diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2066f607..9c7d5766 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -32,6 +32,9 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Verify PVM bridge assets
+        run: bun run check:pvm-runtime
+
       - name: Run tests
         run: bunx --bun turbo run test
 
diff --git a/.prettierignore b/.prettierignore
index bb6b577c..6b15bc6e 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -3,3 +3,4 @@ node_modules/
 bun.lock
 tests/results/
 docs/
+apps/sandbox/public/pvm-runtime/
diff --git a/README.md b/README.md
index d9168dbf..7865db08 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,7 @@ Each product gets its own `<label>.app.paseo.li` origin, so versions of the same
 1. **Resolves** `.dot` names via an in-browser [smoldot](https://github.com/paritytech/smoldot) light client connected to Asset Hub Paseo, querying dotNS contracts.
 2. **Fetches** content from the [Bulletin Chain](https://github.com/paritytech/polkadot-bulletin-chain) via smoldot `bitswap_v1_get` JSON-RPC or an IPFS gateway.
 3. **Renders** the content in a sandboxed iframe with the Rust-backed TrUAPI bridge, so loaded SPAs can request accounts, sign transactions, connect to chains, and use scoped storage.
+4. **Runs** verified framebuffer PolkaVM products by translating `app.polkavm` to WebAssembly at load time inside a worker, with a bounded interpreter fallback.
 
 ```
 host-playground.paseo.li
@@ -100,12 +101,31 @@ When a CID points to an IPFS directory (not a single file):
 4. The iframe loads from `/dotli-app/index.html` — the SW intercepts all requests and serves files from the in-memory archive
 5. Relative imports (`<script src="main.js">`, `<link href="styles.css">`) just work
 
+## How PolkaVM apps work
+
+An archive whose `manifest.json` declares `runtime.kind: "polkavm"` never
+executes package-owned HTML. The sandbox instead creates a host-owned canvas,
+loads the verified `app.polkavm` and immutable package assets, and translates
+the program to WebAssembly inside a worker. Keyboard, pointer, framebuffer,
+PCM-audio, asset, and save traffic stays on the bounded PolkaVM host ABI.
+
+The initial profile supports Epoca framebuffer ABI version 1, including CoreVM
+products such as `doom.paseo`. Tri2D, WebGPU, and TruAPI guest hostcalls fail
+closed until their capability boundaries are implemented independently.
+
+Translated Wasm bytes are cached in product-origin IndexedDB by the SHA-256 of
+the PVM program and the pinned translator version. Warm launches skip PVM
+instruction lowering; WebAssembly compilation remains browser-owned. If
+translation or Wasm compilation fails, the same worker retries through the
+bounded interpreter.
+
 ## Caching and verification
 
-dotli uses a two-layer cache for fast repeat visits:
+dotli uses three cache layers for fast repeat visits:
 
 1. **CID cache** (IndexedDB) — maps `.dot` labels to their last-known CID
 2. **Archive cache** (Service Worker) — stores fetched file maps keyed by domain; a cache hit additionally requires the stored CID (and content backend) to match
+3. **PVM translation cache** (IndexedDB) — stores translated Wasm bytes keyed by translator version and PVM program digest
 
 On repeat visits, content renders instantly from the cache while it is resolved in the background. The topbar shield shows how the current page was loaded:
 
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index df4d8895..c6ef4457 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -8,9 +8,11 @@ alphabetically. Copyright and permission notices for each package are retained
 in its distribution under `node_modules`.
 
 GPL-family components (GPL-3.0 with the Classpath linking exception) are
-compatible with this project's AGPL-3.0 outbound license. Build-time-only
-tooling under weak-copyleft (MPL-2.0) or source-available (FSL-1.1-MIT) terms is
-used to build the application and is not redistributed as part of it.
+compatible with this project's AGPL-3.0 outbound license. The vendored Epoca
+PolkaVM browser runtime remains under MPL-2.0, with its PolkaVM-derived portions
+under Apache-2.0 OR MIT. Its complete notices and source provenance ship beside
+the runtime. Build-time-only tooling under source-available FSL-1.1-MIT terms is
+not redistributed as part of the application.
 
 > Generated from the resolved dependency tree (595 distinct third-party
 > packages). Platform-specific binary packages (for example
@@ -76,7 +78,7 @@ smoldot, verifiablejs
 
 ## MPL-2.0
 
-lightningcss, lightningcss-darwin-arm64
+Epoca PolkaVM browser runtime, lightningcss, lightningcss-darwin-arm64
 
 ## FSL-1.1-MIT
 
diff --git a/apps/host/package.json b/apps/host/package.json
index 81c83827..37b91e49 100644
--- a/apps/host/package.json
+++ b/apps/host/package.json
@@ -7,12 +7,13 @@
   "scripts": {
     "build": "tsc && bunx --bun vite build",
     "build:prod": "tsc && bunx --bun vite build && bun ../../scripts/compress-dist.ts",
-    "test:functional": "playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts",
+    "test:functional": "playwright test --config=tests/functional/playwright.config.ts tests/functional/loading.spec.ts tests/functional/resolution.spec.ts tests/functional/navigation.spec.ts tests/functional/pvm.spec.ts",
     "test:e2e": "playwright test --config=tests/e2e/playwright.config.ts",
     "test:e2e:local": "E2E_PRODUCT_URL=${E2E_PRODUCT_URL:-http://localhost:5199} SIGNER_BOT_BASE_URL=${SIGNER_BOT_BASE_URL:-http://localhost:3737/} SIGNER_BOT_SVC_TOKEN=${SIGNER_BOT_SVC_TOKEN:-admin} SIGNER_BOT_NETWORK=${SIGNER_BOT_NETWORK:-paseo-next-v2} playwright test --config=tests/e2e/playwright.config.ts",
     "test:perf": "PERF_RUNS=10 PERF_DOMAIN_A=explore PERF_DOMAIN_B=host-playground npx playwright test --config=tests/performance/playwright.config.ts tests/performance/cold-start.spec.ts",
     "test:perf:base": "PERF_RUNS=20 PERF_SAVE_BASE=1 PERF_DOMAIN_A=explore PERF_DOMAIN_B=host-playground npx playwright test --config=tests/performance/playwright.config.ts tests/performance/cold-start.spec.ts",
     "test:perf:compare": "bun tests/performance/compare.ts",
+    "test:pvm:doom": "playwright test --config=tests/performance/playwright.config.ts tests/performance/pvm-doom.spec.ts",
     "test:perf:compare:md": "bun tests/performance/compare.ts --markdown",
     "lint": "bunx eslint src/",
     "typecheck": "tsc --noEmit"
@@ -21,10 +22,14 @@
     "@dotli/eslint-config": "workspace:*",
     "@dotli/typescript-config": "workspace:*",
     "@playwright/test": "^1.59.1",
+    "@ipld/car": "^5.4.3",
+    "@ipld/dag-pb": "^4.1.5",
     "playwright": "^1.59.1",
     "@types/node": "^25.9.3",
     "eslint": "^10.5.0",
     "jsqr": "^1.4.0",
+    "ipfs-unixfs": "^13.0.0",
+    "multiformats": "^14.0.0",
     "prettier": "^3.8.3",
     "simple-statistics": "^7.9.0",
     "typescript": "~6.0.3",
diff --git a/apps/host/src/main.ts b/apps/host/src/main.ts
index b04badf1..3ecf65fc 100644
--- a/apps/host/src/main.ts
+++ b/apps/host/src/main.ts
@@ -53,9 +53,11 @@ import {
   warmupProtocol,
 } from "@dotli/protocol/client";
 import {
-  getCachedCid,
-  setCachedCid,
-  recordRevalidateOutcome,
+  evictCachedInstalledExecutable,
+  getCachedInstalledExecutable,
+  reconcileInstalledExecutable,
+  setCachedInstalledExecutable,
+  type InstalledExecutable,
 } from "@dotli/storage/cid-cache";
 import { recordRecentLabel } from "@dotli/ui/recent-labels";
 import { dur, elapsed } from "@dotli/shared/perf";
@@ -72,6 +74,7 @@ import type {
   ManifestResult,
   RootManifest,
 } from "@dotli/resolver/manifest";
+import { parseExecutableManifest } from "@dotli/resolver/manifest-types";
 import { BASE_DOMAIN, DEBUG, SITE_ID, isLocalhost } from "@dotli/config/config";
 import { log } from "@dotli/shared/log";
 import { serializeError } from "@dotli/shared/errors";
@@ -319,31 +322,108 @@ function setShieldState(state: "validating" | "verified"): void {
   armTopbarAutoHide();
 }
 
+async function resolveAppExecutableManifest(
+  label: string,
+  chainBackend: Backend,
+): Promise<ManifestResult<ExecutableManifest>> {
+  if (chainBackend === "rpc-gateway") {
+    const mod = await import("@dotli/resolver/rpc-resolve");
+    return mod.resolveExecutableManifestViaRpc(label, "app");
+  }
+  return resolveExecutableManifestRemote(label, "app");
+}
+
+async function loadAppExecutableManifest(
+  label: string,
+  chainBackend: Backend,
+): Promise<ManifestResult<ExecutableManifest> | null> {
+  try {
+    // App manifest v2 is an execution contract, not optional metadata. Let the
+    // resolver's own transport timeout govern this read: replacing a slow
+    // response with `null` makes the sandbox reject valid PolkaVM packages as
+    // if their required external manifest did not exist.
+    return await resolveAppExecutableManifest(label, chainBackend);
+  } catch (error: unknown) {
+    log.warn(
+      `[dot.li manifest] executable manifest resolution failed for ${withActiveTld(label)}: ${serializeError(error)}`,
+    );
+    return null;
+  }
+}
+
+function executableManifestText(
+  result: ManifestResult<ExecutableManifest> | null,
+): string | null {
+  return result?.kind === "ok" && result.value.kind === "app"
+    ? result.raw
+    : null;
+}
+
+function installedExecutableFromManifest(
+  contenthash: string,
+  result: ManifestResult<ExecutableManifest> | null,
+): InstalledExecutable | null {
+  return result?.kind === "ok" &&
+    result.value.kind === "app" &&
+    result.value.$v === 1
+    ? { contenthash, executableManifest: result.raw }
+    : null;
+}
+
+function cachedV1AppManifest(
+  executable: InstalledExecutable,
+): ManifestResult<ExecutableManifest> | null {
+  const parsed = parseExecutableManifest(executable.executableManifest);
+  return parsed.ok && parsed.value.kind === "app" && parsed.value.$v === 1
+    ? {
+        kind: "ok",
+        value: parsed.value,
+        raw: executable.executableManifest,
+      }
+    : null;
+}
+
+async function resolveAppContenthash(
+  label: string,
+  chainBackend: Backend,
+  onProgress?: (message: string) => void,
+): Promise<string | null> {
+  let contenthash: string | null;
+  if (chainBackend === "rpc-gateway") {
+    const { resolveDotNameViaRpc } =
+      await import("@dotli/resolver/rpc-resolve");
+    contenthash = await resolveDotNameViaRpc(`app.${label}`, onProgress);
+    contenthash ??= await resolveDotNameViaRpc(label, onProgress);
+  } else {
+    contenthash = await resolveDotNameRemote(`app.${label}`, onProgress);
+    contenthash ??= await resolveDotNameRemote(label, onProgress);
+  }
+  if (contenthash === null) {
+    log.warn(
+      `[dot.li resolve] neither app.${withActiveTld(label)} nor ${withActiveTld(label)} has a contenthash`,
+    );
+  }
+  return contenthash;
+}
+
 /**
  * Apply the product's branding from the root manifest at `<label>.dot`.
  *
- * Runs after the app iframe is rendered so a slow or absent manifest never
- * blocks first paint. The manifest itself is read through the user's
- * selected backend (smoldot or RPC). The icon bytes flow through the same
- * backend via `bitswapGet`, which dispatches through the protocol bridge.
+ * Runs after the app iframe is rendered. The executable manifest result is
+ * reused from the launch path; only cosmetic root metadata and icon bytes are
+ * fetched here, so branding never delays the application.
  */
 async function applyProductBranding(
   label: string,
   chainBackend: Backend,
+  appResult: ManifestResult<ExecutableManifest> | null,
 ): Promise<void> {
   let rootResult: ManifestResult<RootManifest>;
-  let appResult: ManifestResult<ExecutableManifest>;
   if (chainBackend === "rpc-gateway") {
     const mod = await import("@dotli/resolver/rpc-resolve");
-    [rootResult, appResult] = await Promise.all([
-      mod.resolveRootManifestViaRpc(label),
-      mod.resolveExecutableManifestViaRpc(label, "app"),
-    ]);
+    rootResult = await mod.resolveRootManifestViaRpc(label);
   } else {
-    [rootResult, appResult] = await Promise.all([
-      resolveRootManifestRemote(label),
-      resolveExecutableManifestRemote(label, "app"),
-    ]);
+    rootResult = await resolveRootManifestRemote(label);
   }
   if (rootResult.kind === "ok") {
     const root = rootResult.value;
@@ -368,7 +448,7 @@ async function applyProductBranding(
       );
     }
   }
-  if (appResult.kind === "ok" && appResult.value.kind === "app") {
+  if (appResult?.kind === "ok" && appResult.value.kind === "app") {
     setActiveAppManifest({
       schemaVersion: appResult.value.$v,
       appVersion: appResult.value.appVersion,
@@ -576,54 +656,6 @@ function listenForSandboxDebugEvents(emit: EmitFn): void {
   });
 }
 
-/** SWR pass after fast-path render. Re-resolves, updates cache, surfaces a reload notice on change. */
-async function runBackgroundRevalidate(
-  label: string,
-  servedCid: string,
-  chainBackend: Backend,
-): Promise<void> {
-  const stopTimer = m.timer(S.CACHE_REVALIDATE_LATENCY);
-  try {
-    let freshCid: string | null;
-    if (chainBackend !== "rpc-gateway") {
-      freshCid = await resolveDotNameRemote(label);
-    } else {
-      const { resolveDotNameViaRpc } =
-        await import("@dotli/resolver/rpc-resolve");
-      freshCid = await resolveDotNameViaRpc(label);
-    }
-    stopTimer();
-    const outcome = await recordRevalidateOutcome(label, servedCid, freshCid);
-    if (outcome.kind === "update") {
-      log.warn(
-        `[dot.li cid-cache] revalidate: ${label} updated ${servedCid} -> ${outcome.cid}`,
-      );
-      showNotification({
-        label: "New version available",
-        text: "This site has been updated. Reload to see the latest version.",
-        dismissMs: 0,
-        action: {
-          label: "Reload",
-          onClick: () => {
-            window.location.reload();
-          },
-        },
-      });
-    } else if (outcome.kind === "cleared") {
-      // Owner unset the pointer. Cache is already evicted, so reload to show the cold-path error.
-      log.warn(
-        `[dot.li cid-cache] revalidate: ${label} cleared on-chain, reloading`,
-      );
-      window.location.reload();
-    }
-  } catch (err) {
-    stopTimer();
-    m.count(S.CACHE_REVALIDATE_ERROR);
-    log.warn(`[dot.li cid-cache] revalidate failed for ${label}:`, err);
-    captureException(err, { kind: "cid_cache_revalidate_error" });
-  }
-}
-
 /** Best-effort `localStorage.getItem`, returning null on Safari-private-mode failure. */
 function readRawLocalStorage(key: string): string | null {
   try {
@@ -1180,58 +1212,117 @@ async function main(): Promise<void> {
   setLoadingDomain(label);
   advancePhase(0);
   trackStatus(`Resolving ${withActiveTld(label)}`);
+  const network = getNetwork();
+  let appManifestPromise:
+    | Promise<ManifestResult<ExecutableManifest> | null>
+    | undefined;
+  const appManifest =
+    (): Promise<ManifestResult<ExecutableManifest> | null> => {
+      appManifestPromise ??= loadAppExecutableManifest(label, chainBackend);
+      return appManifestPromise;
+    };
+  let resolvedContenthash: string | undefined;
 
   try {
-    const cachedCid = cacheSettings.skipCidCache
-      ? null
-      : await getCachedCid(label);
+    const cacheResult = cacheSettings.skipCidCache
+      ? ({ kind: "miss" } as const)
+      : await getCachedInstalledExecutable(label, network, "app");
+    if (cacheResult.kind === "error") {
+      throw cacheResult.cause;
+    }
+    const cachedExecutable =
+      cacheResult.kind === "hit" ? cacheResult.executable : null;
     emitDotliDebugEvent({
       layer: "boot",
-      event: "cid_cache_checked",
+      event: "installed_executable_cache_checked",
       flowId: bootFlowId,
       timestamp: Date.now(),
-      payload: { label, hit: cachedCid !== null, cid: cachedCid ?? undefined },
+      payload: {
+        label,
+        hit: cachedExecutable !== null,
+        contenthash: cachedExecutable?.contenthash,
+      },
     });
-    if (cachedCid !== null) {
-      m.count(S.CACHE_HIT);
-      log.warn(
-        `[dot.li resolve] path=cache (${chainBackend}) (${elapsed(T0)}) -> ${cachedCid}`,
-      );
-      // Wrap the warm-path render in a span so its duration is queryable
-      // as `dotli.e2e.fast_path` alongside `dotli.e2e.slow_path`.
-      await m.span(S.E2E_FAST, async () => {
-        setShieldState(shieldState);
-        const { renderAppSubdomain } = await renderChunkPromise;
-        advancePhase(contentFetchPhase);
-        await renderAppSubdomain(cachedCid, label);
-      });
-      void recordRecentLabel(label);
-      void applyProductBranding(label, chainBackend).catch((err: unknown) => {
+    if (cachedExecutable !== null) {
+      const cachedManifest = cachedV1AppManifest(cachedExecutable);
+      if (cachedManifest === null) {
+        await evictCachedInstalledExecutable(label, network, "app");
         log.warn(
-          `[dot.li manifest] branding failed for ${withActiveTld(label)}: ${err instanceof Error ? err.message : String(err)}`,
+          `[dot.li installed-executable-cache] evicted invalid v1 app record for ${label}`,
         );
-      });
-      performance.mark("dotli:main:end");
-      log.warn(`[dot.li perf] === TOTAL (fast path): ${dur(T0)} ===`);
-      emitDotliDebugEvent({
-        layer: "boot",
-        event: "ready",
-        flowId: bootFlowId,
-        timestamp: Date.now(),
-        payload: {
+      } else {
+        const stopRevalidate = m.timer(S.CACHE_REVALIDATE_LATENCY);
+        let freshContenthash: string | null;
+        try {
+          freshContenthash = await resolveAppContenthash(label, chainBackend);
+          stopRevalidate();
+        } catch (error) {
+          stopRevalidate();
+          m.count(S.CACHE_REVALIDATE_ERROR);
+          throw error;
+        }
+        const outcome = await reconcileInstalledExecutable(
           label,
-          totalMs: performance.now() - T0,
-          path: "fast",
-        },
-      });
-      // SWR: keep the cache honest across reloads without blocking the render.
-      requestIdleCallback(() => {
-        void runBackgroundRevalidate(label, cachedCid, chainBackend);
-      });
-      return;
+          network,
+          "app",
+          cachedExecutable,
+          freshContenthash,
+        );
+        if (outcome.kind === "cleared") {
+          stopStatusTick();
+          showNoContentError(label);
+          performance.mark("dotli:main:end");
+          return;
+        }
+        if (outcome.kind === "match") {
+          m.count(S.CACHE_HIT);
+          log.warn(
+            `[dot.li resolve] path=installed-executable (${chainBackend}) (${elapsed(T0)}) -> ${cachedExecutable.contenthash}`,
+          );
+          await m.span(S.E2E_FAST, async () => {
+            setShieldState(shieldState);
+            const { renderAppSubdomain } = await renderChunkPromise;
+            advancePhase(contentFetchPhase);
+            await renderAppSubdomain(
+              cachedExecutable.contenthash,
+              label,
+              cachedExecutable.executableManifest,
+            );
+          });
+          void recordRecentLabel(label);
+          void applyProductBranding(label, chainBackend, cachedManifest).catch(
+            (err: unknown) => {
+              log.warn(
+                `[dot.li manifest] branding failed for ${withActiveTld(label)}: ${err instanceof Error ? err.message : String(err)}`,
+              );
+            },
+          );
+          performance.mark("dotli:main:end");
+          log.warn(
+            `[dot.li perf] === TOTAL (validated installed executable): ${dur(T0)} ===`,
+          );
+          emitDotliDebugEvent({
+            layer: "boot",
+            event: "ready",
+            flowId: bootFlowId,
+            timestamp: Date.now(),
+            payload: {
+              label,
+              totalMs: performance.now() - T0,
+              path: "fast",
+            },
+          });
+          return;
+        }
+        resolvedContenthash = outcome.contenthash;
+        log.warn(
+          `[dot.li installed-executable-cache] deployment changed ${cachedExecutable.contenthash} -> ${resolvedContenthash}; resolving the matching manifest`,
+        );
+      }
     }
     m.count(S.CACHE_MISS);
-    log.warn(`[dot.li perf] CID cache MISS (${elapsed(T0)})`);
+    log.warn(`[dot.li perf] installed-executable cache MISS (${elapsed(T0)})`);
+    const appManifestPromiseForRender = appManifest();
 
     // One event per cold resolve attempt, BEFORE anything that can fail.
     Sentry.captureMessage("dotli.resolve_attempt", {
@@ -1277,57 +1368,46 @@ async function main(): Promise<void> {
      * Try the app subname first, fall back to the base label when the
      * subname has no contenthash.
      */
-    let cid: string | null;
-    if (chainBackend !== "rpc-gateway") {
-      log.warn(
-        `[dot.li resolve] path=smoldot (trustless light-client) (${elapsed(T0)})`,
-      );
-      const { statusToPhase } = await import("@dotli/resolver/resolve");
-      const onResolveProgress = (msg: string): void => {
-        // Progress events arrive as opaque strings across the iframe
-        // boundary. The resolver package owns the authoritative
-        // mapping from status text to ResolvePhase, so we defer to it
-        // instead of maintaining a parallel regex here.
-        const phase = statusToPhase(msg);
-        if (phase === "relay-chain-adding") {
-          advancePhase(1);
-        } else if (
-          // `asset-hub-connecting` is ~0ms (just createClient), so it shares
-          // the Syncing band rather than getting a slice that makes the bar
-          // jump for no work.
-          phase === "asset-hub-connecting" ||
-          phase === "asset-hub-syncing" ||
-          phase === "asset-hub-ready"
-        ) {
-          advancePhase(2);
-        } else if (phase === "resolving-content") {
-          advancePhase(3);
-        }
-        emitPhase(msg, phase ?? "progress");
-        trackStatus(msg);
-      };
-      cid = await resolveDotNameRemote(`app.${label}`, onResolveProgress);
-      if (cid === null) {
-        cid = await resolveDotNameRemote(label, onResolveProgress);
+    let cid: string | null = resolvedContenthash ?? null;
+    if (resolvedContenthash === undefined) {
+      if (chainBackend !== "rpc-gateway") {
         log.warn(
-          `[dot.li resolve] fallback ${withActiveTld(label)} contenthash -> ${cid ?? "null"}`,
+          `[dot.li resolve] path=smoldot (trustless light-client) (${elapsed(T0)})`,
         );
-      }
-    } else {
-      log.warn(
-        `[dot.li resolve] path=json-rpc (gateway mode) (${elapsed(T0)})`,
-      );
-      const { resolveDotNameViaRpc } =
-        await import("@dotli/resolver/rpc-resolve");
-      const onResolveProgress = (msg: string): void => {
-        emitPhase(msg, "progress");
-        trackStatus(msg);
-      };
-      cid = await resolveDotNameViaRpc(`app.${label}`, onResolveProgress);
-      if (cid === null) {
-        cid = await resolveDotNameViaRpc(label, onResolveProgress);
+        const { statusToPhase } = await import("@dotli/resolver/resolve");
+        const onResolveProgress = (msg: string): void => {
+          const phase = statusToPhase(msg);
+          if (phase === "relay-chain-adding") {
+            advancePhase(1);
+          } else if (
+            phase === "asset-hub-connecting" ||
+            phase === "asset-hub-syncing" ||
+            phase === "asset-hub-ready"
+          ) {
+            advancePhase(2);
+          } else if (phase === "resolving-content") {
+            advancePhase(3);
+          }
+          emitPhase(msg, phase ?? "progress");
+          trackStatus(msg);
+        };
+        cid = await resolveAppContenthash(
+          label,
+          chainBackend,
+          onResolveProgress,
+        );
+      } else {
         log.warn(
-          `[dot.li resolve] fallback ${withActiveTld(label)} contenthash -> ${cid ?? "null"}`,
+          `[dot.li resolve] path=json-rpc (gateway mode) (${elapsed(T0)})`,
+        );
+        const onResolveProgress = (msg: string): void => {
+          emitPhase(msg, "progress");
+          trackStatus(msg);
+        };
+        cid = await resolveAppContenthash(
+          label,
+          chainBackend,
+          onResolveProgress,
         );
       }
     }
@@ -1360,23 +1440,38 @@ async function main(): Promise<void> {
       return;
     }
 
-    if (!cacheSettings.skipCidCache) {
+    const appManifestResult = await appManifestPromiseForRender;
+    const installedExecutable = installedExecutableFromManifest(
+      cid,
+      appManifestResult,
+    );
+    if (!cacheSettings.skipCidCache && installedExecutable !== null) {
       requestIdleCallback(() => {
-        void setCachedCid(label, cid);
+        void setCachedInstalledExecutable(
+          label,
+          network,
+          "app",
+          installedExecutable,
+        );
       });
     }
 
     setShieldState(shieldState);
-
     const { renderAppSubdomain } = await renderChunkPromise;
     advancePhase(contentFetchPhase);
-    await renderAppSubdomain(cid, label);
+    await renderAppSubdomain(
+      cid,
+      label,
+      executableManifestText(appManifestResult),
+    );
     void recordRecentLabel(label);
-    void applyProductBranding(label, chainBackend).catch((err: unknown) => {
-      log.warn(
-        `[dot.li manifest] branding failed for ${withActiveTld(label)}: ${err instanceof Error ? err.message : String(err)}`,
-      );
-    });
+    void applyProductBranding(label, chainBackend, appManifestResult).catch(
+      (err: unknown) => {
+        log.warn(
+          `[dot.li manifest] branding failed for ${withActiveTld(label)}: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      },
+    );
 
     m.distribution(S.E2E_SLOW, performance.now() - coldStartMs, "millisecond", {
       outcome: "ok",
diff --git a/apps/host/src/pwa.ts b/apps/host/src/pwa.ts
index 662f4c4c..a5168a67 100644
--- a/apps/host/src/pwa.ts
+++ b/apps/host/src/pwa.ts
@@ -21,31 +21,41 @@ const UPDATE_INTERVAL_MS = 15 * 60 * 1000;
 
 if ("serviceWorker" in navigator) {
   const wb = new Workbox("/host-sw.js");
+  let hostUpdateRequired = false;
+  let applyingUpdate = false;
+
+  const applyWaitingUpdate = (): void => {
+    if (applyingUpdate) {
+      return;
+    }
+    applyingUpdate = true;
+    wb.addEventListener("controlling", () => {
+      window.location.reload();
+    });
+    wb.messageSkipWaiting();
+  };
 
   wb.addEventListener("waiting", () => {
+    if (hostUpdateRequired) {
+      applyWaitingUpdate();
+      return;
+    }
     showNotification({
       label: "Update available",
       text: "A new version of dot.li is ready. Reload to apply.",
       dismissMs: 0,
       action: {
         label: "Reload",
-        onClick: () => {
-          // Reload once the new SW is in control to avoid serving a mix of
-          // old and new chunks during the swap.
-          wb.addEventListener("controlling", () => {
-            window.location.reload();
-          });
-          wb.messageSkipWaiting();
-        },
+        onClick: applyWaitingUpdate,
       },
     });
   });
 
-  void wb
+  const registrationPromise = wb
     .register()
     .then((registration) => {
       if (!registration) {
-        return;
+        return undefined;
       }
       setInterval(() => {
         if (navigator.onLine) {
@@ -57,8 +67,27 @@ if ("serviceWorker" in navigator) {
           void registration.update();
         }
       });
+      return registration;
     })
     .catch((err: unknown) => {
       log.warn(`[dot.li] SW registration failed: ${String(err)}`);
+      return undefined;
     });
+
+  // The sandbox emits this only when its schema is newer than the contract
+  // supplied by this host build. Consent is no longer relevant: the current
+  // host cannot run the app safely, so activate a waiting compatible build.
+  window.addEventListener("dotli:host-update-required", () => {
+    hostUpdateRequired = true;
+    void registrationPromise.then((registration) => {
+      if (!registration) {
+        return;
+      }
+      if (registration.waiting) {
+        applyWaitingUpdate();
+        return;
+      }
+      void registration.update();
+    });
+  });
 }
diff --git a/apps/host/tests/functional/fixtures/pvm/LICENSE-MIT b/apps/host/tests/functional/fixtures/pvm/LICENSE-MIT
new file mode 100644
index 00000000..78ef3776
--- /dev/null
+++ b/apps/host/tests/functional/fixtures/pvm/LICENSE-MIT
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 replghost
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/apps/host/tests/functional/fixtures/pvm/framebuffer-test.polkavm b/apps/host/tests/functional/fixtures/pvm/framebuffer-test.polkavm
new file mode 100644
index 00000000..39d4a064
Binary files /dev/null and b/apps/host/tests/functional/fixtures/pvm/framebuffer-test.polkavm differ
diff --git a/apps/host/tests/functional/fixtures/pvm/manifest.json b/apps/host/tests/functional/fixtures/pvm/manifest.json
new file mode 100644
index 00000000..e923b5f4
--- /dev/null
+++ b/apps/host/tests/functional/fixtures/pvm/manifest.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "epoca:experimental-product/v1",
+  "$v": 1,
+  "kind": "framebuffer",
+  "appVersion": [0, 1, 0],
+  "runtime": {
+    "kind": "polkavm",
+    "entrypoint": "app.polkavm"
+  },
+  "modalities": {
+    "framebuffer": {
+      "abiVersion": 1,
+      "controls": ["Pointer", "Keyboard"]
+    }
+  }
+}
diff --git a/apps/host/tests/functional/helpers/cache.ts b/apps/host/tests/functional/helpers/cache.ts
index 4dc5f12a..a6072917 100644
--- a/apps/host/tests/functional/helpers/cache.ts
+++ b/apps/host/tests/functional/helpers/cache.ts
@@ -16,21 +16,26 @@ export function hostResolveStarted(page: Page): Promise<boolean> {
   );
 }
 
+interface InstalledExecutableScope {
+  label: string;
+  network: string;
+}
+
 /**
- * Browser-side check for a cached CID entry under `label`.
- *
- * Defined as a standalone function so the two Playwright entry points
- * below (`hasCachedCid` via `page.evaluate`, `waitForCachedCid` via
- * `page.waitForFunction`) share one IDB query body instead of two
- * copies that can drift.
+ * Browser-side check for a cached app executable under a network-scoped label.
  */
-const cachedCidExists = (label: string): Promise<boolean> =>
-  new Promise<boolean>((resolve) => {
-    const open = indexedDB.open("dotli", 1);
+const cachedInstalledExecutableExists = ({
+  label,
+  network,
+}: InstalledExecutableScope): Promise<boolean> => {
+  return new Promise<boolean>((resolve) => {
+    const open = indexedDB.open("dotli-installed-executables", 1);
     open.onsuccess = () => {
       try {
-        const tx = open.result.transaction("cids", "readonly");
-        const req = tx.objectStore("cids").get(label);
+        const tx = open.result.transaction("installed_executables", "readonly");
+        const req = tx
+          .objectStore("installed_executables")
+          .get([network, "app", label]);
         req.onsuccess = () => {
           resolve(req.result !== undefined);
         };
@@ -45,28 +50,32 @@ const cachedCidExists = (label: string): Promise<boolean> =>
       resolve(false);
     };
   });
+};
 
-/** Snapshot whether the host has a cached CID for `label`. */
-export function hasCachedCid(page: Page, label: string): Promise<boolean> {
-  return page.evaluate(cachedCidExists, label);
+/** Snapshot whether the host has a cached installed app executable. */
+export function hasCachedInstalledExecutable(
+  page: Page,
+  label: string,
+  network = "paseo-next-v2",
+): Promise<boolean> {
+  return page.evaluate(cachedInstalledExecutableExists, { label, network });
 }
 
-/**
- * Wait until the host has a cached CID for `label`.
- *
- * `setCachedCid` runs inside `requestIdleCallback` after
- * `dotli:app:end`, so a warm reload kicked off too quickly could
- * otherwise race the write.
- */
-export async function waitForCachedCid(
+/** Wait until the host commits the complete installed executable record. */
+export async function waitForCachedInstalledExecutable(
   page: Page,
   label: string,
   timeoutMs: number,
+  network = "paseo-next-v2",
 ): Promise<void> {
-  await page.waitForFunction(cachedCidExists, label, {
-    timeout: timeoutMs,
-    polling: 200,
-  });
+  await page.waitForFunction(
+    cachedInstalledExecutableExists,
+    { label, network },
+    {
+      timeout: timeoutMs,
+      polling: 200,
+    },
+  );
 }
 
 /**
diff --git a/apps/host/tests/functional/host-settings.spec.ts b/apps/host/tests/functional/host-settings.spec.ts
index ea7c9d19..1d89bafc 100644
--- a/apps/host/tests/functional/host-settings.spec.ts
+++ b/apps/host/tests/functional/host-settings.spec.ts
@@ -25,11 +25,11 @@ import { DOMAIN, PORT, TIMEOUT_MS } from "../env";
 import { setupTest } from "./helpers/context";
 import { waitForResolutionOutcome } from "../product-frame";
 import {
-  hasCachedCid,
+  hasCachedInstalledExecutable,
   hostResolveStarted,
   sandboxArchiveCacheLookups,
   trackArchiveCacheLookups,
-  waitForCachedCid,
+  waitForCachedInstalledExecutable,
 } from "./helpers/cache";
 import {
   BACKENDS,
@@ -238,7 +238,7 @@ test.describe("Settings works", () => {
   });
 
   for (const backend of BACKENDS) {
-    test(`As a user on ${backend} with the dotNS cache on, revisiting a site skips looking its name up again`, async ({
+    test(`As a user on ${backend} with the dotNS cache on, revisiting validates my installed executable before reuse`, async ({
       browser,
     }) => {
       // Given
@@ -249,13 +249,14 @@ test.describe("Settings works", () => {
       await page.goto(BASE_URL, { waitUntil: "commit" });
       await waitForResolutionOutcome(page, TIMEOUT_MS, backend);
       expect(await hostResolveStarted(page)).toBe(true);
-      await waitForCachedCid(page, DOMAIN, 5_000);
+      await waitForCachedInstalledExecutable(page, DOMAIN, 5_000);
 
       try {
         // When
         await page.reload({ waitUntil: "commit" });
 
-        // Then
+        // Then the installed-executable path reuses the paired manifest after
+        // re-reading contenthash, without entering the full cold resolver.
         await waitForResolutionOutcome(page, TIMEOUT_MS, backend);
         expect(await hostResolveStarted(page)).toBe(false);
       } finally {
@@ -273,7 +274,7 @@ test.describe("Settings works", () => {
       });
       await page.goto(BASE_URL, { waitUntil: "commit" });
       await waitForResolutionOutcome(page, TIMEOUT_MS, backend);
-      await waitForCachedCid(page, DOMAIN, 5_000);
+      await waitForCachedInstalledExecutable(page, DOMAIN, 5_000);
 
       try {
         // When
@@ -283,13 +284,112 @@ test.describe("Settings works", () => {
         // Then
         await waitForResolutionOutcome(page, TIMEOUT_MS, backend);
         expect(await hostResolveStarted(page)).toBe(true);
-        expect(await hasCachedCid(page, DOMAIN)).toBe(true);
+        expect(await hasCachedInstalledExecutable(page, DOMAIN)).toBe(true);
       } finally {
         await context.close();
       }
     });
   }
 
+  test("As a warm user, a changed contenthash never reuses the old manifest", async ({
+    browser,
+  }) => {
+    const { context, page } = await setupTest(browser, {
+      backend: "rpc-gateway",
+      cacheSeed: CACHE_ENABLED,
+    });
+    await page.goto(BASE_URL, { waitUntil: "commit" });
+    await waitForResolutionOutcome(page, TIMEOUT_MS, "rpc-gateway");
+    await waitForCachedInstalledExecutable(page, DOMAIN, 5_000);
+    const frame = page.locator(`iframe[src*="${DOMAIN}.app.localhost"]`);
+    const firstSrc = await frame.getAttribute("src");
+    const currentContenthash =
+      firstSrc === null ? null : new URL(firstSrc).searchParams.get("cid");
+    expect(currentContenthash).not.toBeNull();
+    const staleManifest = '{"$v":1,"kind":"app","appVersion":[99,0,0]}';
+
+    try {
+      await page.evaluate(
+        async ({ label, executableManifest }) => {
+          const db = await new Promise<IDBDatabase>((resolve, reject) => {
+            const open = indexedDB.open("dotli-installed-executables", 1);
+            open.onsuccess = () => {
+              resolve(open.result);
+            };
+            open.onerror = () => {
+              reject(open.error ?? new Error("DB open failed"));
+            };
+          });
+          const tx = db.transaction("installed_executables", "readwrite");
+          const completed = new Promise<void>((resolve, reject) => {
+            tx.oncomplete = () => {
+              resolve();
+            };
+            tx.onerror = () => {
+              reject(tx.error ?? new Error("cache seed failed"));
+            };
+          });
+          tx.objectStore("installed_executables").put({
+            network: "paseo-next-v2",
+            modality: "app",
+            label,
+            contenthash: "bafy-stale",
+            executableManifest,
+            timestamp: Date.now(),
+          });
+          await completed;
+        },
+        { label: DOMAIN, executableManifest: staleManifest },
+      );
+
+      await page.reload({ waitUntil: "commit" });
+      await waitForResolutionOutcome(page, TIMEOUT_MS, "rpc-gateway");
+      await waitForCachedInstalledExecutable(page, DOMAIN, 5_000);
+
+      const refreshedSrc = await frame.getAttribute("src");
+      expect(
+        refreshedSrc === null
+          ? null
+          : new URL(refreshedSrc).searchParams.get("cid"),
+      ).toBe(currentContenthash);
+      const cached = await page.evaluate(async (label) => {
+        const db = await new Promise<IDBDatabase>((resolve, reject) => {
+          const open = indexedDB.open("dotli-installed-executables", 1);
+          open.onsuccess = () => {
+            resolve(open.result);
+          };
+          open.onerror = () => {
+            reject(open.error ?? new Error("DB open failed"));
+          };
+        });
+        return await new Promise<{
+          contenthash: string;
+          executableManifest: string;
+        }>((resolve, reject) => {
+          const tx = db.transaction("installed_executables", "readonly");
+          const request = tx
+            .objectStore("installed_executables")
+            .get(["paseo-next-v2", "app", label]);
+          request.onsuccess = () => {
+            resolve(
+              request.result as {
+                contenthash: string;
+                executableManifest: string;
+              },
+            );
+          };
+          request.onerror = () => {
+            reject(request.error ?? new Error("cache read failed"));
+          };
+        });
+      }, DOMAIN);
+      expect(cached.contenthash).toBe(currentContenthash);
+      expect(cached.executableManifest).not.toBe(staleManifest);
+    } finally {
+      await context.close();
+    }
+  });
+
   for (const backend of BACKENDS) {
     test(`As a user on ${backend} with the archive cache on, revisiting a site checks my local copy first`, async ({
       browser,
diff --git a/apps/host/tests/functional/navigation.spec.ts b/apps/host/tests/functional/navigation.spec.ts
index a27151b6..bed9e875 100644
--- a/apps/host/tests/functional/navigation.spec.ts
+++ b/apps/host/tests/functional/navigation.spec.ts
@@ -163,12 +163,12 @@ test.describe("Sandbox URL hygiene: host contract keys never reach the product",
   }) => {
     // Given
     await seedBackend(page);
-    // First visit warms the IndexedDB CID cache.
+    // First visit installs the network-scoped v1 executable record.
     await page.goto(`${HOST_BY_LABEL}/?a=b`);
     await getProductFrame(page, TIMEOUT_MS);
 
     // When
-    // Second visit takes the cache-hit code path in apps/host/src/main.ts.
+    // Second visit validates and reuses the installed-executable pair.
     await page.goto(`${HOST_BY_LABEL}/?a=b`);
 
     // Then
diff --git a/apps/host/tests/functional/pvm.spec.ts b/apps/host/tests/functional/pvm.spec.ts
new file mode 100644
index 00000000..40f245ed
--- /dev/null
+++ b/apps/host/tests/functional/pvm.spec.ts
@@ -0,0 +1,339 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { expect, test, type Page } from "@playwright/test";
+import { CarReader, CarWriter } from "@ipld/car";
+import * as dagPb from "@ipld/dag-pb";
+import type { PBLink } from "@ipld/dag-pb";
+import { UnixFS } from "ipfs-unixfs";
+import { CID } from "multiformats/cid";
+import * as raw from "multiformats/codecs/raw";
+import { sha256 } from "multiformats/hashes/sha2";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { SANDBOX_SCHEMA_VERSION } from "@dotli/config/host-sandbox-contract";
+
+interface TestCar {
+  cid: string;
+  bytes: Uint8Array;
+}
+
+async function pvmCar(): Promise<TestCar> {
+  const fixture = join(import.meta.dirname, "fixtures/pvm");
+  const files = await Promise.all(
+    [
+      ["manifest.json", join(fixture, "manifest.json")],
+      ["app.polkavm", join(fixture, "framebuffer-test.polkavm")],
+    ].map(async ([name, path]) => {
+      const bytes = new Uint8Array(await readFile(path));
+      const cid = CID.createV1(raw.code, await sha256.digest(bytes));
+      return { name, bytes, cid };
+    }),
+  );
+  const runtimeOverride = new TextEncoder().encode("package-owned runtime");
+  files.push({
+    name: "pvm-runtime/pvm-browser-runtime.wasm",
+    bytes: runtimeOverride,
+    cid: CID.createV1(raw.code, await sha256.digest(runtimeOverride)),
+  });
+  const links: PBLink[] = files
+    .map(({ name, bytes, cid }) => ({
+      Name: name,
+      Tsize: bytes.length,
+      Hash: cid,
+    }))
+    .sort((left, right) => (left.Name ?? "").localeCompare(right.Name ?? ""));
+  const rootBytes = dagPb.encode({
+    Data: new UnixFS({ type: "directory" }).marshal(),
+    Links: links,
+  });
+  const root = CID.createV1(dagPb.code, await sha256.digest(rootBytes));
+  const { writer, out } = CarWriter.create([root]);
+  const chunksPromise = (async (): Promise<Uint8Array[]> => {
+    const chunks: Uint8Array[] = [];
+    for await (const chunk of out) chunks.push(chunk);
+    return chunks;
+  })();
+  for (const { cid, bytes } of files) await writer.put({ cid, bytes });
+  await writer.put({ cid: root, bytes: rootBytes });
+  await writer.close();
+  const chunks = await chunksPromise;
+  const length = chunks.reduce((total, chunk) => total + chunk.length, 0);
+  const car = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    car.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return { cid: root.toString(), bytes: car };
+}
+
+async function installTruapiPortResponder(page: Page): Promise<void> {
+  await page.addInitScript(() => {
+    const channel = new MessageChannel();
+    const scope = window as typeof window & {
+      __HOST_API_PORT__?: MessagePort;
+    };
+    channel.port2.onmessage = (event) => {
+      if (!(event.data instanceof Uint8Array)) {
+        return;
+      }
+      const request = event.data;
+      const first = request[0];
+      if (first === undefined || (first & 3) !== 0) {
+        return;
+      }
+      const kindOffset = 1 + (first >> 2);
+      if (
+        request.length !== kindOffset + 3 ||
+        request[kindOffset] !== 0 ||
+        request[kindOffset + 1] !== 0 ||
+        request[kindOffset + 2] !== 1
+      ) {
+        return;
+      }
+      const response = new Uint8Array(kindOffset + 3);
+      response.set(request.subarray(0, kindOffset));
+      response[kindOffset] = 1;
+      response[kindOffset + 1] = 0;
+      response[kindOffset + 2] = 0;
+      channel.port2.postMessage(response, [response.buffer]);
+    };
+    channel.port2.start();
+    scope.__HOST_API_PORT__ = channel.port1;
+  });
+}
+
+test("a verified PolkaVM package translates and renders in the sandbox", async ({
+  page,
+}) => {
+  const fixture = await pvmCar();
+  await page.route(`**/ipfs/${fixture.cid}?format=car`, async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: "application/vnd.ipld.car",
+      body: Buffer.from(fixture.bytes),
+    });
+  });
+  await page.goto("http://localhost:5173/", { waitUntil: "domcontentloaded" });
+  await installTruapiPortResponder(page);
+  await page.evaluate(
+    ({ cid, schemaVersion }) => {
+      const iframe = document.createElement("iframe");
+      iframe.id = "pvm-product";
+      iframe.src = `http://pvm-fixture.app.localhost:5173/?cid=${cid}&v=${String(schemaVersion)}&chainBackend=rpc-gateway&network=paseo-next-v2&fullReset=1`;
+      document.body.replaceChildren(iframe);
+    },
+    { cid: fixture.cid, schemaVersion: SANDBOX_SCHEMA_VERSION },
+  );
+
+  const product = page.frameLocator("#pvm-product");
+  const canvas = product.locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 30_000,
+  });
+  await expect(canvas).toHaveAttribute("data-pvm-backend", "compiler");
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")))
+    .toBeGreaterThan(2);
+  await expect(canvas).toHaveAttribute("width", "320");
+  await expect(canvas).toHaveAttribute("height", "200");
+
+  // The host-owned PVM canvas retains its verified launch contract so a
+  // browser/frame reload restarts the same CID without relying on parent state.
