooth",
         max_edge: 1170,
-        fps: 30,
-        min_bitrate: 2_000_000,
-        bits_per_pixel: 3,
+        fps: 60,
+        min_bitrate: 4_000_000,
+        bits_per_pixel: 5,
     },
     StreamQualityProfile {
         id: "economy",
@@ -177,6 +191,12 @@ pub(crate) enum ControlMessage {
         key_code: u16,
         modifiers: Option<u32>,
     },
+    DismissKeyboard,
+    Home,
+    AppSwitcher,
+    RotateLeft,
+    RotateRight,
+    ToggleAppearance,
 }
 
 #[derive(Deserialize)]
@@ -786,7 +806,7 @@ async fn inspector_response(
 }
 
 async fn list_simulators(State(state): State<AppState>) -> Result<Json<Value>, AppError> {
-    let simulators = run_bridge_action(state.clone(), |bridge| bridge.list_simulators()).await?;
+    let simulators = list_simulators_cached(state.clone(), false).await?;
     Ok(json(json_value!({
         "simulators": state.registry.enrich_simulators(simulators),
     })))
@@ -1265,6 +1285,14 @@ pub(crate) async fn run_control_message(
             key_code,
             modifiers,
         } => session.send_key(key_code, modifiers.unwrap_or(0)),
+        ControlMessage::DismissKeyboard => session.send_key(41, 0),
+        ControlMessage::Home => session.press_home(),
+        ControlMessage::AppSwitcher => session.open_app_switcher(),
+        ControlMessage::RotateLeft => session.rotate_left(),
+        ControlMessage::RotateRight => session.rotate_right(),
+        ControlMessage::ToggleAppearance => Err(AppError::bad_request(
+            "`toggleAppearance` requires the WebRTC control channel.",
+        )),
     })
     .await
     .map_err(|error| AppError::internal(format!("Failed to join control task: {error}")))?
@@ -3310,6 +3338,25 @@ where
         })?
 }
 
+async fn list_simulators_cached(
+    state: AppState,
+    force_refresh: bool,
+) -> Result<Vec<crate::native::bridge::Simulator>, AppError> {
+    let mut guard = state.simulator_inventory.inner.lock().await;
+    if !force_refresh {
+        if let (Some(simulators), Some(updated_at)) = (&guard.simulators, guard.updated_at) {
+            if updated_at.elapsed() <= SIMULATOR_INVENTORY_CACHE_TTL {
+                return Ok(simulators.clone());
+            }
+        }
+    }
+
+    let simulators = run_bridge_action(state.clone(), |bridge| bridge.list_simulators()).await?;
+    guard.simulators = Some(simulators.clone());
+    guard.updated_at = Some(Instant::now());
+    Ok(simulators)
+}
+
 async fn accessibility_snapshot(
     state: AppState,
     udid: String,
@@ -3323,7 +3370,7 @@ async fn accessibility_snapshot(
 }
 
 async fn simulator_payload(state: AppState, udid: String) -> Result<Json<Value>, AppError> {
-    let simulators = run_bridge_action(state.clone(), |bridge| bridge.list_simulators()).await?;
+    let simulators = list_simulators_cached(state.clone(), true).await?;
     let enriched = state.registry.enrich_simulators(simulators);
     let simulator = enriched
         .into_iter()
diff --git a/server/src/main.rs b/server/src/main.rs
index 1525ffa3..b2512148 100644
--- a/server/src/main.rs
+++ b/server/src/main.rs
@@ -445,7 +445,7 @@ enum StudioCommand {
         bind: IpAddr,
         #[arg(long)]
         low_latency: bool,
-        #[arg(long, value_enum, default_value_t = VideoCodecMode::Auto)]
+        #[arg(long, value_enum, default_value_t = VideoCodecMode::Software)]
         video_codec: VideoCodecMode,
         #[arg(long, value_enum, conflicts_with = "low_latency")]
         stream_quality: Option<StreamQualityProfileArg>,
@@ -519,6 +519,7 @@ enum PasteboardCommand {
 enum VideoCodecMode {
     Auto,
     Hardware,
+    #[value(alias = "h264-software")]
     Software,
 }
 
