Follow-ups found while testing phase-1 (PR #2) against a real desktop guest, real libvirt and systemd, and in a code review. Details and numbers are in JOURNAL.md (2026-09-13).

Performance (REQ-NFR-001)

• Full-motion video misses the latency target. A 1080p guest playing full-screen video measures p95 22 ms (target ≤ 12 ms; the pattern guest does 4-5 ms). Every frame is fully damaged:

  • the frame store copies the shared map into its buffer (listener thread)
  • capture copies that buffer into the image (capture thread)
  • the image is uploaded to CUDA

  Remove one copy by copying from the map straight into the pipeline image at capture time, and keep the frame-store lock out of the full-frame memcpy so QEMU’s listener calls don’t wait.

• 4K full-motion is ~22 fps, limited before the encoder. It’s the same at a 1080p stream and with software encoding. The guest’s vCPUs are busy in virtio-gpu 2D transfers, while Sunshine’s threads use ≤ 35% of a core. The GL/DMABUF path (#3) is the real fix; add a 4K desktop run to its verification.

• Latency for an idle or typing desktop isn’t measured. The idle runs produced 1-2 samples. Add a workload to tests/e2e/qemu/desktop/desktop_stream.sh that makes small, frequent damage (typing into a terminal, cursor moves) and record p50/p95.

Robustness (review findings, minor)

• Console input proxies are created with blocking *_proxy_new_sync on the input thread (session.cpp, console_input_impl_t::start). Events for the previous console queue behind them; use the async variants.
• The input call queue is unbounded when QEMU stops reading but keeps its socket open (SIGSTOP or a debugger). Cap it and merge motion; never drop key or button releases.
• A guest volume change made while no client is streaming is never seen (QEMU doesn’t replay SetVolume), so the next session uses the cached value.
• libvirt_open_display (virConnectOpen) has no timeout of its own, though it no longer holds the shared_session lock.

Manual checks still needed (need a person or other hardware)

• A real Moonlight client (#4, #5): tests/e2e/qemu/desktop/serve_desktop.sh serves the desktop VM with persistent pairing.
  • On WSL2 other devices can’t reach it without networkingMode=mirrored or port forwards; the script prints both.
• The virt-manager click-through (#6). The hook, units and p2p display are verified on real libvirt 10.0 and systemd 255 without the GUI.
• DMABUF, VAAPI and the GPU unit tests on native Linux with /dev/dri (#3).