+  const productFrame = page
+    .frames()
+    .find((frame) => frame.url().includes("pvm-fixture.app.localhost"));
+  if (productFrame === undefined) {
+    throw new Error("PVM product frame did not mount");
+  }
+  expect(new URL(productFrame.url()).searchParams.get("cid")).toBe(fixture.cid);
+  expect(new URL(productFrame.url()).searchParams.has("fullReset")).toBe(false);
+  await Promise.all([
+    productFrame.waitForNavigation({ waitUntil: "domcontentloaded" }),
+    productFrame.evaluate(() => {
+      window.location.reload();
+    }),
+  ]);
+  await expect(canvas).toHaveAttribute("data-pvm-cache-hit", "true", {
+    timeout: 30_000,
+  });
+  await expect(canvas).toHaveAttribute("data-pvm-translation-ms", "0");
+});
+
+test("a PolkaVM package can bypass translation and use the interpreter", async ({
+  page,
+}) => {
+  const fixture = await pvmCar();
+  await page.route(`**/ipfs/${fixture.cid}?format=car`, async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: "application/vnd.ipld.car",
+      body: Buffer.from(fixture.bytes),
+    });
+  });
+  await page.goto("http://localhost:5173/", { waitUntil: "domcontentloaded" });
+  await installTruapiPortResponder(page);
+  await page.evaluate(
+    ({ cid, schemaVersion }) => {
+      const iframe = document.createElement("iframe");
+      iframe.id = "pvm-interpreter-product";
+      iframe.src = `http://pvm-fixture.app.localhost:5173/?cid=${cid}&v=${String(schemaVersion)}&chainBackend=rpc-gateway&network=paseo-next-v2&pvmMode=interpreter`;
+      document.body.replaceChildren(iframe);
+    },
+    { cid: fixture.cid, schemaVersion: SANDBOX_SCHEMA_VERSION },
+  );
+
+  const canvas = page
+    .frameLocator("#pvm-interpreter-product")
+    .locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 30_000,
+  });
+  await expect(canvas).toHaveAttribute("data-pvm-backend", "interpreter");
+  await expect(canvas).toHaveAttribute("data-pvm-translation-ms", "0");
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")))
+    .toBeGreaterThan(2);
+  await expect(canvas).toHaveAttribute("data-pvm-startup-stage", "first-frame");
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-updates")))
+    .toBeGreaterThan(0);
+});
+
+const doomV2CarPath = process.env.DOTLI_DOOM_V2_CAR;
+const doomV2ManifestPath = process.env.DOTLI_DOOM_V2_MANIFEST;
+const expectedV2Backend = process.env.DOTLI_PVM_EXPECTED_BACKEND ?? "compiler";
+const expectedV2Profile = process.env.DOTLI_PVM_EXPECTED_PROFILE;
+const expectedTruapi = process.env.DOTLI_PVM_EXPECTED_TRUAPI === "1";
+const expectedResize = process.env.DOTLI_PVM_EXPECTED_RESIZE === "1";
+const expectedInputKeys = (process.env.DOTLI_PVM_INPUT_KEYS ?? "ArrowUp,Space")
+  .split(",")
+  .filter(Boolean);
+
+test("the canonical Doom App v2 artifact renders with exact manifest bytes", async ({
+  page,
+}) => {
+  test.skip(
+    doomV2CarPath === undefined || doomV2ManifestPath === undefined,
+    "DOTLI_DOOM_V2_CAR and DOTLI_DOOM_V2_MANIFEST are required",
+  );
+  const carBytes = new Uint8Array(await readFile(doomV2CarPath as string));
+  const manifest = await readFile(doomV2ManifestPath as string, "utf8");
+  const reader = await CarReader.fromBytes(carBytes);
+  const [root] = await reader.getRoots();
+  if (root === undefined) throw new Error("Doom v2 CAR has no root");
+  const cid = root.toString();
+  await page.route(`**/ipfs/${cid}?format=car`, async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: "application/vnd.ipld.car",
+      body: Buffer.from(carBytes),
+    });
+  });
+  await page.goto("http://localhost:5173/", {
+    waitUntil: "domcontentloaded",
+  });
+  await installTruapiPortResponder(page);
+  await page.evaluate(
+    ({ artifactCid, executableManifest, schemaVersion }) => {
+      const url = new URL(
+        `http://doom-v2.app.localhost:5173/?cid=${artifactCid}&v=${String(schemaVersion)}&chainBackend=rpc-gateway&network=paseo-next-v2`,
+      );
+      url.searchParams.set("executableManifest", executableManifest);
+      const iframe = document.createElement("iframe");
+      iframe.id = "doom-v2-product";
+      iframe.src = url.toString();
+      document.body.replaceChildren(iframe);
+    },
+    {
+      artifactCid: cid,
+      executableManifest: manifest,
+      schemaVersion: SANDBOX_SCHEMA_VERSION,
+    },
+  );
+
+  const canvas = page
+    .frameLocator("#doom-v2-product")
+    .locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 60_000,
+  });
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")), {
+      timeout: 60_000,
+    })
+    .toBeGreaterThan(2);
+  await expect(canvas).toHaveAttribute("data-pvm-backend", expectedV2Backend);
+  if (expectedV2Profile !== undefined) {
+    await expect(canvas).toHaveAttribute("data-pvm-profile", expectedV2Profile);
+  }
+  if (expectedV2Profile === "tri2d") {
+    await expect
+      .poll(async () =>
+        Number(await canvas.getAttribute("data-pvm-tri2d-draws")),
+      )
+      .toBeGreaterThan(0);
+  } else if (expectedV2Profile === "webgpu-raster") {
+    await expect(canvas).toHaveAttribute("data-pvm-gpu", "ready");
+  }
+  if (expectedTruapi) {
+    await expect
+      .poll(async () =>
+        Number(await canvas.getAttribute("data-pvm-truapi-requests")),
+      )
+      .toBeGreaterThan(0);
+    await expect
+      .poll(async () =>
+        Number(await canvas.getAttribute("data-pvm-truapi-responses")),
+      )
+      .toBeGreaterThan(0);
+  }
+  if (expectedResize) {
+    const framesBeforeResize = Number(
+      await canvas.getAttribute("data-pvm-frames"),
+    );
+    await page.locator("#doom-v2-product").evaluate((iframe) => {
+      iframe.style.width = "100vw";
+      iframe.style.height = "100vh";
+    });
+    await page.setViewportSize({ width: 960, height: 640 });
+    await expect
+      .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")))
+      .toBeGreaterThan(framesBeforeResize);
+    await expect(canvas).toHaveAttribute("data-pvm-ready", "true");
+    if (expectedV2Profile === "webgpu-raster") {
+      await expect(canvas).toHaveAttribute("data-pvm-gpu", "ready");
+    }
+  }
+  const framesBeforeInput = Number(
+    await canvas.getAttribute("data-pvm-frames"),
+  );
+  await canvas.click({ position: { x: 160, y: 100 } });
+  if (expectedV2Profile === "webgpu-raster") {
+    const productFrame = page
+      .frames()
+      .find((frame) => frame.url().includes("doom-v2.app.localhost"));
+    if (productFrame === undefined) {
+      throw new Error("WebGPU product frame did not mount");
+    }
+    await expect
+      .poll(async () =>
+        productFrame.evaluate(() => document.pointerLockElement?.id ?? null),
+      )
+      .toBe("dotli-pvm-canvas");
+    await page.keyboard.press("Escape");
+    await expect
+      .poll(async () =>
+        productFrame.evaluate(() => document.pointerLockElement?.id ?? null),
+      )
+      .toBeNull();
+    await canvas.click({ position: { x: 160, y: 100 } });
+  }
+  for (const key of expectedInputKeys) {
+    await page.keyboard.press(key);
+  }
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")))
+    .toBeGreaterThan(framesBeforeInput);
+});
diff --git a/apps/host/tests/performance/cold-start.spec.ts b/apps/host/tests/performance/cold-start.spec.ts
index ee86119e..23eb229d 100644
--- a/apps/host/tests/performance/cold-start.spec.ts
+++ b/apps/host/tests/performance/cold-start.spec.ts
@@ -619,7 +619,7 @@ async function runWarmIterations(
  *
  * "Lukewarm" means a different .dot site in the same browser session. The
  * browser has already compiled WASM, cached JS chunks (HTTP cache), and
- * warmed up network stacks, but DOMAIN_B has no CID cache, no SW archive,
+ * warmed up network stacks, but DOMAIN_B has no installed-executable record, no SW archive,
  * and a separate SW/IDB origin. This measures the benefit of infrastructure
  * reuse across different .dot sites.
  */
diff --git a/apps/host/tests/performance/playwright.config.ts b/apps/host/tests/performance/playwright.config.ts
index af95923a..7f05bcfd 100644
--- a/apps/host/tests/performance/playwright.config.ts
+++ b/apps/host/tests/performance/playwright.config.ts
@@ -4,6 +4,8 @@
 import { defineConfig } from "@playwright/test";
 import { baseConfig } from "../playwright.base.config";
 
+const PORT = process.env.PERF_PORT ?? "5173";
+
 export default defineConfig({
   ...baseConfig,
   testDir: ".",
@@ -11,7 +13,13 @@ export default defineConfig({
   retries: 0,
   use: {
     ...baseConfig.use,
-    baseURL: "http://browse.localhost:5173",
+    baseURL: `http://browse.localhost:${PORT}`,
+  },
+  webServer: {
+    command: `PORT=${PORT} bun ../../../../scripts/preview-server.ts`,
+    url: `http://localhost:${PORT}`,
+    reuseExistingServer: false,
+    timeout: 30_000,
   },
   reporter: [["list"]],
 });
diff --git a/apps/host/tests/performance/pvm-doom.spec.ts b/apps/host/tests/performance/pvm-doom.spec.ts
new file mode 100644
index 00000000..8eb4a9b8
--- /dev/null
+++ b/apps/host/tests/performance/pvm-doom.spec.ts
@@ -0,0 +1,199 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { expect, test } from "@playwright/test";
+import type { Locator, Page } from "@playwright/test";
+import { seedBackend } from "../functional/fixtures/settings";
+import type { Backend } from "../functional/fixtures/settings";
+
+const PORT = process.env.PERF_PORT ?? "5173";
+const DOOM_URL = `http://doom.localhost:${PORT}/`;
+const QUAKE_URL = `http://quake.localhost:${PORT}/`;
+const DUKE_URL = `http://duke.localhost:${PORT}/`;
+
+interface DoomMetrics {
+  backend: string | null;
+  cacheHit: boolean;
+  translationMs: number;
+  compilationMs: number;
+  startupMs: number;
+  firstFrameMs: number;
+  frames: number;
+  fps: number;
+  updates: number;
+  updateP50Ms: number;
+  updateP95Ms: number;
+  updateMaxMs: number;
+  audioChunks: number;
+  audioSamples: number;
+}
+
+async function readMetrics(canvas: Locator): Promise<DoomMetrics> {
+  const number = async (name: string): Promise<number> =>
+    Number((await canvas.getAttribute(name)) ?? 0);
+  return {
+    backend: await canvas.getAttribute("data-pvm-backend"),
+    cacheHit: (await canvas.getAttribute("data-pvm-cache-hit")) === "true",
+    translationMs: await number("data-pvm-translation-ms"),
+    compilationMs: await number("data-pvm-compilation-ms"),
+    startupMs: await number("data-pvm-startup-ms"),
+    firstFrameMs: await number("data-pvm-first-frame-ms"),
+    frames: await number("data-pvm-frames"),
+    fps: await number("data-pvm-fps"),
+    updates: await number("data-pvm-updates"),
+    updateP50Ms: await number("data-pvm-update-p50-ms"),
+    updateP95Ms: await number("data-pvm-update-p95-ms"),
+    updateMaxMs: await number("data-pvm-update-max-ms"),
+    audioChunks: await number("data-pvm-audio-chunks"),
+    audioSamples: await number("data-pvm-audio-samples"),
+  };
+}
+
+async function launchDoom(
+  page: Page,
+  backend: Backend = "rpc-gateway",
+): Promise<void> {
+  await seedBackend(page, backend);
+  await page.goto(DOOM_URL, { waitUntil: "domcontentloaded" });
+}
+
+test("doom.paseo receives its required App v2 manifest over smoldot", async ({
+  page,
+}) => {
+  test.setTimeout(180_000);
+  await launchDoom(page, "smoldot-direct");
+
+  const productFrame = page.locator('iframe[src*="doom.app.localhost"]');
+  await expect(productFrame).toHaveAttribute("src", /[?&]executableManifest=/, {
+    timeout: 120_000,
+  });
+
+  const canvas = page
+    .frameLocator('iframe[src*="doom.app.localhost"]')
+    .locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 60_000,
+  });
+});
+
+test("quake.paseo advances frames through the translated runtime", async ({
+  page,
+}) => {
+  test.setTimeout(180_000);
+  await seedBackend(page, "smoldot-direct");
+  await page.goto(QUAKE_URL, { waitUntil: "domcontentloaded" });
+
+  const canvas = page
+    .frameLocator('iframe[src*="quake.app.localhost"]')
+    .locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 120_000,
+  });
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")), {
+      timeout: 30_000,
+    })
+    .toBeGreaterThan(120);
+  expect(await canvas.getAttribute("data-pvm-backend")).toBe("compiler");
+});
+
+test("duke.paseo continues across bounded translated hostcall slices", async ({
+  page,
+}) => {
+  test.setTimeout(180_000);
+  await seedBackend(page, "smoldot-direct");
+  await page.goto(DUKE_URL, { waitUntil: "domcontentloaded" });
+
+  const product = page.frameLocator('iframe[src*="duke.app.localhost"]');
+  const canvas = product.locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 120_000,
+  });
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-updates")), {
+      timeout: 30_000,
+    })
+    .toBeGreaterThan(120);
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-frames")), {
+      timeout: 30_000,
+    })
+    .toBeGreaterThan(120);
+  await expect(product.locator("body")).not.toContainText(
+    "exceeded hostcall budget",
+  );
+  expect(await canvas.getAttribute("data-pvm-backend")).toBe("compiler");
+  await canvas.click();
+  await page.waitForTimeout(8_000);
+  const audioBefore = Number(
+    await canvas.getAttribute("data-pvm-audio-samples"),
+  );
+  await page.waitForTimeout(8_000);
+  const audioAfter = Number(
+    await canvas.getAttribute("data-pvm-audio-samples"),
+  );
+  expect(audioAfter - audioBefore).toBeGreaterThan(300_000);
+  await expect(canvas).toHaveAttribute("data-pvm-audio-nonzero", "true");
+});
+
+test("doom.paseo is playable through the real-time PVM to Wasm translator", async ({
+  page,
+}, testInfo) => {
+  test.setTimeout(120_000);
+  await launchDoom(page);
+  const productFrame = page.locator('iframe[src*="doom.app.localhost"]');
+  await expect(productFrame).toBeAttached({ timeout: 60_000 });
+  const product = page.frameLocator('iframe[src*="doom.app.localhost"]');
+  const canvas = product.locator("#dotli-pvm-canvas");
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 60_000,
+  });
+  await canvas.click();
+  await page.keyboard.down("w");
+  await page.waitForTimeout(750);
+  await page.keyboard.up("w");
+  await page.keyboard.press("Space");
+  await expect
+    .poll(async () => Number(await canvas.getAttribute("data-pvm-updates")), {
+      timeout: 20_000,
+    })
+    .toBeGreaterThanOrEqual(300);
+
+  const cold = await readMetrics(canvas);
+  expect(cold.backend).toBe("compiler");
+  expect(cold.fps).toBeGreaterThanOrEqual(35);
+  expect(cold.updateP95Ms).toBeLessThan(28.6);
+  expect(cold.firstFrameMs).toBeLessThan(3_000);
+  expect(cold.audioChunks).toBeGreaterThan(0);
+  expect(cold.audioSamples).toBeGreaterThan(0);
+  await testInfo.attach("doom-pvm-cold-metrics.json", {
+    body: Buffer.from(JSON.stringify(cold, null, 2)),
+    contentType: "application/json",
+  });
+  await testInfo.attach("doom-pvm.png", {
+    body: await productFrame.screenshot(),
+    contentType: "image/png",
+  });
+
+  const sandboxUrl = await productFrame.getAttribute("src");
+  expect(sandboxUrl).not.toBeNull();
+  await productFrame.evaluate((iframe, url) => {
+    if (iframe instanceof HTMLIFrameElement && url !== null) {
+      iframe.src = url;
+    }
+  }, sandboxUrl);
+  await expect(canvas).toHaveAttribute("data-pvm-ready", "true", {
+    timeout: 60_000,
+  });
+  await expect(canvas).toHaveAttribute("data-pvm-cache-hit", "true", {
+    timeout: 60_000,
+  });
+  const warm = await readMetrics(canvas);
+  expect(warm.backend).toBe("compiler");
+  expect(warm.translationMs).toBe(0);
+  expect(warm.firstFrameMs).toBeLessThan(1_000);
+  await testInfo.attach("doom-pvm-warm-metrics.json", {
+    body: Buffer.from(JSON.stringify(warm, null, 2)),
+    contentType: "application/json",
+  });
+});
diff --git a/apps/host/tests/playwright.base.config.ts b/apps/host/tests/playwright.base.config.ts
index 68ab46ee..8a30c6f3 100644
--- a/apps/host/tests/playwright.base.config.ts
+++ b/apps/host/tests/playwright.base.config.ts
@@ -21,6 +21,15 @@ export const baseConfig: PlaywrightTestConfig = {
     bypassCSP: true,
     launchOptions: {
       slowMo: process.env.SLOWMO ? Number(process.env.SLOWMO) : 0,
+      args:
+        process.env.DOTLI_WEBGPU === "1"
+          ? [
+              "--enable-unsafe-webgpu",
+              "--enable-features=Vulkan",
+              "--use-angle=swiftshader",
+              "--use-vulkan=swiftshader",
+            ]
+          : [],
     },
   },
   webServer: {
diff --git a/apps/sandbox/package.json b/apps/sandbox/package.json
index 366b16b0..a8495431 100644
--- a/apps/sandbox/package.json
+++ b/apps/sandbox/package.json
@@ -8,6 +8,7 @@
     "build": "tsc && bunx --bun vite build",
     "build:prod": "tsc && bunx --bun vite build && bun ../../scripts/compress-dist.ts",
     "lint": "bunx eslint src/",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
@@ -18,7 +19,8 @@
     "prettier": "^3.8.3",
     "typescript": "~6.0.3",
     "vite": "^8.0.16",
-    "vite-plugin-wasm": "^3.5.0"
+    "vite-plugin-wasm": "^3.5.0",
+    "vitest": "^4.1.8"
   },
   "dependencies": {
     "@dotli/config": "workspace:*",
diff --git a/apps/sandbox/public/pvm-runtime/LICENSE-MPL-2.0 b/apps/sandbox/public/pvm-runtime/LICENSE-MPL-2.0
new file mode 100644
index 00000000..f4bbcd20
--- /dev/null
+++ b/apps/sandbox/public/pvm-runtime/LICENSE-MPL-2.0
@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in 
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.
\ No newline at end of file
diff --git a/apps/sandbox/public/pvm-runtime/PolkaVM-LICENSE-APACHE b/apps/sandbox/public/pvm-runtime/PolkaVM-LICENSE-APACHE
new file mode 100644
index 00000000..16fe87b0
--- /dev/null
+++ b/apps/sandbox/public/pvm-runtime/PolkaVM-LICENSE-APACHE
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright [yyyy] [name of copyright owner]
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/apps/sandbox/public/pvm-runtime/PolkaVM-LICENSE-MIT b/apps/sandbox/public/pvm-runtime/PolkaVM-LICENSE-MIT
new file mode 100644
index 00000000..31aa7938
--- /dev/null
+++ b/apps/sandbox/public/pvm-runtime/PolkaVM-LICENSE-MIT
@@ -0,0 +1,23 @@
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
diff --git a/apps/sandbox/public/pvm-runtime/SOURCE b/apps/sandbox/public/pvm-runtime/SOURCE
new file mode 100644
index 00000000..174fe97d
--- /dev/null
+++ b/apps/sandbox/public/pvm-runtime/SOURCE
@@ -0,0 +1,11 @@
+PolkaVM App v2 browser runtime
+Bridge repository: https://github.com/paritytech/host-rust-core.git
+Bridge commit: b8def25b8130d2c9579e8d507981df015cc67485
+Runtime repository: https://github.com/paritytech/pvm-host-runtime
+Runtime commit: cdc8811b7ab6ca0046aa6132b9ad5f553f2aea06
+Release: v0.1.6
+
+Bridge-owned artifacts:
+- pvm-browser-runtime.wasm
+- pvm-wasm-worker.js
+- pvm-gpu-worker.js
diff --git a/apps/sandbox/public/pvm-runtime/pvm-browser-runtime.wasm b/apps/sandbox/public/pvm-runtime/pvm-browser-runtime.wasm
new file mode 100644
index 00000000..97c63f64
Binary files /dev/null and b/apps/sandbox/public/pvm-runtime/pvm-browser-runtime.wasm differ
diff --git a/apps/sandbox/public/pvm-runtime/pvm-gpu-worker.js b/apps/sandbox/public/pvm-runtime/pvm-gpu-worker.js
new file mode 100644
index 00000000..37580745
--- /dev/null
+++ b/apps/sandbox/public/pvm-runtime/pvm-gpu-worker.js
@@ -0,0 +1,1884 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* global GPUBufferUsage, GPUMapMode, GPUTextureUsage */
+
+"use strict";
+
+const WIRE_VERSION = 1;
+const BATCH_HEADER_BYTES = 24;
+const COMMAND_HEADER_BYTES = 8;
+const EVENT_HEADER_BYTES = 24;
+const MAX_BATCH_BYTES = 4 * 1024 * 1024;
+const MAX_COMMANDS = 16_384;
+const MAX_DIAGNOSTIC_BYTES = 8 * 1024;
+const HANDLE_SLOT_MASK = (1 << 20) - 1;
+const HANDLE_LIVE_BIT = 1 << 12;
+const MAX_COMPILATIONS_PER_BATCH = 8;
+const MAX_PENDING_BATCHES = 4;
+const BATCH_ERROR_STALE_SURFACE = 4;
+const MAX_RENDER_PASSES_PER_BATCH = 16;
+const MAX_DRAWS_PER_BATCH = 8_192;
+const MAX_TOTAL_BUFFER_BYTES = 64 * 1024 * 1024;
+const MAX_TOTAL_TEXTURE_BYTES = 256 * 1024 * 1024;
+const resourceLimits = new Map([
+  ["buffer", 4_096],
+  ["texture", 512],
+  ["textureView", 1_024],
+  ["sampler", 128],
+  ["shader", 128],
+  ["bindGroupLayout", 128],
+  ["pipelineLayout", 64],
+  ["bindGroup", 512],
+  ["pipeline", 256],
+]);
+const bindGroupResourceKinds = new Map([
+  [1, "buffer"],
+  [2, "sampler"],
+  [3, "textureView"],
+]);
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder("utf-8", { fatal: true });
+
+const formats = new Map([
+  [1, "rgba8unorm"],
+  [2, "rgba8unorm-srgb"],
+  [3, "bgra8unorm"],
+  [4, "bgra8unorm-srgb"],
+  [5, "depth24plus"],
+  [6, "depth32float"],
+]);
+const formatIds = new Map([...formats].map(([id, format]) => [format, id]));
+const vertexFormats = new Map([
+  [1, "float32"],
+  [2, "float32x2"],
+  [3, "float32x3"],
+  [4, "float32x4"],
+  [5, "uint32"],
+  [6, "uint32x2"],
+  [7, "uint32x4"],
+  [8, "unorm8x2"],
+  [9, "unorm8x4"],
+  [10, "snorm8x2"],
+  [11, "snorm8x4"],
+]);
+const indexFormats = new Map([
+  [1, "uint16"],
+  [2, "uint32"],
+]);
+const addressModes = new Map([
+  [1, "clamp-to-edge"],
+  [2, "repeat"],
+  [3, "mirror-repeat"],
+]);
+const filterModes = new Map([
+  [1, "nearest"],
+  [2, "linear"],
+]);
+const compareFunctions = new Map([
+  [1, "never"],
+  [2, "less"],
+  [3, "equal"],
+  [4, "less-equal"],
+  [5, "greater"],
+  [6, "not-equal"],
+  [7, "greater-equal"],
+  [8, "always"],
+]);
+const blendOperations = new Map([
+  [1, "add"],
+  [2, "subtract"],
+  [3, "reverse-subtract"],
+  [4, "min"],
+  [5, "max"],
+]);
+const blendFactors = new Map([
+  [1, "zero"],
+  [2, "one"],
+  [3, "src"],
+  [4, "one-minus-src"],
+  [5, "src-alpha"],
+  [6, "one-minus-src-alpha"],
+  [7, "dst"],
+  [8, "one-minus-dst"],
+  [9, "dst-alpha"],
+  [10, "one-minus-dst-alpha"],
+  [11, "src-alpha-saturated"],
+  [12, "constant"],
+  [13, "one-minus-constant"],
+]);
+const topologies = new Map([
+  [1, "point-list"],
+  [2, "line-list"],
+  [3, "line-strip"],
+  [4, "triangle-list"],
+  [5, "triangle-strip"],
+]);
+const frontFaces = new Map([
+  [1, "ccw"],
+  [2, "cw"],
+]);
+const cullModes = new Map([
+  [0, "none"],
+  [1, "front"],
+  [2, "back"],
+]);
+const samplerBindingTypes = new Map([
+  [1, "filtering"],
+  [2, "non-filtering"],
+  [3, "comparison"],
+]);
+const textureSampleTypes = new Map([
+  [1, "float"],
+  [2, "unfilterable-float"],
+  [3, "depth"],
+  [4, "sint"],
+  [5, "uint"],
+]);
+const vertexStepModes = new Map([
+  [1, "vertex"],
+  [2, "instance"],
+]);
+const textureAspects = new Map([
+  [1, "all"],
+  [2, "depth-only"],
+]);
+
+class ProtocolError extends Error {
+  constructor(message, commandIndex = 0xffffffff, errorCode = 1) {
+    super(message);
+    this.commandIndex = commandIndex;
+    this.errorCode = errorCode;
+  }
+}
+
+class Reader {
+  constructor(bytes) {
+    if (!(bytes instanceof Uint8Array)) {
+      throw new ProtocolError("GPU payload is not bytes");
+    }
+    this.bytes = bytes;
+    this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    this.offset = 0;
+  }
+
+  take(length) {
+    const end = this.offset + length;
+    if (!Number.isSafeInteger(end) || end > this.bytes.byteLength) {
+      throw new ProtocolError("GPU payload is truncated");
+    }
+    const value = this.bytes.subarray(this.offset, end);
+    this.offset = end;
+    return value;
+  }
+
+  u8() {
+    return this.take(1)[0];
+  }
+
+  u16() {
+    const offset = this.offset;
+    this.take(2);
+    return this.view.getUint16(offset, true);
+  }
+
+  u32() {
+    const offset = this.offset;
+    this.take(4);
+    return this.view.getUint32(offset, true);
+  }
+
+  i32() {
+    const offset = this.offset;
+    this.take(4);
+    return this.view.getInt32(offset, true);
+  }
+
+  u64() {
+    const offset = this.offset;
+    this.take(8);
+    const value = this.view.getBigUint64(offset, true);
+    if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new ProtocolError("GPU integer exceeds the safe range");
+    }
+    return Number(value);
+  }
+
+  f32() {
+    const offset = this.offset;
+    this.take(4);
+    const value = this.view.getFloat32(offset, true);
+    if (!Number.isFinite(value)) {
+      throw new ProtocolError("GPU descriptor contains non-finite float");
+    }
+    return value;
+  }
+
+  text(length) {
+    return textDecoder.decode(this.take(length));
+  }
+
+  zero(length) {
+    if (this.take(length).some(byte => byte !== 0)) {
+      throw new ProtocolError("GPU descriptor has nonzero reserved bytes");
+    }
+  }
+
+  finish() {
+    if (this.offset !== this.bytes.byteLength) {
+      throw new ProtocolError("GPU descriptor has trailing bytes");
+    }
+  }
+}
+
+function mapped(table, value, label) {
+  const result = table.get(value);
+  if (result === undefined) {
+    throw new ProtocolError(`unsupported GPU ${label} ${value}`);
+  }
+  return result;
+}
+
+function validHandle(id) {
+  return id !== 0 && (id & HANDLE_SLOT_MASK) !== 0 && id >>> 20 !== 0;
+}
+
+function resource(catalog, id, kind, commandIndex) {
+  const entry = catalog.get(id);
+  if (!entry || (kind && entry.kind !== kind) || entry.failed) {
+    throw new ProtocolError(
+      `invalid ${kind || "resource"} handle ${id}`,
+      commandIndex
+    );
+  }
+  return entry;
+}
+
+function createResource(catalog, slots, id, kind, descriptor, commandIndex) {
+  if (!validHandle(id) || catalog.has(id)) {
+    throw new ProtocolError(`invalid new ${kind} handle ${id}`, commandIndex);
+  }
+  const slot = id & HANDLE_SLOT_MASK;
+  const generation = id >>> 20;
+  const prior = slots.get(slot);
+  if (
+    (prior === undefined && generation !== 1) ||
+    (prior !== undefined &&
+      ((prior & HANDLE_LIVE_BIT) !== 0 ||
+        generation !== (prior & ~HANDLE_LIVE_BIT) + 1))
+  ) {
+    throw new ProtocolError(`stale new ${kind} handle ${id}`, commandIndex);
+  }
+  const entry = { kind, descriptor, value: null, failed: false };
+  catalog.set(id, entry);
+  slots.set(slot, generation | HANDLE_LIVE_BIT);
+  return entry;
+}
+
+function textureByteLength(descriptor) {
+  let width = descriptor.width;
+  let height = descriptor.height;
+  let total = 0;
+  for (let level = 0; level < descriptor.mipLevelCount; level++) {
+    const bytes = width * height * 4;
+    if (
+      !Number.isSafeInteger(bytes) ||
+      total > MAX_TOTAL_TEXTURE_BYTES - bytes
+    ) {
+      return MAX_TOTAL_TEXTURE_BYTES + 1;
+    }
+    total += bytes;
+    width = Math.max(1, Math.floor(width / 2));
+    height = Math.max(1, Math.floor(height / 2));
+  }
+  return total;
+}
+
+function adjustResourceStats(stats, entry, delta, commandIndex = 0xffffffff) {
+  const count = (stats.counts.get(entry.kind) || 0) + delta;
+  const limit = resourceLimits.get(entry.kind);
+  if (count < 0 || limit === undefined || count > limit) {
+    throw new ProtocolError(
+      `GPU ${entry.kind} resource quota exceeded`,
+      commandIndex
+    );
+  }
+  stats.counts.set(entry.kind, count);
+  if (entry.kind === "buffer") {
+    stats.bufferBytes += delta * entry.descriptor.size;
+    if (stats.bufferBytes < 0 || stats.bufferBytes > MAX_TOTAL_BUFFER_BYTES) {
+      throw new ProtocolError("GPU buffer memory quota exceeded", commandIndex);
+    }
+  } else if (entry.kind === "texture") {
+    stats.textureBytes += delta * textureByteLength(entry.descriptor);
+    if (
+      stats.textureBytes < 0 ||
+      stats.textureBytes > MAX_TOTAL_TEXTURE_BYTES
+    ) {
+      throw new ProtocolError(
+        "GPU texture memory quota exceeded",
+        commandIndex
+      );
+    }
+  }
+}
+
+function resourceStats(catalog) {
+  const stats = { counts: new Map(), bufferBytes: 0, textureBytes: 0 };
+  for (const entry of catalog.values()) {
+    adjustResourceStats(stats, entry, 1);
+  }
+  return stats;
+}
+
+function createBoundedResource(
+  catalog,
+  slots,
+  stats,
+  creations,
+  id,
+  kind,
+  descriptor,
+  commandIndex
+) {
+  const entry = createResource(
+    catalog,
+    slots,
+    id,
+    kind,
+    descriptor,
+    commandIndex
+  );
+  const creationCount = (creations.counts.get(kind) || 0) + 1;
+  if (creationCount > resourceLimits.get(kind)) {
+    throw new ProtocolError(
+      `too many GPU ${kind} creations in one batch`,
+      commandIndex
+    );
+  }
+  creations.counts.set(kind, creationCount);
+  if (kind === "buffer") {
+    creations.bufferBytes += descriptor.size;
+    if (creations.bufferBytes > MAX_TOTAL_BUFFER_BYTES) {
+      throw new ProtocolError(
+        "GPU buffer allocation budget exceeded",
+        commandIndex
+      );
+    }
+  } else if (kind === "texture") {
+    creations.textureBytes += textureByteLength(descriptor);
+    if (creations.textureBytes > MAX_TOTAL_TEXTURE_BYTES) {
+      throw new ProtocolError(
+        "GPU texture allocation budget exceeded",
+        commandIndex
+      );
+    }
+  } else if (kind === "shader" || kind === "pipeline") {
+    creations.compilations++;
+    if (creations.compilations > MAX_COMPILATIONS_PER_BATCH) {
+      throw new ProtocolError(
+        "too many GPU compilations in one batch",
+        commandIndex
+      );
+    }
+  }
+  adjustResourceStats(stats, entry, 1, commandIndex);
+  return entry;
+}
+
+function parseCommands(bytes) {
+  if (
+    bytes.byteLength < BATCH_HEADER_BYTES ||
+    bytes.byteLength > MAX_BATCH_BYTES
+  ) {
+    throw new ProtocolError("GPU batch length is invalid");
+  }
+  const reader = new Reader(bytes);
+  if (
+    textDecoder.decode(reader.take(4)) !== "EPG1" ||
+    reader.u16() !== WIRE_VERSION
+  ) {
+    throw new ProtocolError("GPU batch header is invalid");
+  }
+  reader.zero(2);
+  if (reader.u32() !== bytes.byteLength) {
+    throw new ProtocolError("GPU batch length does not match its header");
+  }
+  const commandCount = reader.u32();
+  const sequence = reader.u64();
+  if (!sequence || commandCount > MAX_COMMANDS) {
+    throw new ProtocolError("GPU batch sequence or command count is invalid");
+  }
+  const commands = [];
+  for (let index = 0; index < commandCount; index++) {
+    const opcode = reader.u16();
+    reader.zero(2);
+    const commandBytes = reader.u32();
+    if (commandBytes < COMMAND_HEADER_BYTES || commandBytes % 4) {
+      throw new ProtocolError("GPU command length is invalid", index);
+    }
+    const payload = reader.take(commandBytes - COMMAND_HEADER_BYTES);
+    commands.push({ opcode, payload, index });
+  }
+  reader.finish();
+  return { sequence, commands };
+}
+
+// Parsing stays centralized so every opcode's exact wire shape is auditable.