@@ -627,23 +628,23 @@ fn stream_quality_env_for_profile(profile: &str) -> anyhow::Result<StreamQuality
         "quality" => Ok(StreamQualityEnvironment {
             profile: "quality",
             max_edge: 1440,
-            fps: 30,
-            min_bitrate: 3_000_000,
-            bits_per_pixel: 4,
+            fps: 60,
+            min_bitrate: 8_000_000,
+            bits_per_pixel: 6,
         }),
         "balanced" => Ok(StreamQualityEnvironment {
             profile: "balanced",
             max_edge: 1280,
-            fps: 30,
-            min_bitrate: 2_500_000,
-            bits_per_pixel: 4,
+            fps: 60,
+            min_bitrate: 6_000_000,
+            bits_per_pixel: 5,
         }),
         "smooth" => Ok(StreamQualityEnvironment {
             profile: "smooth",
             max_edge: 1170,
-            fps: 30,
-            min_bitrate: 2_000_000,
-            bits_per_pixel: 3,
+            fps: 60,
+            min_bitrate: 4_000_000,
+            bits_per_pixel: 5,
         }),
         "economy" => Ok(StreamQualityEnvironment {
             profile: "economy",
@@ -690,8 +691,7 @@ fn studio_stream_quality_profile(
     requested
         .map(|profile| profile.as_profile_id().to_owned())
         .or_else(|| {
-            (video_codec == VideoCodecMode::Software && !low_latency)
-                .then_some("ci-software".to_owned())
+            (video_codec == VideoCodecMode::Software && !low_latency).then_some("smooth".to_owned())
         })
 }
 
@@ -1288,7 +1288,7 @@ fn expose_to_studio(options: StudioExposeOptions) -> anyhow::Result<()> {
         video_codec: options.video_codec,
         low_latency: options.low_latency,
         realtime_stream: true,
-        stream_quality_profile,
+        stream_quality_profile: stream_quality_profile.clone(),
     })?;
     let selected = if let Some(selector) = options.simulator.as_deref() {
         select_studio_simulator(&metadata.http_url, selector)
@@ -1305,6 +1305,23 @@ fn expose_to_studio(options: StudioExposeOptions) -> anyhow::Result<()> {
                 .with_context(|| format!("boot simulator {}", simulator.name))?;
         }
     }
+    let health = service_get_json(&metadata.http_url, "/api/health").ok();
+    let active_codec = health
+        .as_ref()
+        .and_then(|value| value.get("videoCodec"))
+        .and_then(Value::as_str)
+        .unwrap_or_else(|| options.video_codec.as_env_value());
+    let active_stream_quality = health
+        .as_ref()
+        .and_then(|value| value.get("streamQuality"))
+        .and_then(|value| value.get("profile"))
+        .and_then(Value::as_str)
+        .or(stream_quality_profile.as_deref());
+    let realtime_stream = health
+        .as_ref()
+        .and_then(|value| value.get("realtimeStream"))
+        .and_then(Value::as_bool)
+        .unwrap_or(true);
 
     let bridge_script = studio_provider_bridge_script()?;
     println!(
@@ -1314,6 +1331,14 @@ fn expose_to_studio(options: StudioExposeOptions) -> anyhow::Result<()> {
             .map(|simulator| simulator.name.as_str())
             .unwrap_or("the selected simulator")
     );
+    println!(
+        "Stream: {}{}{}",
+        active_codec,
+        if realtime_stream { ", realtime" } else { "" },
+        active_stream_quality
+            .map(|profile| format!(", quality={profile}"))
+            .unwrap_or_default()
+    );
     println!("Press Ctrl-C to stop the Studio bridge.");
     let status = ProcessCommand::new("node")
         .arg(bridge_script)
@@ -4586,6 +4611,7 @@ async fn serve(
         logs,
         inspectors,
         metrics,
+        simulator_inventory: Default::default(),
     };
 