+// eslint-disable-next-line complexity
+function parseCommand(command) {
+  const reader = new Reader(command.payload);
+  const result = { opcode: command.opcode, index: command.index };
+  switch (command.opcode) {
+    case 1:
+      Object.assign(result, {
+        id: reader.u32(),
+        usage: reader.u32(),
+        size: reader.u64(),
+      });
+      break;
+    case 2: {
+      result.id = reader.u32();
+      reader.zero(4);
+      result.offset = reader.u64();
+      const length = reader.u32();
+      reader.zero(4);
+      result.data = reader.take(length).slice();
+      reader.zero(reader.bytes.byteLength - reader.offset);
+      break;
+    }
+    case 3:
+      Object.assign(result, {
+        id: reader.u32(),
+        width: reader.u32(),
+        height: reader.u32(),
+        mipLevelCount: reader.u16(),
+        sampleCount: reader.u16(),
+        format: mapped(formats, reader.u16(), "texture format"),
+      });
+      if (reader.u8() !== 1) {
+        throw new ProtocolError("unsupported texture dimension", command.index);
+      }
+      reader.zero(1);
+      result.usage = reader.u32();
+      break;
+    case 4: {
+      Object.assign(result, {
+        id: reader.u32(),
+        mipLevel: reader.u32(),
+        origin: { x: reader.u32(), y: reader.u32(), z: reader.u32() },
+        size: {
+          width: reader.u32(),
+          height: reader.u32(),
+          depthOrArrayLayers: reader.u32(),
+        },
+        bytesPerRow: reader.u32(),
+        rowsPerImage: reader.u32(),
+      });
+      const length = reader.u32();
+      result.data = reader.take(length).slice();
+      reader.zero(reader.bytes.byteLength - reader.offset);
+      break;
+    }
+    case 5:
+      Object.assign(result, {
+        id: reader.u32(),
+        addressModeU: mapped(addressModes, reader.u8(), "address mode"),
+        addressModeV: mapped(addressModes, reader.u8(), "address mode"),
+        addressModeW: mapped(addressModes, reader.u8(), "address mode"),
+        magFilter: mapped(filterModes, reader.u8(), "filter mode"),
+        minFilter: mapped(filterModes, reader.u8(), "filter mode"),
+        mipmapFilter: mapped(filterModes, reader.u8(), "filter mode"),
+      });
+      {
+        const compare = reader.u8();
+        result.compare = compare
+          ? mapped(compareFunctions, compare, "compare function")
+          : undefined;
+      }
+      result.maxAnisotropy = reader.u8();
+      result.lodMinClamp = reader.f32();
+      result.lodMaxClamp = reader.f32();
+      reader.zero(4);
+      break;
+    case 6: {
+      result.id = reader.u32();
+      const length = reader.u32();
+      result.source = reader.text(length);
+      reader.zero(reader.bytes.byteLength - reader.offset);
+      break;
+    }
+    case 7: {
+      result.id = reader.u32();
+      const count = reader.u32();
+      result.entries = [];
+      for (let i = 0; i < count; i++) {
+        const binding = reader.u32();
+        const visibility = reader.u32();
+        const kind = reader.u16();
+        const flags = reader.u16();
+        reader.zero(4);
+        const minBindingSize = reader.u64();
+        const parameter0 = reader.u32();
+        const parameter1 = reader.u32();
+        let entry;
+        if (kind === 1) {
+          if (parameter0 || parameter1 || flags & ~1) {
+            throw new ProtocolError(
+              "invalid buffer binding layout",
+              command.index
+            );
+          }
+          entry = {
+            binding,
+            visibility,
+            buffer: {
+              type: "uniform",
+              hasDynamicOffset: Boolean(flags & 1),
+              minBindingSize,
+            },
+          };
+        } else if (kind === 2) {
+          if (flags || minBindingSize || parameter1) {
+            throw new ProtocolError(
+              "invalid sampler binding layout",
+              command.index
+            );
+          }
+          entry = {
+            binding,
+            visibility,
+            sampler: {
+              type: mapped(
+                samplerBindingTypes,
+                parameter0,
+                "sampler binding type"
+              ),
+            },
+          };
+        } else if (kind === 3) {
+          if (flags || minBindingSize) {
+            throw new ProtocolError(
+              "invalid texture binding layout",
+              command.index
+            );
+          }
+          entry = {
+            binding,
+            visibility,
+            texture: {
+              sampleType: mapped(
+                textureSampleTypes,
+                parameter0,
+                "texture sample type"
+              ),
+              viewDimension:
+                parameter1 === 1
+                  ? "2d"
+                  : (() => {
+                      throw new ProtocolError(
+                        "unsupported texture view dimension",
+                        command.index
+                      );
+                    })(),
+              multisampled: false,
+            },
+          };
+        } else {
+          throw new ProtocolError(
+            "unsupported bind group layout entry",
+            command.index
+          );
+        }
+        result.entries.push(entry);
+      }
+      break;
+    }
+    case 8: {
+      result.id = reader.u32();
+      const count = reader.u32();
+      result.layouts = Array.from({ length: count }, () => reader.u32());
+      break;
+    }
+    case 9: {
+      result.id = reader.u32();
+      result.layout = reader.u32();
+      const count = reader.u32();
+      result.entries = [];
+      for (let i = 0; i < count; i++) {
+        const binding = reader.u32();
+        const resourceId = reader.u32();
+        const kind = reader.u16();
+        if (kind !== 1 && kind !== 2 && kind !== 3) {
+          throw new ProtocolError(
+            "unsupported bind group entry kind",
+            command.index
+          );
+        }
+        reader.zero(2);
+        reader.zero(4);
+        const offset = reader.u64();
+        const size = reader.u64();
+        result.entries.push({ binding, resourceId, kind, offset, size });
+      }
+      break;
+    }
+    case 10: {
+      Object.assign(result, {
+        id: reader.u32(),
+        layout: reader.u32(),
+        shader: reader.u32(),
+      });
+      const layoutCount = reader.u16();
+      const attributeCount = reader.u16();
+      const targetCount = reader.u16();
+      result.flags = reader.u16();
+      result.depthFormatId = reader.u16();
+      result.sampleCount = reader.u16();
+      result.topology = mapped(topologies, reader.u8(), "primitive topology");
+      result.frontFace = mapped(frontFaces, reader.u8(), "front face");
+      result.cullMode = mapped(cullModes, reader.u8(), "cull mode");
+      const stripIndex = reader.u8();
+      result.stripIndexFormat = stripIndex
+        ? mapped(indexFormats, stripIndex, "strip index format")
+        : undefined;
+      const depthCompare = reader.u8();
+      result.depthCompare = depthCompare
+        ? mapped(compareFunctions, depthCompare, "depth compare")
+        : undefined;
+      reader.zero(11);
+      result.layouts = [];
+      for (let i = 0; i < layoutCount; i++) {
+        result.layouts.push({
+          arrayStride: reader.u64(),
+          stepMode: mapped(vertexStepModes, reader.u8(), "vertex step mode"),
+          firstAttribute: (reader.zero(3), reader.u16()),
+          attributeCount: reader.u16(),
+        });
+      }
+      result.attributes = [];
+      for (let i = 0; i < attributeCount; i++) {
+        result.attributes.push({
+          format: mapped(vertexFormats, reader.u16(), "vertex format"),
+          shaderLocation: reader.u16(),
+          offset: reader.u64(),
+        });
+        reader.zero(4);
+      }
+      result.targets = [];
+      for (let i = 0; i < targetCount; i++) {
+        const format = mapped(formats, reader.u16(), "color target format");
+        const writeMask = reader.u16();
+        const color = {
+          operation: mapped(blendOperations, reader.u8(), "blend operation"),
+          srcFactor: mapped(blendFactors, reader.u8(), "blend factor"),
+          dstFactor: mapped(blendFactors, reader.u8(), "blend factor"),
+        };
+        const alpha = {
+          operation: mapped(blendOperations, reader.u8(), "blend operation"),
+          srcFactor: mapped(blendFactors, reader.u8(), "blend factor"),
+          dstFactor: mapped(blendFactors, reader.u8(), "blend factor"),
+        };
+        reader.zero(6);
+        result.targets.push({ format, writeMask, blend: { color, alpha } });
+      }
+      break;
+    }
+    case 11:
+    case 13:
+      result.id = reader.u32();
+      break;
+    case 12:
+      Object.assign(result, {
+        colorView: reader.u32(),
+        depthView: reader.u32(),
+        surfaceGeneration: reader.u32(),
+        flags: reader.u32(),
+        clearColor: {
+          r: reader.f32(),
+          g: reader.f32(),
+          b: reader.f32(),
+          a: reader.f32(),
+        },
+        clearDepth: reader.f32(),
+      });
+      break;
+    case 14:
+      Object.assign(result, {
+        slot: reader.u32(),
+        buffer: reader.u32(),
+        offset: reader.u64(),
+        size: reader.u64(),
+      });
+      break;
+    case 15:
+      Object.assign(result, {
+        buffer: reader.u32(),
+        format: mapped(indexFormats, reader.u32(), "index format"),
+        offset: reader.u64(),
+        size: reader.u64(),
+      });
+      break;
+    case 16: {
+      result.bindIndex = reader.u32();
+      result.bindGroup = reader.u32();
+      const count = reader.u32();
+      result.dynamicOffsets = Array.from({ length: count }, () => reader.u32());
+      break;
+    }
+    case 17:
+      result.values = Array.from({ length: 6 }, () => reader.f32());
+      break;
+    case 18:
+    case 19:
+      result.values = Array.from({ length: 4 }, () => reader.u32());
+      break;
+    case 20:
+      result.values = [
+        reader.u32(),
+        reader.u32(),
+        reader.u32(),
+        reader.i32(),
+        reader.u32(),
+      ];
+      break;
+    case 21:
+      break;
+    case 22:
+      Object.assign(result, {
+        source: reader.u32(),
+        destination: reader.u32(),
+        sourceOffset: reader.u64(),
+        destinationOffset: reader.u64(),
+        size: reader.u64(),
+      });
+      break;
+    case 23:
+      Object.assign(result, {
+        id: reader.u32(),
+        texture: reader.u32(),
+        format: mapped(formats, reader.u16(), "texture view format"),
+      });
+      if (reader.u8() !== 1) {
+        throw new ProtocolError(
+          "unsupported texture view dimension",
+          command.index
+        );
+      }
+      result.aspect = mapped(textureAspects, reader.u8(), "texture aspect");
+      result.baseMipLevel = reader.u16();
+      result.mipLevelCount = reader.u16();
+      result.baseArrayLayer = reader.u16();
+      result.arrayLayerCount = reader.u16();
+      break;
+    default:
+      throw new ProtocolError(
+        `unsupported GPU opcode ${command.opcode}`,
+        command.index
+      );
+  }
+  reader.finish();
+  return result;
+}
+
+class GpuEngine {
+  constructor(
+    canvas,
+    device,
+    context,
+    format,
+    limits,
+    dimensions,
+    testReadback,
+    testDeviceLoss
+  ) {
+    this.canvas = canvas;
+    this.device = device;
+    this.context = context;
+    this.format = format;
+    this.formatId = formatIds.get(format);
+    this.limits = limits;
+    this.resources = new Map();
+    this.handleSlots = new Map();
+    this.surfaceGeneration = 1;
+    this.deviceGeneration = 1;
+    this.lastSequence = 0;
+    this.stopped = false;
+    this.queue = Promise.resolve();
+    this.pendingBatches = 0;
+    this.testReadbacksRemaining = testReadback ? 8 : 0;
+    this.testDeviceLossPending = testDeviceLoss;
+    this.pendingResize = null;
+    this.resizeScheduled = false;
+    this.resize(dimensions, false);
+    device.addEventListener("uncapturederror", event => {
+      this.emitTextEvent(
+        4,
+        0,
+        1,
+        event.error?.message || "uncaptured WebGPU error"
+      );
+    });
+    void device.lost.then(info => {
+      if (!this.stopped) {
+        this.stopped = true;
+        this.emitTextEvent(7, 0, 1, info.message || "WebGPU device lost");
+      }
+    });
+  }
+
+  static async create(
+    canvas,
+    requirements,
+    dimensions,
+    testReadback,
+    testDeviceLoss
+  ) {
+    if (!globalThis.navigator?.gpu) {
+      throw new Error("WebGPU is unavailable");
+    }
+    const adapter = await navigator.gpu.requestAdapter();
+    if (!adapter) {
+      throw new Error("WebGPU adapter is unavailable");
+    }
+    const ceilings = {
+      maxTextureDimension2D: 4096,
+      maxBufferSize: 16 * 1024 * 1024,
+      maxBindingsPerBindGroup: 16,
+      maxBindGroups: 4,
+      maxVertexBuffers: 8,
+      maxVertexAttributes: 16,
+      maxColorAttachments: 4,
+    };
+    const requested = {};
+    for (const [name, ceiling] of Object.entries(ceilings)) {
+      const available = Number(adapter.limits[name]);
+      if (!Number.isFinite(available) || available <= 0) {
+        throw new Error(`WebGPU adapter omitted ${name}`);
+      }
+      requested[name] = Math.min(ceiling, available);
+    }
+    for (const [name, minimum] of Object.entries(
+      requirements.requiredLimits || {}
+    )) {
+      if (
+        !(name in requested) ||
+        !Number.isSafeInteger(minimum) ||
+        minimum <= 0 ||
+        requested[name] < minimum
+      ) {
+        throw new Error(`WebGPU does not satisfy required limit ${name}`);
+      }
+    }
+    if (
+      Array.isArray(requirements.requiredFeatures) &&
+      requirements.requiredFeatures.length
+    ) {
+      throw new Error(
+        "optional WebGPU features are unavailable in profile version 1"
+      );
+    }
+    const device = await adapter.requestDevice({
+      requiredFeatures: [],
+      requiredLimits: requested,
+    });
+    const context = canvas.getContext("webgpu");
+    if (!context) {
+      throw new Error("WebGPU canvas context is unavailable");
+    }
+    const format = navigator.gpu.getPreferredCanvasFormat();
+    if (!formatIds.has(format)) {
+      throw new Error(`unsupported WebGPU surface format ${format}`);
+    }
+    const limits = [
+      requested.maxTextureDimension2D,
+      requested.maxBufferSize,
+      requested.maxBindingsPerBindGroup,
+      requested.maxBindGroups,
+      requested.maxVertexBuffers,
+      requested.maxVertexAttributes,
+      requested.maxColorAttachments,
+      256 * 1024 * 1024,
+      64 * 1024 * 1024,
+      8192,
+      MAX_BATCH_BYTES,
+      16 * 1024 * 1024,
+    ];
+    return new GpuEngine(
+      canvas,
+      device,
+      context,
+      format,
+      limits,
+      dimensions,
+      testReadback,
+      testDeviceLoss
+    );
+  }
+
+  resize(dimensions, notify = true) {
+    const physicalWidth = Math.max(
+      1,
+      Math.min(this.limits[0], dimensions.physicalWidth >>> 0)
+    );
+    const physicalHeight = Math.max(
+      1,
+      Math.min(this.limits[0], dimensions.physicalHeight >>> 0)
+    );
+    const logicalWidth = Math.max(1, dimensions.logicalWidth >>> 0);
+    const logicalHeight = Math.max(1, dimensions.logicalHeight >>> 0);
+    const scale = Number(dimensions.scale);
+    if (!Number.isFinite(scale) || scale <= 0) {
+      throw new Error("invalid WebGPU surface scale");
+    }
+    const changed =
+      this.physicalWidth !== physicalWidth ||
+      this.physicalHeight !== physicalHeight ||
+      this.logicalWidth !== logicalWidth ||
+      this.logicalHeight !== logicalHeight ||
+      this.scale !== scale;
+    this.physicalWidth = physicalWidth;
+    this.physicalHeight = physicalHeight;
+    this.logicalWidth = logicalWidth;
+    this.logicalHeight = logicalHeight;
+    this.scale = scale;
+    this.canvas.width = physicalWidth;
+    this.canvas.height = physicalHeight;
+    this.context.configure({
+      device: this.device,
+      format: this.format,
+      alphaMode: "opaque",
+      usage:
+        GPUTextureUsage.RENDER_ATTACHMENT |
+        (this.testReadbacksRemaining > 0 ? GPUTextureUsage.COPY_SRC : 0),
+    });
+    if (notify && changed) {
+      this.surfaceGeneration++;
+      postBytes("capabilities", this.capabilities());
+      const payload = new Uint8Array(28);
+      const view = new DataView(payload.buffer);
+      for (const [offset, value] of [
+        [0, this.surfaceGeneration],
+        [4, physicalWidth],
+        [8, physicalHeight],
+        [12, logicalWidth],
+        [16, logicalHeight],
+      ]) {
+        view.setUint32(offset, value, true);
+      }
+      view.setFloat32(20, scale, true);
+      view.setUint16(24, this.formatId, true);
+      postBytes("event", makeEvent(6, 0, payload));
+    }
+  }
+
+  scheduleResize(dimensions) {
+    this.pendingResize = dimensions;
+    if (this.resizeScheduled) {
+      return;
+    }
+    this.resizeScheduled = true;
+    this.queue = this.queue
+      .then(() => {
+        const latest = this.pendingResize;
+        this.pendingResize = null;
+        this.resizeScheduled = false;
+        if (!this.stopped && latest) {
+          this.resize(latest);
+        }
+      })
+      .catch(error => {
+        postMessage({ type: "error", message: error.message || String(error) });
+        this.stopped = true;
+      });
+  }
+
+  capabilities() {
+    const bytes = new Uint8Array(56 + this.limits.length * 16);
+    const view = new DataView(bytes.buffer);
+    bytes.set(textEncoder.encode("EGC1"), 0);
+    view.setUint16(4, WIRE_VERSION, true);
+    view.setUint32(8, bytes.byteLength, true);
+    view.setUint16(12, this.formatId, true);
+    view.setUint32(16, this.physicalWidth, true);
+    view.setUint32(20, this.physicalHeight, true);
+    view.setUint32(24, this.logicalWidth, true);
+    view.setUint32(28, this.logicalHeight, true);
+    view.setFloat32(32, this.scale, true);
+    view.setUint32(36, this.surfaceGeneration, true);
+    view.setUint32(40, this.deviceGeneration, true);
+    view.setUint32(44, this.limits.length, true);
+    this.limits.forEach((value, index) => {
+      const offset = 56 + index * 16;
+      view.setUint16(offset, index + 1, true);
+      view.setBigUint64(offset + 4, BigInt(value), true);
+    });
+    return bytes;
+  }
+
+  submit(bytes) {
+    if (this.pendingBatches >= MAX_PENDING_BATCHES) {
+      this.emitBatchRejected(0xffffffff, 3, 0, "GPU submission queue is full");
+      return;
+    }
+    this.pendingBatches++;
+    this.queue = this.queue
+      .then(() => this.execute(bytes))
+      .catch(error => {
+        postMessage({ type: "error", message: error.message || String(error) });
+        this.stopped = true;
+      })
+      .finally(() => {
+        this.pendingBatches--;
+      });
+  }
+
+  // Validation is one atomic state transition across the complete opcode set.
+  // eslint-disable-next-line complexity
+  validate(batch) {
+    if (batch.sequence <= this.lastSequence) {
+      throw new ProtocolError("GPU sequence is not increasing");
+    }
+    const shadow = new Map(this.resources);
+    const slots = new Map(this.handleSlots);
+    let pass = false;
+    const stats = resourceStats(shadow);
+    const creations = {
+      counts: new Map(),
+      bufferBytes: 0,
+      textureBytes: 0,
+      compilations: 0,
+    };
+    let renderPasses = 0;
+    let draws = 0;
+    const commands = batch.commands.map(parseCommand);
+    for (const command of commands) {
+      const index = command.index;
+      switch (command.opcode) {
+        case 1:
+          if (!command.size || command.size > this.limits[1]) {
+            throw new ProtocolError("invalid buffer size", index);
+          }
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "buffer",
+            command,
+            index
+          );
+          break;
+        case 2:
+          resource(shadow, command.id, "buffer", index);
+          break;
+        case 3:
+          if (
+            !command.width ||
+            !command.height ||
+            command.width > this.limits[0] ||
+            command.height > this.limits[0] ||
+            !command.mipLevelCount ||
+            command.mipLevelCount > 13 ||
+            command.sampleCount !== 1
+          ) {
+            throw new ProtocolError("invalid texture descriptor", index);
+          }
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "texture",
+            command,
+            index
+          );
+          break;
+        case 4:
+          resource(shadow, command.id, "texture", index);
+          break;
+        case 5:
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "sampler",
+            command,
+            index
+          );
+          break;
+        case 6:
+          if (!command.source.length || command.source.length > 1024 * 1024) {
+            throw new ProtocolError("invalid WGSL source", index);
+          }
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "shader",
+            command,
+            index
+          );
+          break;
+        case 7:
+          if (command.entries.length > this.limits[2]) {
+            throw new ProtocolError("too many bind group entries", index);
+          }
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "bindGroupLayout",
+            command,
+            index
+          );
+          break;
+        case 8:
+          if (command.layouts.length > this.limits[3]) {
+            throw new ProtocolError("too many pipeline bind groups", index);
+          }
+          command.layouts.forEach(id =>
+            resource(shadow, id, "bindGroupLayout", index)
+          );
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "pipelineLayout",
+            command,
+            index
+          );
+          break;
+        case 9:
+          if (command.entries.length > this.limits[2]) {
+            throw new ProtocolError("too many bind group entries", index);
+          }
+          resource(shadow, command.layout, "bindGroupLayout", index);
+          for (const entry of command.entries) {
+            resource(
+              shadow,
+              entry.resourceId,
+              bindGroupResourceKinds.get(entry.kind) || "",
+              index
+            );
+          }
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "bindGroup",
+            command,
+            index
+          );
+          break;
+        case 10:
+          resource(shadow, command.layout, "pipelineLayout", index);
+          resource(shadow, command.shader, "shader", index);
+          if (
+            command.layouts.length > this.limits[4] ||
+            command.attributes.length > this.limits[5] ||
+            command.targets.length > this.limits[6]
+          ) {
+            throw new ProtocolError(
+              "pipeline exceeds negotiated limits",
+              index
+            );
+          }
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "pipeline",
+            command,
+            index
+          );
+          break;
+        case 11: {
+          const removed = resource(shadow, command.id, null, index);
+          adjustResourceStats(stats, removed, -1, index);
+          shadow.delete(command.id);
+          slots.set(command.id & HANDLE_SLOT_MASK, command.id >>> 20);
+          break;
+        }
+        case 12:
+          if (pass) {
+            throw new ProtocolError("nested render pass", index);
+          }
+          if (command.surfaceGeneration !== this.surfaceGeneration) {
+            throw new ProtocolError(
+              `render pass surface generation ${command.surfaceGeneration} ` +
+                `does not match current generation ${this.surfaceGeneration}`,
+              index,
+              BATCH_ERROR_STALE_SURFACE
+            );
+          }
+          if (command.colorView !== 0) {
+            throw new ProtocolError(
+              "render pass uses a non-surface color view",
+              index
+            );
+          }
+          renderPasses++;
+          if (renderPasses > MAX_RENDER_PASSES_PER_BATCH) {
+            throw new ProtocolError("too many render passes", index);
+          }
+          if (command.depthView) {
+            resource(shadow, command.depthView, "textureView", index);
+          }
+          pass = true;
+          break;
+        case 13:
+          if (!pass) {
+            throw new ProtocolError("pipeline set outside render pass", index);
+          }
+          resource(shadow, command.id, "pipeline", index);
+          break;
+        case 14:
+          if (command.slot >= this.limits[4]) {
+            throw new ProtocolError(
+              "vertex buffer slot exceeds negotiated limits",
+              index
+            );
+          }
+          if (!pass) {
+            throw new ProtocolError(
+              "vertex buffer set outside render pass",
+              index
+            );
+          }
+          resource(shadow, command.buffer, "buffer", index);
+          break;
+        case 15:
+          if (!pass) {
+            throw new ProtocolError(
+              "index buffer set outside render pass",
+              index
+            );
+          }
+          resource(shadow, command.buffer, "buffer", index);
+          break;
+        case 16:
+          if (command.bindIndex >= this.limits[3]) {
+            throw new ProtocolError(
+              "bind group index exceeds negotiated limits",
+              index
+            );
+          }
+          if (!pass) {
+            throw new ProtocolError(
+              "bind group set outside render pass",
+              index
+            );
+          }
+          resource(shadow, command.bindGroup, "bindGroup", index);
+          break;
+        case 17:
+        case 18:
+          if (!pass) {
+            throw new ProtocolError(
+              "render command outside render pass",
+              index
+            );
+          }
+          break;
+        case 19:
+        case 20:
+          if (!pass) {
+            throw new ProtocolError(
+              "render command outside render pass",
+              index
+            );
+          }
+          draws++;
+          if (draws > MAX_DRAWS_PER_BATCH) {
+            throw new ProtocolError("too many draw commands", index);
+          }
+          break;
+        case 21:
+          if (!pass) {
+            throw new ProtocolError("render pass is not active", index);
+          }
+          pass = false;
+          break;
+        case 22:
+          if (pass) {
+            throw new ProtocolError("buffer copy inside render pass", index);
+          }
+          resource(shadow, command.source, "buffer", index);
+          resource(shadow, command.destination, "buffer", index);
+          break;
+        case 23:
+          resource(shadow, command.texture, "texture", index);
+          command.resourceEntry = createBoundedResource(
+            shadow,
+            slots,
+            stats,
+            creations,
+            command.id,
+            "textureView",
+            command,
+            index
+          );
+          break;
+      }
+    }
+    if (pass) {
+      throw new ProtocolError("render pass was not ended");
+    }
+    return { commands, shadow, slots };
+  }
+
+  // Execution mirrors the validated opcode set and commits it transactionally.
+  // eslint-disable-next-line complexity
+  async execute(bytes) {
+    if (this.stopped) {
+      return;
+    }
+    let batch;
+    let validated;
+    try {
+      batch = parseCommands(bytes);
+    } catch (error) {
+      throw new Error(`malformed GPU batch: ${error.message}`);
+    }
+    try {
+      validated = this.validate(batch);
+    } catch (error) {
+      this.emitBatchRejected(
+        error.commandIndex ?? 0xffffffff,
+        error.errorCode ?? 1,
+        batch.sequence,
+        error.message
+      );
+      return;
+    }
+    this.device.pushErrorScope("validation");
+    this.device.pushErrorScope("out-of-memory");
+    const next = new Map(this.resources);
+    let encoder = null;
+    let pass = null;
+    let surfaceView = null;
+    let surfaceTexture = null;
+    let readback = null;
+    const removed = [];
+    const shaders = [];
+    const created = [];
+    try {
+      for (const command of validated.commands) {
+        const entry = command.resourceEntry;
+        switch (command.opcode) {
+          case 1:
+            entry.value = this.device.createBuffer({
+              size: command.size,
+              usage: command.usage,
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          case 2:
+            this.device.queue.writeBuffer(
+              resource(next, command.id, "buffer", command.index).value,
+              command.offset,
+              command.data
+            );
+            break;
+          case 3:
+            entry.value = this.device.createTexture({
+              size: [command.width, command.height, 1],
+              mipLevelCount: command.mipLevelCount,
+              sampleCount: command.sampleCount,
+              dimension: "2d",
+              format: command.format,
+              usage: command.usage,
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          case 4:
+            this.device.queue.writeTexture(
+              {
+                texture: resource(next, command.id, "texture", command.index)
+                  .value,
+                mipLevel: command.mipLevel,
+                origin: command.origin,
+              },
+              command.data,
+              {
+                offset: 0,
+                bytesPerRow: command.bytesPerRow,
+                rowsPerImage: command.rowsPerImage,
+              },
+              command.size
+            );
+            break;
+          case 5:
+            entry.value = this.device.createSampler(command);
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          case 6:
+            entry.value = this.device.createShaderModule({
+              code: command.source,
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            shaders.push([entry, command.id]);
+            break;
+          case 7:
+            entry.value = this.device.createBindGroupLayout({
+              entries: command.entries,
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          case 8:
+            entry.value = this.device.createPipelineLayout({
+              bindGroupLayouts: command.layouts.map(
+                id => resource(next, id, "bindGroupLayout", command.index).value
+              ),
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          case 9:
+            entry.value = this.device.createBindGroup({
+              layout: resource(
+                next,
+                command.layout,
+                "bindGroupLayout",
+                command.index
+              ).value,
+              entries: command.entries.map(item => ({
+                binding: item.binding,
+                resource:
+                  item.kind === 1
+                    ? {
+                        buffer: resource(
+                          next,
+                          item.resourceId,
+                          "buffer",
+                          command.index
+                        ).value,
+                        offset: item.offset,
+                        size: item.size,
+                      }
+                    : resource(
+                        next,
+                        item.resourceId,
+                        item.kind === 2 ? "sampler" : "textureView",
+                        command.index
+                      ).value,
+              })),
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          case 10: {
+            const buffers = command.layouts.map(layout => ({
+              arrayStride: layout.arrayStride,
+              stepMode: layout.stepMode,
+              attributes: command.attributes.slice(
+                layout.firstAttribute,
+                layout.firstAttribute + layout.attributeCount
+              ),
+            }));
+            const descriptor = {
+              layout: resource(
+                next,
+                command.layout,
+                "pipelineLayout",
+                command.index
+              ).value,
+              vertex: {
+                module: resource(next, command.shader, "shader", command.index)
+                  .value,
+                entryPoint: "vs_main",
+                buffers,
+              },
+              fragment: {
+                module: resource(next, command.shader, "shader", command.index)
+                  .value,
+                entryPoint: "fs_main",
+                targets: command.targets,
+              },
+              primitive: {
+                topology: command.topology,
+                frontFace: command.frontFace,
+                cullMode: command.cullMode,
+                stripIndexFormat: command.stripIndexFormat,
+              },
+              multisample: { count: command.sampleCount },
+            };
+            if (command.depthFormatId) {
+              descriptor.depthStencil = {
+                format: mapped(formats, command.depthFormatId, "depth format"),
+                depthWriteEnabled: Boolean(command.flags & 1),
+                depthCompare: command.depthCompare,
+              };
+            }
+            entry.value = this.device.createRenderPipeline(descriptor);
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+          }
+          case 11: {
+            const removedEntry = resource(
+              next,
+              command.id,
+              null,
+              command.index
+            );
+            removed.push(removedEntry);
+            next.delete(command.id);
+            break;
+          }
+          case 12: {
+            encoder ||= this.device.createCommandEncoder();
+            const colorAttachment = {
+              view: (surfaceView ??= (surfaceTexture ??=
+                this.context.getCurrentTexture()).createView()),
+              loadOp: command.flags & 1 ? "load" : "clear",
+              storeOp: command.flags & 2 ? "store" : "discard",
+              clearValue: command.clearColor,
+            };
+            const descriptor = { colorAttachments: [colorAttachment] };
+            if (command.depthView) {
+              descriptor.depthStencilAttachment = {
+                view: resource(
+                  next,
+                  command.depthView,
+                  "textureView",
+                  command.index
+                ).value,
+                depthLoadOp: command.flags & 4 ? "load" : "clear",
+                depthStoreOp: command.flags & 8 ? "store" : "discard",
+                depthClearValue: command.clearDepth,
+              };
+            }
+            pass = encoder.beginRenderPass(descriptor);
+            break;
+          }
+          case 13:
+            pass.setPipeline(
+              resource(next, command.id, "pipeline", command.index).value
+            );
+            break;
+          case 14:
+            pass.setVertexBuffer(
+              command.slot,
+              resource(next, command.buffer, "buffer", command.index).value,
+              command.offset,
+              command.size
+            );
+            break;
+          case 15:
+            pass.setIndexBuffer(
+              resource(next, command.buffer, "buffer", command.index).value,
+              command.format,
+              command.offset,
+              command.size
+            );
+            break;
+          case 16:
+            pass.setBindGroup(
+              command.bindIndex,
+              resource(next, command.bindGroup, "bindGroup", command.index)
+                .value,
+              command.dynamicOffsets
+            );
+            break;
+          case 17:
+            pass.setViewport(...command.values);
+            break;
+          case 18:
+            pass.setScissorRect(...command.values);
+            break;
+          case 19:
+            pass.draw(...command.values);
+            break;
+          case 20:
+            pass.drawIndexed(...command.values);
+            break;
+          case 21:
+            pass.end();
+            pass = null;
+            break;
+          case 22:
+            encoder ||= this.device.createCommandEncoder();
+            encoder.copyBufferToBuffer(
+              resource(next, command.source, "buffer", command.index).value,
+              command.sourceOffset,
+              resource(next, command.destination, "buffer", command.index)
+                .value,
+              command.destinationOffset,
+              command.size
+            );
+            break;
+          case 23:
+            entry.value = resource(
+              next,
+              command.texture,
+              "texture",
+              command.index
+            ).value.createView({
+              format: command.format,
+              dimension: "2d",
+              aspect: command.aspect,
+              baseMipLevel: command.baseMipLevel,
+              mipLevelCount: command.mipLevelCount,
+              baseArrayLayer: command.baseArrayLayer,
+              arrayLayerCount: command.arrayLayerCount,
+            });
+            next.set(command.id, entry);
+            created.push(entry);
+            break;
+        }
+      }
+      if (encoder && surfaceTexture && this.testReadbacksRemaining > 0) {
+        readback = this.device.createBuffer({
+          size: 3 * 256,
+          usage: GPUBufferUsage.COPY_DST | GPUBufferUsage.MAP_READ,
+        });
+        const sampleLocations = [
+          [this.physicalWidth >> 1, this.physicalHeight >> 1],
+          [
+            Math.min(8, this.physicalWidth - 1),
+            Math.min(8, this.physicalHeight - 1),
+          ],
+          [Math.max(0, this.physicalWidth - 20), this.physicalHeight >> 1],
+        ];
+        for (const [index, [x, y]] of sampleLocations.entries()) {
+          encoder.copyTextureToBuffer(
+            { texture: surfaceTexture, origin: { x, y } },
+            {
+              buffer: readback,
+              offset: index * 256,
+              bytesPerRow: 256,
+              rowsPerImage: 1,
+            },
+            { width: 1, height: 1, depthOrArrayLayers: 1 }
+          );
+        }
+      }
+      if (encoder) {
+        this.device.queue.submit([encoder.finish()]);
+      }
+    } catch (error) {
+      created.forEach(entry => entry.value?.destroy?.());
+      readback?.destroy();
+      void this.device.popErrorScope();
+      void this.device.popErrorScope();
+      throw error;
+    }
+    const outOfMemory = await this.device.popErrorScope();
+    const validation = await this.device.popErrorScope();
+    const gpuError = outOfMemory || validation;
+    if (gpuError) {
+      readback?.destroy();
+      created.forEach(entry => entry.value?.destroy?.());
+      this.emitBatchRejected(
+        0xffffffff,
+        outOfMemory ? 2 : 1,
+        batch.sequence,
+        gpuError.message
+      );
+      return;
+    }
+    this.resources = next;
+    this.handleSlots = validated.slots;
+    this.lastSequence = batch.sequence;
+    removed.forEach(entry => entry.value?.destroy?.());
+    shaders.forEach(([entry, handle]) =>
+      this.watchShader(entry, handle, batch.sequence)
+    );
+    await this.device.queue.onSubmittedWorkDone();
+    if (readback) {
+      await readback.mapAsync(GPUMapMode.READ);
+      const readbackBytes = new Uint8Array(readback.getMappedRange());
+      const samples = [0, 256, 512].map(offset =>
+        Array.from(readbackBytes.subarray(offset, offset + 4))
+      );
+      readback.unmap();
+      readback.destroy();
+      this.testReadbacksRemaining--;
+      postMessage({ type: "test-readback", samples });
+    }
+    postBytes("event", makeEvent(5, batch.sequence));
+    postMessage({ type: "presented", sequence: batch.sequence });
+    if (this.testDeviceLossPending && surfaceTexture) {
+      this.testDeviceLossPending = false;
+      this.device.destroy();
+    }
+  }
+
+  async watchShader(entry, handle, sequence) {
+    try {
+      const info = await entry.value.getCompilationInfo();
+      for (const message of info.messages) {
+        let severity = 3;
+        if (message.type === "error") {
+          severity = 1;
+        } else if (message.type === "warning") {
+          severity = 2;
+        }
+        const text = diagnosticBytes(message.message || "shader diagnostic");
+        const payload = new Uint8Array(32 + align4(text.bytes.byteLength));
+        const view = new DataView(payload.buffer);
+        view.setUint32(0, handle, true);
+        view.setUint16(4, severity, true);
+        view.setUint16(6, text.truncated ? 1 : 0, true);
+        view.setUint32(8, message.lineNum || 0, true);
+        view.setUint32(12, message.linePos || 0, true);
+        view.setUint32(16, message.offset || 0, true);
+        view.setUint32(20, message.length || 0, true);
+        view.setUint32(24, text.bytes.byteLength, true);
+        payload.set(text.bytes, 32);
+        postBytes("event", makeEvent(2, sequence, payload));
+        if (severity === 1) {
+          entry.failed = true;
+        }
+      }
+    } catch {}
+  }
+
+  emitBatchRejected(commandIndex, errorCode, sequence, message) {
+    const diagnostic = diagnosticBytes(
+      `surface_generation=${this.surfaceGeneration} ` +
+        `physical=${this.physicalWidth}x${this.physicalHeight} ` +
+        `logical=${this.logicalWidth}x${this.logicalHeight} ` +
+        `scale=${this.scale} last_sequence=${this.lastSequence}: ${message}`
+    );
+    const payload = new Uint8Array(16 + align4(diagnostic.bytes.byteLength));
+    const view = new DataView(payload.buffer);
+    view.setUint32(0, commandIndex, true);
+    view.setUint32(4, errorCode, true);
+    view.setUint32(8, diagnostic.bytes.byteLength, true);
+    view.setUint32(12, diagnostic.truncated ? 1 : 0, true);
+    payload.set(diagnostic.bytes, 16);
+    postBytes("event", makeEvent(1, sequence, payload));
+  }
+
+  emitTextEvent(type, sequence, errorCode, message) {
+    const text = diagnosticBytes(message);
+    const payload = new Uint8Array(12 + align4(text.bytes.byteLength));
+    const view = new DataView(payload.buffer);
+    view.setUint32(0, errorCode, true);
+    view.setUint32(4, text.bytes.byteLength, true);
+    view.setUint32(8, text.truncated ? 1 : 0, true);
+    payload.set(text.bytes, 12);
+    postBytes("event", makeEvent(type, sequence, payload));
+  }
+
+  reset() {
+    this.queue = this.queue
+      .then(() => {
+        if (this.stopped) {
+          return;
+        }
+        for (const entry of this.resources.values()) {
+          entry.value?.destroy?.();
+        }
+        this.resources.clear();
+        this.handleSlots.clear();
+        this.pendingResize = null;
+        this.lastSequence = 0;
+      })
+      .catch(error => {
+        postMessage({ type: "error", message: error.message || String(error) });
+        this.stopped = true;
+      });
+  }
+
+  stop() {
+    this.stopped = true;
+    for (const entry of this.resources.values()) {
+      entry.value?.destroy?.();
+    }
+    this.pendingResize = null;
+    this.resources.clear();
+    this.handleSlots.clear();
+    this.device.destroy();
+  }
+}
+
+function align4(value) {
+  return (value + 3) & ~3;
+}
+
+function diagnosticBytes(message) {
+  const encoded = textEncoder.encode(String(message));
+  if (encoded.byteLength <= MAX_DIAGNOSTIC_BYTES) {
+    return { bytes: encoded, truncated: false };
+  }
+  let end = MAX_DIAGNOSTIC_BYTES;
+  while (end > 0) {
+    try {
+      textDecoder.decode(encoded.subarray(0, end));
+      break;
+    } catch {
+      end--;
+    }
+  }
+  return { bytes: encoded.slice(0, end), truncated: true };
+}
+
+function makeEvent(type, sequence, payload = new Uint8Array()) {
+  const bytes = new Uint8Array(EVENT_HEADER_BYTES + payload.byteLength);
+  const view = new DataView(bytes.buffer);
+  bytes.set(textEncoder.encode("EGE1"), 0);
+  view.setUint16(4, WIRE_VERSION, true);
+  view.setUint16(6, type, true);
+  view.setUint32(8, bytes.byteLength, true);
+  view.setBigUint64(16, BigInt(sequence), true);
+  bytes.set(payload, EVENT_HEADER_BYTES);
+  return bytes;
+}
+
+function postBytes(type, bytes) {
+  postMessage({ type, bytes }, [bytes.buffer]);
+}
+
+let engine = null;
+
+onmessage = event => {
+  const message = event.data;
+  if (message?.type === "init" && !engine) {
+    void GpuEngine.create(
+      message.canvas,
+      message.requirements || {},
+      message.dimensions,
+      message.testReadback === true,
+      message.testDeviceLoss === true
+    )
+      .then(created => {
+        engine = created;
+        postBytes("capabilities", engine.capabilities());
+      })
+      .catch(error =>
+        postMessage({ type: "error", message: error.message || String(error) })
+      );
+  } else if (message?.type === "batch" && engine) {
+    engine.submit(new Uint8Array(message.bytes));
+  } else if (message?.type === "resize" && engine) {
+    engine.scheduleResize(message.dimensions);
+  } else if (message?.type === "reset" && engine) {
+    engine.reset();
+  } else if (message?.type === "stop" && engine) {
+    engine.stop();
+    engine = null;
+  }
+};
diff --git a/apps/sandbox/public/pvm-runtime/pvm-wasm-worker.js b/apps/sandbox/public/pvm-runtime/pvm-wasm-worker.js
new file mode 100644
index 00000000..3fe1ee16
--- /dev/null
+++ b/apps/sandbox/public/pvm-runtime/pvm-wasm-worker.js
@@ -0,0 +1,2291 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+(() => {
+  const STATUS_FINISHED = -1;
+  const STATUS_ECALL = -2;
+  const STATUS_TRAP = -3;
+  const STATUS_OUT_OF_GAS = -4;
+  const INPUT_EVENT_BYTES = 8;
+  const MOTION_SAMPLE_BYTES = 48;
+  const MOTION_STATUS_UNAVAILABLE = 0;
+  const MOTION_STATUS_AVAILABLE = 1;
+  const MOTION_STATUS_PERMISSION_DENIED = 2;
+  const MOTION_ERROR_UNAVAILABLE = -1;
+  const MOTION_ERROR_PERMISSION_DENIED = -2;
+  const MOTION_ERROR_INVALID_GUEST_RANGE = -3;
+  const MOTION_ERROR_BUFFER_TOO_SMALL = -4;
+  const MAX_INPUT_EVENTS = 4096;
+  const MAX_HOSTCALLS_PER_INIT = 1024 * 1024;
+  const MAX_HOSTCALLS_PER_UPDATE = 8192;
+  const MAX_HOSTCALL_BYTES = 32 * 1024 * 1024;
+  const MAX_LOG_BYTES = 4 * 1024;
+  const MAX_SAVE_BYTES = 1024 * 1024;
+  const MAX_AUDIO_SAMPLES = 48000 * 2;
+  const MAX_FRAME_BYTES = 16 * 1024 * 1024;
+  const MAX_TRI2D_BYTES = 8 * 1024 * 1024;
+  const MAX_UI_SEMANTICS_BYTES = 256 * 1024;
+  const MAX_UI_SEMANTIC_NODES = 1024;
+  const MAX_UI_SEMANTIC_STRING_BYTES = 1024;
+  const MAX_GPU_BATCH_BYTES = 4 * 1024 * 1024;
+  const MAX_GPU_EVENT_BYTES = 64 * 1024;
+  const MAX_GPU_EVENTS = 256;
+  const MAX_GPU_SUBMITS_PER_UPDATE = 8;
+  const MAX_TRUAPI_FRAME_BYTES = 1024 * 1024;
+  const MAX_TRUAPI_FRAMES = 32;
+  const MAX_TRUAPI_QUEUE_BYTES = 4 * 1024 * 1024;
+  const MAX_GPU_COMMANDS = 16_384;
+  const GPU_ERROR_MALFORMED_BATCH = -2;
+  const GPU_ERROR_QUOTA_EXCEEDED = -3;
+  const GPU_ERROR_INVALID_STATE = -5;
+  const IOV_MAX = 1024n;
+  const AT_FDCWD = BigInt.asUintN(64, -100n);
+  const ENOSYS = 38;
+  const EFAULT = 14;
+  const ENOENT = 2;
+  const EBADF = 9;
+  const EACCES = 13;
+  const EINVAL = 22;
+  const SYS_OPENAT = 56n;
+  const SYS_CLOSE = 57n;
+  const SYS_LSEEK = 62n;
+  const SYS_READ = 63n;
+  const SYS_READV = 65n;
+  const SYS_WRITEV = 66n;
+  const SYS_EXIT = 93n;
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+
+  function validInputRecord(bytes) {
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength !== INPUT_EVENT_BYTES) {
+      return false;
+    }
+    const type = bytes[0];
+    if (type < 1 || type > 14) {
+      return false;
+    }
+    if (type <= 7) {
+      return bytes[6] === 0 && bytes[7] === 0;
+    }
+    if (type <= 10) {
+      const length = bytes[1] & 7;
+      if ((bytes[1] & ~0xc7) !== 0 || length > 6) {
+        return false;
+      }
+      return bytes.subarray(2 + length).every((byte) => byte === 0);
+    }
+    if (type === 11 || type === 12) {
+      return bytes.subarray(1).every((byte) => byte === 0);
+    }
+    if (type === 13) {
+      return bytes[1] <= 1 && bytes.subarray(2).every((byte) => byte === 0);
+    }
+    return bytes[1] === 0 && bytes[6] === 0 && bytes[7] === 0;
+  }
+
+  function validUiSemantics(bytes) {
+    let snapshot;
+    try {
+      snapshot = JSON.parse(decoder.decode(bytes));
+    } catch {
+      return false;
+    }
+    if (
+      snapshot?.version !== 1 ||
+      !Number.isSafeInteger(snapshot.generation) ||
+      snapshot.generation < 0 ||
+      !Array.isArray(snapshot.nodes) ||
+      !snapshot.nodes.length ||
+      snapshot.nodes.length > MAX_UI_SEMANTIC_NODES
+    ) {
+      return false;
+    }
+    const ids = new Set();
+    let roots = 0;
+    for (const node of snapshot.nodes) {
+      if (
+        typeof node?.id !== "string" ||
+        !/^[0-9a-f]{1,16}$/.test(node.id) ||
+        ids.has(node.id) ||
+        !Array.isArray(node.bounds) ||
+        node.bounds.length !== 4 ||
+        !node.bounds.every(Number.isFinite) ||
+        node.bounds[2] < node.bounds[0] ||
+        node.bounds[3] < node.bounds[1] ||
+        typeof node.name !== "string" ||
+        encoder.encode(node.name).byteLength > MAX_UI_SEMANTIC_STRING_BYTES ||
+        typeof node.value !== "string" ||
+        encoder.encode(node.value).byteLength > MAX_UI_SEMANTIC_STRING_BYTES
+      ) {
+        return false;
+      }
+      ids.add(node.id);
+      if (node.parent === null) {
+        roots++;
+      }
+    }
+    return (
+      roots === 1 &&
+      snapshot.nodes.every(
+        (node) => node.parent === null || ids.has(node.parent),
+      )
+    );
+  }
+
+  function readMetadata(module) {
+    const sections = WebAssembly.Module.customSections(
+      module,
+      "epoca.pvm.meta",
+    );
+    if (sections.length !== 1) {
+      throw new Error("translated PolkaVM module has invalid metadata");
+    }
+    const bytes = new Uint8Array(sections[0]);
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    let offset = 0;
+    const requireBytes = (length) => {
+      if (offset + length > bytes.byteLength) {
+        throw new Error("translated PolkaVM metadata is truncated");
+      }
+    };
+    const readU16 = () => {
+      requireBytes(2);
+      const value = view.getUint16(offset, true);
+      offset += 2;
+      return value;
+    };
+    const readU32 = () => {
+      requireBytes(4);
+      const value = view.getUint32(offset, true);
+      offset += 4;
+      return value;
+    };
+    const readString = (length) => {
+      requireBytes(length);
+      const value = decoder.decode(bytes.subarray(offset, offset + length));
+      offset += length;
+      return value;
+    };
+    requireBytes(4);
+    if (decoder.decode(bytes.subarray(0, 4)) !== "EPM2") {
+      throw new Error("translated PolkaVM metadata has an incompatible ABI");
+    }
+    offset = 4;
+    const is64Bit = readU32() !== 0;
+    const names = [
+      "roAddress",
+      "roSize",
+      "roPhysical",
+      "rwAddress",
+      "rwSize",
+      "rwPhysical",
+      "heapBase",
+      "heapLimit",
+      "stackLow",
+      "stackHigh",
+      "stackPhysical",
+    ];
+    const layout = {};
+    for (const name of names) {
+      layout[name] = readU32();
+    }
+    const imports = [];
+    const importCount = readU32();
+    for (let index = 0; index < importCount; index++) {
+      const length = readU16();
+      imports.push(length ? readString(length) : null);
+    }
+    const exports = new Map();
+    const exportCount = readU32();
+    for (let index = 0; index < exportCount; index++) {
+      const name = readString(readU16());
+      const block = readU32();
+      if (!name || exports.has(name)) {
+        throw new Error("translated PolkaVM metadata has invalid exports");
+      }
+      exports.set(name, block);
+    }
+    if (offset !== bytes.byteLength) {
+      throw new Error("translated PolkaVM metadata has trailing data");
+    }
+    return { is64Bit, layout, imports, exports };
+  }
+
+  function errno(code) {
+    return BigInt.asUintN(64, -BigInt(code));
+  }
+
+  function normalizedPath(path) {
+    while (path.startsWith("./")) {
+      path = path.slice(2);
+    }
+    return path.replace(/^\/+/, "");
+  }
+
+  function hidToCoreVm(code) {
+    if (code >= 0x04 && code <= 0x1d) {
+      return 0x61 + code - 0x04;
+    }
+    if (code >= 0x1e && code <= 0x26) {
+      return 0x31 + code - 0x1e;
+    }
+    const keys = new Map([
+      [0x27, 0x30],
+      [0x28, 0x0a],
+      [0x58, 0x0a],
+      [0x29, 0x1b],
+      [0x2a, 0x08],
+      [0x2b, 0x09],
+      [0x2c, 0x20],
+      [0x2d, 0x2d],
+      [0x56, 0x2d],
+      [0x2e, 0x3d],
+      [0x2f, 0x5b],
+      [0x30, 0x5d],
+      [0x31, 0x5c],
+      [0x33, 0x3b],
+      [0x34, 0x27],
+      [0x35, 0x60],
+      [0x36, 0x2c],
+      [0x37, 0x2e],
+      [0x63, 0x2e],
+      [0x38, 0x2f],
+      [0x54, 0x2f],
+      [0x46, 0x91],
+      [0x47, 0x92],
+      [0x48, 0x93],
+      [0x49, 0x94],
+      [0x4a, 0x96],
+      [0x4b, 0x98],
+      [0x4c, 0x95],
+      [0x4d, 0x97],
+      [0x4e, 0x99],
+      [0x4f, 0x82],
+      [0x50, 0x83],
+      [0x51, 0x81],
+      [0x52, 0x80],
+      [0x55, 0x2a],
+      [0x57, 0x2b],
+      [0x59, 0x97],
+      [0x5a, 0x81],
+      [0x5b, 0x99],
+      [0x5c, 0x83],
+      [0x5d, 0x35],
+      [0x5e, 0x82],
+      [0x5f, 0x96],
+      [0x60, 0x80],
+      [0x61, 0x98],
+      [0x62, 0x2e],
+      [0xe0, 0x9c],
+      [0xe1, 0x9a],
+      [0xe2, 0x9e],
+      [0xe4, 0x9d],
+      [0xe5, 0x9b],
+      [0xe6, 0x9f],
+    ]);
+    if (code >= 0x3a && code <= 0x45) {
+      return 0x84 + code - 0x3a;
+    }
+    return keys.get(code);
+  }
+
+  function validMotionSample(bytes) {
+    if (
+      !(bytes instanceof Uint8Array) ||
+      bytes.byteLength !== MOTION_SAMPLE_BYTES
+    ) {
+      return false;
+    }
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const flags = view.getUint16(6, true);
+    if (
+      bytes[0] !== 0x50 ||
+      bytes[1] !== 0x4d ||
+      bytes[2] !== 0x4f ||
+      bytes[3] !== 0x31 ||
+      view.getUint16(4, true) !== 1 ||
+      !flags ||
+      flags & ~7 ||
+      (flags & 4 && !(flags & 2)) ||
+      view.getUint32(8, true) !== MOTION_SAMPLE_BYTES ||
+      view.getUint32(12, true) === 0
+    ) {
+      return false;
+    }
+    const timestamp = view.getFloat64(16, true);
+    if (!Number.isFinite(timestamp) || timestamp < 0) {
+      return false;
+    }
+    for (let offset = 24; offset < MOTION_SAMPLE_BYTES; offset += 4) {
+      if (!Number.isFinite(view.getFloat32(offset, true))) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  class TranslatedPvmRuntime {
+    constructor(
+      module,
+      assets,
+      emit,
+      maxGas,
+      audioEnabled,
+      graphicsProfile,
+      gpuCapabilities = null,
+      motionAvailability = MOTION_STATUS_UNAVAILABLE,
+    ) {
+      this.metadata = readMetadata(module);
+      this.instance = new WebAssembly.Instance(module, {});
+      this.pvm = this.instance.exports;
+      this.memory = this.pvm.memory;
+      if (!(this.memory instanceof WebAssembly.Memory)) {
+        throw new Error("translated PolkaVM module is missing guest memory");
+      }
+      this.assets = new Map(
+        assets.map((asset) => [
+          normalizedPath(asset.path),
+          new Uint8Array(asset.bytes),
+        ]),
+      );
+      this.emit = emit;
+      this.audioEnabled = audioEnabled;
+      if (
+        !["framebuffer", "tri2d", "webgpu-raster"].includes(graphicsProfile)
+      ) {
+        throw new Error(
+          `translated PolkaVM runtime has invalid graphics profile ${graphicsProfile}`,
+        );
+      }
+      this.graphicsProfile = graphicsProfile;
+      if (
+        graphicsProfile === "webgpu-raster" &&
+        !(gpuCapabilities instanceof Uint8Array)
+      ) {
+        throw new Error(
+          "WebGPU capabilities are required before PVM initialization",
+        );
+      }
+      this.gpuCapabilities =
+        gpuCapabilities instanceof Uint8Array ? gpuCapabilities.slice() : null;
+      this.gpuEvents = [];
+      this.gpuSubmits = 0;
+      this.gpuLastSequence = 0n;
+      this.truapiRequests = 0;
+      this.truapiRequestBytes = 0;
+      this.truapiResponses = [];
+      this.truapiResponseBytes = 0;
+      this.tri2dSubmitted = false;
+      this.uiSemanticsSubmitted = false;
+      this.maxGas = BigInt(maxGas);
+      this.input = [];
+      this.coreInput = [];
+      this.epocaInput = [];
+      this.pointer = null;
+      this.setMotionAvailability(motionAvailability);
+      this.motionSample = null;
+      this.timeMs = null;
+      this.clockStartedAt = performance.now();
+      this.hostcalls = 0;
+      this.hostcallBytes = 0;
+      this.resumePending = false;
+      this.stopped = false;
+      this.coreVm = this.metadata.exports.has("_pvm_start");
+      if (this.coreVm && graphicsProfile !== "framebuffer") {
+        throw new Error(
+          "CoreVM guests require the framebuffer graphics profile",
+        );
+      }
+      this.coreVmStarted = false;
+      this.palette = new Uint32Array(256);
+      this.palette.fill(0xffffffff);
+      this.audioChannels = 0;
+      this.audioSampleRate = 0;
+      this.fds = new Map();
+      this.nextFd = 3;
+      this.imports = this.metadata.imports;
+      this.exports = this.metadata.exports;
+      for (let index = 0; index < 13; index++) {
+        if (!(this.pvm[`r${index}`] instanceof WebAssembly.Global)) {
+          throw new Error("translated PolkaVM module is missing registers");
+        }
+      }
+    }
+
+    initialize() {
+      this.#resetBudget(MAX_HOSTCALLS_PER_INIT);
+      if (this.coreVm) {
+        this.#setupCoreVm();
+        return;
+      }
+      const init = this.exports.get("init");
+      if (init !== undefined) {
+        this.#run(init, false);
+      }
+    }
+
+    usesMotion() {
+      return this.imports.includes("host_motion_read");
+    }
+
+    update(timeMs) {
+      if (this.stopped) {
+        return;
+      }
+      this.timeMs = timeMs;
+      this.gpuSubmits = 0;
+      this.truapiRequests = 0;
+      this.uiSemanticsSubmitted = false;
+      this.truapiRequestBytes = 0;
+      this.#resetBudget(
+        this.coreVm && !this.coreVmStarted
+          ? MAX_HOSTCALLS_PER_INIT
+          : MAX_HOSTCALLS_PER_UPDATE,
+      );
+      if (this.coreVm) {
+        this.#run(this.exports.get("_pvm_start"), true);
+        this.coreVmStarted = true;
+        return;
+      }
+      const update = this.exports.get("update");
+      if (update === undefined) {
+        throw new Error("translated PolkaVM guest has no update export");
+      }
+      this.#run(update, false);
+    }
+
+    sendInput(bytes) {
+      if (this.stopped || !validInputRecord(bytes)) {
+        return;
+      }
+      if (!this.coreVm) {
+        if (this.input.length === MAX_INPUT_EVENTS) {
+          this.input.shift();
+        }
+        this.input.push(bytes.slice());
+        return;
+      }
+      const view = new DataView(
+        bytes.buffer,
+        bytes.byteOffset,
+        bytes.byteLength,
+      );
+      const type = bytes[0];
+      if (
+        type === 6 &&
+        (Math.abs(view.getInt16(2, true)) > 127 ||
+          Math.abs(view.getInt16(4, true)) > 127)
+      ) {
+        return;
+      }
+      if (
+        this.imports.includes("pvm_fetch_epoca_inputs") ||
+        this.imports.includes("host_poll_input")
+      ) {
+        this.#queueEpocaInput(bytes);
+        return;
+      }
+      if (type === 1 || type === 2) {
+        const key = hidToCoreVm(bytes[1]);
+        if (key !== undefined) {
+          this.#queueCoreInput(key, type === 1 ? 1 : 0);
+        }
+      } else if (type === 3 || type === 4) {
+        const key =
+          bytes[1] >= 1 && bytes[1] <= 3 ? 0x9f + bytes[1] : undefined;
+        if (key !== undefined) {
+          this.#queueCoreInput(key, type === 3 ? 1 : 0);
+        }
+      } else if (type === 5) {
+        const current = [view.getUint16(2, true), view.getUint16(4, true)];
+        if (this.pointer) {
+          this.#queueCoreInput(
+            0xa3,
+            Math.max(-128, Math.min(127, current[0] - this.pointer[0])) & 0xff,
+          );
+          this.#queueCoreInput(
+            0xa4,
+            Math.max(-128, Math.min(127, current[1] - this.pointer[1])) & 0xff,
+          );
+        }
+        this.pointer = current;
+      } else if (type === 6) {
+        this.#queueCoreInput(
+          0xa3,
+          Math.max(-128, Math.min(127, view.getInt16(2, true))) & 0xff,
+        );
+        this.#queueCoreInput(
+          0xa4,
+          Math.max(-128, Math.min(127, view.getInt16(4, true))) & 0xff,
+        );
+      }
+    }
+
+    setMotionAvailability(availability) {
+      if (
+        !Number.isInteger(availability) ||
+        availability < MOTION_STATUS_UNAVAILABLE ||
+        availability > MOTION_STATUS_PERMISSION_DENIED
+      ) {
+        throw new Error(
+          "translated PolkaVM runtime has invalid motion availability",
+        );
+      }
+      this.motionAvailability = availability;
+      if (availability !== MOTION_STATUS_AVAILABLE) {
+        this.motionSample = null;
+      }
+    }
+
+    sendMotionSample(bytes) {
+      if (this.stopped || !validMotionSample(bytes)) {
+        throw new Error(
+          "translated PolkaVM runtime received an invalid motion sample",
+        );
+      }
+      this.motionAvailability = MOTION_STATUS_AVAILABLE;
+      this.motionSample = bytes.slice();
+    }
+
+    setGpuCapabilities(bytes) {
+      if (
+        this.stopped ||
+        !(bytes instanceof Uint8Array) ||
+        bytes.byteLength < 56 ||
+        bytes.byteLength > 4096
+      ) {
+        throw new Error("invalid translated WebGPU capabilities");
+      }
+      this.gpuCapabilities = bytes.slice();
+    }
+
+    sendGpuEvent(bytes) {
+      if (
+        this.stopped ||
+        !(bytes instanceof Uint8Array) ||
+        bytes.byteLength < 24 ||
+        bytes.byteLength > MAX_GPU_EVENT_BYTES ||
+        decoder.decode(bytes.subarray(0, 4)) !== "EGE1"
+      ) {
+        return;
+      }
+      if (this.gpuEvents.length === MAX_GPU_EVENTS) {
+        this.gpuEvents.shift();
+      }
+      this.gpuEvents.push(bytes.slice());
+    }
+
+    sendTruapiResponse(bytes) {
+      if (
+        this.stopped ||
+        !(bytes instanceof Uint8Array) ||
+        !bytes.byteLength ||
+        bytes.byteLength > MAX_TRUAPI_FRAME_BYTES
+      ) {
+        throw new Error("invalid translated TrUAPI response");
+      }
+      if (
+        this.truapiResponses.length === MAX_TRUAPI_FRAMES ||
+        this.truapiResponseBytes + bytes.byteLength > MAX_TRUAPI_QUEUE_BYTES
+      ) {
+        throw new Error("translated TrUAPI response queue overflow");
+      }
+      this.truapiResponses.push(bytes.slice());
+      this.truapiResponseBytes += bytes.byteLength;
+    }
+
+    stop() {
+      this.stopped = true;
+      this.input.length = 0;
+      this.coreInput.length = 0;
+      this.truapiRequests = 0;
+      this.truapiRequestBytes = 0;
+      this.gpuEvents.length = 0;
+      this.truapiResponses.length = 0;
+      this.truapiResponseBytes = 0;
+    }
+
+    #resetBudget(hostcalls) {
+      this.hostcalls = hostcalls;
+      this.hostcallBytes = MAX_HOSTCALL_BYTES;
+      this.tri2dSubmitted = false;
+      this.pvm.pvm_set_gas(this.maxGas);
+    }
+
+    #run(entry, yieldOnFrame) {
+      let status;
+      if (this.resumePending) {
+        this.resumePending = false;
+        status = this.pvm.pvm_resume();
+      } else {
+        if (entry === undefined) {
+          throw new Error("translated PolkaVM entrypoint is missing");
+        }
+        status = this.pvm.pvm_begin(entry, this.maxGas);
+      }
+      for (;;) {
+        if (status === STATUS_FINISHED) {
+          if (this.coreVm) {
+            throw new Error("CoreVM guest exited");
+          }
+          return;
+        }
+        if (status === STATUS_TRAP) {
+          throw new Error(
+            `translated PolkaVM execution trapped at ${this.pvm.trap_pc.value}`,
+          );
+        }
+        if (status === STATUS_OUT_OF_GAS) {
+          throw new Error("translated PolkaVM guest ran out of gas");
+        }
+        if (status !== STATUS_ECALL) {
+          throw new Error(
+            `translated PolkaVM returned invalid status ${status}`,
+          );
+        }
+        const importIndex = this.pvm.ecall.value >>> 0;
+        const name = this.imports[importIndex];
+        if (!name) {
+          throw new Error(
+            `translated PolkaVM called unknown import ${importIndex}`,
+          );
+        }
+        this.hostcalls--;
+        const yielded = this.coreVm
+          ? this.#handleCoreVmCall(name)
+          : this.#handleCooperativeCall(name);
+        if (yielded && yieldOnFrame) {
+          this.resumePending = true;
+          return;
+        }
+        if (this.hostcalls === 0) {
+          // Resume on the next worker tick after completing this ECALL. Large
+          // assets can require more than one bounded hostcall slice, while
+          // returning here keeps each slice capped and the worker responsive.
+          this.resumePending = true;
+          return;
+        }
+        status = this.pvm.pvm_resume();
+      }
+    }
+
+    #reg(index) {
+      return BigInt.asUintN(64, this.pvm[`r${index}`].value);
+    }
+
+    #setReg(index, value) {
+      const normalized = this.metadata.is64Bit
+        ? BigInt.asIntN(64, BigInt(value))
+        : BigInt.asUintN(32, BigInt(value));
+      this.pvm[`r${index}`].value = normalized;
+    }
+
+    #u32(value) {
+      return Number(value & 0xffffffffn) >>> 0;
+    }
+
+    #range(address, length, write = false) {
+      address >>>= 0;
+      length >>>= 0;
+      const end = address + length;
+      if (end > 0x100000000) {
+        throw new Error(
+          "translated PolkaVM guest memory access is out of range",
+        );
+      }
+      const { layout } = this.metadata;
+      let physical;
+      if (address >= layout.stackLow && end <= layout.stackHigh) {
+        physical = layout.stackPhysical + address - layout.stackLow;
+      } else if (
+        address >= layout.rwAddress &&
+        end <=
+          layout.rwAddress + this.memory.buffer.byteLength - layout.rwPhysical
+      ) {
+        physical = layout.rwPhysical + address - layout.rwAddress;
+      } else if (
+        !write &&
+        address >= layout.roAddress &&
+        end <= layout.roAddress + layout.roSize
+      ) {
+        physical = layout.roPhysical + address - layout.roAddress;
+      } else {
+        throw new Error(
+          "translated PolkaVM guest memory access is out of range",
+        );
+      }
+      return new Uint8Array(this.memory.buffer, physical, length);
+    }
+
+    #read(address, length) {
+      this.#chargeBytes(length);
+      return this.#range(address, length).slice();
+    }
+
+    #write(address, bytes) {
+      this.#chargeBytes(bytes.byteLength);
+      this.#range(address, bytes.byteLength, true).set(bytes);
+    }
+
+    #chargeBytes(length) {
+      if (
+        !Number.isSafeInteger(length) ||
+        length < 0 ||
+        length > this.hostcallBytes
+      ) {
+        throw new Error(
+          "translated PolkaVM guest exceeded hostcall byte budget",
+        );
+      }
+      this.hostcallBytes -= length;
+    }
+
+    #readU64(address) {
+      const bytes = this.#range(address >>> 0, 8);
+      return new DataView(bytes.buffer, bytes.byteOffset, 8).getBigUint64(
+        0,
+        true,
+      );
+    }
+
+    #writeU64(address, value) {
+      const bytes = this.#range(address >>> 0, 8, true);
+      new DataView(bytes.buffer, bytes.byteOffset, 8).setBigUint64(
+        0,
+        BigInt.asUintN(64, value),
+        true,
+      );
+    }
+
+    #readCString(address) {
+      const output = [];
+      for (let offset = 0; offset < 255; offset++) {
+        let byte;
+        try {
+          byte = this.#range((address + offset) >>> 0, 1)[0];
+        } catch {
+          return null;
+        }
+        if (!byte) {
+          return new Uint8Array(output);
+        }
+        output.push(byte);
+      }
+      return null;
+    }
+
+    // eslint-disable-next-line complexity -- Flat hostcall dispatch mirrors the guest ABI.
+    #handleCooperativeCall(name) {
+      const a0 = this.#reg(7);
+      const a1 = this.#reg(8);
+      const a2 = this.#reg(9);
+      const a3 = this.#reg(10);
+      const a4 = this.#reg(11);
+      switch (name) {
+        case "host_present_frame": {
+          const width = this.#u32(a1);
+          const height = this.#u32(a2);
+          const stride = this.#u32(a3);
+          const rowBytes = width * 4;
+          const length = rowBytes * height;
+          if (
+            !width ||
+            !height ||
+            stride !== rowBytes ||
+            length > MAX_FRAME_BYTES
+          ) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          if (this.graphicsProfile !== "framebuffer") {
+            this.#setReg(7, 3n);
+            return false;
+          }
+          const source = this.#read(this.#u32(a0), length);
+          const pixels = new Uint8Array(length);
+          for (let index = 0; index < length; index += 4) {
+            pixels[index] = source[index + 2];
+            pixels[index + 1] = source[index + 1];
+            pixels[index + 2] = source[index];
+            pixels[index + 3] = source[index + 3];
+          }
+          this.emit({ type: "frame", width, height, pixels }, [pixels.buffer]);
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_tri2d_submit": {
+          const length = this.#u32(a1);
+          if (!length || length > MAX_TRI2D_BYTES) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          if (this.graphicsProfile !== "tri2d") {
+            this.#setReg(7, 3n);
+            return false;
+          }
+          if (this.tri2dSubmitted) {
+            this.#setReg(7, 2n);
+            return false;
+          }
+          const bytes = this.#read(this.#u32(a0), length);
+          this.emit({ type: "tri2d", bytes }, [bytes.buffer]);
+          this.tri2dSubmitted = true;
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_ui_semantics_submit": {
+          const length = this.#u32(a1);
+          if (!length || length > MAX_UI_SEMANTICS_BYTES) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          if (this.uiSemanticsSubmitted) {
+            this.#setReg(7, 2n);
+            return false;
+          }
+          const bytes = this.#read(this.#u32(a0), length);
+          if (!validUiSemantics(bytes)) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          this.emit({ type: "ui-semantics", bytes }, [bytes.buffer]);
+          this.uiSemanticsSubmitted = true;
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_gpu_capabilities": {
+          if (this.graphicsProfile !== "webgpu-raster") {
+            this.#setReg(7, BigInt(GPU_ERROR_INVALID_STATE));
+            return false;
+          }
+          if (this.gpuCapabilities === null) {
+            this.#setReg(7, BigInt(GPU_ERROR_INVALID_STATE));
+            return false;
+          }
+          const capacity = this.#u32(a1);
+          const required = this.gpuCapabilities.byteLength;
+          if (capacity < required) {
+            this.#setReg(7, BigInt(-required));
+            return false;
+          }
+          this.#write(this.#u32(a0), this.gpuCapabilities);
+          this.#setReg(7, BigInt(required));
+          return false;
+        }
+        case "host_gpu_submit": {
+          if (this.graphicsProfile !== "webgpu-raster") {
+            this.#setReg(7, BigInt(GPU_ERROR_INVALID_STATE));
+            return false;
+          }
+          const length = this.#u32(a1);
+          if (this.gpuCapabilities === null) {
+            this.#setReg(7, BigInt(GPU_ERROR_INVALID_STATE));
+            return false;
+          }
+          if (
+            !length ||
+            length > MAX_GPU_BATCH_BYTES ||
+            this.gpuSubmits === MAX_GPU_SUBMITS_PER_UPDATE
+          ) {
+            this.#setReg(
+              7,
+              BigInt(
+                this.gpuSubmits === MAX_GPU_SUBMITS_PER_UPDATE
+                  ? GPU_ERROR_QUOTA_EXCEEDED
+                  : GPU_ERROR_MALFORMED_BATCH,
+              ),
+            );
+            return false;
+          }
+          const bytes = this.#read(this.#u32(a0), length);
+          const sequence = this.#gpuBatchSequence(bytes);
+          if (sequence === null) {
+            this.#setReg(7, BigInt(GPU_ERROR_MALFORMED_BATCH));
+            return false;
+          }
+          if (sequence <= this.gpuLastSequence) {
+            this.#setReg(7, BigInt(GPU_ERROR_INVALID_STATE));
+            return false;
+          }
+          this.gpuSubmits++;
+          this.gpuLastSequence = sequence;
+          this.emit({ type: "gpu-batch", bytes }, [bytes.buffer]);
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_gpu_receive": {
+          if (this.graphicsProfile !== "webgpu-raster") {
+            this.#setReg(7, BigInt(GPU_ERROR_INVALID_STATE));
+            return false;
+          }
+          const event = this.gpuEvents[0];
+          if (event === undefined) {
+            this.#setReg(7, 0n);
+            return false;
+          }
+          const capacity = this.#u32(a1);
+          if (capacity < event.byteLength) {
+            this.#setReg(7, BigInt(-event.byteLength));
+            return false;
+          }
+          this.#write(this.#u32(a0), event);
+          this.gpuEvents.shift();
+          this.#setReg(7, BigInt(event.byteLength));
+          return false;
+        }
+        case "host_poll_input": {
+          const capacity = this.#u32(a1);
+          const count = Math.min(
+            Math.floor(capacity / INPUT_EVENT_BYTES),
+            this.input.length,
+          );
+          const output = new Uint8Array(count * INPUT_EVENT_BYTES);
+          for (let index = 0; index < count; index++) {
+            output.set(this.input.shift(), index * INPUT_EVENT_BYTES);
+          }
+          this.#write(this.#u32(a0), output);
+          this.#setReg(7, BigInt(output.byteLength));
+          return false;
+        }
+        case "host_motion_read":
+          return this.#readMotion();
+        case "host_time_ms": {
+          const timeMs = this.timeMs ?? performance.now() - this.clockStartedAt;
+          this.#setReg(7, BigInt(Math.max(0, Math.trunc(timeMs))));
+          return false;
+        }
+        case "host_sleep_ms":
+          this.timeMs =
+            (this.timeMs ?? performance.now() - this.clockStartedAt) +
+            Math.min(this.#u32(a0), 50);
+          return false;
+        case "host_audio_submit": {
+          if (!this.audioEnabled) {
+            this.#setReg(7, 3n);
+            return false;
+          }
+          const sampleCount = this.#u32(a1);
+          if (
+            !sampleCount ||
+            sampleCount % 2 ||
+            sampleCount > MAX_AUDIO_SAMPLES
+          ) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          const samples = this.#read(this.#u32(a0), sampleCount * 2);
+          this.emit(
+            { type: "audio", sampleRate: 48000, channels: 2, samples },
+            [samples.buffer],
+          );
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_truapi_send": {
+          const length = this.#u32(a1);
+          if (!length || length > MAX_TRUAPI_FRAME_BYTES) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          if (
+            this.truapiRequests === MAX_TRUAPI_FRAMES ||
+            this.truapiRequestBytes + length > MAX_TRUAPI_QUEUE_BYTES
+          ) {
+            this.#setReg(7, 2n);
+            return false;
+          }
+          const bytes = this.#read(this.#u32(a0), length);
+          this.emit({ type: "truapi-request", bytes }, [bytes.buffer]);
+          this.truapiRequests++;
+          this.truapiRequestBytes += length;
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_truapi_poll": {
+          const response = this.truapiResponses[0];
+          if (response === undefined) {
+            this.#setReg(7, 0n);
+            return false;
+          }
+          const capacity = this.#u32(a1);
+          if (capacity < response.byteLength) {
+            this.#setReg(7, BigInt(-response.byteLength));
+            return false;
+          }
+          this.#write(this.#u32(a0), response);
+          this.truapiResponses.shift();
+          this.truapiResponseBytes -= response.byteLength;
+          this.#setReg(7, BigInt(response.byteLength));
+          return false;
+        }
+        case "host_asset_read": {
+          const nameLength = this.#u32(a1);
+          const offset = this.#u32(a2);
+          const destination = this.#u32(a3);
+          const capacity = this.#u32(a4);
+          if (!nameLength || nameLength > 1024) {
+            this.#setReg(7, 0n);
+            return false;
+          }
+          const assetName = decoder.decode(
+            this.#read(this.#u32(a0), nameLength),
+          );
+          const asset = this.assets.get(assetName);
+          if (!asset || offset >= asset.byteLength) {
+            this.#setReg(7, 0n);
+            return false;
+          }
+          const length = Math.min(
+            capacity,
+            asset.byteLength - offset,
+            16 * 1024 * 1024,
+          );
+          this.#write(destination, asset.subarray(offset, offset + length));
+          this.#setReg(7, BigInt(length));
+          return false;
+        }
+        case "host_save_submit": {
+          const length = this.#u32(a1);
+          if (!length || length > MAX_SAVE_BYTES) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          const bytes = this.#read(this.#u32(a0), length);
+          this.emit({ type: "save", bytes }, [bytes.buffer]);
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "host_log": {
+          const length = Math.min(this.#u32(a1), MAX_LOG_BYTES);
+          const message = decoder.decode(this.#read(this.#u32(a0), length));
+          this.emit({ type: "log", message });
+          return false;
+        }
+        default:
+          throw new Error(
+            `translated PolkaVM guest uses unsupported import ${name}`,
+          );
+      }
+    }
+
+    #gpuBatchSequence(bytes) {
+      if (
+        bytes.byteLength < 24 ||
+        decoder.decode(bytes.subarray(0, 4)) !== "EPG1"
+      ) {
+        return null;
+      }
+      const view = new DataView(
+        bytes.buffer,
+        bytes.byteOffset,
+        bytes.byteLength,
+      );
+      if (
+        view.getUint16(4, true) !== 1 ||
+        view.getUint16(6, true) !== 0 ||
+        view.getUint32(8, true) !== bytes.byteLength
+      ) {
+        return null;
+      }
+      const commandCount = view.getUint32(12, true);
+      const sequence = view.getBigUint64(16, true);
+      if (sequence === 0n || commandCount > MAX_GPU_COMMANDS) {
+        return null;
+      }
+      let offset = 24;
+      for (let index = 0; index < commandCount; index++) {
+        if (
+          offset + 8 > bytes.byteLength ||
+          view.getUint16(offset + 2, true) !== 0
+        ) {
+          return null;
+        }
+        const commandBytes = view.getUint32(offset + 4, true);
+        if (
+          commandBytes < 8 ||
+          commandBytes % 4 ||
+          commandBytes > bytes.byteLength - offset
+        ) {
+          return null;
+        }
+        offset += commandBytes;
+      }
+      return offset === bytes.byteLength ? sequence : null;
+    }
+
+    #setupCoreVm() {
+      let sp = BigInt(this.metadata.layout.stackHigh);
+      const argc = 1n;
+      sp -= (1n + argc + 1n + 0n + 1n + 4n) * 8n;
+      const addressInit = sp;
+      let pointer = sp;
+      this.#writeU64(Number(pointer), argc);
+      pointer += 8n;
+      const argument = encoder.encode("./quake\0");
+      sp -= BigInt(argument.byteLength);
+      this.#write(Number(sp), argument);
+      this.#writeU64(Number(pointer), sp);
+      pointer += 16n;
+      pointer += 8n;
+      this.#writeU64(Number(pointer), 6n);
+      this.#writeU64(Number(pointer + 8n), 4096n);
+      this.#setReg(1, sp);
+      this.#setReg(7, addressInit);
+    }
+
+    #readMotion() {
+      if (this.motionAvailability === MOTION_STATUS_UNAVAILABLE) {
+        this.#setReg(7, BigInt(MOTION_ERROR_UNAVAILABLE));
+        return false;
+      }
+      if (this.motionAvailability === MOTION_STATUS_PERMISSION_DENIED) {
+        this.#setReg(7, BigInt(MOTION_ERROR_PERMISSION_DENIED));
+        return false;
+      }
+      if (this.motionSample === null) {
+        this.#setReg(7, 0n);
+        return false;
+      }
+      if (this.#u32(this.#reg(8)) < MOTION_SAMPLE_BYTES) {
+        this.#setReg(7, BigInt(MOTION_ERROR_BUFFER_TOO_SMALL));
+        return false;
+      }
+      try {
+        this.#write(this.#u32(this.#reg(7)), this.motionSample);
+      } catch {
+        this.#setReg(7, BigInt(MOTION_ERROR_INVALID_GUEST_RANGE));
+        return false;
+      }
+      this.motionSample = null;
+      this.#setReg(7, BigInt(MOTION_SAMPLE_BYTES));
+      return false;
+    }
+
+    #queueEpocaInput(bytes) {
+      const event = bytes.slice();
+      if (event[0] === 5 || event[0] === 6) {
+        const existing = this.epocaInput.findIndex(
+          (queued) => queued[0] === event[0],
+        );
+        if (existing !== -1) {
+          this.epocaInput[existing] = event;
+          return;
+        }
+      }
+      if (this.epocaInput.length === 256) {
+        this.epocaInput.shift();
+      }
+      this.epocaInput.push(event);
+    }
+
+    #queueCoreInput(key, value) {
+      if (!value && (key === 0xa3 || key === 0xa4)) {
+        return;
+      }
+      if (key === 0xa3 || key === 0xa4) {
+        const existing = this.coreInput.find((event) => event[0] === key);
+        if (existing) {
+          existing[1] = value;
+          return;
+        }
+      }
+      if (this.coreInput.length === 256) {
+        this.coreInput.shift();
+      }
+      this.coreInput.push([key, value]);
+    }
+
+    // eslint-disable-next-line complexity -- Flat hostcall dispatch mirrors the guest ABI.
+    #handleCoreVmCall(name) {
+      switch (name) {
+        case "host_truapi_send":
+        case "host_truapi_poll":
+        case "host_motion_read":
+          return this.#handleCooperativeCall(name);
+        case "pvm_set_palette": {
+          const palette = this.#read(this.#u32(this.#reg(7)), 256 * 3);
+          for (let index = 0; index < 256; index++) {
+            const offset = index * 3;
+            this.palette[index] =
+              palette[offset] |
+              (palette[offset + 1] << 8) |
+              (palette[offset + 2] << 16) |
+              0xff000000;
+          }
+          return false;
+        }
+        case "pvm_display": {
+          const width = this.#u32(this.#reg(7));
+          const height = this.#u32(this.#reg(8));
+          const length = width * height;
+          if (!width || !height || length > MAX_FRAME_BYTES / 4) {
+            throw new Error("CoreVM guest supplied invalid frame dimensions");
+          }
+          const indices = this.#read(this.#u32(this.#reg(9)), length);
+          const pixels = new Uint8Array(length * 4);
+          const rgba = new Uint32Array(pixels.buffer);
+          for (let index = 0; index < length; index++) {
+            rgba[index] = this.palette[indices[index]];
+          }
+          this.emit({ type: "frame", width, height, pixels }, [pixels.buffer]);
+          return true;
+        }
+        case "pvm_fetch_epoca_inputs": {
+          const count = Math.min(
+            this.#u32(this.#reg(8)),
+            this.epocaInput.length,
+          );
+          const output = new Uint8Array(count * INPUT_EVENT_BYTES);
+          for (let index = 0; index < count; index++) {
+            output.set(this.epocaInput.shift(), index * INPUT_EVENT_BYTES);
+          }
+          this.#write(this.#u32(this.#reg(7)), output);
+          this.#setReg(7, BigInt(count));
+          return false;
+        }
+        case "pvm_fetch_inputs": {
+          const count = Math.min(
+            this.#u32(this.#reg(8)),
+            this.coreInput.length,
+          );
+          const output = new Uint8Array(count * 2);
+          for (let index = 0; index < count; index++) {
+            output.set(this.coreInput.shift(), index * 2);
+          }
+          this.#write(this.#u32(this.#reg(7)), output);
+          this.#setReg(7, BigInt(count));
+          return false;
+        }
+        case "pvm_asset_read": {
+          const nameLength = this.#u32(this.#reg(8));
+          const offset = this.#u32(this.#reg(9));
+          const destination = this.#u32(this.#reg(10));
+          const capacity = this.#u32(this.#reg(11));
+          if (!nameLength || nameLength > 1024) {
+            this.#setReg(7, 0n);
+            return false;
+          }
+          const assetName = decoder.decode(
+            this.#read(this.#u32(this.#reg(7)), nameLength),
+          );
+          const asset = this.assets.get(assetName);
+          if (!asset || offset >= asset.byteLength) {
+            this.#setReg(7, 0n);
+            return false;
+          }
+          const length = Math.min(
+            capacity,
+            asset.byteLength - offset,
+            16 * 1024 * 1024,
+          );
+          this.#write(destination, asset.subarray(offset, offset + length));
+          this.#setReg(7, BigInt(length));
+          return false;
+        }
+        case "host_audio_submit": {
+          if (!this.audioEnabled) {
+            this.#setReg(7, 3n);
+            return false;
+          }
+          const sampleCount = this.#u32(this.#reg(8));
+          if (
+            !sampleCount ||
+            sampleCount % 2 ||
+            sampleCount > MAX_AUDIO_SAMPLES
+          ) {
+            this.#setReg(7, 1n);
+            return false;
+          }
+          const samples = this.#read(this.#u32(this.#reg(7)), sampleCount * 2);
+          this.emit(
+            { type: "audio", sampleRate: 48000, channels: 2, samples },
+            [samples.buffer],
+          );
+          this.#setReg(7, 0n);
+          return false;
+        }
+        case "pvm_time_ms": {
+          const timeMs = this.timeMs ?? performance.now() - this.clockStartedAt;
+          this.#setReg(7, BigInt(Math.max(0, Math.trunc(timeMs))));
+          return false;
+        }
+        case "host_log": {
+          const length = Math.min(this.#u32(this.#reg(8)), MAX_LOG_BYTES);
+          const message = decoder.decode(
+            this.#read(this.#u32(this.#reg(7)), length),
+          );
+          this.emit({ type: "log", message });
+          return false;
+        }
+        case "pvm_yield":
+          return true;
+        case "pvm_init_audio": {
+          const channels = this.#u32(this.#reg(7));
+          const bitsPerSample = this.#u32(this.#reg(8));
+          const sampleRate = this.#u32(this.#reg(9));
+          if (
+            bitsPerSample !== 16 ||
+            channels < 1 ||
+            channels > 2 ||
+            sampleRate < 8000 ||
+            sampleRate > 96000
+          ) {
+            this.#setReg(7, 0n);
+          } else {
+            this.audioChannels = channels;
+            this.audioSampleRate = sampleRate;
+            this.#setReg(7, 1n);
+          }
+          return false;
+        }
+        case "pvm_output_audio": {
+          const frames = this.#u32(this.#reg(8));
+          const sampleCount = Math.min(frames * this.audioChannels, 1024 * 64);
+          if (this.audioChannels && sampleCount) {
+            const samples = this.#read(
+              this.#u32(this.#reg(7)),
+              sampleCount * 2,
+            );
+            this.emit(
+              {
+                type: "audio",
+                sampleRate: this.audioSampleRate,
+                channels: this.audioChannels,
+                samples,
+              },
+              [samples.buffer],
+            );
+          }
+          return false;
+        }
+        case "pvm_syscall":
+          return this.#handleCoreVmSyscall();
+        default:
+          throw new Error(
+            `translated CoreVM guest uses unsupported import ${name}`,
+          );
+      }
+    }
+
+    #handleCoreVmSyscall() {
+      const syscall = this.#reg(7);
+      const a1 = this.#reg(8);
+      const a2 = this.#reg(9);
+      const a3 = this.#reg(10);
+      if (syscall === SYS_READ) {
+        this.#setReg(7, this.#readFile(a1, a2, a3));
+      } else if (syscall === SYS_READV || syscall === SYS_WRITEV) {
+        if (!a3 || a3 > IOV_MAX) {
+          this.#setReg(7, errno(EINVAL));
+          return false;
+        }
+        let total = 0n;
+        for (let index = 0n; index < a3; index++) {
+          let address;
+          let length;
+          try {
+            address = this.#readU64(this.#u32(a2 + index * 16n));
+            length = this.#readU64(this.#u32(a2 + index * 16n + 8n));
+          } catch {
+            this.#setReg(7, errno(EFAULT));
+            return false;
+          }
+          const result =
+            syscall === SYS_READV
+              ? this.#readFile(a1, address, length)
+              : this.#writeFile(a1, address, length);
+          if (BigInt.asIntN(64, result) < 0n) {
+            this.#setReg(7, result);
+            return false;
+          }
+          total += length;
+        }
+        this.#setReg(7, total);
+      } else if (syscall === SYS_EXIT) {
+        if (a1 === 0n) {
+          throw new Error("CoreVM guest exited");
+        }
+        throw new Error(`CoreVM guest exited with status ${a1}`);
+      } else if (syscall === SYS_OPENAT) {
+        if (a1 !== AT_FDCWD) {
+          this.#setReg(7, errno(ENOSYS));
+          return false;
+        }
+        const pathBytes = this.#readCString(this.#u32(a2));
+        if (!pathBytes) {
+          this.#setReg(7, errno(EFAULT));
+          return false;
+        }
+        const path = normalizedPath(decoder.decode(pathBytes));
+        const flags = a3;
+        const asset = this.assets.get(path);
+        if (!asset) {
+          this.#setReg(7, errno(ENOENT));
+        } else if (flags & 3n) {
+          this.#setReg(7, errno(EACCES));
+        } else {
+          const fd = this.nextFd++;
+          this.fds.set(fd, { bytes: asset, position: 0n });
+          this.#setReg(7, BigInt(fd));
+        }
+      } else if (syscall === SYS_LSEEK) {
+        this.#setReg(7, this.#seekFile(a1, a2, a3));
+      } else if (syscall === SYS_CLOSE) {
+        const fd = this.#fdNumber(a1);
+        if (fd === null || !this.fds.delete(fd)) {
+          this.#setReg(7, errno(EBADF));
+        } else {
+          this.#setReg(7, 0n);
+        }
+      } else {
+        this.#setReg(7, errno(ENOSYS));
+      }
+      return false;
+    }
+
+    #fdNumber(value) {
+      return value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : null;
+    }
+
+    #readFile(fdValue, address, length) {
+      const fd = this.#fdNumber(fdValue);
+      const file = fd === null ? null : this.fds.get(fd);
+      if (!file) {
+        return errno(EBADF);
+      }
+      if (
+        address + length > 0x100000000n ||
+        length > BigInt(MAX_HOSTCALL_BYTES)
+      ) {
+        return errno(EFAULT);
+      }
+      const end =
+        file.position + length < BigInt(file.bytes.byteLength)
+          ? file.position + length
+          : BigInt(file.bytes.byteLength);
+      if (file.position >= end) {
+        return 0n;
+      }
+      const count = Number(end - file.position);
+      try {
+        this.#write(
+          this.#u32(address),
+          file.bytes.subarray(
+            Number(file.position),
+            Number(file.position) + count,
+          ),
+        );
+      } catch {
+        return errno(EFAULT);
+      }
+      file.position += BigInt(count);
+      return BigInt(count);
+    }
+
+    #writeFile(fdValue, address, length) {
+      if (fdValue !== 1n && fdValue !== 2n) {
+        return errno(EBADF);
+      }
+      if (
+        address + length > 0x100000000n ||
+        length > BigInt(MAX_HOSTCALL_BYTES)
+      ) {
+        return errno(EFAULT);
+      }
+      try {
+        const byteLength = Number(length);
+        this.#chargeBytes(byteLength);
+        const bytes = this.#range(this.#u32(address), byteLength);
+        const message = decoder.decode(bytes.subarray(0, MAX_LOG_BYTES));
+        if (message) {
+          this.emit({ type: "log", message });
+        }
+      } catch {
+        return errno(EFAULT);
+      }
+      return length;
+    }
+
+    #seekFile(fdValue, offsetValue, whence) {
+      const fd = this.#fdNumber(fdValue);
+      const file = fd === null ? null : this.fds.get(fd);
+      if (!file) {
+        return errno(EBADF);
+      }
+      const offset = BigInt.asIntN(64, offsetValue);
+      const fileLength = BigInt(file.bytes.byteLength);
+      if (whence === 0n) {
+        file.position = BigInt.asUintN(64, offset);
+      } else if (whence === 1n) {
+        file.position = BigInt.asUintN(
+          64,
+          BigInt.asIntN(64, file.position) + offset,
+        );
+        if (file.position > fileLength) {
+          file.position = fileLength;
+        }
+      } else if (whence === 2n) {
+        file.position = BigInt.asUintN(
+          64,
+          BigInt.asIntN(64, fileLength) + offset,
+        );
+        if (file.position > fileLength) {
+          file.position = fileLength;
+        }
+      } else {
+        return errno(EINVAL);
+      }
+      return file.position;
+    }
+  }
+
+  globalThis.TranslatedPvmRuntime = TranslatedPvmRuntime;
+})();
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/**
+ * Creates the bounded PolkaVM endpoint in a Worker or on a host thread.
+ *
+ * @param {DedicatedWorkerGlobalScope} endpoint - Message endpoint owned by the runtime.