     let http_router = app_router(
@@ -4763,6 +4789,7 @@ mod tests {
             ("auto", VideoCodecMode::Auto),
             ("hardware", VideoCodecMode::Hardware),
             ("software", VideoCodecMode::Software),
+            ("h264-software", VideoCodecMode::Software),
         ] {
             let cli = Cli::parse_from(["simdeck", "daemon", "start", "--video-codec", mode]);
             let Command::Daemon {
@@ -4780,14 +4807,6 @@ mod tests {
         assert!(
             Cli::try_parse_from(["simdeck", "daemon", "start", "--video-codec", "h264"]).is_err()
         );
-        assert!(Cli::try_parse_from([
-            "simdeck",
-            "daemon",
-            "start",
-            "--video-codec",
-            "h264-software"
-        ])
-        .is_err());
     }
 
     #[test]
diff --git a/server/src/native/bridge.rs b/server/src/native/bridge.rs
index 6318a754..1a7c9016 100644
--- a/server/src/native/bridge.rs
+++ b/server/src/native/bridge.rs
@@ -686,6 +686,46 @@ impl NativeSession {
             )
         }
     }
+
+    pub fn press_home(&self) -> Result<(), AppError> {
+        unsafe {
+            let mut error = ptr::null_mut();
+            bool_result(
+                ffi::xcw_native_session_press_home(self.handle, &mut error),
+                error,
+            )
+        }
+    }
+
+    pub fn open_app_switcher(&self) -> Result<(), AppError> {
+        unsafe {
+            let mut error = ptr::null_mut();
+            bool_result(
+                ffi::xcw_native_session_open_app_switcher(self.handle, &mut error),
+                error,
+            )
+        }
+    }
+
+    pub fn rotate_left(&self) -> Result<(), AppError> {
+        unsafe {
+            let mut error = ptr::null_mut();
+            bool_result(
+                ffi::xcw_native_session_rotate_left(self.handle, &mut error),
+                error,
+            )
+        }
+    }
+
+    pub fn rotate_right(&self) -> Result<(), AppError> {
+        unsafe {
+            let mut error = ptr::null_mut();
+            bool_result(
+                ffi::xcw_native_session_rotate_right(self.handle, &mut error),
+                error,
+            )
+        }
+    }
 }
 
 impl Drop for NativeSession {
diff --git a/server/src/native/ffi.rs b/server/src/native/ffi.rs
index 9a6b6154..8ca3b7a6 100644
--- a/server/src/native/ffi.rs
+++ b/server/src/native/ffi.rs
@@ -202,6 +202,22 @@ unsafe extern "C" {
         modifiers: u32,
         error_message: *mut *mut c_char,
     ) -> bool;
+    pub fn xcw_native_session_press_home(
+        handle: *mut c_void,
+        error_message: *mut *mut c_char,
+    ) -> bool;
+    pub fn xcw_native_session_open_app_switcher(
+        handle: *mut c_void,
+        error_message: *mut *mut c_char,
+    ) -> bool;
+    pub fn xcw_native_session_rotate_right(
+        handle: *mut c_void,
+        error_message: *mut *mut c_char,
+    ) -> bool;
+    pub fn xcw_native_session_rotate_left(
+        handle: *mut c_void,
+        error_message: *mut *mut c_char,
+    ) -> bool;
 
     pub fn xcw_native_free_string(value: *mut c_char);
     pub fn xcw_native_free_bytes(bytes: xcw_native_owned_bytes);
diff --git a/server/src/simulators/session.rs b/server/src/simulators/session.rs
index cc7d1e49..9ed209ea 100644
--- a/server/src/simulators/session.rs
+++ b/server/src/simulators/session.rs
@@ -182,6 +182,22 @@ impl SimulatorSession {
         self.inner.native.send_key(key_code, modifiers)
     }
 
+    pub fn press_home(&self) -> Result<(), AppError> {
+        self.inner.native.press_home()
+    }
+
+    pub fn open_app_switcher(&self) -> Result<(), AppError> {
+        self.inner.native.open_app_switcher()
+    }
+
+    pub fn rotate_left(&self) -> Result<(), AppError> {
+        self.inner.native.rotate_left()
+    }
+
+    pub fn rotate_right(&self) -> Result<(), AppError> {
+        self.inner.native.rotate_right()
+    }
+
     pub fn snapshot(&self) -> serde_json::Value {
         serde_json::json!({
             "displayReady": self.inner.display_ready.load(Ordering::Relaxed),
diff --git a/server/src/transport/webrtc.rs b/server/src/transport/webrtc.rs
index 2c9d5faf..c49cade0 100644
--- a/server/src/transport/webrtc.rs
+++ b/server/src/transport/webrtc.rs
@@ -1,5 +1,6 @@
 use crate::api::routes::{run_control_message, AppState, ControlMessage};
 use crate::error::AppError;
+use crate::metrics::counters::ClientStreamStats;
 use bytes::Bytes;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
@@ -7,6 +8,7 @@ use std::sync::atomic::Ordering;
 use std::sync::{Arc, Mutex, OnceLock};
 use std::time::Duration;
 use tokio::sync::broadcast;
+use tokio::task;
 use tokio::time;
 use tracing::{info, warn};
 use webrtc::api::interceptor_registry::register_default_interceptors;
@@ -34,6 +36,7 @@ use webrtc::track::track_local::TrackLocalWriter;
 const ANNEX_B_START_CODE: &[u8] = &[0, 0, 0, 1];
 const DEFAULT_STUN_URL: &str = "stun:stun.l.google.com:19302";
 const WEBRTC_CONTROL_CHANNEL_LABEL: &str = "simdeck-control";
+const WEBRTC_TELEMETRY_CHANNEL_LABEL: &str = "simdeck-telemetry";
 const WEBRTC_BOOTSTRAP_KEYFRAME_INTERVAL: Duration = Duration::from_millis(150);
 const WEBRTC_BOOTSTRAP_KEYFRAME_REPEATS: u8 = 3;
 const WEBRTC_MIN_REFRESH_INTERVAL: Duration = Duration::from_millis(16);
@@ -123,7 +126,7 @@ pub async fn create_answer(
         ));
     }
 
-    let h264_fmtp_line = h264_sdp_fmtp_line(&codec);
+    let h264_fmtp_line = h264_sdp_fmtp_line(&codec, &payload.sdp);
     let mut media_engine = MediaEngine::default();
     media_engine
         .register_codec(
@@ -159,7 +162,12 @@ pub async fn create_answer(
         .map_err(|error| AppError::internal(format!("create WebRTC peer connection: {error}")))?,
     );
     register_diagnostics(&peer_connection, &udid);
-    register_control_data_channel(&peer_connection, session.clone(), udid.clone());
+    register_control_data_channel(
+        &peer_connection,
+        session.clone(),
+        state.clone(),
+        udid.clone(),
+    );
 