+ */
+globalThis.createPvmRuntime = (endpoint) => {
+  const postMessage = (message, transfers) => {
+    if (transfers) {
+      endpoint.postMessage(message, transfers);
+    } else {
+      endpoint.postMessage(message);
+    }
+  };
+
+  const FRAME_INTERVAL_MS = 1000 / 60;
+  const MAX_GAS_PER_UPDATE = 500_000_000;
+  const MAX_TRANSLATED_LOOPS_PER_UPDATE = 50_000_000;
+  const MAX_PROGRAM_BYTES = 16 * 1024 * 1024;
+  const MAX_ASSET_FILES = 2048;
+  const MAX_ASSET_NAME_BYTES = 1024;
+  const MAX_ASSET_FILE_BYTES = 64 * 1024 * 1024;
+  const MAX_ASSET_BYTES = 128 * 1024 * 1024;
+  const MOTION_SAMPLE_BYTES = 48;
+  const FORCE_INTERPRETER = Symbol("force-interpreter");
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+
+  let pvm;
+  let translated;
+  let backend = "interpreter";
+  let running = false;
+  let disposed = false;
+  let motionAvailability = 0;
+  let pendingMotionSample = null;
+  let pendingGpuCapabilities = null;
+  let timer;
+  let startedAt = 0;
+  let updateCount = 0;
+  const updateSamples = [];
+  const tickChannel = new MessageChannel();
+  tickChannel.port1.onmessage = tick;
+
+  function stopRuntime() {
+    if (disposed) {
+      return;
+    }
+    disposed = true;
+    running = false;
+    clearTimeout(timer);
+    translated?.stop();
+    pvm?.pvm_browser_reset?.();
+    tickChannel.port1.close();
+    tickChannel.port2.close();
+    endpoint.onmessage = null;
+  }
+
+  function errorText() {
+    const pointer = pvm.pvm_browser_error_pointer();
+    const length = pvm.pvm_browser_error_length();
+    return decoder.decode(new Uint8Array(pvm.memory.buffer, pointer, length));
+  }
+
+  function check(status, operation) {
+    if (status !== 0) {
+      throw new Error(`${operation}: ${errorText()}`);
+    }
+  }
+
+  function stage(bytes) {
+    const source =
+      bytes instanceof Uint8Array
+        ? bytes
+        : new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const pointer = pvm.pvm_browser_staging_reserve(source.byteLength);
+    if (!pointer) {
+      throw new Error(`reserve browser runtime memory: ${errorText()}`);
+    }
+    new Uint8Array(pvm.memory.buffer, pointer, source.byteLength).set(source);
+  }
+
+  function addAsset(asset) {
+    const path = encoder.encode(asset.path.replace(/^\/+/, ""));
+    const bytes = new Uint8Array(asset.bytes);
+    const packed = new Uint8Array(path.byteLength + bytes.byteLength);
+    packed.set(path);
+    packed.set(bytes, path.byteLength);
+    stage(packed);
+    check(
+      pvm.pvm_browser_launch_add_asset(path.byteLength),
+      `mount browser asset ${asset.path}`,
+    );
+  }
+
+  function drainFrame() {
+    if (!pvm.pvm_browser_take_frame()) {
+      return;
+    }
+    const width = pvm.pvm_browser_frame_width();
+    const height = pvm.pvm_browser_frame_height();
+    const length = pvm.pvm_browser_frame_length();
+    const source = new Uint8Array(
+      pvm.memory.buffer,
+      pvm.pvm_browser_frame_pointer(),
+      length,
+    );
+    const pixels = new Uint8Array(length);
+    for (let index = 0; index < length; index += 4) {
+      pixels[index] = source[index + 2];
+      pixels[index + 1] = source[index + 1];
+      pixels[index + 2] = source[index];
+      pixels[index + 3] = source[index + 3];
+    }
+    postMessage({ type: "frame", width, height, pixels }, [pixels.buffer]);
+  }
+
+  function drainTri2d() {
+    if (!pvm.pvm_browser_take_tri2d?.()) {
+      return;
+    }
+    const length = pvm.pvm_browser_tri2d_length();
+    const bytes = new Uint8Array(
+      pvm.memory.buffer,
+      pvm.pvm_browser_tri2d_pointer(),
+      length,
+    ).slice();
+    postMessage({ type: "tri2d", bytes }, [bytes.buffer]);
+  }
+
+  function drainUiSemantics() {
+    if (!pvm.pvm_browser_take_ui_semantics?.()) {
+      return;
+    }
+    const length = pvm.pvm_browser_ui_semantics_length();
+    const bytes = new Uint8Array(
+      pvm.memory.buffer,
+      pvm.pvm_browser_ui_semantics_pointer(),
+      length,
+    ).slice();
+    postMessage({ type: "ui-semantics", bytes }, [bytes.buffer]);
+  }
+
+  function drainGpuBatches() {
+    while (pvm.pvm_browser_take_gpu_batch?.()) {
+      const length = pvm.pvm_browser_gpu_batch_length();
+      const bytes = new Uint8Array(
+        pvm.memory.buffer,
+        pvm.pvm_browser_gpu_batch_pointer(),
+        length,
+      ).slice();
+      postMessage({ type: "gpu-batch", bytes }, [bytes.buffer]);
+    }
+  }
+
+  function drainTruapiRequests() {
+    while (pvm.pvm_browser_take_truapi_request?.()) {
+      const length = pvm.pvm_browser_truapi_request_length();
+      const bytes = new Uint8Array(
+        pvm.memory.buffer,
+        pvm.pvm_browser_truapi_request_pointer(),
+        length,
+      ).slice();
+      postMessage({ type: "truapi-request", bytes }, [bytes.buffer]);
+    }
+  }
+
+  function drainAudio() {
+    while (pvm.pvm_browser_take_audio()) {
+      const sampleRate = pvm.pvm_browser_audio_sample_rate();
+      const channels = pvm.pvm_browser_audio_channels();
+      const length = pvm.pvm_browser_audio_length() * 2;
+      const samples = new Uint8Array(
+        pvm.memory.buffer,
+        pvm.pvm_browser_audio_pointer(),
+        length,
+      ).slice();
+      postMessage({ type: "audio", sampleRate, channels, samples }, [
+        samples.buffer,
+      ]);
+    }
+  }
+
+  function drainSave() {
+    while (pvm.pvm_browser_take_save()) {
+      const length = pvm.pvm_browser_save_length();
+      const bytes = new Uint8Array(
+        pvm.memory.buffer,
+        pvm.pvm_browser_save_pointer(),
+        length,
+      ).slice();
+      postMessage({ type: "save", bytes }, [bytes.buffer]);
+    }
+  }
+
+  function drainLogs() {
+    while (pvm.pvm_browser_take_log()) {
+      const pointer = pvm.pvm_browser_log_pointer();
+      const length = pvm.pvm_browser_log_length();
+      const message = decoder.decode(
+        new Uint8Array(pvm.memory.buffer, pointer, length),
+      );
+      postMessage({ type: "log", message });
+    }
+  }
+
+  function tick() {
+    if (!running) {
+      return;
+    }
+    const firstUpdate = updateCount === 0;
+    if (firstUpdate) {
+      postMessage({ type: "startup", stage: "first-update-started" });
+    }
+    const before = performance.now();
+    try {
+      if (translated) {
+        translated.update(before - startedAt);
+      } else {
+        check(
+          pvm.pvm_browser_update(before - startedAt),
+          "update PolkaVM browser guest",
+        );
+        drainFrame();
+        drainTri2d();
+        drainUiSemantics();
+        drainGpuBatches();
+        drainTruapiRequests();
+        drainAudio();
+        drainSave();
+        drainLogs();
+      }
+    } catch (error) {
+      stopRuntime();
+      postMessage({ type: "error", message: error.message });
+      postMessage({ type: "terminated" });
+      return;
+    }
+    const elapsed = performance.now() - before;
+    if (firstUpdate) {
+      postMessage({ type: "startup", stage: "first-update-completed" });
+    }
+    updateCount++;
+    updateSamples.push(elapsed);
+    if (updateSamples.length > 600) {
+      updateSamples.shift();
+    }
+    if (updateCount % 120 === 0) {
+      const sorted = [...updateSamples].sort((a, b) => a - b);
+      const percentile = (value) =>
+        sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * value))];
+      postMessage({
+        type: "metrics",
+        updates: updateCount,
+        updateP50Ms: percentile(0.5),
+        updateP95Ms: percentile(0.95),
+        updateMaxMs: sorted[sorted.length - 1],
+      });
+    }
+    const delay = FRAME_INTERVAL_MS - elapsed;
+    if (delay > 0) {
+      timer = setTimeout(tick, delay);
+    } else {
+      tickChannel.port2.postMessage(null);
+    }
+  }
+
+  function asBytes(value, label) {
+    if (value instanceof ArrayBuffer) {
+      return new Uint8Array(value);
+    }
+    if (ArrayBuffer.isView(value)) {
+      return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+    }
+    throw new Error(`${label} must be binary data`);
+  }
+
+  function validateAssetPath(path) {
+    const encoded = encoder.encode(path);
+    if (
+      !path ||
+      encoded.byteLength > MAX_ASSET_NAME_BYTES ||
+      path.startsWith("/") ||
+      path.includes("\\") ||
+      path
+        .split("/")
+        .some(
+          (component) => !component || component === "." || component === "..",
+        )
+    ) {
+      throw new Error(`invalid PolkaVM browser asset path ${path}`);
+    }
+  }
+
+  function validateStartMessage(message) {
+    if (
+      !(message.runtime instanceof WebAssembly.Module) &&
+      asBytes(message.runtime, "PolkaVM browser runtime").byteLength === 0
+    ) {
+      throw new Error("PolkaVM browser runtime is empty");
+    }
+    const program = asBytes(message.program, "PolkaVM browser program");
+    if (!program.byteLength || program.byteLength > MAX_PROGRAM_BYTES) {
+      throw new Error(
+        `PolkaVM browser program must contain 1..=${MAX_PROGRAM_BYTES} bytes`,
+      );
+    }
+    if (
+      !["framebuffer", "tri2d", "webgpu-raster"].includes(
+        message.graphicsProfile,
+      )
+    ) {
+      throw new Error(
+        `invalid PolkaVM browser graphics profile ${message.graphicsProfile}`,
+      );
+    }
+    if (
+      !Array.isArray(message.assets) ||
+      message.assets.length > MAX_ASSET_FILES
+    ) {
+      throw new Error(
+        `PolkaVM browser launch exceeds ${MAX_ASSET_FILES} assets`,
+      );
+    }
+    const paths = new Set();
+    let assetBytes = 0;
+    for (const asset of message.assets) {
+      if (!asset || typeof asset.path !== "string") {
+        throw new Error("PolkaVM browser asset is missing its path");
+      }
+      validateAssetPath(asset.path);
+      if (paths.has(asset.path)) {
+        throw new Error(
+          `PolkaVM browser asset path is duplicated: ${asset.path}`,
+        );
+      }
+      paths.add(asset.path);
+      const length = asBytes(
+        asset.bytes,
+        `PolkaVM browser asset ${asset.path}`,
+      ).byteLength;
+      if (length > MAX_ASSET_FILE_BYTES) {
+        throw new Error(
+          `PolkaVM browser asset ${asset.path} exceeds ${MAX_ASSET_FILE_BYTES} bytes`,
+        );
+      }
+      assetBytes += length;
+      if (!Number.isSafeInteger(assetBytes) || assetBytes > MAX_ASSET_BYTES) {
+        throw new Error(
+          `PolkaVM browser assets exceed ${MAX_ASSET_BYTES} bytes`,
+        );
+      }
+    }
+    if (
+      message.graphicsProfile === "webgpu-raster" &&
+      !(message.gpuCapabilities instanceof ArrayBuffer)
+    ) {
+      throw new Error(
+        "WebGPU capabilities are required before PVM initialization",
+      );
+    }
+    if (
+      message.motionAvailability !== undefined &&
+      (!Number.isInteger(message.motionAvailability) ||
+        message.motionAvailability < 0 ||
+        message.motionAvailability > 2)
+    ) {
+      throw new Error("invalid PolkaVM browser motion availability");
+    }
+    return program;
+  }
+
+  async function start(message) {
+    if (disposed) {
+      throw new Error("PolkaVM browser worker is stopped");
+    }
+    if (pvm || running) {
+      throw new Error("PolkaVM browser worker is already started");
+    }
+    const program = validateStartMessage(message);
+    motionAvailability = message.motionAvailability ?? 0;
+    pendingGpuCapabilities =
+      message.gpuCapabilities instanceof ArrayBuffer
+        ? new Uint8Array(message.gpuCapabilities).slice()
+        : null;
+    const bootStarted = performance.now();
+    let translationMs = 0;
+    let compilationMs = 0;
+    let translatedWasmBytes = 0;
+    let cacheHit = false;
+    postMessage({ type: "startup", stage: "runtime-instantiating" });
+    const instantiated = await WebAssembly.instantiate(message.runtime, {});
+    pvm = instantiated.instance.exports;
+    if (pvm.pvm_browser_abi_version() !== 1) {
+      throw new Error("PolkaVM browser runtime has an incompatible ABI");
+    }
+    postMessage({ type: "startup", stage: "runtime-instantiated" });
+    const pendingOutputs = [];
+    try {
+      if (message.forceInterpreter === true) {
+        throw FORCE_INTERPRETER;
+      }
+      stage(program);
+      let module = message.compiledModule;
+      let bytes =
+        message.compiledBytes instanceof ArrayBuffer
+          ? new Uint8Array(message.compiledBytes)
+          : null;
+      cacheHit = module instanceof WebAssembly.Module || bytes !== null;
+      if (!(module instanceof WebAssembly.Module)) {
+        if (bytes === null) {
+          const translationStarted = performance.now();
+          check(
+            pvm.pvm_browser_translate_staged(),
+            "translate PolkaVM browser guest",
+          );
+          translationMs = performance.now() - translationStarted;
+          const pointer = pvm.pvm_browser_translation_pointer();
+          const length = pvm.pvm_browser_translation_length();
+          bytes = new Uint8Array(pvm.memory.buffer, pointer, length).slice();
+          const persistent = bytes.slice();
+          postMessage(
+            {
+              type: "translated",
+              cacheKey: message.cacheKey,
+              bytes: persistent,
+            },
+            [persistent.buffer],
+          );
+        }
+        translatedWasmBytes = bytes.byteLength;
+        const compilationStarted = performance.now();
+        module = await WebAssembly.compile(bytes);
+        compilationMs = performance.now() - compilationStarted;
+        try {
+          postMessage({ type: "compiled", cacheKey: message.cacheKey, module });
+        } catch {}
+      }
+      translated = new globalThis.TranslatedPvmRuntime(
+        module,
+        message.assets,
+        (output, transfers = []) => {
+          if (running) {
+            postMessage(output, transfers);
+          } else {
+            pendingOutputs.push({ output, transfers });
+          }
+        },
+        MAX_TRANSLATED_LOOPS_PER_UPDATE,
+        message.audioEnabled,
+        message.graphicsProfile,
+        pendingGpuCapabilities,
+        motionAvailability,
+      );
+      if (pendingMotionSample !== null) {
+        translated.sendMotionSample(pendingMotionSample);
+      }
+      translated.initialize();
+      pendingGpuCapabilities = null;
+      pendingMotionSample = null;
+      backend = "compiler";
+    } catch (error) {
+      translated = null;
+      pendingOutputs.length = 0;
+      if (error !== FORCE_INTERPRETER) {
+        console.warn(`PolkaVM translation failed; using interpreter: ${error}`);
+      }
+      let presentation = 0;
+      if (message.graphicsProfile === "tri2d") {
+        presentation = 1;
+      } else if (message.graphicsProfile === "webgpu-raster") {
+        presentation = 2;
+      }
+      const begin = pvm.pvm_browser_launch_begin_v2;
+      if (typeof begin !== "function") {
+        throw new Error(
+          "PolkaVM interpreter does not support graphics profiles",
+        );
+      }
+      postMessage({ type: "startup", stage: "interpreter-staging-program" });
+      stage(program);
+      postMessage({ type: "startup", stage: "interpreter-program-staged" });
+      postMessage({ type: "startup", stage: "interpreter-launch-begin" });
+      check(
+        begin(MAX_GAS_PER_UPDATE, message.audioEnabled ? 1 : 0, presentation),
+        "begin PolkaVM browser launch",
+      );
+      postMessage({ type: "startup", stage: "interpreter-launch-begun" });
+      postMessage({ type: "startup", stage: "interpreter-mounting-assets" });
+      for (const asset of message.assets) {
+        addAsset(asset);
+      }
+      postMessage({ type: "startup", stage: "interpreter-assets-mounted" });
+      postMessage({ type: "startup", stage: "interpreter-launch-starting" });
+      check(pvm.pvm_browser_launch_start(), "start PolkaVM browser launch");
+      postMessage({ type: "startup", stage: "interpreter-launch-started" });
+      check(
+        pvm.pvm_browser_set_motion_availability(motionAvailability),
+        "set PolkaVM browser motion availability",
+      );
+      if (pendingMotionSample !== null) {
+        stage(pendingMotionSample);
+        check(
+          pvm.pvm_browser_send_motion_sample(),
+          "send PolkaVM browser motion sample",
+        );
+        pendingMotionSample = null;
+      }
+      if (message.graphicsProfile === "webgpu-raster") {
+        if (pendingGpuCapabilities === null) {
+          throw new Error(
+            "WebGPU capabilities are required before PVM initialization",
+          );
+        }
+        stage(pendingGpuCapabilities);
+        check(
+          pvm.pvm_browser_set_gpu_capabilities(),
+          "set PolkaVM browser GPU capabilities",
+        );
+        pendingGpuCapabilities = null;
+      }
+      postMessage({ type: "startup", stage: "interpreter-initializing" });
+      try {
+        check(pvm.pvm_browser_init(), "initialize PolkaVM browser guest");
+      } catch (initError) {
+        drainLogs();
+        throw initError;
+      }
+      postMessage({ type: "startup", stage: "interpreter-initialized" });
+      drainTri2d();
+      drainGpuBatches();
+      drainTruapiRequests();
+      drainLogs();
+    }
+    const usesMotion = translated
+      ? translated.usesMotion()
+      : pvm.pvm_browser_uses_motion() === 1;
+    startedAt = performance.now();
+    running = true;
+    postMessage({
+      type: "ready",
+      backend,
+      usesMotion,
+      cacheHit,
+      translationMs,
+      compilationMs,
+      translatedWasmBytes,
+      startupMs: performance.now() - bootStarted,
+    });
+    for (const { output, transfers } of pendingOutputs) {
+      postMessage(output, transfers);
+    }
+    tick();
+  }
+
+  function sendInput(bytes) {
+    if (!running || bytes.byteLength !== 8) {
+      return;
+    }
+    if (translated) {
+      translated.sendInput(bytes);
+      return;
+    }
+    if (bytes[0] <= 7) {
+      const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+      check(
+        pvm.pvm_browser_send_input(
+          bytes[0],
+          bytes[1],
+          view.getUint16(2, true),
+          view.getUint16(4, true),
+        ),
+        "send PolkaVM browser input",
+      );
+      return;
+    }
+    stage(bytes);
+    check(
+      pvm.pvm_browser_send_input_record(),
+      "send PolkaVM browser extended input",
+    );
+  }
+
+  function setMotionAvailability(availability) {
+    if (
+      !Number.isInteger(availability) ||
+      availability < 0 ||
+      availability > 2
+    ) {
+      throw new Error("invalid PolkaVM browser motion availability");
+    }
+    motionAvailability = availability;
+    if (availability !== 1) {
+      pendingMotionSample = null;
+    }
+    if (!running || !pvm) {
+      return;
+    }
+    if (translated) {
+      translated.setMotionAvailability(availability);
+      return;
+    }
+    check(
+      pvm.pvm_browser_set_motion_availability(availability),
+      "set PolkaVM browser motion availability",
+    );
+  }
+
+  function sendMotionSample(bytes) {
+    if (bytes.byteLength !== MOTION_SAMPLE_BYTES) {
+      throw new Error("invalid PolkaVM browser motion sample");
+    }
+    if (!running || !pvm) {
+      pendingMotionSample = bytes.slice();
+      motionAvailability = 1;
+      return;
+    }
+    if (translated) {
+      translated.sendMotionSample(bytes);
+      return;
+    }
+    stage(bytes);
+    check(
+      pvm.pvm_browser_send_motion_sample(),
+      "send PolkaVM browser motion sample",
+    );
+  }
+
+  function sendGpuCapabilities(bytes) {
+    if (bytes.byteLength < 56 || bytes.byteLength > 4096) {
+      throw new Error("invalid PolkaVM browser GPU capabilities");
+    }
+    if (!running || !pvm) {
+      pendingGpuCapabilities = bytes.slice();
+      return;
+    }
+    if (translated) {
+      translated.setGpuCapabilities(bytes);
+      return;
+    }
+    stage(bytes);
+    check(
+      pvm.pvm_browser_set_gpu_capabilities(),
+      "update PolkaVM browser GPU capabilities",
+    );
+  }
+
+  function sendGpuEvent(bytes) {
+    if (!running || !pvm || !bytes.byteLength) {
+      return;
+    }
+    if (translated) {
+      translated.sendGpuEvent(bytes);
+      return;
+    }
+    stage(bytes);
+    check(pvm.pvm_browser_send_gpu_event(), "send PolkaVM browser GPU event");
+  }
+
+  function sendTruapiResponse(bytes) {
+    if (!running || !pvm || !bytes.byteLength) {
+      return;
+    }
+    if (translated) {
+      translated.sendTruapiResponse(bytes);
+      return;
+    }
+    stage(bytes);
+    check(
+      pvm.pvm_browser_send_truapi_response(),
+      "send PolkaVM browser TrUAPI response",
+    );
+  }
+
+  endpoint.onmessage = (event) => {
+    const message = event.data;
+    if (message?.type === "start") {
+      void start(message).catch((error) => {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      });
+    } else if (message?.type === "input") {
+      try {
+        sendInput(new Uint8Array(message.bytes));
+      } catch (error) {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      }
+    } else if (message?.type === "motion-status") {
+      try {
+        setMotionAvailability(message.availability);
+      } catch (error) {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      }
+    } else if (message?.type === "motion") {
+      try {
+        sendMotionSample(new Uint8Array(message.bytes));
+      } catch (error) {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      }
+    } else if (message?.type === "gpu-capabilities") {
+      try {
+        sendGpuCapabilities(new Uint8Array(message.bytes));
+      } catch (error) {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      }
+    } else if (message?.type === "gpu-event") {
+      try {
+        sendGpuEvent(new Uint8Array(message.bytes));
+      } catch (error) {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      }
+    } else if (message?.type === "truapi-response") {
+      try {
+        sendTruapiResponse(new Uint8Array(message.bytes));
+      } catch (error) {
+        stopRuntime();
+        postMessage({ type: "error", message: error.message });
+        postMessage({ type: "terminated" });
+      }
+    } else if (message?.type === "stop") {
+      stopRuntime();
+      postMessage({ type: "terminated" });
+    }
+  };
+};
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+globalThis.createPvmRuntime(globalThis);
diff --git a/apps/sandbox/src/app-sw.ts b/apps/sandbox/src/app-sw.ts
index bf351dfd..3bc00edb 100644
--- a/apps/sandbox/src/app-sw.ts
+++ b/apps/sandbox/src/app-sw.ts
@@ -21,6 +21,7 @@ import { SW_ARCHIVE_CACHE_MAX } from "@dotli/config/config";
 // Base path, derived at runtime from the SW script location.
 const BASE = self.location.pathname.replace(/(?:src\/)?app-sw\.[jt]s$/, "");
 const DOTLI_APP_PREFIX = `${BASE}dotli-app/`;
+const PVM_RUNTIME_PREFIX = `${BASE}pvm-runtime/`;
 
 function hasExtension(path: string): boolean {
   const lastSlash = path.lastIndexOf("/");
@@ -403,6 +404,12 @@ self.addEventListener("fetch", (event: FetchEvent) => {
     return;
   }
 
+  // PolkaVM products run inside a host-owned runtime. Package files must never
+  // shadow the translator, worker, Wasm interpreter, or their license notices.
+  if (url.pathname.startsWith(PVM_RUNTIME_PREFIX)) {
+    return;
+  }
+
   const result = lookupArchive(url.pathname, event.request.mode);
   if (result !== null) {
     event.respondWith(result);
diff --git a/apps/sandbox/src/main.ts b/apps/sandbox/src/main.ts
index 74d39a27..47941108 100644
--- a/apps/sandbox/src/main.ts
+++ b/apps/sandbox/src/main.ts
@@ -49,6 +49,11 @@ import { setNetworkOverride } from "@dotli/config/network";
 import { elapsed } from "@dotli/shared/perf";
 import { log } from "@dotli/shared/log";
 import { parseIpfsResponse } from "@dotli/content/archive";
+import {
+  isPvmPackage,
+  runPvmApplication,
+  unsupportedPvmImport,
+} from "./pvm-runtime";
 
 initSentry("sandbox");
 installGlobalErrorHandlers("sandbox");
@@ -84,6 +89,19 @@ function stripContractParamsFromUrl(): void {
   }
   history.replaceState(null, "", cleaned.toString());
 }
+/**
+ * A full reset is a one-shot host signal. Consume only that flag after the
+ * purge while retaining the PVM launch contract, so reloading the host-owned
+ * canvas can start again with the same verified CID and manifest.
+ */
+function consumeFullResetParam(): void {
+  const cleaned = new URL(window.location.href);
+  if (!cleaned.searchParams.has(SANDBOX_CONTRACT_PARAMS.fullReset)) {
+    return;
+  }
+  cleaned.searchParams.delete(SANDBOX_CONTRACT_PARAMS.fullReset);
+  history.replaceState(null, "", cleaned.toString());
+}
 
 /**
  * Ask the host shell to rebuild this iframe with a fresh contract URL.
@@ -104,6 +122,18 @@ function requestHostRerender(reason: string): void {
     failLoading("Invalid sandbox URL", reason);
   }, TIMEOUTS.SANDBOX_RECOVER);
 }
+/**
+ * A newer sandbox cannot safely interpret a contract emitted by an older host.
+ * Ask the parent to activate its waiting PWA build instead of re-rendering the
+ * same stale contract and looping.
+ */
+function requestHostUpdate(reason: string): void {
+  showStatus("Updating dot.li...");
+  window.parent.postMessage({ type: "dotli:host-update-required" }, "*");
+  window.setTimeout(() => {
+    failLoading("dot.li update required", reason);
+  }, TIMEOUTS.SANDBOX_RECOVER);
+}
 
 /**
  * Render the sandbox-local error page AND tell the host shell its loading
@@ -410,6 +440,23 @@ async function maybeInjectSandboxChecker(html: string): Promise<string> {
   return injectSandboxChecker(html);
 }
 
+async function runPvmIfPresent(
+  files: ArchiveFiles,
+  cid: string,
+  executableManifest: string | null,
+): Promise<boolean> {
+  if (!isPvmPackage(files)) {
+    return false;
+  }
+  showStatus("Starting PolkaVM application...");
+  // PVM apps are host-owned canvases, not package HTML. Retain their launch
+  // contract so a browser or frame reload can verify and restart the same CID.
+  await runPvmApplication(files, cid, executableManifest);
+  notifyLoadingDone();
+  performance.mark("dotli:app:end");
+  return true;
+}
+
 // Session-scoped decryption key cache: once a user decrypts a CID in this tab,
 // we store the password so SW-cache hits don't re-prompt.
 const decryptedPasswords = new Map<string, string>();
@@ -612,7 +659,9 @@ async function main(): Promise<void> {
   const urlParams = new URL(window.location.href).searchParams;
   const parsed = validateSandboxParams(urlParams);
   if (!parsed.ok) {
-    if (parsed.recoverable === true) {
+    if (parsed.hostUpdateRequired === true) {
+      requestHostUpdate(parsed.reason);
+    } else if (parsed.recoverable === true) {
       requestHostRerender(parsed.reason);
     } else {
       failLoading("Invalid sandbox URL", parsed.reason);
@@ -620,7 +669,8 @@ async function main(): Promise<void> {
     stopApp();
     return;
   }
-  const { cid, chainBackend, network, skipArchiveCache } = parsed.params;
+  const { cid, chainBackend, network, skipArchiveCache, executableManifest } =
+    parsed.params;
   const isGateway = chainBackend === "rpc-gateway";
 
   setNetworkOverride(network);
@@ -633,6 +683,7 @@ async function main(): Promise<void> {
   if (parsed.params.fullReset) {
     log.warn("[dot.li app] fullReset=1 → purging sandbox-origin state");
     await purgeSandboxOriginState();
+    consumeFullResetParam();
   }
 
   // Propagate the chainBackend and network choices into every metric emitted
@@ -672,6 +723,10 @@ async function main(): Promise<void> {
     : await getCachedArchive(cid, cid, chainBackend);
   if (cachedFiles) {
     log.warn(`[dot.li app] SW archive cache HIT (${elapsed(T0)})`);
+    if (await runPvmIfPresent(cachedFiles, cid, executableManifest)) {
+      stopApp();
+      return;
+    }
 
     // Extract index.html and write it directly into this window so it
     // occupies the APP iframe. An archive without index.html is invalid,
@@ -752,14 +807,19 @@ async function main(): Promise<void> {
   if (result.type === "single") {
     html = new TextDecoder().decode(result.content);
   } else {
-    // For multi-file archives, store files in the SW so it can serve
-    // sub-resources (CSS, JS, fonts) when the browser loads them.
+    // Persist every verified archive before choosing its runtime. HTML products
+    // use the SW as a virtual file system; PolkaVM products use the same cache
+    // as their immutable asset source on the next launch.
     await storeArchiveInSW(result.files, cid, cid, chainBackend);
     log.warn(`[dot.li app] archive stored in SW (${elapsed(T0)})`);
+    if (await runPvmIfPresent(result.files, cid, executableManifest)) {
+      stopApp();
+      return;
+    }
     const indexHtml = result.files["index.html"] as Uint8Array | undefined;
     if (indexHtml === undefined) {
       throw new Error(
-        "Archive missing index.html — cannot render a sandbox without a root document.",
+        "Archive is neither a supported PolkaVM product nor an HTML application.",
       );
     }
     html = new TextDecoder().decode(indexHtml);
@@ -824,6 +884,18 @@ function run(): void {
         attempt: String(runAttempts),
       });
       const message = err instanceof Error ? err.message : String(err);
+      const unsupportedImport = unsupportedPvmImport(message);
+      if (unsupportedImport !== null) {
+        const feature =
+          unsupportedImport === "host_motion_read"
+            ? `motion input (${unsupportedImport})`
+            : `the runtime feature ${unsupportedImport}`;
+        failLoading(
+          "App feature isn't supported",
+          `This app requires ${feature}, which dot.li does not support. Update the app or open it in a compatible host.`,
+        );
+        return;
+      }
       failLoading(
         "Failed to load content",
         `${message} (via ${dependency})`,
diff --git a/apps/sandbox/src/pvm-runtime.test.ts b/apps/sandbox/src/pvm-runtime.test.ts
new file mode 100644
index 00000000..230148b3
--- /dev/null
+++ b/apps/sandbox/src/pvm-runtime.test.ts
@@ -0,0 +1,495 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { describe, expect, it, vi } from "vitest";
+import {
+  accumulateRelativePointerDelta,
+  describePvmPackage,
+  encodedInput,
+  encodedTextInput,
+  encodedMotionSample,
+  encodedPointerMotionSample,
+  formatPvmMetrics,
+  isPvmPackage,
+  normalizedPointerDelta,
+  unsupportedPvmImport,
+  waitForTruapiPort,
+  type TruapiPortScope,
+  type TruapiPortTarget,
+} from "./pvm-runtime";
+
+const encoder = new TextEncoder();
+
+function doomManifest(): Uint8Array {
+  return encoder.encode(
+    JSON.stringify({
+      $schema: "epoca:experimental-product/v1",
+      $v: 1,
+      kind: "framebuffer",
+      runtime: { kind: "polkavm", entrypoint: "app.polkavm" },
+      modalities: {
+        framebuffer: {
+          abiVersion: 1,
+          controls: ["WASD Move", "Space Fire"],
+        },
+      },
+      contentSlots: [
+        {
+          id: "iwad",
+          required: true,
+          mount: "game/doom.wad",
+        },
+      ],
+    }),
+  );
+}
+
+function doomAppV2Manifest(): string {
+  return JSON.stringify({
+    $v: 2,
+    kind: "app",
+    appVersion: [0, 1, 7],
+    runtime: {
+      kind: "polkavm",
+      abiVersion: 1,
+      entrypoint: "app.polkavm",
+    },
+    capabilities: {
+      graphics: {
+        abiVersion: 1,
+        profile: "framebuffer",
+        requiredFeatures: [],
+      },
+      deviceInput: {
+        abiVersion: 1,
+        requiredFeatures: ["pointer", "keyboard"],
+      },
+      audio: { abiVersion: 1, requiredFeatures: [] },
+    },
+  });
+}
+
+function tri2dAppV2Manifest(): string {
+  const manifest = JSON.parse(doomAppV2Manifest()) as Record<string, unknown>;
+  const capabilities = manifest.capabilities as Record<string, unknown>;
+  const graphics = capabilities.graphics as Record<string, unknown>;
+  graphics.profile = "tri2d";
+  delete capabilities.audio;
+  return JSON.stringify(manifest);
+}
+
+function webGpuAppV2Manifest(): string {
+  const manifest = JSON.parse(doomAppV2Manifest()) as Record<string, unknown>;
+  const capabilities = manifest.capabilities as Record<string, unknown>;
+  const graphics = capabilities.graphics as Record<string, unknown>;
+  graphics.profile = "webgpu-raster";
+  graphics.requiredLimits = {
+    maxTextureDimension2D: 4096,
+    maxBufferSize: 1024,
+    maxBindingsPerBindGroup: 3,
+  };
+  delete capabilities.audio;
+  return JSON.stringify(manifest);
+}
+
+describe("PolkaVM pointer input", () => {
+  it("preserves signed pointer deltas for the guest runtime", () => {
+    const large = encodedInput(6, 0, 32_000, -32_000);
+    const largeView = new DataView(large.buffer);
+    expect(largeView.getInt16(2, true)).toBe(32_000);
+    expect(largeView.getInt16(4, true)).toBe(-32_000);
+
+    const normal = encodedInput(6, 0, 23, -19);
+    const normalView = new DataView(normal.buffer);
+    expect(normalView.getInt16(2, true)).toBe(23);
+    expect(normalView.getInt16(4, true)).toBe(-19);
+  });
+
+  it("coalesces a high-rate pointer backlog into one bounded frame delta", () => {
+    let x = 0;
+    let y = 0;
+    for (let index = 0; index < 64; index++) {
+      [x, y] = accumulateRelativePointerDelta(x, y, 5, -3);
+    }
+    expect([x, y]).toEqual([127, -127]);
+
+    expect(accumulateRelativePointerDelta(x, y, -20, 20)).toEqual([107, -107]);
+  });
+});
+
+describe("PolkaVM advanced input encoding", () => {
+  it("chunks UTF-8 text without splitting code points", () => {
+    const records = encodedTextInput(8, "hello π");
+    expect(records).toHaveLength(2);
+    expect(records[0]).toEqual(
+      new Uint8Array([8, 0x46, 104, 101, 108, 108, 111, 32]),
+    );
+    expect(records[1]).toEqual(
+      new Uint8Array([8, 0x82, 0xcf, 0x80, 0, 0, 0, 0]),
+    );
+    expect(encodedTextInput(9, "")).toEqual([
+      new Uint8Array([9, 0xc0, 0, 0, 0, 0, 0, 0]),
+    ]);
+    expect(encodedTextInput(10, "a".repeat(4097))).toEqual([]);
+  });
+
+  it("encodes signed wheel deltas and focus state", () => {
+    const wheel = encodedInput(14, 0, -12, 32000);
+    const view = new DataView(wheel.buffer);
+    expect(view.getInt16(2, true)).toBe(-12);
+    expect(view.getInt16(4, true)).toBe(32000);
+    expect(encodedInput(13, 1)).toEqual(
+      new Uint8Array([13, 1, 0, 0, 0, 0, 0, 0]),
+    );
+  });
+});
+
+describe("MotionSample v1 encoding", () => {
+  it("encodes pointer movement as bounded rotation-rate motion", () => {
+    const bytes = encodedPointerMotionSample(10, -5, 20, 3, 100);
+    const view = new DataView(bytes.buffer);
+    expect(new TextDecoder().decode(bytes.subarray(0, 4))).toBe("PMO1");
+    expect(view.getUint16(4, true)).toBe(1);
+    expect(view.getUint16(6, true)).toBe(6);
+    expect(view.getUint32(8, true)).toBe(48);
+    expect(view.getUint32(12, true)).toBe(3);
+    expect(view.getFloat64(16, true)).toBe(100);
+    expect(view.getFloat32(40, true)).toBeCloseTo(-37.5);
+    expect(view.getFloat32(44, true)).toBeCloseTo(75);
+  });
+
+  it("encodes finite device motion and rejects malformed samples", () => {
+    const bytes = encodedMotionSample({
+      flags: 3,
+      sequence: 1,
+      timestampMs: 20,
+      accelerationX: 1,
+      accelerationY: 2,
+      accelerationZ: 3,
+      rotationAlpha: 4,
+      rotationBeta: 5,
+      rotationGamma: 6,
+    });
+    expect(new DataView(bytes.buffer).getFloat32(32, true)).toBe(3);
+    expect(() =>
+      encodedMotionSample({
+        flags: 0,
+        sequence: 1,
+        timestampMs: 20,
+        accelerationX: 0,
+        accelerationY: 0,
+        accelerationZ: 0,
+        rotationAlpha: 0,
+        rotationBeta: 0,
+        rotationGamma: 0,
+      }),
+    ).toThrow(/invalid MotionSample v1/);
+  });
+});
+
+describe("PolkaVM metrics display", () => {
+  const metrics = {
+    backend: "compiler" as const,
+    fps: 59.94,
+    startupStage: "first-frame",
+    translationMs: 10,
+    compilationMs: 5,
+    updateP50Ms: 0,
+    updateP95Ms: 1,
+    updateMaxMs: 4,
+  };
+
+  it("keeps the default JIT badge to one concise line", () => {
+    const display = formatPvmMetrics(metrics);
+    expect(display.summary).toBe("PolkaVM / JIT · 59.9 FPS");
+    expect(display.summary).not.toContain("Stage");
+    expect(display.summary).not.toContain("Translate");
+  });
+
+  it("retains diagnostics in the expandable details", () => {
+    expect(formatPvmMetrics({ ...metrics, backend: "interpreter" })).toEqual({
+      summary: "PolkaVM / Interpreter · 59.9 FPS",
+      details:
+        "Stage: first-frame\nTranslate 10.0 ms · Compile 5.0 ms\nUpdate p50 0.00 ms · p95 1.00 ms · max 4.00 ms",
+    });
+  });
+});
+
+describe("PolkaVM compatibility errors", () => {
+  it("extracts unsupported imports from translated guest failures", () => {
+    expect(
+      unsupportedPvmImport(
+        "translated PolkaVM guest uses unsupported import host_motion_read",
+      ),
+    ).toBe("host_motion_read");
+    expect(
+      unsupportedPvmImport(
+        "translated CoreVM guest uses unsupported import pvm_unknown",
+      ),
+    ).toBe("pvm_unknown");
+  });
+
+  it("leaves transport and content failures unclassified", () => {
+    expect(unsupportedPvmImport("IPFS request timed out")).toBeNull();
+  });
+});
+
+describe("PolkaVM package recognition", () => {
+  it("recognizes the deployed doom.paseo package shape", () => {
+    const files = {
+      "manifest.json": doomManifest(),
+      "app.polkavm": new Uint8Array([1, 2, 3]),
+      "game/doom.wad": new Uint8Array([4, 5, 6]),
+    };
+
+    expect(isPvmPackage(files)).toBe(true);
+    expect(describePvmPackage(files)).toEqual({
+      graphicsProfile: "framebuffer",
+      webGpuRequirements: null,
+      programPath: "app.polkavm",
+      controls: ["WASD Move", "Space Fire"],
+      inputFeatures: ["pointer", "keyboard", "motion"],
+      audioEnabled: true,
+      requiredAssets: ["game/doom.wad"],
+      manifestVersion: null,
+    });
+  });
+
+  it("recognizes App manifest v2 and requires exact external bytes", () => {
+    const manifest = doomAppV2Manifest();
+    const files = {
+      "manifest.json": encoder.encode(manifest),
+      "app.polkavm": new Uint8Array([1, 2, 3]),
+      "game/doom.wad": new Uint8Array([4, 5, 6]),
+    };
+
+    expect(describePvmPackage(files, manifest)).toEqual({
+      graphicsProfile: "framebuffer",
+      webGpuRequirements: null,
+      programPath: "app.polkavm",
+      controls: ["Pointer", "Keyboard"],
+      inputFeatures: ["pointer", "keyboard"],
+      audioEnabled: true,
+      requiredAssets: [],
+      manifestVersion: 2,
+    });
+    expect(() => describePvmPackage(files)).toThrow(
+      /external App manifest is required/,
+    );
+    expect(() => describePvmPackage(files, `${manifest}\n`)).toThrow(
+      /does not match/,
+    );
+  });
+
+  it("accepts required MotionSample v1 input", () => {
+    const value = JSON.parse(doomAppV2Manifest()) as {
+      capabilities: {
+        deviceInput: { requiredFeatures: string[] };
+      };
+    };
+    value.capabilities.deviceInput.requiredFeatures.push("motion");
+    const manifest = JSON.stringify(value);
+    const files = {
+      "manifest.json": encoder.encode(manifest),
+      "app.polkavm": new Uint8Array([1, 2, 3]),
+    };
+    expect(describePvmPackage(files, manifest)?.controls).toEqual([
+      "Pointer",
+      "Keyboard",
+      "Motion",
+    ]);
+  });
+
+  it("accepts required text, IME, focus, and wheel input", () => {
+    const value = JSON.parse(doomAppV2Manifest()) as {
+      capabilities: {
+        deviceInput: { requiredFeatures: string[] };
+      };
+    };
+    value.capabilities.deviceInput.requiredFeatures.push(
+      "text",
+      "ime",
+      "focus",
+      "wheel",
+    );
+    const manifest = JSON.stringify(value);
+    const files = {
+      "manifest.json": encoder.encode(manifest),
+      "app.polkavm": new Uint8Array([1, 2, 3]),
+    };
+    expect(describePvmPackage(files, manifest)?.inputFeatures).toEqual([
+      "pointer",
+      "keyboard",
+      "text",
+      "ime",
+      "focus",
+      "wheel",
+    ]);
+  });
+
+  it("recognizes strict App manifest v2 Tri2D packages", () => {
+    const manifest = tri2dAppV2Manifest();
+    const files = {
+      "manifest.json": encoder.encode(manifest),
+      "app.polkavm": new Uint8Array([1, 2, 3]),
+    };
+    expect(describePvmPackage(files, manifest)).toEqual({
+      graphicsProfile: "tri2d",
+      webGpuRequirements: null,
+      programPath: "app.polkavm",
+      controls: ["Pointer", "Keyboard"],
+      inputFeatures: ["pointer", "keyboard"],
+      audioEnabled: false,
+      requiredAssets: [],
+      manifestVersion: 2,
+    });
+  });
+
+  it("recognizes strict App manifest v2 WebGPU Raster limits", () => {
+    const manifest = webGpuAppV2Manifest();
+    const files = {
+      "manifest.json": encoder.encode(manifest),
+      "app.polkavm": new Uint8Array([1, 2, 3]),
+    };
+    expect(describePvmPackage(files, manifest)).toEqual({
+      graphicsProfile: "webgpu-raster",
+      webGpuRequirements: {
+        requiredFeatures: [],
+        requiredLimits: {
+          maxTextureDimension2D: 4096,
+          maxBufferSize: 1024,
+          maxBindingsPerBindGroup: 3,
+        },
+      },
+      programPath: "app.polkavm",
+      controls: ["Pointer", "Keyboard"],
+      inputFeatures: ["pointer", "keyboard"],
+      audioEnabled: false,
+      requiredAssets: [],
+      manifestVersion: 2,
+    });
+  });
+
+  it("leaves ordinary HTML archives on the existing sandbox path", () => {
+    expect(
+      isPvmPackage({
+        "index.html": encoder.encode("<h1>app</h1>"),
+      }),
+    ).toBe(false);
+  });
+
+  it("rejects unsupported graphics profiles rather than guessing", () => {
+    const manifest = encoder.encode(
+      JSON.stringify({
+        $schema: "epoca:experimental-product/v2",
+        $v: 2,
+        kind: "application",
+        runtime: { kind: "polkavm", entrypoint: "app.polkavm" },
+        modalities: {
+          graphics: { abiVersion: 1, profile: "tri2d" },
+          generalInput: { abiVersion: 1, controls: [] },
+        },
+      }),
+    );
+    expect(() =>
+      isPvmPackage({
+        "manifest.json": manifest,
+        "app.polkavm": new Uint8Array([1]),
+      }),
+    ).toThrow(/only framebuffer ABI version 1/);
+  });
+});
+
+describe("PolkaVM TrUAPI transport", () => {
+  it("adopts an existing Host-injected canonical MessagePort", async () => {
+    const channel = new MessageChannel();
+    const scope = {
+      __HOST_API_PORT__: channel.port1,
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn(),
+    } satisfies TruapiPortScope;
+    const target = { postMessage: vi.fn() } satisfies TruapiPortTarget;
+    await expect(waitForTruapiPort(scope, target, 0)).resolves.toBe(
+      channel.port1,
+    );
+    expect(target.postMessage).not.toHaveBeenCalled();
+    channel.port1.close();
+    channel.port2.close();
+  });
+
+  it("negotiates and adopts a transferred Host port", async () => {
+    const channel = new MessageChannel();
+    let listener: ((event: MessageEvent<unknown>) => void) | null = null;
+    const scope: TruapiPortScope = {
+      addEventListener(
+        _type: "message",
+        next: (event: MessageEvent<unknown>) => void,
+      ) {
+        listener = next;
+      },
+      removeEventListener(
+        _type: "message",
+        current: (event: MessageEvent<unknown>) => void,
+      ) {
+        if (listener === current) {
+          listener = null;
+        }
+      },
+    };
+    const target = {
+      postMessage(message: unknown, targetOrigin: string) {
+        expect(message).toEqual({ type: "truapi-ready" });
+        expect(targetOrigin).toBe("*");
+        if (listener === null) {
+          throw new Error("message listener was not ready");
+        }
+        listener({
+          source: target as unknown as MessageEventSource,
+          data: { type: "truapi-init" },
+          ports: [channel.port1],
+        } as unknown as MessageEvent<unknown>);
+      },
+    } satisfies TruapiPortTarget;
+
+    await expect(waitForTruapiPort(scope, target, 100)).resolves.toBe(
+      channel.port1,
+    );
+    expect(scope.__HOST_API_PORT__).toBe(channel.port1);
+    channel.port1.close();
+    channel.port2.close();
+  });
+
+  it("fails closed when the Host port is absent", async () => {
+    const scope = {
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn(),
+    } satisfies TruapiPortScope;
+    const target = { postMessage: vi.fn() } satisfies TruapiPortTarget;
+    await expect(waitForTruapiPort(scope, target, 0)).rejects.toThrow(
+      /TrUAPI Host port was not available/,
+    );
+    expect(target.postMessage).toHaveBeenCalledWith(
+      { type: "truapi-ready" },
+      "*",
+    );
+  });
+});
+
+describe("pointer lock mouse deltas", () => {
+  it("drops the cursor-warp sample after pointer lock acquisition", () => {
+    expect(normalizedPointerDelta(80, -40, true)).toBeNull();
+  });
+
+  it("preserves deltas representable by the CoreVM mouse ABI", () => {
+    expect(normalizedPointerDelta(127, -127, false)).toEqual([127, -127]);
+    expect(normalizedPointerDelta(3, -5, false)).toEqual([3, -5]);
+  });
+
+  it("drops pointer-lock discontinuities and invalid browser deltas", () => {
+    expect(normalizedPointerDelta(430, -314, false)).toBeNull();
+    expect(
+      normalizedPointerDelta(Number.POSITIVE_INFINITY, 0, false),
+    ).toBeNull();
+    expect(normalizedPointerDelta(0, Number.NaN, false)).toBeNull();
+  });
+});
diff --git a/apps/sandbox/src/pvm-runtime.ts b/apps/sandbox/src/pvm-runtime.ts
new file mode 100644
index 00000000..c3783fde
--- /dev/null
+++ b/apps/sandbox/src/pvm-runtime.ts
@@ -0,0 +1,1924 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { ArchiveFiles } from "@dotli/content/archive";
+import { Tri2dRenderer } from "./tri2d-renderer";
+import { WebGpuRasterBridge, type WebGpuRequirements } from "./webgpu-raster";
+
+const PVM_RUNTIME_ROOT = "/pvm-runtime";
+const MAX_PROGRAM_BYTES = 16 * 1024 * 1024;
+const MAX_ASSET_FILES = 2_048;
+const MAX_ASSET_FILE_BYTES = 64 * 1024 * 1024;
+const MAX_ASSET_BYTES = 128 * 1024 * 1024;
+const MAX_AUDIO_BYTES = 48_000 * 2 * 2;
+const MAX_SAVE_BYTES = 1024 * 1024;
+const MAX_TRANSLATED_WASM_BYTES = 16 * 1024 * 1024;
+const MAX_TRUAPI_FRAME_BYTES = 1024 * 1024;
+const MAX_TRUAPI_PENDING_FRAMES = 32;
+const MAX_TRUAPI_PENDING_BYTES = 4 * 1024 * 1024;
+const TRUAPI_PORT_TIMEOUT_MS = 10_000;
+const START_TIMEOUT_MS = 30_000;
+const INTERPRETER_START_TIMEOUT_MS = 180_000;
+const SAVE_DB_NAME = "dotli-pvm";
+const SAVE_DB_VERSION = 2;
+const SAVE_STORE = "saves";
+const TRANSLATION_STORE = "translations";
+const RUNTIME_SOURCE = "pvm-host-runtime-1d73f040";
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const encoder = new TextEncoder();
+const compiledModules = new Map<string, WebAssembly.Module>();
+let runtimeBytesPromise: Promise<ArrayBuffer> | null = null;
+
+export interface PvmMetrics {
+  backend: "compiler" | "interpreter" | "starting";
+  cacheHit: boolean;
+  translationMs: number;
+  compilationMs: number;
+  startupMs: number;
+  startupStage: string;
+  firstFrameMs: number;
+  translatedWasmBytes: number;
+  frames: number;
+  fps: number;
+  updates: number;
+  updateP50Ms: number;
+  updateP95Ms: number;
+  updateMaxMs: number;
+  audioChunks: number;
+  audioSamples: number;
+}
+
+type PvmMetricsDisplaySource = Pick<
+  PvmMetrics,
+  | "backend"
+  | "fps"
+  | "startupStage"
+  | "translationMs"
+  | "compilationMs"
+  | "updateP50Ms"
+  | "updateP95Ms"
+  | "updateMaxMs"
+>;
+
+export function formatPvmMetrics(metrics: PvmMetricsDisplaySource): {
+  summary: string;
+  details: string;
+} {
+  const backend =
+    metrics.backend === "compiler"
+      ? "JIT"
+      : metrics.backend === "interpreter"
+        ? "Interpreter"
+        : "Starting";
+  return {
+    summary: `PolkaVM / ${backend} · ${metrics.fps.toFixed(1)} FPS`,
+    details: [
+      `Stage: ${metrics.startupStage}`,
+      `Translate ${metrics.translationMs.toFixed(1)} ms · Compile ${metrics.compilationMs.toFixed(1)} ms`,
+      `Update p50 ${metrics.updateP50Ms.toFixed(2)} ms · p95 ${metrics.updateP95Ms.toFixed(2)} ms · max ${metrics.updateMaxMs.toFixed(2)} ms`,
+    ].join("\n"),
+  };
+}
+
+export function unsupportedPvmImport(message: string): string | null {
+  return (
+    /translated (?:PolkaVM|CoreVM) guest uses unsupported import ([A-Za-z][A-Za-z0-9_]*)/.exec(
+      message,
+    )?.[1] ?? null
+  );
+}
+
+declare global {
+  interface Window {
+    __dotliPvmMetrics?: PvmMetrics;
+    __HOST_API_PORT__?: MessagePort;
+  }
+}
+
+interface PvmDescriptor {
+  programPath: string;
+  graphicsProfile: "framebuffer" | "tri2d" | "webgpu-raster";
+  webGpuRequirements: WebGpuRequirements | null;
+  controls: string[];
+  inputFeatures: string[];
+  audioEnabled: boolean;
+  requiredAssets: string[];
+  manifestVersion: number | null;
+}
+
+interface WorkerReady {
+  type: "ready";
+  backend: "compiler" | "interpreter";
+  cacheHit?: boolean;
+  translationMs?: number;
+  compilationMs?: number;
+  startupMs?: number;
+  translatedWasmBytes?: number;
+}
+
+interface WorkerStartup {
+  type: "startup";
+  stage: string;
+}
+
+interface WorkerFrame {
+  type: "frame";
+  width: number;
+  height: number;
+  pixels: Uint8Array;
+}
+
+interface WorkerTri2d {
+  type: "tri2d";
+  bytes: Uint8Array;
+}
+
+interface WorkerGpuBatch {
+  type: "gpu-batch";
+  bytes: Uint8Array;
+}
+interface WorkerAudio {
+  type: "audio";
+  sampleRate: number;
+  channels: number;
+  samples: Uint8Array;
+}
+
+interface WorkerMetrics {
+  type: "metrics";
+  updates: number;
+  updateP50Ms: number;
+  updateP95Ms: number;
+  updateMaxMs: number;
+}
+
+const keyCodes: Readonly<Record<string, number>> = Object.freeze({
+  KeyA: 0x04,
+  KeyB: 0x05,
+  KeyC: 0x06,
+  KeyD: 0x07,
+  KeyE: 0x08,
+  KeyF: 0x09,
+  KeyG: 0x0a,
+  KeyH: 0x0b,
+  KeyI: 0x0c,
+  KeyJ: 0x0d,
+  KeyK: 0x0e,
+  KeyL: 0x0f,
+  KeyM: 0x10,
+  KeyN: 0x11,
+  KeyO: 0x12,
+  KeyP: 0x13,
+  KeyQ: 0x14,
+  KeyR: 0x15,
+  KeyS: 0x16,
+  KeyT: 0x17,
+  KeyU: 0x18,
+  KeyV: 0x19,
+  KeyW: 0x1a,
+  KeyX: 0x1b,
+  KeyY: 0x1c,
+  KeyZ: 0x1d,
+  Digit1: 0x1e,
+  Digit2: 0x1f,
+  Digit3: 0x20,
+  Digit4: 0x21,
+  Digit5: 0x22,
+  Digit6: 0x23,
+  Digit7: 0x24,
+  Digit8: 0x25,
+  Digit9: 0x26,
+  Digit0: 0x27,
+  Enter: 0x28,
+  Escape: 0x29,
+  Backspace: 0x2a,
+  Tab: 0x2b,
+  Space: 0x2c,
+  Minus: 0x2d,
+  Equal: 0x2e,
+  ArrowRight: 0x4f,
+  ArrowLeft: 0x50,
+  ArrowDown: 0x51,
+  ArrowUp: 0x52,
+  ControlLeft: 0xe0,
+  ShiftLeft: 0xe1,
+  AltLeft: 0xe2,
+  ControlRight: 0xe4,
+  ShiftRight: 0xe5,
+  AltRight: 0xe6,
+});
+const pointerButtons: Readonly<Record<number, number>> = Object.freeze({
+  0: 1,
+  1: 3,
+  2: 2,
+});
+
+function object(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function cleanPath(value: unknown): string | null {
+  if (typeof value !== "string" || value === "" || value.includes("\\")) {
+    return null;
+  }
+  const path = value.replace(/^\/+/, "");
+  const parts = path.split("/");
+  return parts.some((part) => part === "" || part === "." || part === "..")