     let video_track = Arc::new(TrackLocalStaticRTP::new(
         RTCRtpCodecCapability {
@@ -330,16 +338,19 @@ fn redact_candidate_address(address: &str) -> String {
 fn register_control_data_channel(
     peer_connection: &Arc<webrtc::peer_connection::RTCPeerConnection>,
     session: crate::simulators::session::SimulatorSession,
+    state: AppState,
     udid: String,
 ) {
     peer_connection.on_data_channel(Box::new(move |channel: Arc<RTCDataChannel>| {
         let session = session.clone();
+        let state = state.clone();
         let udid = udid.clone();
         Box::pin(async move {
-            if channel.label() != WEBRTC_CONTROL_CHANNEL_LABEL {
+            let label = channel.label();
+            if label != WEBRTC_CONTROL_CHANNEL_LABEL && label != WEBRTC_TELEMETRY_CHANNEL_LABEL {
                 return;
             }
-            attach_control_data_channel(channel, session, udid);
+            attach_control_data_channel(channel, session, state, udid);
         })
     }));
 }
@@ -347,16 +358,28 @@ fn register_control_data_channel(
 fn attach_control_data_channel(
     channel: Arc<RTCDataChannel>,
     session: crate::simulators::session::SimulatorSession,
+    state: AppState,
     udid: String,
 ) {
     channel.on_message(Box::new(move |message: DataChannelMessage| {
         let session = session.clone();
+        let state = state.clone();
         let udid = udid.clone();
         Box::pin(async move {
             let Ok(text) = std::str::from_utf8(&message.data) else {
                 warn!("Invalid WebRTC control message bytes for {udid}");
                 return;
             };
+            if let Ok(message) = serde_json::from_str::<WebRtcDataChannelMessage>(text) {
+                match message {
+                    WebRtcDataChannelMessage::ClientStats { stats } => {
+                        if !stats.client_id.trim().is_empty() && !stats.kind.trim().is_empty() {
+                            state.metrics.record_client_stream_stats(stats);
+                        }
+                    }
+                }
+                return;
+            }
             let control_message = match serde_json::from_str::<ControlMessage>(text) {
                 Ok(message) => message,
                 Err(error) => {
@@ -364,29 +387,98 @@ fn attach_control_data_channel(
                     return;
                 }
             };
-            if let Err(error) = run_control_message(session, control_message).await {
-                warn!("WebRTC control message failed for {udid}: {error}");
+            match control_message {
+                ControlMessage::ToggleAppearance => {
+                    let bridge = state.registry.bridge().clone();
+                    let action_udid = udid.clone();
+                    let result =
+                        task::spawn_blocking(move || bridge.toggle_appearance(&action_udid))
+                            .await
+                            .map_err(|error| {
+                                AppError::internal(format!("Failed to join control task: {error}"))
+                            })
+                            .and_then(|result| result);
+                    if let Err(error) = result {
+                        warn!("WebRTC control message failed for {udid}: {error}");
+                    }
+                }
+                control_message => {
+                    if let Err(error) = run_control_message(session, control_message).await {
+                        warn!("WebRTC control message failed for {udid}: {error}");
+                    }
+                }
             }
         })
     }));
 }
 
+#[derive(Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "camelCase")]
+enum WebRtcDataChannelMessage {
+    ClientStats { stats: ClientStreamStats },
+}
+
 fn is_h264_codec(codec: &str) -> bool {
     let codec = codec.trim().to_ascii_lowercase();
     codec.contains("h264") || codec.starts_with("avc1.") || codec.starts_with("avc3.")
 }
 
-fn h264_sdp_fmtp_line(codec: &str) -> String {
-    let profile_level_id = codec
+fn h264_sdp_fmtp_line(codec: &str, offer_sdp: &str) -> String {
+    let codec_profile_level_id = codec
         .split_once('.')
         .map(|(_, value)| value)
         .filter(|value| value.len() >= 6)
         .map(|value| &value[..6])
         .filter(|value| value.chars().all(|ch| ch.is_ascii_hexdigit()))
-        .unwrap_or("42e01f");
+        .map(|value| value.to_ascii_lowercase());
+    let offered_profile_level_ids = offer_h264_profile_level_ids(offer_sdp);
+    let profile_level_id = codec_profile_level_id
+        .clone()
+        .or_else(|| offered_profile_level_ids.first().cloned())
+        .unwrap_or_else(|| "42e01f".to_owned());
     format!("level-asymmetry-allowed=1;packetization-mode=1;profile-level-id={profile_level_id}")
 }
 
+fn offer_h264_profile_level_ids(sdp: &str) -> Vec<String> {
+    let h264_payload_types = sdp
+        .lines()
+        .filter_map(|line| line.strip_prefix("a=rtpmap:"))
+        .filter_map(|line| {
+            let (payload_type, codec) = line.split_once(' ')?;
+            codec
+                .to_ascii_lowercase()
+                .starts_with("h264/")
+                .then(|| payload_type.to_owned())
+        })
+        .collect::<Vec<_>>();
+    if h264_payload_types.is_empty() {
+        return Vec::new();
+    }
+
+    sdp.lines()
+        .filter_map(|line| line.strip_prefix("a=fmtp:"))
+        .filter_map(|line| {
+            let (payload_type, fmtp) = line.split_once(' ')?;
+            h264_payload_types
+                .iter()
+                .any(|candidate| candidate == payload_type)
+                .then_some(fmtp)
+        })
+        .flat_map(|fmtp| fmtp.split(';'))
+        .filter_map(|parameter| parameter.trim().split_once('='))
+        .filter_map(|(name, value)| {
+            if name.eq_ignore_ascii_case("profile-level-id")
+                && value.len() >= 6
+                && value[..6].chars().all(|ch| ch.is_ascii_hexdigit())
+            {
+                Some(value[..6].to_ascii_lowercase())
+            } else {
+                None
+            }
+        })
+        .collect()
+}
+
 fn h264_rtcp_feedback() -> Vec<RTCPFeedback> {
     let mut feedback = vec![
         RTCPFeedback {
@@ -1096,8 +1188,13 @@ mod tests {
 
     #[test]
     fn uses_h264_profile_level_id_when_available() {
-        assert!(h264_sdp_fmtp_line("avc1.42e01f").contains("profile-level-id=42e01f"));
-        assert!(h264_sdp_fmtp_line("h264").contains("profile-level-id=42e01f"));
+        assert!(h264_sdp_fmtp_line("avc1.42e01f", "").contains("profile-level-id=42e01f"));
+        assert!(h264_sdp_fmtp_line("h264", "").contains("profile-level-id=42e01f"));
+        assert!(h264_sdp_fmtp_line(
+            "avc1.42e01f",
+            "a=rtpmap:99 H264/90000\r\na=fmtp:99 level-asymmetry-allowed=1;packetization-mode=1;profile-level-id=640c1f\r\n"
+        )
+        .contains("profile-level-id=42e01f"));
     }
 
     #[test]
diff --git a/skills/simdeck/SKILL.md b/skills/simdeck/SKILL.md
index e09cbec8..8b84b236 100644
--- a/skills/simdeck/SKILL.md
+++ b/skills/simdeck/SKILL.md
@@ -45,12 +45,13 @@ and proxies REST requests through that bridge while WebRTC media negotiates
 directly with the runner.
 For an ad-hoc local provider that can be opened from another browser or phone,
 run `simdeck studio expose "iPhone 17 Pro"` and keep that process running. It
-prints the unique Studio simulator URL. This defaults to `auto`, letting
-VideoToolbox choose the encoder. Use `--video-codec software` to force software
-encoding. Studio expose uses
-realtime stream settings so remote viewers drop stale frames instead of building
-latency. Software H.264 Studio providers default to the `ci-software` stream
-quality profile; override with `--stream-quality quality|balanced|smooth|economy|ci-software`.
+prints the unique Studio simulator URL and active stream settings. This defaults
+to software H.264 with realtime stream settings so remote viewers drop stale
+frames instead of building latency. Studio providers default to the `smooth`
+stream quality profile (1170 px, dynamic up to 60 fps, higher bitrate to reduce
+artifacts); override with
+`--stream-quality quality|balanced|smooth|economy|ci-software`, or pass
+`--video-codec hardware` when a dedicated hardware encoder is preferable.
 
 The local viewer gets the API token automatically. LAN browsers pair with the printed code before receiving the API cookie. Direct HTTP calls need `X-SimDeck-Token` or `Authorization: Bearer <token>`.