+    ? null
+    : path;
+}
+
+function assertExternalManifest(
+  embedded: Uint8Array,
+  externalManifest: string | null,
+): void {
+  if (externalManifest === null) {
+    throw new Error("external App manifest is required for App manifest v2");
+  }
+  const external = encoder.encode(externalManifest);
+  if (
+    external.byteLength !== embedded.byteLength ||
+    external.some((byte, index) => byte !== embedded[index])
+  ) {
+    throw new Error(
+      "embedded App manifest does not match the external executable record",
+    );
+  }
+}
+
+function parseManifest(
+  files: ArchiveFiles,
+  externalManifest: string | null = null,
+  enforceExternal = true,
+): PvmDescriptor | null {
+  if (!Object.hasOwn(files, "manifest.json")) {
+    return null;
+  }
+  const bytes = files["manifest.json"];
+  let value: unknown;
+  try {
+    value = JSON.parse(decoder.decode(bytes));
+  } catch {
+    return null;
+  }
+  const manifest = object(value);
+  const runtime = object(manifest?.runtime);
+  if (runtime?.kind !== "polkavm") {
+    return null;
+  }
+
+  const programPath = cleanPath(runtime.entrypoint);
+  if (programPath?.endsWith(".polkavm") !== true) {
+    throw new Error("PolkaVM manifest has an invalid runtime entrypoint");
+  }
+  const modalities = object(manifest?.modalities);
+  let graphicsProfile: "framebuffer" | "tri2d" | "webgpu-raster";
+  let webGpuRequirements: WebGpuRequirements | null = null;
+  let controls: string[];
+  let inputFeatures: string[];
+  let audioEnabled: boolean;
+  let manifestVersion: number | null = null;
+  if (manifest?.$v === 2 && manifest.kind === "app") {
+    if (runtime.abiVersion !== 1) {
+      throw new Error("PolkaVM App v2 runtime requires ABI version 1");
+    }
+    const capabilities = object(manifest.capabilities);
+    const graphics = object(capabilities?.graphics);
+    if (
+      graphics?.abiVersion !== 1 ||
+      !["framebuffer", "tri2d", "webgpu-raster"].includes(
+        String(graphics.profile),
+      )
+    ) {
+      throw new Error(
+        "dotli supports framebuffer, Tri2D, and WebGPU Raster ABI version 1 PolkaVM Apps",
+      );
+    }
+    graphicsProfile = graphics.profile as
+      | "framebuffer"
+      | "tri2d"
+      | "webgpu-raster";
+    const graphicsFeatures = Array.isArray(graphics.requiredFeatures)
+      ? graphics.requiredFeatures
+      : null;
+    if (
+      graphicsFeatures === null ||
+      graphicsFeatures.some((feature) => typeof feature !== "string") ||
+      graphicsFeatures.length > 0
+    ) {
+      throw new Error("PolkaVM App v2 requires unsupported graphics features");
+    }
+    if (graphicsProfile === "webgpu-raster") {
+      const requiredLimits = object(graphics.requiredLimits);
+      if (requiredLimits === null) {
+        throw new Error("WebGPU Raster requires explicit bounded limits");
+      }
+      const limits: Record<string, number> = {};
+      for (const [name, value] of Object.entries(requiredLimits)) {
+        if (
+          !Number.isSafeInteger(value) ||
+          (value as number) <= 0 ||
+          ![
+            "maxTextureDimension2D",
+            "maxBufferSize",
+            "maxBindingsPerBindGroup",
+            "maxBindGroups",
+            "maxVertexBuffers",
+            "maxVertexAttributes",
+            "maxColorAttachments",
+          ].includes(name)
+        ) {
+          throw new Error(`WebGPU Raster requires unsupported limit ${name}`);
+        }
+        limits[name] = value as number;
+      }
+      webGpuRequirements = {
+        requiredFeatures: graphicsFeatures as string[],
+        requiredLimits: limits,
+      };
+    } else if (graphics.requiredLimits !== undefined) {
+      throw new Error("non-WebGPU graphics profiles cannot require GPU limits");
+    }
+    const deviceInput =
+      capabilities?.deviceInput === undefined
+        ? null
+        : object(capabilities.deviceInput);
+    const deviceFeatures =
+      deviceInput === null
+        ? []
+        : Array.isArray(deviceInput.requiredFeatures)
+          ? deviceInput.requiredFeatures
+          : null;
+    if (
+      (deviceInput !== null && deviceInput.abiVersion !== 1) ||
+      deviceFeatures === null ||
+      deviceFeatures.some(
+        (feature) =>
+          typeof feature !== "string" ||
+          ![
+            "pointer",
+            "keyboard",
+            "text",
+            "ime",
+            "focus",
+            "wheel",
+            "motion",
+          ].includes(feature),
+      )
+    ) {
+      throw new Error("PolkaVM App v2 requires unsupported device input");
+    }
+    const audio =
+      capabilities?.audio === undefined ? null : object(capabilities.audio);
+    if (
+      audio !== null &&
+      (audio.abiVersion !== 1 ||
+        !Array.isArray(audio.requiredFeatures) ||
+        audio.requiredFeatures.length > 0)
+    ) {
+      throw new Error("PolkaVM App v2 requires unsupported audio features");
+    }
+    controls = deviceFeatures.map(
+      (feature) =>
+        (feature as string)[0].toUpperCase() + (feature as string).slice(1),
+    );
+    inputFeatures = deviceFeatures as string[];
+    audioEnabled = audio !== null;
+    manifestVersion = 2;
+    if (enforceExternal) {
+      assertExternalManifest(bytes, externalManifest);
+    }
+  } else if (
+    manifest?.$schema === "epoca:experimental-product/v1" &&
+    manifest.$v === 1 &&
+    manifest.kind === "framebuffer"
+  ) {
+    const framebuffer = object(modalities?.framebuffer);
+    if (framebuffer?.abiVersion !== 1) {
+      throw new Error("PolkaVM framebuffer manifest requires ABI version 1");
+    }
+    controls = Array.isArray(framebuffer.controls)
+      ? framebuffer.controls.filter(
+          (control): control is string => typeof control === "string",
+        )
+      : [];
+    inputFeatures = ["pointer", "keyboard", "motion"];
+    audioEnabled = true;
+    graphicsProfile = "framebuffer";
+  } else if (
+    manifest?.$schema === "epoca:experimental-product/v2" &&
+    manifest.$v === 2 &&
+    manifest.kind === "application"
+  ) {
+    const graphics = object(modalities?.graphics);
+    if (graphics?.abiVersion !== 1 || graphics.profile !== "framebuffer") {
+      throw new Error(
+        "dotli currently supports only framebuffer ABI version 1 PolkaVM applications",
+      );
+    }
+    const generalInput = object(modalities?.generalInput);
+    controls = Array.isArray(generalInput?.controls)
+      ? generalInput.controls.filter(
+          (control): control is string => typeof control === "string",
+        )
+      : [];
+    inputFeatures = ["pointer", "keyboard", "motion"];
+    audioEnabled = modalities?.audio !== undefined;
+    graphicsProfile = "framebuffer";
+  } else {
+    throw new Error("PolkaVM package uses an unsupported manifest version");
+  }
+
+  const requiredAssets: string[] = [];
+  if (Array.isArray(manifest.contentSlots)) {
+    for (const slotValue of manifest.contentSlots) {
+      const slot = object(slotValue);
+      const mount = cleanPath(slot?.mount);
+      if (slot?.required === true && mount !== null) {
+        requiredAssets.push(mount);
+      }
+    }
+  }
+  return {
+    graphicsProfile,
+    webGpuRequirements,
+    programPath,
+    controls,
+    inputFeatures,
+    audioEnabled,
+    requiredAssets,
+    manifestVersion,
+  };
+}
+
+export function isPvmPackage(files: ArchiveFiles): boolean {
+  return parseManifest(files, null, false) !== null;
+}
+
+export function describePvmPackage(
+  files: ArchiveFiles,
+  externalManifest: string | null = null,
+): PvmDescriptor | null {
+  return parseManifest(files, externalManifest);
+}
+
+function validateFiles(files: ArchiveFiles, descriptor: PvmDescriptor): void {
+  if (!Object.hasOwn(files, descriptor.programPath)) {
+    throw new Error("PolkaVM package is missing its program");
+  }
+  const program = files[descriptor.programPath];
+  if (program.byteLength === 0 || program.byteLength > MAX_PROGRAM_BYTES) {
+    throw new Error("PolkaVM package has an oversized program");
+  }
+  const entries = Object.entries(files).filter(
+    ([path]) => path !== "manifest.json" && path !== descriptor.programPath,
+  );
+  if (entries.length > MAX_ASSET_FILES) {
+    throw new Error("PolkaVM package contains too many assets");
+  }
+  let total = 0;
+  for (const [path, bytes] of entries) {
+    if (cleanPath(path) === null || bytes.byteLength > MAX_ASSET_FILE_BYTES) {
+      throw new Error(`PolkaVM package has an invalid asset: ${path}`);
+    }
+    total += bytes.byteLength;
+    if (total > MAX_ASSET_BYTES) {
+      throw new Error("PolkaVM package exceeds the asset byte limit");
+    }
+  }
+  for (const path of descriptor.requiredAssets) {
+    if (!Object.hasOwn(files, path)) {
+      throw new Error(
+        `PolkaVM package is missing required content mount ${path}`,
+      );
+    }
+  }
+}
+
+function ownedBytes(value: Uint8Array): Uint8Array<ArrayBuffer> {
+  const bytes = new Uint8Array(value.byteLength);
+  bytes.set(value);
+  return bytes;
+}
+
+export interface TruapiPortScope {
+  __HOST_API_PORT__?: MessagePort;
+  addEventListener(
+    type: "message",
+    listener: (event: MessageEvent<unknown>) => void,
+  ): void;
+  removeEventListener(
+    type: "message",
+    listener: (event: MessageEvent<unknown>) => void,
+  ): void;
+}
+
+export interface TruapiPortTarget {
+  postMessage(message: unknown, targetOrigin: string): void;
+}
+
+export function waitForTruapiPort(
+  scope: TruapiPortScope = window,
+  target: TruapiPortTarget = window.parent,
+  timeoutMs = TRUAPI_PORT_TIMEOUT_MS,
+): Promise<MessagePort> {
+  if (scope.__HOST_API_PORT__ instanceof MessagePort) {
+    return Promise.resolve(scope.__HOST_API_PORT__);
+  }
+
+  const { promise, resolve, reject } = Promise.withResolvers<MessagePort>();
+  let timer = 0;
+  const cleanup = (): void => {
+    globalThis.clearTimeout(timer);
+    scope.removeEventListener("message", onMessage);
+  };
+  const onMessage = (event: MessageEvent<unknown>): void => {
+    if (event.source !== target || object(event.data)?.type !== "truapi-init") {
+      return;
+    }
+    const [port] = event.ports;
+    if (!(port instanceof MessagePort)) {
+      cleanup();
+      reject(new Error("TrUAPI initialization did not include a MessagePort"));
+      return;
+    }
+    cleanup();
+    scope.__HOST_API_PORT__ = port;
+    resolve(port);
+  };
+  scope.addEventListener("message", onMessage);
+  timer = globalThis.setTimeout(() => {
+    cleanup();
+    reject(
+      new Error(
+        `TrUAPI Host port was not available within ${String(timeoutMs)}ms`,
+      ),
+    );
+  }, timeoutMs);
+  target.postMessage({ type: "truapi-ready" }, "*");
+  return promise;
+}
+
+async function programDigest(program: Uint8Array): Promise<string> {
+  const digest = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", ownedBytes(program).buffer),
+  );
+  return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join(
+    "",
+  );
+}
+
+function runtimeBytes(): Promise<ArrayBuffer> {
+  runtimeBytesPromise ??= fetch(
+    `${PVM_RUNTIME_ROOT}/pvm-browser-runtime.wasm`,
+    {
+      cache: "force-cache",
+    },
+  ).then((response) => {
+    if (!response.ok) {
+      throw new Error(
+        `PolkaVM runtime fetch failed: HTTP ${String(response.status)}`,
+      );
+    }
+    return response.arrayBuffer();
+  });
+  return runtimeBytesPromise;
+}
+
+function openSaveDb(): Promise<IDBDatabase> {
+  const { promise, resolve, reject } = Promise.withResolvers<IDBDatabase>();
+  const request = indexedDB.open(SAVE_DB_NAME, SAVE_DB_VERSION);
+  request.onerror = () => {
+    reject(request.error ?? new Error("save DB failed"));
+  };
+  request.onupgradeneeded = () => {
+    if (!request.result.objectStoreNames.contains(SAVE_STORE)) {
+      request.result.createObjectStore(SAVE_STORE);
+    }
+    if (!request.result.objectStoreNames.contains(TRANSLATION_STORE)) {
+      request.result.createObjectStore(TRANSLATION_STORE);
+    }
+  };
+  request.onsuccess = () => {
+    resolve(request.result);
+  };
+  return promise;
+}
+
+async function loadSave(key: string): Promise<Uint8Array | null> {
+  const db = await openSaveDb();
+  try {
+    const transaction = db.transaction(SAVE_STORE, "readonly");
+    const request = transaction.objectStore(SAVE_STORE).get(key);
+    const { promise, resolve, reject } = Promise.withResolvers<unknown>();
+    request.onsuccess = () => {
+      resolve(request.result);
+    };
+    request.onerror = () => {
+      reject(request.error ?? new Error("save read failed"));
+    };
+    const value = await promise;
+    return value instanceof ArrayBuffer && value.byteLength <= MAX_SAVE_BYTES
+      ? new Uint8Array(value)
+      : null;
+  } finally {
+    db.close();
+  }
+}
+
+async function storeSave(key: string, bytes: Uint8Array): Promise<void> {
+  if (bytes.byteLength === 0 || bytes.byteLength > MAX_SAVE_BYTES) {
+    return;
+  }
+  const db = await openSaveDb();
+  try {
+    const transaction = db.transaction(SAVE_STORE, "readwrite");
+    transaction.objectStore(SAVE_STORE).put(bytes.slice().buffer, key);
+    const { promise, resolve, reject } = Promise.withResolvers<undefined>();
+    transaction.oncomplete = () => {
+      resolve(undefined);
+    };
+    transaction.onerror = () => {
+      reject(transaction.error ?? new Error("save write failed"));
+    };
+    await promise;
+  } finally {
+    db.close();
+  }
+}
+
+async function loadTranslation(
+  key: string,
+): Promise<Uint8Array<ArrayBuffer> | null> {
+  const db = await openSaveDb();
+  try {
+    const transaction = db.transaction(TRANSLATION_STORE, "readonly");
+    const request = transaction.objectStore(TRANSLATION_STORE).get(key);
+    const { promise, resolve, reject } = Promise.withResolvers<unknown>();
+    request.onsuccess = () => {
+      resolve(request.result);
+    };
+    request.onerror = () => {
+      reject(request.error ?? new Error("translation cache read failed"));
+    };
+    const value = await promise;
+    return value instanceof ArrayBuffer &&
+      value.byteLength > 0 &&
+      value.byteLength <= MAX_TRANSLATED_WASM_BYTES
+      ? new Uint8Array(value)
+      : null;
+  } finally {
+    db.close();
+  }
+}
+
+async function storeTranslation(key: string, bytes: Uint8Array): Promise<void> {
+  if (bytes.byteLength === 0 || bytes.byteLength > MAX_TRANSLATED_WASM_BYTES) {
+    return;
+  }
+  const db = await openSaveDb();
+  try {
+    const transaction = db.transaction(TRANSLATION_STORE, "readwrite");
+    transaction
+      .objectStore(TRANSLATION_STORE)
+      .put(ownedBytes(bytes).buffer, key);
+    const { promise, resolve, reject } = Promise.withResolvers<undefined>();
+    transaction.oncomplete = () => {
+      resolve(undefined);
+    };
+    transaction.onerror = () => {
+      reject(transaction.error ?? new Error("translation cache write failed"));
+    };
+    await promise;
+  } finally {
+    db.close();
+  }
+}
+
+function clamp(value: number, minimum: number, maximum: number): number {
+  return Math.max(minimum, Math.min(maximum, Math.round(value)));
+}
+
+export function encodedInput(
+  type: number,
+  code: number,
+  x = 0,
+  y = 0,
+): Uint8Array {
+  const bytes = new Uint8Array(8);
+  const view = new DataView(bytes.buffer);
+  bytes[0] = type;
+  bytes[1] = code;
+  if (type === 6 || type === 14) {
+    view.setInt16(2, clamp(x, -32768, 32767), true);
+    view.setInt16(4, clamp(y, -32768, 32767), true);
+  } else {
+    view.setUint16(2, clamp(x, 0, 65535), true);
+    view.setUint16(4, clamp(y, 0, 65535), true);
+  }
+  return bytes;
+}
+
+const MAX_TEXT_INPUT_BYTES = 4 * 1024;
+const TEXT_CHUNK_BYTES = 6;
+const TEXT_CHUNK_START = 0x40;
+const TEXT_CHUNK_END = 0x80;
+
+export function encodedTextInput(
+  type: 8 | 9 | 10,
+  text: string,
+): Uint8Array[] {
+  const encoded = new TextEncoder().encode(text);
+  if (encoded.byteLength > MAX_TEXT_INPUT_BYTES) {
+    return [];
+  }
+  const records: Uint8Array[] = [];
+  let offset = 0;
+  do {
+    let end = Math.min(offset + TEXT_CHUNK_BYTES, encoded.byteLength);
+    while (
+      end > offset &&
+      end < encoded.byteLength &&
+      (encoded[end] & 0xc0) === 0x80
+    ) {
+      end -= 1;
+    }
+    const length = end - offset;
+    const record = new Uint8Array(8);
+    record[0] = type;
+    record[1] =
+      length |
+      (offset === 0 ? TEXT_CHUNK_START : 0) |
+      (end === encoded.byteLength ? TEXT_CHUNK_END : 0);
+    record.set(encoded.subarray(offset, end), 2);
+    records.push(record);
+    offset = end;
+  } while (offset < encoded.byteLength);
+  return records;
+}
+
+const MOTION_SAMPLE_BYTES = 48;
+const MOTION_FLAG_ACCELERATION = 1;
+const MOTION_FLAG_ROTATION = 2;
+const MOTION_FLAG_POINTER_EMULATED = 4;
+const POINTER_ROTATION_DEGREES_PER_PIXEL = 0.15;
+const MAX_POINTER_ROTATION_RATE = 720;
+
+export interface MotionSampleValues {
+  flags: number;
+  sequence: number;
+  timestampMs: number;
+  accelerationX: number;
+  accelerationY: number;
+  accelerationZ: number;
+  rotationAlpha: number;
+  rotationBeta: number;
+  rotationGamma: number;
+}
+
+export function encodedMotionSample(sample: MotionSampleValues): Uint8Array {
+  if (
+    !Number.isInteger(sample.flags) ||
+    sample.flags <= 0 ||
+    (sample.flags & ~7) !== 0 ||
+    ((sample.flags & MOTION_FLAG_POINTER_EMULATED) !== 0 &&
+      (sample.flags & MOTION_FLAG_ROTATION) === 0) ||
+    !Number.isInteger(sample.sequence) ||
+    sample.sequence <= 0 ||
+    sample.sequence > 0xffffffff ||
+    !Number.isFinite(sample.timestampMs) ||
+    sample.timestampMs < 0 ||
+    [
+      sample.accelerationX,
+      sample.accelerationY,
+      sample.accelerationZ,
+      sample.rotationAlpha,
+      sample.rotationBeta,
+      sample.rotationGamma,
+    ].some((value) => !Number.isFinite(value))
+  ) {
+    throw new Error("invalid MotionSample v1");
+  }
+  const bytes = new Uint8Array(MOTION_SAMPLE_BYTES);
+  const view = new DataView(bytes.buffer);
+  bytes.set([0x50, 0x4d, 0x4f, 0x31]);
+  view.setUint16(4, 1, true);
+  view.setUint16(6, sample.flags, true);
+  view.setUint32(8, MOTION_SAMPLE_BYTES, true);
+  view.setUint32(12, sample.sequence, true);
+  view.setFloat64(16, sample.timestampMs, true);
+  for (const [offset, value] of [
+    [24, sample.accelerationX],
+    [28, sample.accelerationY],
+    [32, sample.accelerationZ],
+    [36, sample.rotationAlpha],
+    [40, sample.rotationBeta],
+    [44, sample.rotationGamma],
+  ] as const) {
+    view.setFloat32(offset, value, true);
+  }
+  return bytes;
+}
+
+export function encodedPointerMotionSample(
+  deltaX: number,
+  deltaY: number,
+  elapsedMs: number,
+  sequence: number,
+  timestampMs: number,
+): Uint8Array {
+  if (
+    !Number.isFinite(deltaX) ||
+    !Number.isFinite(deltaY) ||
+    !Number.isFinite(elapsedMs) ||
+    elapsedMs <= 0
+  ) {
+    throw new Error("invalid pointer motion sample");
+  }
+  const degreesPerSecond = (delta: number): number =>
+    Math.max(
+      -MAX_POINTER_ROTATION_RATE,
+      Math.min(
+        MAX_POINTER_ROTATION_RATE,
+        (delta * POINTER_ROTATION_DEGREES_PER_PIXEL * 1_000) / elapsedMs,
+      ),
+    );
+  return encodedMotionSample({
+    flags: MOTION_FLAG_ROTATION | MOTION_FLAG_POINTER_EMULATED,
+    sequence,
+    timestampMs,
+    accelerationX: 0,
+    accelerationY: 0,
+    accelerationZ: 0,
+    rotationAlpha: 0,
+    rotationBeta: degreesPerSecond(deltaY),
+    rotationGamma: degreesPerSecond(deltaX),
+  });
+}
+
+// CoreVM's mouse ABI is a signed byte. Drop individual samples outside that
+// range as pointer-lock discontinuities, then bound the normal backlog
+// accumulated before the next display frame.
+const MAX_COREVM_POINTER_DELTA = 127;
+
+export function normalizedPointerDelta(
+  movementX: number,
+  movementY: number,
+  firstAfterPointerLock: boolean,
+): [number, number] | null {
+  if (
+    firstAfterPointerLock ||
+    !Number.isFinite(movementX) ||
+    !Number.isFinite(movementY) ||
+    Math.abs(movementX) > MAX_COREVM_POINTER_DELTA ||
+    Math.abs(movementY) > MAX_COREVM_POINTER_DELTA
+  ) {
+    return null;
+  }
+  return [movementX, movementY];
+}
+
+export function accumulateRelativePointerDelta(
+  currentX: number,
+  currentY: number,
+  deltaX: number,
+  deltaY: number,
+): [number, number] {
+  return [
+    clamp(
+      currentX + deltaX,
+      -MAX_COREVM_POINTER_DELTA,
+      MAX_COREVM_POINTER_DELTA,
+    ),
+    clamp(
+      currentY + deltaY,
+      -MAX_COREVM_POINTER_DELTA,
+      MAX_COREVM_POINTER_DELTA,
+    ),
+  ];
+}
+
+function createShell(controls: string[]): {
+  canvas: HTMLCanvasElement;
+  status: HTMLElement;
+  metrics: HTMLDetailsElement;
+  metricsSummary: HTMLElement;
+  metricsDetails: HTMLElement;
+} {
+  const style = document.createElement("style");
+  style.textContent = `
+    html,body{width:100%;height:100%;margin:0;background:#050505;color:#fff;overflow:hidden}
+    #dotli-pvm-shell{width:100%;height:100%;display:grid;place-items:center;position:relative;background:#050505}
+    #dotli-pvm-canvas{max-width:100%;max-height:100%;width:100%;height:100%;object-fit:contain;image-rendering:pixelated;outline:none}
+    .dotli-pvm-overlay{position:absolute;left:12px;background:#090b0de8;border:1px solid #ffffff2b;border-radius:4px;font:11px/1.35 ui-monospace,monospace;color:#f5f5f5}
+    #dotli-pvm-status{top:12px;padding:5px 8px;pointer-events:none}
+    #dotli-pvm-status:empty{display:none}
+    #dotli-pvm-metrics{top:12px;max-width:min(460px,calc(100vw - 24px));overflow:hidden;pointer-events:auto}
+    #dotli-pvm-metrics[hidden]{display:none}
+    #dotli-pvm-metrics summary{padding:6px 9px;cursor:pointer;white-space:nowrap;font-weight:600;user-select:none}
+    #dotli-pvm-metrics pre{margin:0;padding:7px 9px;border-top:1px solid #ffffff1f;white-space:pre-wrap;color:#c9ced3;font:inherit;font-weight:400}
+    #dotli-pvm-controls{position:absolute;right:12px;bottom:12px;max-width:min(480px,70vw);font:11px/1.4 ui-monospace,monospace;color:#ddd;text-align:right}
+  `;
+  const shell = document.createElement("main");
+  shell.id = "dotli-pvm-shell";
+  const canvas = document.createElement("canvas");
+  canvas.id = "dotli-pvm-canvas";
+  canvas.tabIndex = 0;
+  const status = document.createElement("div");
+  status.id = "dotli-pvm-status";
+  status.className = "dotli-pvm-overlay";
+  status.textContent = "Translating PolkaVM application…";
+  const metrics = document.createElement("details");
+  metrics.id = "dotli-pvm-metrics";
+  metrics.className = "dotli-pvm-overlay";
+  metrics.hidden = true;
+  const metricsSummary = document.createElement("summary");
+  const metricsDetails = document.createElement("pre");
+  metrics.append(metricsSummary, metricsDetails);
+  const controlText = document.createElement("div");
+  controlText.id = "dotli-pvm-controls";
+  controlText.textContent = controls.join(" · ");
+  shell.append(canvas, status, metrics, controlText);
+  document.head.append(style);
+  document.body.replaceChildren(shell);
+  return { canvas, status, metrics, metricsSummary, metricsDetails };
+}
+
+function installInput(
+  canvas: HTMLCanvasElement,
+  graphicsProfile: "framebuffer" | "tri2d" | "webgpu-raster",
+  inputFeatures: readonly string[],
+  send: (bytes: Uint8Array) => void,
+  sendMotion: (bytes: Uint8Array) => void,
+  resumeAudio: () => void,
+): { cleanup: () => void; sendSurfaceMetrics: () => void } {
+  const pressed = new Set<number>();
+  const inputFeatureSet = new Set(inputFeatures);
+  const textInput =
+    inputFeatureSet.has("text") || inputFeatureSet.has("ime")
+      ? document.createElement("textarea")
+      : null;
+  if (textInput !== null) {
+    textInput.tabIndex = -1;
+    textInput.spellcheck = false;
+    textInput.setAttribute("autocomplete", "off");
+    textInput.setAttribute("autocapitalize", "off");
+    textInput.style.cssText =
+      "position:fixed;left:0;top:0;width:1px;height:1px;opacity:0;pointer-events:none";
+    document.body.append(textInput);
+  }
+  const focusTarget: HTMLCanvasElement | HTMLTextAreaElement =
+    textInput ?? canvas;
+  let composing = false;
+  let suppressCommittedInput = false;
+  let firstMoveAfterPointerLock = false;
+  let relativeX = 0;
+  let relativeY = 0;
+  let relativeFrame: number | null = null;
+  let motionSequence = 0;
+  let motionX = 0;
+  let motionY = 0;
+  let motionFrame: number | null = null;
+  let motionWindowStarted = performance.now();
+  let previousPointer: [number, number] | null = null;
+  let motionPermissionRequested = false;
+  const nextMotionSequence = (): number => {
+    motionSequence = motionSequence === 0xffffffff ? 1 : motionSequence + 1;
+    return motionSequence;
+  };
+  const flushPointerMotion = (now: number): void => {
+    motionFrame = null;
+    const x = motionX;
+    const y = motionY;
+    motionX = 0;
+    motionY = 0;
+    if (x === 0 && y === 0) {
+      return;
+    }
+    const elapsedMs = Math.max(1, now - motionWindowStarted);
+    motionWindowStarted = now;
+    sendMotion(
+      encodedPointerMotionSample(x, y, elapsedMs, nextMotionSequence(), now),
+    );
+  };
+  const queuePointerMotion = (x: number, y: number): void => {
+    motionX += x;
+    motionY += y;
+    motionFrame ??= window.requestAnimationFrame(flushPointerMotion);
+  };
+  const requestDeviceMotionPermission = (): void => {
+    if (motionPermissionRequested || typeof DeviceMotionEvent === "undefined") {
+      return;
+    }
+    motionPermissionRequested = true;
+    const constructor = DeviceMotionEvent as typeof DeviceMotionEvent & {
+      requestPermission?: () => Promise<"granted" | "denied">;
+    };
+    if (typeof constructor.requestPermission === "function") {
+      void constructor.requestPermission().catch(() => undefined);
+    }
+  };
+  const deviceMotion = (event: DeviceMotionEvent): void => {
+    const acceleration = event.accelerationIncludingGravity;
+    const rotation = event.rotationRate;
+    const accelerationValues = [
+      acceleration?.x,
+      acceleration?.y,
+      acceleration?.z,
+    ];
+    const rotationValues = [rotation?.alpha, rotation?.beta, rotation?.gamma];
+    const hasAcceleration = accelerationValues.every(
+      (value) => typeof value === "number" && Number.isFinite(value),
+    );
+    const hasRotation = rotationValues.every(
+      (value) => typeof value === "number" && Number.isFinite(value),
+    );
+    if (!hasAcceleration && !hasRotation) {
+      return;
+    }
+    sendMotion(
+      encodedMotionSample({
+        flags:
+          (hasAcceleration ? MOTION_FLAG_ACCELERATION : 0) |
+          (hasRotation ? MOTION_FLAG_ROTATION : 0),
+        sequence: nextMotionSequence(),
+        timestampMs: performance.now(),
+        accelerationX: hasAcceleration ? (acceleration?.x ?? 0) : 0,
+        accelerationY: hasAcceleration ? (acceleration?.y ?? 0) : 0,
+        accelerationZ: hasAcceleration ? (acceleration?.z ?? 0) : 0,
+        rotationAlpha: hasRotation ? (rotation?.alpha ?? 0) : 0,
+        rotationBeta: hasRotation ? (rotation?.beta ?? 0) : 0,
+        rotationGamma: hasRotation ? (rotation?.gamma ?? 0) : 0,
+      }),
+    );
+  };
+  const flushRelativePointer = (): void => {
+    relativeFrame = null;
+    const x = relativeX;
+    const y = relativeY;
+    relativeX = 0;
+    relativeY = 0;
+    if (x !== 0 || y !== 0) {
+      send(encodedInput(6, 0, x, y));
+      queuePointerMotion(x, y);
+    }
+  };
+  const queueRelativePointer = (x: number, y: number): void => {
+    [relativeX, relativeY] = accumulateRelativePointerDelta(
+      relativeX,
+      relativeY,
+      x,
+      y,
+    );
+    relativeFrame ??= window.requestAnimationFrame(flushRelativePointer);
+  };
+  const pointerLockChanged = (): void => {
+    if (relativeFrame !== null) {
+      window.cancelAnimationFrame(relativeFrame);
+      relativeFrame = null;
+    }
+    relativeX = 0;
+    relativeY = 0;
+    if (motionFrame !== null) {
+      window.cancelAnimationFrame(motionFrame);
+      motionFrame = null;
+    }
+    motionX = 0;
+    motionY = 0;
+    motionWindowStarted = performance.now();
+    previousPointer = null;
+    firstMoveAfterPointerLock = document.pointerLockElement === canvas;
+  };
+  const canvasPosition = (event: PointerEvent): [number, number] => {
+    const bounds = canvas.getBoundingClientRect();
+    if (bounds.width <= 0 || bounds.height <= 0) {
+      return [0, 0];
+    }
+    return [
+      ((event.clientX - bounds.left) * canvas.width) / bounds.width,
+      ((event.clientY - bounds.top) * canvas.height) / bounds.height,
+    ];
+  };
+  const sendTextRecords = (type: 8 | 9 | 10, text: string): void => {
+    for (const record of encodedTextInput(type, text)) {
+      send(record);
+    }
+  };
+  const focus = (): void => {
+    if (inputFeatureSet.has("focus")) {
+      send(encodedInput(13, 1));
+    }
+  };
+  const blur = (): void => {
+    if (composing && inputFeatureSet.has("ime")) {
+      send(encodedInput(12, 0));
+    }
+    composing = false;
+    if (inputFeatureSet.has("focus")) {
+      send(encodedInput(13, 0));
+    }
+  };
+  const beforeInput = (event: InputEvent): void => {
+    if (
+      !inputFeatureSet.has("text") ||
+      composing ||
+      event.isComposing ||
+      suppressCommittedInput ||
+      event.data === null
+    ) {
+      return;
+    }
+    sendTextRecords(8, event.data);
+    if (event.cancelable) {
+      event.preventDefault();
+    }
+  };
+  const input = (): void => {
+    if (!composing && textInput !== null) {
+      textInput.value = "";
+    }
+  };
+  const compositionStart = (): void => {
+    composing = true;
+    if (inputFeatureSet.has("ime")) {
+      send(encodedInput(11, 0));
+    }
+  };
+  const compositionUpdate = (event: CompositionEvent): void => {
+    if (inputFeatureSet.has("ime")) {
+      sendTextRecords(9, event.data);
+    }
+  };
+  const compositionEnd = (event: CompositionEvent): void => {
+    composing = false;
+    suppressCommittedInput = true;
+    queueMicrotask(() => {
+      suppressCommittedInput = false;
+    });
+    if (inputFeatureSet.has("ime")) {
+      sendTextRecords(10, event.data);
+      send(encodedInput(12, 0));
+    } else if (inputFeatureSet.has("text")) {
+      sendTextRecords(8, event.data);
+    }
+    if (textInput !== null) {
+      textInput.value = "";
+    }
+  };
+  const wheel = (event: WheelEvent): void => {
+    event.preventDefault();
+    const scale =
+      event.deltaMode === WheelEvent.DOM_DELTA_LINE
+        ? 16
+        : event.deltaMode === WheelEvent.DOM_DELTA_PAGE
+          ? Math.max(1, canvas.clientHeight)
+          : 1;
+    send(encodedInput(14, 0, event.deltaX * scale, event.deltaY * scale));
+  };
+  const keydown = (event: KeyboardEvent): void => {
+    requestDeviceMotionPermission();
+    if (event.code === "Escape" && document.pointerLockElement === canvas) {
+      event.preventDefault();
+      document.exitPointerLock();
+      return;
+    }
+    if (!(event.code in keyCodes) || event.repeat) {
+      return;
+    }
+    const code = keyCodes[event.code];
+    if (pressed.has(code)) {
+      return;
+    }
+    if (
+      textInput === null ||
+      event.ctrlKey ||
+      event.metaKey ||
+      event.altKey ||
+      event.code === "Tab"
+    ) {
+      event.preventDefault();
+    }
+    pressed.add(code);
+    resumeAudio();
+    send(encodedInput(1, code));
+  };
+  const keyup = (event: KeyboardEvent): void => {
+    if (!(event.code in keyCodes)) {
+      return;
+    }
+    const code = keyCodes[event.code];
+    if (!pressed.delete(code)) {
+      return;
+    }
+    event.preventDefault();
+    send(encodedInput(2, code));
+  };
+  const pointer = (event: PointerEvent, type: 3 | 4): void => {
+    if (!(event.button in pointerButtons)) {
+      return;
+    }
+    event.preventDefault();
+    resumeAudio();
+    const [x, y] = canvasPosition(event);
+    send(encodedInput(type, pointerButtons[event.button], x, y));
+  };
+  const move = (event: PointerEvent): void => {
+    if (graphicsProfile === "tri2d") {
+      const [x, y] = canvasPosition(event);
+      send(encodedInput(5, 0, x, y));
+      if (previousPointer !== null) {
+        queuePointerMotion(
+          event.clientX - previousPointer[0],
+          event.clientY - previousPointer[1],
+        );
+      }
+      previousPointer = [event.clientX, event.clientY];
+      return;
+    }
+    if (document.pointerLockElement !== canvas) {
+      return;
+    }
+    const delta = normalizedPointerDelta(
+      event.movementX,
+      event.movementY,
+      firstMoveAfterPointerLock,
+    );
+    firstMoveAfterPointerLock = false;
+    if (delta !== null) {
+      // Pointer events can outpace a guest frame by an order of magnitude.
+      // Coalesce them once per display frame so a render stall cannot replay
+      // a stale queue as one camera snap.
+      queueRelativePointer(delta[0], delta[1]);
+    }
+  };
+  const down = (event: PointerEvent): void => {
+    requestDeviceMotionPermission();
+    previousPointer = [event.clientX, event.clientY];
+    focusTarget.focus({ preventScroll: true });
+    if (graphicsProfile === "tri2d") {
+      move(event);
+    }
+    pointer(event, 3);
+    if (
+      graphicsProfile !== "tri2d" &&
+      event.button === 0 &&
+      document.pointerLockElement !== canvas
+    ) {
+      void canvas.requestPointerLock().catch(() => undefined);
+    }
+  };
+  const up = (event: PointerEvent): void => {
+    pointer(event, 4);
+  };
+  const contextmenu = (event: MouseEvent): void => {
+    event.preventDefault();
+  };
+  const sendSurfaceMetrics = (): void => {
+    if (graphicsProfile !== "tri2d") {
+      return;
+    }
+    const bounds = canvas.getBoundingClientRect();
+    const scale = Math.max(1 / 32, Math.min(3, window.devicePixelRatio || 1));
+    const width = clamp(bounds.width * scale, 1, 4_096);
+    const height = clamp(bounds.height * scale, 1, 4_096);
+    send(encodedInput(7, clamp(scale * 32, 1, 96), width, height));
+  };
+  const resizeObserver =
+    graphicsProfile === "tri2d"
+      ? new ResizeObserver(() => {
+          sendSurfaceMetrics();
+        })
+      : null;
+  resizeObserver?.observe(canvas);
+  focusTarget.addEventListener("focus", focus);
+  focusTarget.addEventListener("blur", blur);
+  if (textInput !== null) {
+    textInput.addEventListener("beforeinput", beforeInput);
+    textInput.addEventListener("input", input);
+    textInput.addEventListener("compositionstart", compositionStart);
+    textInput.addEventListener("compositionupdate", compositionUpdate);
+    textInput.addEventListener("compositionend", compositionEnd);
+  }
+  if (inputFeatureSet.has("wheel")) {
+    canvas.addEventListener("wheel", wheel, { passive: false });
+  }
+  document.addEventListener("pointerlockchange", pointerLockChanged);
+  window.addEventListener("keydown", keydown);
+  window.addEventListener("keyup", keyup);
+  window.addEventListener("devicemotion", deviceMotion);
+  canvas.addEventListener("pointerdown", down);
+  canvas.addEventListener("pointerup", up);
+  canvas.addEventListener("pointermove", move);
+  canvas.addEventListener("contextmenu", contextmenu);
+  return {
+    sendSurfaceMetrics,
+    cleanup: () => {
+      resizeObserver?.disconnect();
+      if (document.activeElement === focusTarget) {
+        focusTarget.blur();
+      }
+      pointerLockChanged();
+      document.removeEventListener("pointerlockchange", pointerLockChanged);
+      window.removeEventListener("keydown", keydown);
+      window.removeEventListener("keyup", keyup);
+      window.removeEventListener("devicemotion", deviceMotion);
+      focusTarget.removeEventListener("focus", focus);
+      focusTarget.removeEventListener("blur", blur);
+      if (textInput !== null) {
+        textInput.removeEventListener("beforeinput", beforeInput);
+        textInput.removeEventListener("input", input);
+        textInput.removeEventListener("compositionstart", compositionStart);
+        textInput.removeEventListener("compositionupdate", compositionUpdate);
+        textInput.removeEventListener("compositionend", compositionEnd);
+        textInput.remove();
+      }
+      canvas.removeEventListener("wheel", wheel);
+      canvas.removeEventListener("pointerdown", down);
+      canvas.removeEventListener("pointerup", up);
+      canvas.removeEventListener("pointermove", move);
+      canvas.removeEventListener("contextmenu", contextmenu);
+    },
+  };
+}
+
+export async function runPvmApplication(
+  files: ArchiveFiles,
+  cid: string,
+  externalManifest: string | null = null,
+): Promise<void> {
+  const descriptor = parseManifest(files, externalManifest);
+  if (descriptor === null) {
+    throw new Error("package is not a PolkaVM application");
+  }
+  validateFiles(files, descriptor);
+  const forceInterpreter =
+    new URLSearchParams(location.search).get("pvmMode") === "interpreter";
+
+  const started = performance.now();
+  const {
+    canvas,
+    status,
+    metrics: metricsElement,
+    metricsSummary,
+    metricsDetails,
+  } = createShell(descriptor.controls);
+  if (forceInterpreter) {
+    status.textContent = "Starting PolkaVM interpreter…";
+  }
+  const context =
+    descriptor.graphicsProfile === "framebuffer"
+      ? canvas.getContext("2d", { alpha: false })
+      : null;
+  if (descriptor.graphicsProfile === "framebuffer" && context === null) {
+    throw new Error("2D canvas is unavailable");
+  }
+  const tri2d =
+    descriptor.graphicsProfile === "tri2d" ? new Tri2dRenderer(canvas) : null;
+  canvas.dataset.pvmProfile = descriptor.graphicsProfile;
+
+  const runtime = await runtimeBytes();
+  const program = ownedBytes(files[descriptor.programPath]);
+  const cacheKey = `${RUNTIME_SOURCE}:${await programDigest(program)}`;
+  const compiledModule = forceInterpreter
+    ? undefined
+    : compiledModules.get(cacheKey);
+  const compiledBytes =
+    !forceInterpreter && compiledModule === undefined
+      ? await loadTranslation(cacheKey)
+      : null;
+  let saveIdentity = cid;
+  if (descriptor.requiredAssets.length > 0) {
+    const fingerprints: string[] = [];
+    for (const path of [...descriptor.requiredAssets].sort()) {
+      fingerprints.push(path, await programDigest(files[path]));
+    }
+    saveIdentity = await programDigest(
+      encoder.encode(fingerprints.join("\u0000")),
+    );
+  }
+  const saveKey = `${location.hostname}:${saveIdentity}`;
+  const assets = Object.entries(files)
+    .filter(
+      ([path]) => path !== "manifest.json" && path !== descriptor.programPath,
+    )
+    .map(([path, bytes]) => ({ path, bytes: ownedBytes(bytes) }));
+  const save = await loadSave(saveKey);
+  if (
+    save !== null &&
+    !assets.some((asset) => asset.path === "save/cartridge.sav")
+  ) {
+    assets.push({ path: "save/cartridge.sav", bytes: ownedBytes(save) });
+  }
+
+  const worker = new Worker(`${PVM_RUNTIME_ROOT}/pvm-wasm-worker.js`);
+  const {
+    promise: startedPromise,
+    resolve: resolveStarted,
+    reject: rejectStarted,
+  } = Promise.withResolvers<undefined>();
+  const truapiPort = await waitForTruapiPort();
+  canvas.dataset.pvmTruapiRequests = "0";
+  canvas.dataset.pvmTruapiResponses = "0";
+  const failTruapi = (error: Error): void => {
+    status.textContent = error.message;
+    rejectStarted(error);
+    worker.postMessage({ type: "stop" });
+    worker.terminate();
+    truapiPort.onmessage = null;
+    truapiPort.onmessageerror = null;
+    truapiPort.close();
+  };
+  let truapiReady = false;
+  let pendingTruapiBytes = 0;
+  const pendingTruapiResponses: Uint8Array<ArrayBuffer>[] = [];
+  const sendTruapiResponse = (value: Uint8Array): void => {
+    const bytes = ownedBytes(value);
+    worker.postMessage({ type: "truapi-response", bytes }, [bytes.buffer]);
+  };
+  truapiPort.onmessage = (event: MessageEvent<unknown>): void => {
+    if (
+      !(event.data instanceof Uint8Array) ||
+      event.data.byteLength === 0 ||
+      event.data.byteLength > MAX_TRUAPI_FRAME_BYTES
+    ) {
+      failTruapi(new Error("TrUAPI Host returned an invalid PVM frame"));
+      return;
+    }
+    const bytes = ownedBytes(event.data);
+    canvas.dataset.pvmTruapiResponses = String(
+      Number(canvas.dataset.pvmTruapiResponses) + 1,
+    );
+    if (truapiReady) {
+      sendTruapiResponse(bytes);
+      return;
+    }
+    if (
+      pendingTruapiResponses.length === MAX_TRUAPI_PENDING_FRAMES ||
+      pendingTruapiBytes + bytes.byteLength > MAX_TRUAPI_PENDING_BYTES
+    ) {
+      failTruapi(
+        new Error("TrUAPI response queue overflow during PVM startup"),
+      );
+      return;
+    }
+    pendingTruapiBytes += bytes.byteLength;
+    pendingTruapiResponses.push(bytes);
+  };
+  truapiPort.onmessageerror = () => {
+    failTruapi(new Error("TrUAPI Host port could not decode a PVM frame"));
+  };
+  truapiPort.start();
+  let audioContext: AudioContext | null = null;
+  let audioCursor = 0;
+  let firstFrame = false;
+  let frameWindowStarted = performance.now();
+  let frameWindowCount = 0;
+  const pvmMetrics: PvmMetrics = {
+    backend: "starting",
+    cacheHit: false,
+    translationMs: 0,
+    compilationMs: 0,
+    startupMs: 0,
+    startupStage: "worker-created",
+    firstFrameMs: 0,
+    translatedWasmBytes: 0,
+    frames: 0,
+    fps: 0,
+    updates: 0,
+    updateP50Ms: 0,
+    updateP95Ms: 0,
+    updateMaxMs: 0,
+    audioChunks: 0,
+    audioSamples: 0,
+  };
+  window.__dotliPvmMetrics = pvmMetrics;
+
+  const updateMetrics = (): void => {
+    const display = formatPvmMetrics(pvmMetrics);
+    metricsSummary.textContent = display.summary;
+    metricsDetails.textContent = display.details;
+    canvas.dataset.pvmBackend = pvmMetrics.backend;
+    canvas.dataset.pvmCacheHit = String(pvmMetrics.cacheHit);
+    canvas.dataset.pvmTranslationMs = String(pvmMetrics.translationMs);
+    canvas.dataset.pvmCompilationMs = String(pvmMetrics.compilationMs);
+    canvas.dataset.pvmStartupMs = String(pvmMetrics.startupMs);
+    canvas.dataset.pvmStartupStage = pvmMetrics.startupStage;
+    canvas.dataset.pvmFirstFrameMs = String(pvmMetrics.firstFrameMs);
+    canvas.dataset.pvmFrames = String(pvmMetrics.frames);
+    canvas.dataset.pvmFps = String(pvmMetrics.fps);
+    canvas.dataset.pvmUpdates = String(pvmMetrics.updates);
+    canvas.dataset.pvmUpdateP50Ms = String(pvmMetrics.updateP50Ms);
+    canvas.dataset.pvmUpdateP95Ms = String(pvmMetrics.updateP95Ms);
+    canvas.dataset.pvmUpdateMaxMs = String(pvmMetrics.updateMaxMs);
+    canvas.dataset.pvmAudioChunks = String(pvmMetrics.audioChunks);
+    canvas.dataset.pvmAudioSamples = String(pvmMetrics.audioSamples);
+  };
+  const setStartupStage = (stage: string): void => {
+    if (firstFrame) {
+      return;
+    }
+    pvmMetrics.startupStage = stage;
+    status.textContent = `PVM startup: ${stage.replaceAll("-", " ")}…`;
+    updateMetrics();
+  };
+  const presentedFrame = (): void => {
+    pvmMetrics.frames++;
+    canvas.dataset.pvmFrames = String(pvmMetrics.frames);
+    frameWindowCount++;
+    const now = performance.now();
+    if (now - frameWindowStarted >= 500) {
+      pvmMetrics.fps = (frameWindowCount * 1000) / (now - frameWindowStarted);
+      frameWindowStarted = now;
+      frameWindowCount = 0;
+      updateMetrics();
+    }
+    if (!firstFrame) {
+      firstFrame = true;
+      pvmMetrics.firstFrameMs = now - started;
+      pvmMetrics.startupStage = "first-frame";
+      status.textContent = "";
+      metricsElement.hidden = false;
+      window.clearTimeout(timer);
+      updateMetrics();
+      resolveStarted(undefined);
+    }
+  };
+
+  const resumeAudio = (): void => {
+    audioContext ??= new AudioContext({ sampleRate: 48_000 });
+    if (audioContext.state === "suspended") {
+      void audioContext.resume();
+    }
+  };
+  const playAudio = (message: WorkerAudio): void => {
+    if (
+      !Number.isInteger(message.channels) ||
+      message.channels < 1 ||
+      message.channels > 2 ||
+      !Number.isInteger(message.sampleRate) ||
+      message.sampleRate < 8_000 ||
+      message.sampleRate > 96_000 ||
+      !(message.samples instanceof Uint8Array) ||
+      message.samples.byteLength === 0 ||
+      message.samples.byteLength > MAX_AUDIO_BYTES ||
+      message.samples.byteLength % (message.channels * 2) !== 0
+    ) {
+      return;
+    }
+    pvmMetrics.audioChunks++;
+    pvmMetrics.audioSamples += message.samples.byteLength / 2;
+    canvas.dataset.pvmAudioChunks = String(pvmMetrics.audioChunks);
+    canvas.dataset.pvmAudioSamples = String(pvmMetrics.audioSamples);
+    if (
+      canvas.dataset.pvmAudioNonzero !== "true" &&
+      message.samples.some((byte) => byte !== 0)
+    ) {
+      canvas.dataset.pvmAudioNonzero = "true";
+    }
+    resumeAudio();
+    if (audioContext?.state !== "running") {
+      audioCursor = 0;
+      return;
+    }
+    const samples = new Int16Array(
+      message.samples.buffer,
+      message.samples.byteOffset,
+      message.samples.byteLength / 2,
+    );
+    const frameCount = samples.length / message.channels;
+    const start = Math.max(audioCursor, audioContext.currentTime + 0.02);
+    if (
+      start + frameCount / message.sampleRate - audioContext.currentTime >
+      0.25
+    ) {
+      return;
+    }
+    const buffer = audioContext.createBuffer(
+      message.channels,
+      frameCount,
+      message.sampleRate,
+    );
+    for (let channel = 0; channel < message.channels; channel++) {
+      const output = buffer.getChannelData(channel);
+      for (let index = 0; index < frameCount; index++) {
+        output[index] = samples[index * message.channels + channel] / 32768;
+      }
+    }
+    const source = audioContext.createBufferSource();
+    source.buffer = buffer;
+    source.connect(audioContext.destination);
+    source.start(start);
+    audioCursor = start + buffer.duration;
+  };
+
+  const startTimeoutMs = forceInterpreter
+    ? INTERPRETER_START_TIMEOUT_MS
+    : START_TIMEOUT_MS;
+  const timer = window.setTimeout(() => {
+    rejectStarted(
+      new Error(
+        `${forceInterpreter ? "PolkaVM interpreter" : "PolkaVM application"} did not present a frame within ${String(startTimeoutMs / 1000)}s (last stage: ${pvmMetrics.startupStage})`,
+      ),
+    );
+  }, startTimeoutMs);
+  let webGpu: WebGpuRasterBridge | null = null;
+  let gpuCapabilities: Uint8Array | null = null;
+  if (descriptor.graphicsProfile === "webgpu-raster") {
+    if (descriptor.webGpuRequirements === null) {
+      throw new Error("WebGPU Raster requirements are missing");
+    }
+    webGpu = new WebGpuRasterBridge(canvas, descriptor.webGpuRequirements, {
+      capabilities: (bytes) => {
+        const capabilities = ownedBytes(bytes);
+        worker.postMessage({ type: "gpu-capabilities", bytes: capabilities }, [
+          capabilities.buffer,
+        ]);
+      },
+      event: (bytes) => {
+        worker.postMessage({ type: "gpu-event", bytes }, [bytes.buffer]);
+      },
+      presented: presentedFrame,
+      error: (error) => {
+        status.textContent = error.message;
+        rejectStarted(error);
+      },
+    });
+    gpuCapabilities = await webGpu.capabilities;
+  }
+
+  const { cleanup: cleanupInput, sendSurfaceMetrics } = installInput(
+    canvas,
+    descriptor.graphicsProfile,
+    descriptor.inputFeatures,
+    (bytes) => {
+      worker.postMessage({ type: "input", bytes }, [bytes.buffer]);
+    },
+    (bytes) => {
+      const flags = new DataView(
+        bytes.buffer,
+        bytes.byteOffset,
+        bytes.byteLength,
+      ).getUint16(6, true);
+      canvas.dataset.pvmMotionSamples = String(
+        Number(canvas.dataset.pvmMotionSamples ?? 0) + 1,
+      );
+      canvas.dataset.pvmMotionSource =
+        (flags & MOTION_FLAG_POINTER_EMULATED) !== 0 ? "pointer" : "device";
+      worker.postMessage({ type: "motion", bytes }, [bytes.buffer]);
+    },
+    resumeAudio,
+  );
+  const stop = (): void => {
+    cleanupInput();
+    tri2d?.dispose();
+    worker.postMessage({ type: "stop" });
+    webGpu?.dispose();
+    worker.terminate();
+    void audioContext?.close();
+    truapiPort.onmessage = null;
+    truapiPort.onmessageerror = null;
+    truapiPort.close();
+  };
+  window.addEventListener("pagehide", stop, { once: true });
+
+  let translationStorePromise: Promise<void> = Promise.resolve();
+  worker.onmessage = async (event: MessageEvent<unknown>): Promise<void> => {
+    const message = object(event.data);
+    switch (message?.type) {
+      case "startup": {
+        const startup = message as unknown as WorkerStartup;
+        if (typeof startup.stage === "string" && startup.stage !== "") {
+          setStartupStage(startup.stage);
+        }
+        break;
+      }
+      case "translated": {
+        setStartupStage("translated");
+        if (
+          message.cacheKey === cacheKey &&
+          message.bytes instanceof Uint8Array
+        ) {
+          translationStorePromise = storeTranslation(
+            cacheKey,
+            message.bytes,
+          ).catch((error: unknown) => {
+            console.warn(
+              `PolkaVM translation cache write failed: ${error instanceof Error ? error.message : String(error)}`,
+            );
+          });
+        }
+        break;
+      }
+      case "compiled": {
+        setStartupStage("compiled");
+        if (
+          message.cacheKey === cacheKey &&
+          message.module instanceof WebAssembly.Module
+        ) {
+          compiledModules.delete(cacheKey);
+          compiledModules.set(cacheKey, message.module);
+          if (compiledModules.size > 8) {
+            const oldest = compiledModules.keys().next().value;
+            if (oldest !== undefined) {
+              compiledModules.delete(oldest);
+            }
+          }
+        }
+        break;
+      }
+      case "ready": {
+        await translationStorePromise;
+        const ready = message as unknown as WorkerReady;
+        pvmMetrics.backend = ready.backend;
+        pvmMetrics.cacheHit = ready.cacheHit === true;
+        pvmMetrics.translationMs = ready.translationMs ?? 0;
+        pvmMetrics.compilationMs = ready.compilationMs ?? 0;
+        pvmMetrics.startupMs = ready.startupMs ?? 0;
+        pvmMetrics.translatedWasmBytes = ready.translatedWasmBytes ?? 0;
+        pvmMetrics.startupStage = "ready";
+        status.textContent = `${ready.backend === "compiler" ? "PVM→Wasm JIT" : "PVM interpreter"} ready`;
+        canvas.dataset.pvmReady = "true";
+        updateMetrics();
+        sendSurfaceMetrics();
+        truapiReady = true;
+        for (const response of pendingTruapiResponses.splice(0)) {
+          pendingTruapiBytes -= response.byteLength;
+          sendTruapiResponse(response);
+        }
+        break;
+      }
+      case "truapi-request": {
+        const bytes = message.bytes;
+        if (
+          !(bytes instanceof Uint8Array) ||
+          bytes.byteLength === 0 ||
+          bytes.byteLength > MAX_TRUAPI_FRAME_BYTES
+        ) {
+          failTruapi(
+            new Error("PolkaVM guest emitted an invalid TrUAPI frame"),
+          );
+          return;
+        }
+        const request = ownedBytes(bytes);
+        canvas.dataset.pvmTruapiRequests = String(
+          Number(canvas.dataset.pvmTruapiRequests) + 1,
+        );
+        truapiPort.postMessage(request, [request.buffer]);
+        break;
+      }
+      case "frame": {
+        const frame = message as unknown as WorkerFrame;
+        if (
+          descriptor.graphicsProfile !== "framebuffer" ||
+          context === null ||
+          !Number.isInteger(frame.width) ||
+          !Number.isInteger(frame.height) ||
+          frame.width <= 0 ||
+          frame.height <= 0 ||
+          !(frame.pixels instanceof Uint8Array) ||
+          frame.pixels.byteLength !== frame.width * frame.height * 4
+        ) {
+          rejectStarted(
+            new Error("PolkaVM guest emitted an invalid framebuffer"),
+          );
+          return;
+        }
+        canvas.width = frame.width;
+        canvas.height = frame.height;
+        const pixels = new Uint8ClampedArray(frame.pixels.byteLength);
+        pixels.set(frame.pixels);
+        context.putImageData(
+          new ImageData(pixels, frame.width, frame.height),
+          0,
+          0,
+        );
+        presentedFrame();
+        break;
+      }
+      case "tri2d": {
+        const frame = message as unknown as WorkerTri2d;
+        if (
+          descriptor.graphicsProfile !== "tri2d" ||
+          tri2d === null ||
+          !(frame.bytes instanceof Uint8Array)
+        ) {
+          rejectStarted(
+            new Error("PolkaVM guest emitted an invalid Tri2D frame"),
+          );
+          return;
+        }
+        try {
+          const metadata = tri2d.render(frame.bytes);
+          canvas.dataset.pvmTri2dDraws = String(metadata.drawCount);
+          canvas.dataset.pvmTri2dVertices = String(metadata.vertexCount);
+          canvas.dataset.pvmTri2dIndices = String(metadata.indexCount);
+          presentedFrame();
+        } catch (error) {
+          rejectStarted(error);
+        }
+        break;
+      }
+      case "gpu-batch": {
+        const batch = message as unknown as WorkerGpuBatch;
+        if (
+          descriptor.graphicsProfile !== "webgpu-raster" ||
+          webGpu === null ||
+          !(batch.bytes instanceof Uint8Array) ||
+          batch.bytes.byteLength === 0 ||
+          batch.bytes.byteLength > 4 * 1024 * 1024
+        ) {
+          rejectStarted(
+            new Error("PolkaVM guest emitted an invalid WebGPU Raster batch"),
+          );
+          return;
+        }
+        webGpu.submit(batch.bytes);
+        break;
+      }
+      case "audio":
+        playAudio(message as unknown as WorkerAudio);
+        break;
+      case "save": {
+        const bytes = message.bytes;
+        if (bytes instanceof Uint8Array) {
+          void storeSave(saveKey, bytes);
+        }
+        break;
+      }
+      case "metrics": {
+        const values = message as unknown as WorkerMetrics;
+        pvmMetrics.updates = values.updates;
+        pvmMetrics.updateP50Ms = values.updateP50Ms;
+        pvmMetrics.updateP95Ms = values.updateP95Ms;
+        pvmMetrics.updateMaxMs = values.updateMaxMs;
+        updateMetrics();
+        break;
+      }
+      case "log": {
+        const text = typeof message.message === "string" ? message.message : "";
+        console.warn(`[PolkaVM] ${text}`);
+        break;
+      }
+      case "error": {
+        const text =
+          typeof message.message === "string"
+            ? message.message
+            : "PolkaVM runtime failed";
+        const error = new Error(text);
+        status.textContent = error.message;
+        rejectStarted(error);
+        break;
+      }
+    }
+  };
+  worker.onerror = (event: ErrorEvent): void => {
+    rejectStarted(
+      new Error(
+        event.message
+          ? `PolkaVM worker failed: ${event.message}`
+          : "PolkaVM worker failed",
+      ),
+    );
+  };
+
+  const runtimeCopy = runtime.slice(0);
+  const transfers: Transferable[] = [runtimeCopy, program.buffer];
+  if (compiledBytes !== null) {
+    transfers.push(compiledBytes.buffer);
+  }
+  for (const asset of assets) {
+    transfers.push(asset.bytes.buffer);
+  }
+  const gpuCapabilitiesBuffer = gpuCapabilities?.buffer;
+  if (gpuCapabilitiesBuffer !== undefined) {
+    transfers.push(gpuCapabilitiesBuffer);
+  }
+  worker.postMessage(
+    {
+      type: "start",
+      runtime: runtimeCopy,
+      program,
+      assets,
+      audioEnabled: descriptor.audioEnabled,
+      cacheKey,
+      compiledModule,
+      compiledBytes: compiledBytes?.buffer,
+      graphicsProfile: descriptor.graphicsProfile,
+      gpuCapabilities: gpuCapabilitiesBuffer,
+      motionAvailability:
+        typeof PointerEvent !== "undefined" ||
+        typeof DeviceMotionEvent !== "undefined"
+          ? 1
+          : 0,
+      forceInterpreter,
+    },
+    transfers,
+  );
+
+  await startedPromise.catch((error: unknown) => {
+    stop();
+    throw error;
+  });
+}
diff --git a/apps/sandbox/src/tri2d-renderer.test.ts b/apps/sandbox/src/tri2d-renderer.test.ts
new file mode 100644
index 00000000..9f667064
--- /dev/null
+++ b/apps/sandbox/src/tri2d-renderer.test.ts
@@ -0,0 +1,48 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { describe, expect, it } from "vitest";
+import { parseTri2dStream } from "./tri2d-renderer";
+
+const initial = new Uint8Array([
+  69, 84, 68, 49, 1, 0, 24, 0, 64, 0, 0, 0, 48, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0,
+  255, 1, 0, 0, 0, 24, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0,
+  4, 0, 0, 0, 255, 255, 255, 255, 5, 0, 0, 0, 0, 0, 0, 0,
+]);
+const destroy = new Uint8Array([
+  69, 84, 68, 49, 1, 0, 24, 0, 64, 0, 0, 0, 48, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0,
+  255, 3, 0, 0, 0, 4, 0, 0, 0, 1, 0, 0, 0, 5, 0, 0, 0, 0, 0, 0, 0,
+]);
+
+describe("Tri2D stream validation", () => {
+  it("accepts bounded stateful texture frames", () => {
+    const created = parseTri2dStream(initial);
+    expect(created).toMatchObject({
+      width: 64,
+      height: 48,
+      drawCount: 0,
+      vertexCount: 0,
+      indexCount: 0,
+      textureBytes: 4,
+    });
+    expect(created.textures.get(1)).toEqual({ width: 1, height: 1, bytes: 4 });
+
+    const removed = parseTri2dStream(
+      destroy,
+      created.textures,
+      created.textureBytes,
+    );
+    expect(removed.textures.size).toBe(0);
+    expect(removed.textureBytes).toBe(0);
+  });
+
+  it("rejects frames without a final presentation boundary", () => {
+    const malformed = initial.slice(0, initial.byteLength - 8);
+    new DataView(malformed.buffer).setUint32(16, 1, true);
+    expect(() => parseTri2dStream(malformed)).toThrow(/presentation boundary/);
+  });
+
+  it("rejects state transitions using unknown texture handles", () => {
+    expect(() => parseTri2dStream(destroy)).toThrow(/unknown handle/);
+  });
+});
diff --git a/apps/sandbox/src/tri2d-renderer.ts b/apps/sandbox/src/tri2d-renderer.ts
new file mode 100644
index 00000000..4e39025f
--- /dev/null
+++ b/apps/sandbox/src/tri2d-renderer.ts
@@ -0,0 +1,626 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+const MAGIC = "ETD1";
+const VERSION = 1;
+const HEADER_BYTES = 24;
+const VERTEX_BYTES = 20;
+const MAX_STREAM_BYTES = 8 * 1024 * 1024;
+const MAX_COMMANDS = 8_192;
+const MAX_SURFACE_SIZE = 4_096;
+const MAX_TEXTURE_SIZE = 4_096;
+const MAX_TEXTURES = 256;
+const MAX_TEXTURE_BYTES = 64 * 1024 * 1024;
+const MAX_DRAWS = 4_096;
+const MAX_VERTICES = 262_144;
+const MAX_INDICES = 786_432;
+
+const TEXTURE_CREATE = 1;
+const TEXTURE_UPDATE = 2;
+const TEXTURE_DESTROY = 3;
+const DRAW = 4;
+const PRESENT = 5;
+
+interface TextureState {
+  width: number;
+  height: number;
+  bytes: number;
+}
+
+interface TextureCreate {
+  kind: "texture-create";
+  handle: number;
+  width: number;
+  height: number;
+  filter: number;
+  pixels: Uint8Array;
+}
+
+interface TextureUpdate {
+  kind: "texture-update";
+  handle: number;
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+  pixels: Uint8Array;
+}
+
+interface TextureDestroy {
+  kind: "texture-destroy";
+  handle: number;
+}
+
+interface Draw {
+  kind: "draw";
+  handle: number;
+  clipX: number;
+  clipY: number;
+  clipWidth: number;
+  clipHeight: number;
+  vertices: Uint8Array;
+  indices: Uint32Array;
+}
+
+type Tri2dOperation = TextureCreate | TextureUpdate | TextureDestroy | Draw;
+
+export interface ParsedTri2dFrame {
+  width: number;
+  height: number;
+  clearRgba: number;
+  drawCount: number;
+  vertexCount: number;
+  indexCount: number;
+  operations: Tri2dOperation[];
+  textures: Map<number, TextureState>;
+  textureBytes: number;
+}
+
+class Reader {
+  readonly #bytes: Uint8Array;
+  readonly #view: DataView;
+  #offset = 0;
+
+  constructor(bytes: Uint8Array) {
+    this.#bytes = bytes;
+    this.#view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  }
+
+  get remaining(): number {
+    return this.#bytes.byteLength - this.#offset;
+  }
+
+  bytes(length: number): Uint8Array {
+    if (
+      !Number.isSafeInteger(length) ||
+      length < 0 ||
+      length > this.remaining
+    ) {
+      throw new Error("truncated Tri2D stream");
+    }
+    const start = this.#offset;
+    this.#offset += length;
+    return this.#bytes.subarray(start, this.#offset);
+  }
+
+  u8(): number {
+    return this.bytes(1)[0];
+  }
+
+  u16(): number {
+    if (this.remaining < 2) {
+      throw new Error("truncated Tri2D stream");
+    }
+    const value = this.#view.getUint16(this.#offset, true);
+    this.#offset += 2;
+    return value;
+  }
+
+  u32(): number {
+    if (this.remaining < 4) {
+      throw new Error("truncated Tri2D stream");
+    }
+    const value = this.#view.getUint32(this.#offset, true);
+    this.#offset += 4;
+    return value;
+  }
+}
+
+function multiply(...values: number[]): number {
+  let product = 1;
+  for (const value of values) {
+    product *= value;
+    if (!Number.isSafeInteger(product)) {
+      throw new Error("Tri2D byte length overflow");
+    }
+  }
+  return product;
+}
+
+function nonzeroHandle(value: number): number {
+  if (value === 0) {
+    throw new Error("Tri2D texture handle must be nonzero");
+  }
+  return value;
+}
+
+function validExtent(offset: number, length: number, limit: number): boolean {
+  return length > 0 && offset <= limit && length <= limit - offset;
+}
+
+export function parseTri2dStream(
+  bytes: Uint8Array,
+  currentTextures: ReadonlyMap<number, TextureState> = new Map(),
+  currentTextureBytes = 0,
+): ParsedTri2dFrame {
+  if (bytes.byteLength < HEADER_BYTES || bytes.byteLength > MAX_STREAM_BYTES) {
+    throw new Error("Tri2D stream has invalid byte length");
+  }
+  const reader = new Reader(bytes);
+  if (new TextDecoder("ascii").decode(reader.bytes(4)) !== MAGIC) {
+    throw new Error("Tri2D stream has invalid magic");
+  }
+  if (reader.u16() !== VERSION || reader.u16() !== HEADER_BYTES) {
+    throw new Error("Tri2D stream has incompatible framing");
+  }
+  const width = reader.u32();
+  const height = reader.u32();
+  if (
+    width === 0 ||
+    height === 0 ||
+    width > MAX_SURFACE_SIZE ||
+    height > MAX_SURFACE_SIZE
+  ) {
+    throw new Error("Tri2D stream has invalid surface dimensions");
+  }
+  const commandCount = reader.u32();
+  if (commandCount === 0 || commandCount > MAX_COMMANDS) {
+    throw new Error("Tri2D stream has invalid command count");
+  }
+  const clearRgba = reader.u32();
+  const textures = new Map(currentTextures);
+  let textureBytes = currentTextureBytes;
+  let drawCount = 0;
+  let vertexCount = 0;
+  let indexCount = 0;
+  let presented = false;
+  const operations: Tri2dOperation[] = [];
+
+  for (let commandIndex = 0; commandIndex < commandCount; commandIndex++) {
+    const opcode = reader.u8();
+    if (reader.u8() !== 0 || reader.u16() !== 0) {
+      throw new Error("Tri2D command has unsupported flags");
+    }
+    const payloadLength = reader.u32();
+    const payload = new Reader(reader.bytes(payloadLength));
+    if (presented) {
+      throw new Error("Tri2D command follows present");
+    }
+
+    if (opcode === TEXTURE_CREATE) {
+      const handle = nonzeroHandle(payload.u32());
+      const textureWidth = payload.u32();
+      const textureHeight = payload.u32();
+      const filter = payload.u32();
+      const byteLength = payload.u32();
+      if (
+        textureWidth === 0 ||
+        textureHeight === 0 ||
+        textureWidth > MAX_TEXTURE_SIZE ||
+        textureHeight > MAX_TEXTURE_SIZE ||
+        filter > 1
+      ) {
+        throw new Error("Tri2D texture create has invalid properties");
+      }
+      const expected = multiply(textureWidth, textureHeight, 4);
+      if (byteLength !== expected || payload.remaining !== byteLength) {
+        throw new Error("Tri2D texture create has invalid pixel length");
+      }
+      const pixels = payload.bytes(byteLength).slice();
+      if (
+        textures.has(handle) ||
+        textures.size === MAX_TEXTURES ||
+        textureBytes + byteLength > MAX_TEXTURE_BYTES
+      ) {
+        throw new Error("Tri2D texture limits exceeded");
+      }
+      textures.set(handle, {
+        width: textureWidth,
+        height: textureHeight,
+        bytes: byteLength,
+      });
+      textureBytes += byteLength;
+      operations.push({
+        kind: "texture-create",
+        handle,
+        width: textureWidth,
+        height: textureHeight,
+        filter,
+        pixels,
+      });
+    } else if (opcode === TEXTURE_UPDATE) {
+      const handle = nonzeroHandle(payload.u32());
+      const x = payload.u32();
+      const y = payload.u32();
+      const updateWidth = payload.u32();
+      const updateHeight = payload.u32();
+      const byteLength = payload.u32();
+      const texture = textures.get(handle);
+      if (texture === undefined) {
+        throw new Error("Tri2D texture update uses an unknown handle");
+      }
+      if (
+        !validExtent(x, updateWidth, texture.width) ||
+        !validExtent(y, updateHeight, texture.height)
+      ) {
+        throw new Error("Tri2D texture update exceeds texture bounds");
+      }
+      const expected = multiply(updateWidth, updateHeight, 4);
+      if (byteLength !== expected || payload.remaining !== byteLength) {
+        throw new Error("Tri2D texture update has invalid pixel length");
+      }
+      operations.push({
+        kind: "texture-update",
+        handle,
+        x,
+        y,
+        width: updateWidth,
+        height: updateHeight,
+        pixels: payload.bytes(byteLength).slice(),
+      });
+    } else if (opcode === TEXTURE_DESTROY) {
+      const handle = nonzeroHandle(payload.u32());
+      const texture = textures.get(handle);
+      if (texture === undefined) {
+        throw new Error("Tri2D texture destroy uses an unknown handle");
+      }
+      textures.delete(handle);
+      textureBytes -= texture.bytes;
+      operations.push({ kind: "texture-destroy", handle });
+    } else if (opcode === DRAW) {
+      const handle = nonzeroHandle(payload.u32());
+      if (!textures.has(handle)) {
+        throw new Error("Tri2D draw uses an unknown texture handle");
+      }
+      const clipX = payload.u32();
+      const clipY = payload.u32();
+      const clipWidth = payload.u32();
+      const clipHeight = payload.u32();
+      if (
+        !validExtent(clipX, clipWidth, width) ||
+        !validExtent(clipY, clipHeight, height)
+      ) {
+        throw new Error("Tri2D draw has an invalid clip rectangle");
+      }
+      const vertices = payload.u32();
+      const indices = payload.u32();
+      if (vertices === 0 || indices === 0 || indices % 3 !== 0) {
+        throw new Error("Tri2D draw has invalid element counts");
+      }
+      drawCount++;
+      vertexCount += vertices;
+      indexCount += indices;
+      if (
+        drawCount > MAX_DRAWS ||
+        vertexCount > MAX_VERTICES ||
+        indexCount > MAX_INDICES
+      ) {
+        throw new Error("Tri2D draw limits exceeded");
+      }
+      const vertexBytes = multiply(vertices, VERTEX_BYTES);
+      const indexBytes = multiply(indices, 4);
+      if (payload.remaining !== vertexBytes + indexBytes) {
+        throw new Error("Tri2D draw has invalid payload length");
+      }
+      const vertexData = payload.bytes(vertexBytes).slice();
+      const indexData = new Uint32Array(indices);
+      for (let index = 0; index < indices; index++) {
+        const value = payload.u32();
+        if (value >= vertices) {
+          throw new Error("Tri2D draw index exceeds vertex count");
+        }
+        indexData[index] = value;
+      }
+      operations.push({
+        kind: "draw",
+        handle,
+        clipX,
+        clipY,
+        clipWidth,
+        clipHeight,
+        vertices: vertexData,
+        indices: indexData,
+      });
+    } else if (opcode === PRESENT) {
+      if (payloadLength !== 0 || commandIndex + 1 !== commandCount) {
+        throw new Error("Tri2D present must be the final empty command");
+      }
+      presented = true;
+    } else {
+      throw new Error(`Tri2D stream has unknown opcode ${String(opcode)}`);
+    }
+    if (payload.remaining !== 0) {
+      throw new Error("Tri2D command has trailing payload bytes");
+    }
+  }
+
+  if (!presented || reader.remaining !== 0) {
+    throw new Error("Tri2D stream has invalid presentation boundary");
+  }
+  return {
+    width,
+    height,
+    clearRgba,
+    drawCount,
+    vertexCount,
+    indexCount,
+    operations,
+    textures,
+    textureBytes,
+  };
+}
+
+interface GpuTexture extends TextureState {
+  texture: WebGLTexture;
+}
+
+function shader(
+  gl: WebGL2RenderingContext,
+  type: number,
+  source: string,
+): WebGLShader {
+  const value = gl.createShader(type);
+  if (value === null) {
+    throw new Error("WebGL could not allocate a Tri2D shader");
+  }
+  gl.shaderSource(value, source);
+  gl.compileShader(value);
+  if (gl.getShaderParameter(value, gl.COMPILE_STATUS) !== true) {
+    const message = gl.getShaderInfoLog(value) ?? "unknown shader error";
+    gl.deleteShader(value);
+    throw new Error(`Tri2D shader compilation failed: ${message}`);
+  }
+  return value;
+}
+
+function program(gl: WebGL2RenderingContext): WebGLProgram {
+  const vertex = shader(
+    gl,
+    gl.VERTEX_SHADER,
+    `#version 300 es
+      precision highp float;
+      precision highp int;
+      layout(location = 0) in ivec2 positionFixed;
+      layout(location = 1) in ivec2 uvFixed;
+      layout(location = 2) in vec4 color;
+      uniform vec2 surface;
+      out vec2 textureUv;
+      out vec4 vertexColor;
+      void main() {
+        vec2 position = vec2(positionFixed) / 65536.0;
+        vec2 clip = position / surface * vec2(2.0, -2.0) + vec2(-1.0, 1.0);
+        gl_Position = vec4(clip, 0.0, 1.0);
+        textureUv = vec2(uvFixed) / 65536.0;
+        vertexColor = color;
+      }
+    `,
+  );
+  const fragment = shader(
+    gl,
+    gl.FRAGMENT_SHADER,
+    `#version 300 es
+      precision mediump float;
+      uniform sampler2D image;
+      in vec2 textureUv;
+      in vec4 vertexColor;
+      out vec4 outputColor;
+      void main() {
+        outputColor = texture(image, textureUv) * vertexColor;
+      }
+    `,
+  );
+  const value = gl.createProgram();
+  gl.attachShader(value, vertex);
+  gl.attachShader(value, fragment);
+  gl.linkProgram(value);
+  gl.deleteShader(vertex);
+  gl.deleteShader(fragment);
+  if (gl.getProgramParameter(value, gl.LINK_STATUS) !== true) {
+    const message = gl.getProgramInfoLog(value) ?? "unknown link error";
+    gl.deleteProgram(value);
+    throw new Error(`Tri2D shader link failed: ${message}`);
+  }
+  return value;
+}
+
+export class Tri2dRenderer {
+  readonly #canvas: HTMLCanvasElement;
+  readonly #gl: WebGL2RenderingContext;
+  readonly #program: WebGLProgram;
+  readonly #surface: WebGLUniformLocation;
+  readonly #vertexBuffer: WebGLBuffer;
+  readonly #indexBuffer: WebGLBuffer;
+  readonly #vao: WebGLVertexArrayObject;
+  #textures = new Map<number, GpuTexture>();
+  #textureBytes = 0;
+
+  constructor(canvas: HTMLCanvasElement) {
+    const gl = canvas.getContext("webgl2", {
+      alpha: false,
+      antialias: false,
+      premultipliedAlpha: true,
+      preserveDrawingBuffer: false,
+    });
+    if (gl === null) {
+      throw new Error("WebGL2 is required for Tri2D");
+    }
+    const renderProgram = program(gl);
+    const surface = gl.getUniformLocation(renderProgram, "surface");
+    const vertexBuffer = gl.createBuffer();
+    const indexBuffer = gl.createBuffer();
+    const vao = gl.createVertexArray();
+    if (surface === null) {
+      throw new Error("WebGL could not locate the Tri2D surface uniform");
+    }
+    this.#canvas = canvas;
+    this.#gl = gl;
+    this.#program = renderProgram;
+    this.#surface = surface;
+    this.#vertexBuffer = vertexBuffer;
+    this.#indexBuffer = indexBuffer;
+    this.#vao = vao;
+
+    gl.useProgram(renderProgram);
+    gl.uniform1i(gl.getUniformLocation(renderProgram, "image"), 0);
+    gl.bindVertexArray(vao);
+    gl.bindBuffer(gl.ARRAY_BUFFER, vertexBuffer);
+    gl.enableVertexAttribArray(0);
+    gl.vertexAttribIPointer(0, 2, gl.INT, VERTEX_BYTES, 0);
+    gl.enableVertexAttribArray(1);
+    gl.vertexAttribIPointer(1, 2, gl.INT, VERTEX_BYTES, 8);
+    gl.enableVertexAttribArray(2);
+    gl.vertexAttribPointer(2, 4, gl.UNSIGNED_BYTE, true, VERTEX_BYTES, 16);
+    gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, indexBuffer);
+    gl.enable(gl.BLEND);
+    gl.blendFunc(gl.ONE, gl.ONE_MINUS_SRC_ALPHA);
+    gl.enable(gl.SCISSOR_TEST);
+    gl.activeTexture(gl.TEXTURE0);
+    gl.pixelStorei(gl.UNPACK_ALIGNMENT, 1);
+  }
+
+  render(bytes: Uint8Array): ParsedTri2dFrame {
+    const state = new Map<number, TextureState>();
+    for (const [handle, texture] of this.#textures) {
+      state.set(handle, {
+        width: texture.width,
+        height: texture.height,
+        bytes: texture.bytes,
+      });
+    }
+    const frame = parseTri2dStream(bytes, state, this.#textureBytes);
+    const gl = this.#gl;
+    if (gl.isContextLost()) {
+      throw new Error("Tri2D WebGL context was lost");
+    }
+    if (this.#canvas.width !== frame.width) {
+      this.#canvas.width = frame.width;
+    }
+    if (this.#canvas.height !== frame.height) {
+      this.#canvas.height = frame.height;
+    }
+    gl.viewport(0, 0, frame.width, frame.height);
+    gl.useProgram(this.#program);
+    gl.uniform2f(this.#surface, frame.width, frame.height);
+    gl.bindVertexArray(this.#vao);
+    gl.bindBuffer(gl.ARRAY_BUFFER, this.#vertexBuffer);
+    gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, this.#indexBuffer);
+    const clear = frame.clearRgba;
+    gl.disable(gl.SCISSOR_TEST);
+    gl.clearColor(
+      (clear & 0xff) / 255,
+      ((clear >>> 8) & 0xff) / 255,
+      ((clear >>> 16) & 0xff) / 255,
+      ((clear >>> 24) & 0xff) / 255,
+    );
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    gl.enable(gl.SCISSOR_TEST);
+
+    for (const operation of frame.operations) {
+      if (operation.kind === "texture-create") {
+        const texture = gl.createTexture();
+        gl.bindTexture(gl.TEXTURE_2D, texture);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, gl.CLAMP_TO_EDGE);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
+        const filter = operation.filter === 0 ? gl.NEAREST : gl.LINEAR;
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, filter);
+        gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, filter);
+        gl.texImage2D(
+          gl.TEXTURE_2D,
+          0,
+          gl.RGBA8,
+          operation.width,
+          operation.height,
+          0,
+          gl.RGBA,
+          gl.UNSIGNED_BYTE,
+          operation.pixels,
+        );
+        this.#textures.set(operation.handle, {
+          texture,
+          width: operation.width,
+          height: operation.height,
+          bytes: operation.pixels.byteLength,
+        });
+        this.#textureBytes += operation.pixels.byteLength;
+      } else if (operation.kind === "texture-update") {
+        const texture = this.#textures.get(operation.handle);
+        if (texture === undefined) {
+          throw new Error("Tri2D texture state diverged");
+        }
+        gl.bindTexture(gl.TEXTURE_2D, texture.texture);
+        gl.texSubImage2D(
+          gl.TEXTURE_2D,
+          0,
+          operation.x,
+          operation.y,
+          operation.width,
+          operation.height,
+          gl.RGBA,
+          gl.UNSIGNED_BYTE,
+          operation.pixels,
+        );
+      } else if (operation.kind === "texture-destroy") {
+        const texture = this.#textures.get(operation.handle);
+        if (texture === undefined) {
+          throw new Error("Tri2D texture state diverged");
+        }
+        gl.deleteTexture(texture.texture);
+        this.#textures.delete(operation.handle);
+        this.#textureBytes -= texture.bytes;
+      } else {
+        const texture = this.#textures.get(operation.handle);
+        if (texture === undefined) {
+          throw new Error("Tri2D texture state diverged");
+        }
+        gl.bindTexture(gl.TEXTURE_2D, texture.texture);
+        gl.scissor(
+          operation.clipX,
+          frame.height - operation.clipY - operation.clipHeight,
+          operation.clipWidth,
+          operation.clipHeight,
+        );
+        gl.bufferData(gl.ARRAY_BUFFER, operation.vertices, gl.DYNAMIC_DRAW);
+        gl.bufferData(
+          gl.ELEMENT_ARRAY_BUFFER,
+          operation.indices,
+          gl.DYNAMIC_DRAW,
+        );
+        gl.drawElements(
+          gl.TRIANGLES,
+          operation.indices.length,
+          gl.UNSIGNED_INT,
+          0,
+        );
+      }
+    }
+    gl.flush();
+    const error = gl.getError();
+    if (error !== gl.NO_ERROR) {
+      throw new Error(`Tri2D WebGL operation failed (${String(error)})`);
+    }
+    this.#textureBytes = frame.textureBytes;
+    return frame;
+  }
+
+  dispose(): void {
+    const gl = this.#gl;
+    for (const texture of this.#textures.values()) {
+      gl.deleteTexture(texture.texture);
+    }
+    this.#textures.clear();
+    gl.deleteBuffer(this.#vertexBuffer);
+    gl.deleteBuffer(this.#indexBuffer);
+    gl.deleteVertexArray(this.#vao);
+    gl.deleteProgram(this.#program);
+  }
+}
diff --git a/apps/sandbox/src/webgpu-raster.ts b/apps/sandbox/src/webgpu-raster.ts
new file mode 100644
index 00000000..6022f3da
--- /dev/null
+++ b/apps/sandbox/src/webgpu-raster.ts
@@ -0,0 +1,133 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: AGPL-3.0-only
+
+const GPU_READY_TIMEOUT_MS = 30_000;
+
+export interface WebGpuRequirements {
+  requiredFeatures: string[];
+  requiredLimits: Record<string, number>;
+}
+
+interface Dimensions {
+  physicalWidth: number;
+  physicalHeight: number;
+  logicalWidth: number;
+  logicalHeight: number;
+  scale: number;
+}
+
+interface Callbacks {
+  event: (bytes: Uint8Array) => void;
+  capabilities: (bytes: Uint8Array) => void;
+  presented: () => void;
+  error: (error: Error) => void;
+}
+
+function dimensions(canvas: HTMLCanvasElement): Dimensions {
+  const bounds = canvas.getBoundingClientRect();
+  const scale = window.devicePixelRatio || 1;
+  const logicalWidth = Math.max(1, Math.round(bounds.width));
+  const logicalHeight = Math.max(1, Math.round(bounds.height));
+  return {
+    physicalWidth: Math.max(1, Math.round(logicalWidth * scale)),
+    physicalHeight: Math.max(1, Math.round(logicalHeight * scale)),
+    logicalWidth,
+    logicalHeight,
+    scale,
+  };
+}
+
+export class WebGpuRasterBridge {
+  readonly #worker: Worker;
+  readonly #resizeObserver: ResizeObserver;
+  readonly capabilities: Promise<Uint8Array>;
+  #stopped = false;
+
+  constructor(
+    canvas: HTMLCanvasElement,
+    requirements: WebGpuRequirements,
+    callbacks: Callbacks,
+  ) {
+    if (typeof canvas.transferControlToOffscreen !== "function") {
+      throw new Error("WebGPU OffscreenCanvas is unavailable");
+    }
+    const worker = new Worker("/pvm-runtime/pvm-gpu-worker.js");
+    const offscreen = canvas.transferControlToOffscreen();
+    const { promise, resolve, reject } = Promise.withResolvers<Uint8Array>();
+    const timer = window.setTimeout(() => {
+      reject(new Error("WebGPU capability negotiation timed out"));
+    }, GPU_READY_TIMEOUT_MS);
+    this.#worker = worker;
+    this.capabilities = promise;
+    worker.onmessage = (event: MessageEvent<unknown>): void => {
+      const message =
+        event.data !== null && typeof event.data === "object"
+          ? (event.data as Record<string, unknown>)
+          : null;
+      if (
+        message?.type === "capabilities" &&
+        message.bytes instanceof Uint8Array
+      ) {
+        const bytes = message.bytes.slice();
+        window.clearTimeout(timer);
+        canvas.dataset.pvmGpu = "ready";
+        callbacks.capabilities(bytes);
+        resolve(bytes);
+      } else if (
+        message?.type === "event" &&
+        message.bytes instanceof Uint8Array
+      ) {
+        callbacks.event(message.bytes);
+      } else if (message?.type === "presented") {
+        callbacks.presented();
+      } else if (message?.type === "error") {
+        const error = new Error(
+          typeof message.message === "string"
+            ? message.message
+            : "WebGPU worker failed",
+        );
+        reject(error);
+        callbacks.error(error);
+      }
+    };
+    worker.onerror = (): void => {
+      const error = new Error("WebGPU worker failed");
+      reject(error);
+      callbacks.error(error);
+    };
+    worker.postMessage(
+      {
+        type: "init",
+        canvas: offscreen,
+        requirements,
+        dimensions: dimensions(canvas),
+        testReadback: false,
+        testDeviceLoss: false,
+      },
+      [offscreen],
+    );
+    this.#resizeObserver = new ResizeObserver(() => {
+      if (!this.#stopped) {
+        worker.postMessage({ type: "resize", dimensions: dimensions(canvas) });
+      }
+    });
+    this.#resizeObserver.observe(canvas);
+  }
+
+  submit(bytes: Uint8Array): void {
+    if (this.#stopped || bytes.byteLength === 0) {
+      return;
+    }
+    this.#worker.postMessage({ type: "batch", bytes }, [bytes.buffer]);
+  }
+
+  dispose(): void {
+    if (this.#stopped) {
+      return;
+    }
+    this.#stopped = true;
+    this.#resizeObserver.disconnect();
+    this.#worker.postMessage({ type: "stop" });
+    this.#worker.terminate();
+  }
+}
diff --git a/apps/sandbox/tsconfig.json b/apps/sandbox/tsconfig.json
index 0849d319..fd35340a 100644
--- a/apps/sandbox/tsconfig.json
+++ b/apps/sandbox/tsconfig.json
@@ -3,5 +3,8 @@
     "@dotli/typescript-config/base.json",
     "@dotli/typescript-config/paths.json"
   ],
+  "compilerOptions": {
+    "lib": ["ES2024", "DOM", "DOM.Iterable"]
+  },
   "include": ["src"]
 }
diff --git a/bun.lock b/bun.lock
index b373a121..924003d1 100644
--- a/bun.lock
+++ b/bun.lock
@@ -32,10 +32,14 @@
       "devDependencies": {
         "@dotli/eslint-config": "workspace:*",
         "@dotli/typescript-config": "workspace:*",
+        "@ipld/car": "^5.4.3",
+        "@ipld/dag-pb": "^4.1.5",
         "@playwright/test": "^1.59.1",
         "@types/node": "^25.9.3",
         "eslint": "^10.5.0",
+        "ipfs-unixfs": "^13.0.0",
         "jsqr": "^1.4.0",
+        "multiformats": "^14.0.0",
         "playwright": "^1.59.1",
         "prettier": "^3.8.3",
         "simple-statistics": "^7.9.0",
@@ -93,6 +97,7 @@
         "typescript": "~6.0.3",
         "vite": "^8.0.16",
         "vite-plugin-wasm": "^3.5.0",
+        "vitest": "^4.1.8",
       },
     },
     "packages/config": {
diff --git a/package.json b/package.json
index 57d03daa..373c34f9 100644
--- a/package.json
+++ b/package.json
@@ -20,6 +20,8 @@
     "format": "prettier --write \"**/*.{ts,tsx,md}\"",
     "format:check": "prettier --check \"**/*.{ts,tsx,md}\"",
     "typecheck": "turbo run typecheck",
+    "sync:pvm-runtime": "node scripts/sync-pvm-runtime-assets.mjs",
+    "check:pvm-runtime": "node scripts/sync-pvm-runtime-assets.mjs --check",
     "set-version": "bun scripts/set-version.ts",
     "link:truapi": "bun scripts/link-truapi-local.ts",
     "unlink:truapi": "bun scripts/unlink-truapi-local.ts",
diff --git a/packages/config/src/host-sandbox-contract.ts b/packages/config/src/host-sandbox-contract.ts
index b3e3ab0e..c967b5be 100644
--- a/packages/config/src/host-sandbox-contract.ts
+++ b/packages/config/src/host-sandbox-contract.ts
@@ -16,9 +16,10 @@
 // re-resolve. Archive caching still keys on the CID so a new CID under
 // the same name is never served a stale archive.
 //
-// Schema v3 (current):
+// Schema v4 (current):
 //
 //   Required:
+//     ?v=<schema version integer>
 //     ?cid=<IPFS content id the host resolved from the dotns label>
 //     ?chainBackend=<"smoldot-direct" | "smoldot-shared-worker" | "rpc-gateway">
 //     ?network=<"paseo-next-v1" | "paseo-next-v2">
@@ -26,7 +27,7 @@
 //   Optional:
 //     ?skipArchiveCache=<"0" | "1">
 //     ?fullReset=<"0" | "1">
-//     ?v=<schema version integer, reserved for future breakage>
+//     ?executableManifest=<exact UTF-8 App executable text record>
 //
 // When we add a new required param, bump SANDBOX_SCHEMA_VERSION and
 // have the validator reject unmatched versions so stale host builds
@@ -34,7 +35,7 @@
 
 import { isValidNetwork, type Network } from "./network";
 
-export const SANDBOX_SCHEMA_VERSION = 3;
+export const SANDBOX_SCHEMA_VERSION = 4;
 
 // Cheap CID charset gate (base32 cidv1 / base58btc cidv0 are alphanumeric).
 // The sandbox does the authoritative CID.parse, then hash-verifies fetched
@@ -62,6 +63,7 @@ export const SANDBOX_CONTRACT_PARAMS = {
   network: "network",
   skipArchiveCache: "skipArchiveCache",
   fullReset: "fullReset",
+  executableManifest: "executableManifest",
   v: "v",
 } as const;
 
@@ -74,11 +76,17 @@ export interface SandboxParams {
   network: Network;
   skipArchiveCache: boolean;
   fullReset: boolean;
+  executableManifest: string | null;
 }
 
 export type SandboxParamsResult =
   | { ok: true; params: SandboxParams }
-  | { ok: false; reason: string; recoverable?: boolean };
+  | {
+      ok: false;
+      reason: string;
+      recoverable?: boolean;
+      hostUpdateRequired?: boolean;
+    };
 
 /**
  * Validate a sandbox URL against the host-to-sandbox contract.
@@ -97,15 +105,18 @@ export type SandboxParamsResult =
 export function validateSandboxParams(
   search: URLSearchParams,
 ): SandboxParamsResult {
-  // Version gate: if the host sends an explicit version token, it must
-  // match. Absent `?v=` means "pre-versioned host", a path now rejected
-  // post-collapse because the `?backend=` requirement is also new and a
-  // pre-collapse host would not emit it.
+  // A contract carrying a CID is an active host launch and must identify its
+  // schema. A URL with no contract keys is the supported post-boot reload
+  // shape; let the missing-CID path below ask the host to reconstruct it.
   const version = search.get(SANDBOX_CONTRACT_PARAMS.v);
-  if (version !== null && version !== String(SANDBOX_SCHEMA_VERSION)) {
+  if (
+    (version === null && search.has(SANDBOX_CONTRACT_PARAMS.cid)) ||
+    (version !== null && version !== String(SANDBOX_SCHEMA_VERSION))
+  ) {
     return {
       ok: false,
-      reason: `Sandbox contract version mismatch (got v=${version}, expected v=${String(SANDBOX_SCHEMA_VERSION)}). Reload from the host to pick up the matching build.`,
+      hostUpdateRequired: true,
+      reason: `Sandbox contract version mismatch (got ${version === null ? "no version" : `v=${version}`}, expected v=${String(SANDBOX_SCHEMA_VERSION)}). Update dot.li to load the matching host build.`,
     };
   }
 
@@ -176,6 +187,21 @@ export function validateSandboxParams(
     };
   }
 
+  const executableManifest = search.get(
+    SANDBOX_CONTRACT_PARAMS.executableManifest,
+  );
+  if (
+    executableManifest !== null &&
+    (executableManifest.length === 0 ||
+      new TextEncoder().encode(executableManifest).byteLength > 64 * 1024)
+  ) {
+    return {
+      ok: false,
+      reason:
+        "Invalid executableManifest — expected a non-empty App manifest within 65536 UTF-8 bytes.",
+    };
+  }
+
   return {
     ok: true,
     params: {
@@ -187,6 +213,7 @@ export function validateSandboxParams(
       network,
       skipArchiveCache: skipRaw === "1",
       fullReset: resetRaw === "1",
+      executableManifest,
     },
   };
 }
diff --git a/packages/config/tests/host-sandbox-contract.test.ts b/packages/config/tests/host-sandbox-contract.test.ts
index 04c5a181..a3aa4bea 100644
--- a/packages/config/tests/host-sandbox-contract.test.ts
+++ b/packages/config/tests/host-sandbox-contract.test.ts
@@ -10,11 +10,12 @@ import {
 
 const VALID_CID = "bafyreigh2akiscaildcqabsyg3dfr6chu3fgpregiymsck7e7aqa4s52zy";
 
-/** Build a search string with the required v3 params, allowing overrides. */
+/** Build a search string with the required v4 params, allowing overrides. */
 function search(
   overrides: Record<string, string | null> = {},
 ): URLSearchParams {
   const base: Record<string, string> = {
+    [SANDBOX_CONTRACT_PARAMS.v]: String(SANDBOX_SCHEMA_VERSION),
     [SANDBOX_CONTRACT_PARAMS.cid]: VALID_CID,
     [SANDBOX_CONTRACT_PARAMS.chainBackend]: "smoldot-direct",
     [SANDBOX_CONTRACT_PARAMS.network]: "paseo-next-v2",
@@ -27,9 +28,9 @@ function search(
   return params;
 }
 
-describe("validateSandboxParams: v3 cid contract", () => {
+describe("validateSandboxParams: v4 cid contract", () => {
   it("As the sandbox, when I receive a valid contract, I read cid, chainBackend, and network from the params", () => {
-    // Given a contract that carries every required v3 param.
+    // Given a contract that carries every required v4 param.
     const params = search();
 
     // When the sandbox validates it.
@@ -44,6 +45,21 @@ describe("validateSandboxParams: v3 cid contract", () => {
     }
   });
 
+  it("preserves exact executable manifest text for sandbox byte comparison", () => {
+    const executableManifest =
+      '{"$v":2,"kind":"app","appVersion":[0,1,7],"runtime":{"kind":"web","entrypoint":"index.html"}}';
+    const result = validateSandboxParams(
+      search({
+        [SANDBOX_CONTRACT_PARAMS.executableManifest]: executableManifest,
+      }),
+    );
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.params.executableManifest).toBe(executableManifest);
+    }
+  });
+
   it("As the sandbox, I reject a contract that omits the cid, but flag it recoverable so the host can re-render me", () => {
     // Given a contract with no cid param (the post-boot strip leaves
     // exactly this shape behind, so a reload of a booted sandbox lands here).
@@ -103,17 +119,27 @@ describe("validateSandboxParams: v3 cid contract", () => {
     expect(result.ok).toBe(true);
   });
 
-  it("As the sandbox, I reject a contract whose schema version is older than my build", () => {
-    // Given a contract from a host built against an older schema.
+  it("As the sandbox, I request a host update when its schema is older than my build", () => {
     const params = search({
       [SANDBOX_CONTRACT_PARAMS.v]: String(SANDBOX_SCHEMA_VERSION - 1),
     });
 
-    // When the sandbox validates it.
     const result = validateSandboxParams(params);
 
-    // Then it fails (the version gate protects against stale host deploys).
     expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.hostUpdateRequired).toBe(true);
+      expect(result.reason).toMatch(/update dot\.li/i);
+    }
+  });
+
+  it("As the sandbox, I request a host update when an active contract omits its schema version", () => {
+    const result = validateSandboxParams(
+      search({ [SANDBOX_CONTRACT_PARAMS.v]: null }),
+    );
+
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.hostUpdateRequired).toBe(true);
   });
 
   it("As the sandbox, I reject a contract that omits the chainBackend", () => {
@@ -123,7 +149,7 @@ describe("validateSandboxParams: v3 cid contract", () => {
     // When the sandbox validates it.
     const result = validateSandboxParams(params);
 
-    // Then it fails (chainBackend is still required after the v3 bump).
+    // Then it fails (chainBackend is still required after the v4 bump).
     expect(result.ok).toBe(false);
   });
 
@@ -134,7 +160,7 @@ describe("validateSandboxParams: v3 cid contract", () => {
     // When the sandbox validates it.
     const result = validateSandboxParams(params);
 
-    // Then it fails (network is still required after the v3 bump).
+    // Then it fails (network is still required after the v4 bump).
     expect(result.ok).toBe(false);
   });
 
diff --git a/packages/resolver/src/manifest-types.ts b/packages/resolver/src/manifest-types.ts
index 090415b0..be4523a9 100644
--- a/packages/resolver/src/manifest-types.ts
+++ b/packages/resolver/src/manifest-types.ts
@@ -30,21 +30,70 @@ export interface RootManifest {
   icon: Icon;
 }
 
-interface CommonExecutableFields {
+interface CommonExecutableFieldsV1 {
   $v: 1;
   appVersion: AppVersion;
 }
 
-export interface AppManifest extends CommonExecutableFields {
+export interface AppManifestV1 extends CommonExecutableFieldsV1 {
   kind: "app";
 }
 
+export interface WebAppManifestV2 {
+  $v: 2;
+  kind: "app";
+  appVersion: AppVersion;
+  runtime: {
+    kind: "web";
+    entrypoint: string;
+  };
+}
+
+export interface PolkaVmAppManifestV2 {
+  $v: 2;
+  kind: "app";
+  appVersion: AppVersion;
+  runtime: {
+    kind: "polkavm";
+    abiVersion: 1;
+    entrypoint: string;
+  };
+  capabilities: {
+    graphics: {
+      abiVersion: 1;
+      profile: "framebuffer" | "tri2d" | "webgpu-raster";
+      requiredFeatures: readonly string[];
+      requiredLimits?: Readonly<Record<string, number>>;
+    };
+    deviceInput?: {
+      abiVersion: 1;
+      requiredFeatures: readonly (
+        | "pointer"
+        | "keyboard"
+        | "touch"
+        | "wheel"
+        | "text"
+        | "ime"
+        | "focus"
+        | "motion"
+      )[];
+    };
+    audio?: {
+      abiVersion: 1;
+      requiredFeatures: readonly string[];
+    };
+  };
+}
+
+export type AppManifestV2 = WebAppManifestV2 | PolkaVmAppManifestV2;
+export type AppManifest = AppManifestV1 | AppManifestV2;
+
 export interface WidgetDimensions {
   height: readonly number[];
   width?: number;
 }
 
-export interface WidgetManifest extends CommonExecutableFields {
+export interface WidgetManifest extends CommonExecutableFieldsV1 {
   kind: "widget";
   description?: string;
   dimensions: WidgetDimensions;
@@ -55,7 +104,7 @@ export interface WorkerIncludes {
   pocket: boolean;
 }
 
-export interface WorkerManifest extends CommonExecutableFields {
+export interface WorkerManifest extends CommonExecutableFieldsV1 {
   kind: "worker";
   entrypoint: string;
   includes: WorkerIncludes;
@@ -94,14 +143,115 @@ function isAppVersion(value: unknown): value is AppVersion {
   if (
     !value
       .slice(0, 3)
-      .every((n) => typeof n === "number" && Number.isFinite(n) && n >= 0)
+      .every((part) => Number.isSafeInteger(part) && (part as number) >= 0)
   ) {
     return false;
   }
-  if (value.length === 4 && typeof value[3] !== "string") {
-    return false;
+  return value.length !== 4 || isNonEmptyString(value[3]);
+}
+
+function relativeEntrypoint(value: unknown, suffix: string): boolean {
+  return (
+    isNonEmptyString(value) &&
+    !value.startsWith("/") &&
+    !value.includes("\\") &&
+    !value
+      .split("/")
+      .some((part) => part === "" || part === "." || part === "..") &&
+    value.toLowerCase().endsWith(suffix)
+  );
+}
+
+function requiredFeatures(value: unknown, allowed: readonly string[]): boolean {
+  return (
+    Array.isArray(value) &&
+    new Set(value).size === value.length &&
+    value.every(
+      (feature) => typeof feature === "string" && allowed.includes(feature),
+    )
+  );
+}
+
+function validateAppV2(input: Record<string, unknown>, p: string): string[] {
+  const errors: string[] = [];
+  const runtime = isPlainObject(input.runtime) ? input.runtime : null;
+  if (runtime === null) {
+    return [`${p}runtime must be an object`];
+  }
+  if (runtime.kind === "web") {
+    if (!relativeEntrypoint(runtime.entrypoint, ".html")) {
+      errors.push(`${p}web runtime entrypoint must be a relative HTML path`);
+    }
+    if (input.capabilities !== undefined) {
+      errors.push(`${p}web runtime must not declare PolkaVM capabilities`);
+    }
+    return errors;
+  }
+  if (runtime.kind !== "polkavm") {
+    return [`${p}runtime.kind must be web or polkavm`];
+  }
+  if (runtime.abiVersion !== 1) {
+    errors.push(`${p}PolkaVM runtime abiVersion must be 1`);
+  }
+  if (!relativeEntrypoint(runtime.entrypoint, ".polkavm")) {
+    errors.push(`${p}PolkaVM entrypoint must be a relative .polkavm path`);
   }
-  return true;
+  const capabilities = isPlainObject(input.capabilities)
+    ? input.capabilities
+    : null;
+  const graphics =
+    capabilities !== null && isPlainObject(capabilities.graphics)
+      ? capabilities.graphics
+      : null;
+  if (graphics === null) {
+    errors.push(`${p}PolkaVM capabilities.graphics must be an object`);
+  } else {
+    if (
+      graphics.abiVersion !== 1 ||
+      !["framebuffer", "tri2d", "webgpu-raster"].includes(
+        graphics.profile as string,
+      )
+    ) {
+      errors.push(`${p}graphics must select a supported ABI version 1 profile`);
+    }
+    if (!requiredFeatures(graphics.requiredFeatures, [])) {
+      errors.push(`${p}graphics.requiredFeatures contains unsupported values`);
+    }
+  }
+  if (capabilities?.deviceInput !== undefined) {
+    const inputCapability = isPlainObject(capabilities.deviceInput)
+      ? capabilities.deviceInput
+      : null;
+    if (inputCapability === null) {
+      errors.push(`${p}deviceInput capability is unsupported`);
+    } else if (
+      inputCapability.abiVersion !== 1 ||
+      !requiredFeatures(inputCapability.requiredFeatures, [
+        "pointer",
+        "keyboard",
+        "touch",
+        "wheel",
+        "text",
+        "ime",
+        "focus",
+        "motion",
+      ])
+    ) {
+      errors.push(`${p}deviceInput capability is unsupported`);
+    }
+  }
+  if (capabilities?.audio !== undefined) {
+    const audio = isPlainObject(capabilities.audio) ? capabilities.audio : null;
+    if (audio === null) {
+      errors.push(`${p}audio capability is unsupported`);
+    } else if (
+      audio.abiVersion !== 1 ||
+      !requiredFeatures(audio.requiredFeatures, [])
+    ) {
+      errors.push(`${p}audio capability is unsupported`);
+    }
+  }
+  return errors;
 }
 
 function validateWidgetFields(
@@ -252,11 +402,6 @@ export function validateExecutableManifest(
   if (!isPlainObject(input)) {
     return { ok: false, errors: ["executable manifest must be an object"] };
   }
-  if (input.$v !== 1) {
-    errors.push(
-      `executable manifest $v must be 1 (got ${JSON.stringify(input.$v)})`,
-    );
-  }
   if (!isAppVersion(input.appVersion)) {
     errors.push(
       "executable manifest appVersion must be [major, minor, patch] or [major, minor, patch, build]",
@@ -264,16 +409,25 @@ export function validateExecutableManifest(
   }
   const kind = input.kind;
   const p = "executable manifest ";
-  if (kind === "app") {
-    // App has no kind-specific fields beyond the common ones.
-  } else if (kind === "widget") {
-    errors.push(...validateWidgetFields(input, p));
-  } else if (kind === "worker") {
-    errors.push(...validateWorkerFields(input, p));
+  if (kind === "app" && input.$v === 2) {
+    errors.push(...validateAppV2(input, p));
   } else {
-    errors.push(
-      `${p}kind must be one of app, widget, worker (got ${JSON.stringify(kind)})`,
-    );
+    if (input.$v !== 1) {
+      errors.push(
+        `executable manifest $v must be 1 (got ${JSON.stringify(input.$v)})`,
+      );
+    }
+    if (kind === "app") {
+      // App v1 has no kind-specific fields.
+    } else if (kind === "widget") {
+      errors.push(...validateWidgetFields(input, p));
+    } else if (kind === "worker") {
+      errors.push(...validateWorkerFields(input, p));
+    } else {
+      errors.push(
+        `${p}kind must be one of app, widget, worker (got ${JSON.stringify(kind)})`,
+      );
+    }
   }
   return errors.length === 0
     ? { ok: true, value: input as unknown as ExecutableManifest }
diff --git a/packages/resolver/src/manifest.ts b/packages/resolver/src/manifest.ts
index b547faf7..ddc80487 100644
--- a/packages/resolver/src/manifest.ts
+++ b/packages/resolver/src/manifest.ts
@@ -37,7 +37,7 @@ export const EXECUTABLE_MANIFEST_KEY = "executable";
  *  used for legacy contenthash reads.
  */
 export type ManifestResult<T> =
-  | { kind: "ok"; value: T }
+  | { kind: "ok"; value: T; raw: string }
   | { kind: "empty" }
   | { kind: "unsupported"; reason: string }
   | { kind: "invalid"; errors: string[] };
@@ -167,7 +167,7 @@ async function readManifestText<T>(
     { kind: metricKind, outcome: parsed.ok ? "ok" : "invalid" },
   );
   return parsed.ok
-    ? { kind: "ok", value: parsed.value }
+    ? { kind: "ok", value: parsed.value, raw }
     : { kind: "invalid", errors: parsed.errors };
 }
 
diff --git a/packages/resolver/tests/manifest-types.test.ts b/packages/resolver/tests/manifest-types.test.ts
index 5723cc34..817bb299 100644
--- a/packages/resolver/tests/manifest-types.test.ts
+++ b/packages/resolver/tests/manifest-types.test.ts
@@ -22,6 +22,29 @@ const VALID_APP = {
   appVersion: [1, 0, 0],
 };
 
+const VALID_APP_V2 = {
+  $v: 2,
+  kind: "app",
+  appVersion: [0, 1, 7],
+  runtime: {
+    kind: "polkavm",
+    abiVersion: 1,
+    entrypoint: "app.polkavm",
+  },
+  capabilities: {
+    graphics: {
+      abiVersion: 1,
+      profile: "framebuffer",
+      requiredFeatures: [],
+    },
+    deviceInput: {
+      abiVersion: 1,
+      requiredFeatures: ["pointer", "keyboard"],
+    },
+    audio: { abiVersion: 1, requiredFeatures: [] },
+  },
+};
+
 const VALID_WIDGET = {
   $v: 1,
   kind: "widget",
@@ -75,6 +98,48 @@ describe("validateExecutableManifest", () => {
     expect(validateExecutableManifest(VALID_APP).ok).toBe(true);
   });
 
+  it("accepts App manifest v2 runtime capabilities", () => {
+    expect(validateExecutableManifest(VALID_APP_V2).ok).toBe(true);
+    expect(
+      validateExecutableManifest({
+        ...VALID_APP_V2,
+        capabilities: {
+          ...VALID_APP_V2.capabilities,
+          deviceInput: {
+            abiVersion: 1,
+            requiredFeatures: ["pointer", "motion"],
+          },
+        },
+      }).ok,
+    ).toBe(true);
+    expect(
+      validateExecutableManifest({
+        $v: 2,
+        kind: "app",
+        appVersion: [1, 0, 0],
+        runtime: { kind: "web", entrypoint: "index.html" },
+      }).ok,
+    ).toBe(true);
+  });
+
+  it("rejects unsafe App v2 entrypoints and unknown required features", () => {
+    expect(
+      validateExecutableManifest({
+        ...VALID_APP_V2,
+        runtime: { ...VALID_APP_V2.runtime, entrypoint: "../app.polkavm" },
+      }).ok,
+    ).toBe(false);
+    expect(
+      validateExecutableManifest({
+        ...VALID_APP_V2,
+        capabilities: {
+          ...VALID_APP_V2.capabilities,
+          audio: { abiVersion: 1, requiredFeatures: ["spatial"] },
+        },
+      }).ok,
+    ).toBe(false);
+  });
+
   it("accepts a valid widget manifest", () => {
     expect(validateExecutableManifest(VALID_WIDGET).ok).toBe(true);
   });
diff --git a/packages/storage/src/cid-cache.ts b/packages/storage/src/cid-cache.ts
index 0763c870..3ac1807d 100644
--- a/packages/storage/src/cid-cache.ts
+++ b/packages/storage/src/cid-cache.ts
@@ -1,52 +1,129 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: AGPL-3.0-only
 
-// dot.li IndexedDB-backed cache mapping a label to its CID.
+// dot.li IndexedDB-backed installed-executable cache.
 //
-// Enables stale-while-revalidate: on repeat visits, render from
-// the cached CID instantly while smoldot validates in the background.
-//
-// The canonical surface is the discriminated `getCachedCidResult` so
-// callers can distinguish "miss" (run full resolution) from "error"
-// (storage broken, surface to user). The legacy `getCachedCid` remains
-// for incremental migration but collapses both into `null`.
+// A cached executable is one atomic v1 manifest/contenthash pair, scoped to
+// the network and executable modality that produced it. Contenthash changes
+// evict the whole pair; a newly resolved hash is never written without the
+// manifest resolved alongside it.
 
-import { getDb } from "./db";
+import type { Network } from "@dotli/config/network";
 import { m } from "@dotli/metrics/metrics";
 import * as S from "@dotli/metrics/spans";
 import { isValidDotLabel } from "@dotli/shared/html";
 import { log } from "@dotli/shared/log";
 import { captureException } from "@dotli/metrics/sentry";
 
-const STORE = "cids";
+const DB_NAME = "dotli-installed-executables";
+const DB_VERSION = 1;
+const STORE = "installed_executables";
+let installedDbPromise: Promise<IDBDatabase> | null = null;
+
+function getInstalledExecutableDb(): Promise<IDBDatabase> {
+  if (installedDbPromise !== null) {
+    return installedDbPromise;
+  }
+  installedDbPromise = new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB_NAME, DB_VERSION);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE)) {
+        db.createObjectStore(STORE, {
+          keyPath: ["network", "modality", "label"],
+        });
+      }
+    };
+    request.onsuccess = () => {
+      const db = request.result;
+      db.onversionchange = () => {
+        db.close();
+      };
+      db.onclose = () => {
+        installedDbPromise = null;
+      };
+      resolve(db);
+    };
+    request.onerror = () => {
+      installedDbPromise = null;
+      reject(request.error ?? new Error("installed executable DB open failed"));
+    };
+    request.onblocked = () => {
+      installedDbPromise = null;
+      reject(new Error("installed executable DB open blocked"));
+    };
+  });
+  return installedDbPromise;
+}
+
+export type ExecutableModality = "app" | "widget" | "worker";
+
+export interface InstalledExecutable {
+  contenthash: string;
+  executableManifest: string;
+}
 
-interface CidEntry {
+interface InstalledExecutableEntry extends InstalledExecutable {
   label: string;
-  cid: string;
+  network: Network;
+  modality: ExecutableModality;
   timestamp: number;
 }
 
-export type CidCacheResult =
-  | { kind: "hit"; cid: string }
+export type InstalledExecutableCacheResult =
+  | { kind: "hit"; executable: InstalledExecutable }
   | { kind: "miss" }
   | { kind: "error"; cause: unknown };
 
-export async function getCachedCidResult(
+function cacheKey(
+  label: string,
+  network: Network,
+  modality: ExecutableModality,
+): [Network, ExecutableModality, string] {
+  return [network, modality, label];
+}
+
+function transactionCompletion(
+  tx: IDBTransaction,
+  action: string,
+): Promise<void> {
+  return new Promise<void>((resolve, reject) => {
+    tx.oncomplete = () => {
+      resolve();
+    };
+    tx.onerror = () => {
+      reject(tx.error ?? new Error(`IDB ${action} error`));
+    };
+    tx.onabort = () => {
+      reject(tx.error ?? new Error(`IDB ${action} aborted`));
+    };
+  });
+}
+
+export async function getCachedInstalledExecutable(
   label: string,
-): Promise<CidCacheResult> {
+  network: Network,
+  modality: ExecutableModality,
+): Promise<InstalledExecutableCacheResult> {
   const stop = m.timer(S.CACHE_READ_LATENCY);
   try {
-    const db = await getDb();
-    return await new Promise<CidCacheResult>((resolve) => {
+    const db = await getInstalledExecutableDb();
+    return await new Promise<InstalledExecutableCacheResult>((resolve) => {
       const tx = db.transaction(STORE, "readonly");
-      const req = tx.objectStore(STORE).get(label);
+      const req = tx.objectStore(STORE).get(cacheKey(label, network, modality));
       req.onsuccess = () => {
-        const entry = req.result as CidEntry | undefined;
+        const entry = req.result as InstalledExecutableEntry | undefined;
         stop();
         resolve(
           entry === undefined
             ? { kind: "miss" }
-            : { kind: "hit", cid: entry.cid },
+            : {
+                kind: "hit",
+                executable: {
+                  contenthash: entry.contenthash,
+                  executableManifest: entry.executableManifest,
+                },
+              },
         );
       };
       req.onerror = () => {
@@ -63,22 +140,6 @@ export async function getCachedCidResult(
   }
 }
 
-/**
- * Legacy surface where `null` collapses cache miss and storage error.
- *
- * New callers should use `getCachedCidResult` so storage failures can be
- * surfaced rather than silently treated as "no cache".
- */
-export async function getCachedCid(label: string): Promise<string | null> {
-  const result = await getCachedCidResult(label);
-  if (result.kind === "error") {
-    log.error("[dot.li cid-cache] read error:", result.cause);
-    captureException(result.cause, { kind: "cid_cache_read_error" });
-    return null;
-  }
-  return result.kind === "hit" ? result.cid : null;
-}
-
 export const RECENT_KEY = "dotli_recent";
 const MAX_RECENT = 8;
 
@@ -154,90 +215,108 @@ export function writeRecentLabels(labels: string[]): void {
   }
 }
 
-export async function setCachedCid(label: string, cid: string): Promise<void> {
+export async function setCachedInstalledExecutable(
+  label: string,
+  network: Network,
+  modality: ExecutableModality,
+  executable: InstalledExecutable,
+): Promise<void> {
   const stop = m.timer(S.CACHE_WRITE_LATENCY);
   try {
-    const db = await getDb();
+    const db = await getInstalledExecutableDb();
     const tx = db.transaction(STORE, "readwrite");
-    const entry: CidEntry = {
+    const completed = transactionCompletion(tx, "write");
+    const entry: InstalledExecutableEntry = {
       label,
-      cid,
+      network,
+      modality,
+      contenthash: executable.contenthash,
+      executableManifest: executable.executableManifest,
       timestamp: Date.now(),
     };
     tx.objectStore(STORE).put(entry);
+    await completed;
     stop();
   } catch (err) {
     stop();
-    log.error("[dot.li cid-cache] write error:", err);
-    captureException(err, { kind: "cid_cache_write_error" });
+    log.error("[dot.li installed-executable-cache] write error:", err);
+    captureException(err, { kind: "installed_executable_cache_write_error" });
   }
 }
 
 /**
- * Clear every cached label-to-CID entry.
+ * Clear every installed-executable entry.
  *
  * Used when the user turns the dotNS cache off in settings. Awaits
- * transaction completion so a reload right after won't abort the clear
- * mid-flight. Best-effort: failures are logged.
+ * transaction completion so a reload right after cannot race the clear.
+ * Best-effort: failures are logged.
  */
-export async function clearCidCache(): Promise<void> {
+export async function clearInstalledExecutableCache(): Promise<void> {
   const stop = m.timer(S.CACHE_WRITE_LATENCY);
   try {
-    const db = await getDb();
+    const db = await getInstalledExecutableDb();
     const tx = db.transaction(STORE, "readwrite");
+    const completed = transactionCompletion(tx, "clear");
     tx.objectStore(STORE).clear();
-    await new Promise<void>((resolve, reject) => {
-      tx.oncomplete = () => {
-        resolve();
-      };
-      tx.onerror = () => {
-        reject(tx.error ?? new Error("IDB clear error"));
-      };
-    });
+    await completed;
     stop();
   } catch (err) {
     stop();
-    log.error("[dot.li cid-cache] clear error:", err);
-    captureException(err, { kind: "cid_cache_clear_error" });
+    log.error("[dot.li installed-executable-cache] clear error:", err);
+    captureException(err, { kind: "installed_executable_cache_clear_error" });
   }
 }
 
-/** Remove a cached entry. Best-effort: failures are logged, not thrown. */
-export async function evictCachedCid(label: string): Promise<void> {
+/** Remove one scoped installed executable. Best-effort. */
+export async function evictCachedInstalledExecutable(
+  label: string,
+  network: Network,
+  modality: ExecutableModality,
+): Promise<void> {
   const stop = m.timer(S.CACHE_WRITE_LATENCY);
   try {
-    const db = await getDb();
+    const db = await getInstalledExecutableDb();
     const tx = db.transaction(STORE, "readwrite");
-    tx.objectStore(STORE).delete(label);
+    const completed = transactionCompletion(tx, "eviction");
+    tx.objectStore(STORE).delete(cacheKey(label, network, modality));
+    await completed;
     stop();
   } catch (err) {
     stop();
-    log.error("[dot.li cid-cache] evict error:", err);
-    captureException(err, { kind: "cid_cache_evict_error" });
+    log.error("[dot.li installed-executable-cache] evict error:", err);
+    captureException(err, { kind: "installed_executable_cache_evict_error" });
   }
 }
 
 export type RevalidateOutcome =
   | { kind: "match" }
-  | { kind: "update"; cid: string }
+  | { kind: "update"; contenthash: string }
   | { kind: "cleared" };
 
-/** Reconcile a freshly-resolved CID against the served one: write, evict, or noop. */
-export async function recordRevalidateOutcome(
+/**
+ * Reconcile a fresh contenthash against a cached installed executable.
+ *
+ * A changed hash evicts the old pair. It is deliberately not cached until the
+ * caller resolves the matching executable manifest and writes the full pair.
+ */
+export async function reconcileInstalledExecutable(
   label: string,
-  servedCid: string,
-  freshCid: string | null,
+  network: Network,
+  modality: ExecutableModality,
+  installed: InstalledExecutable,
+  freshContenthash: string | null,
 ): Promise<RevalidateOutcome> {
-  if (freshCid === null) {
-    await evictCachedCid(label);
+  if (freshContenthash === null) {
+    await evictCachedInstalledExecutable(label, network, modality);
     m.count(S.CACHE_REVALIDATE_CLEARED);
     return { kind: "cleared" };
   }
-  await setCachedCid(label, freshCid);
-  if (freshCid === servedCid) {
+  if (freshContenthash === installed.contenthash) {
+    await setCachedInstalledExecutable(label, network, modality, installed);
     m.count(S.CACHE_REVALIDATE_MATCH);
     return { kind: "match" };
   }
+  await evictCachedInstalledExecutable(label, network, modality);
   m.count(S.CACHE_REVALIDATE_UPDATE);
-  return { kind: "update", cid: freshCid };
+  return { kind: "update", contenthash: freshContenthash };
 }
diff --git a/packages/storage/tests/cid-cache.test.ts b/packages/storage/tests/cid-cache.test.ts
index 7aea0a27..aaa3c217 100644
--- a/packages/storage/tests/cid-cache.test.ts
+++ b/packages/storage/tests/cid-cache.test.ts
@@ -2,20 +2,20 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 
 import "fake-indexeddb/auto";
-import { describe, it, expect, beforeEach } from "vitest";
+import { describe, it, expect, beforeEach, vi } from "vitest";
 import {
-  getRecentLabels,
   addRecentLabel,
+  clearInstalledExecutableCache,
+  evictCachedInstalledExecutable,
+  getCachedInstalledExecutable,
+  getRecentLabels,
+  reconcileInstalledExecutable,
   removeRecentLabel,
-  getCachedCid,
-  getCachedCidResult,
-  setCachedCid,
-  evictCachedCid,
-  recordRevalidateOutcome,
+  setCachedInstalledExecutable,
+  type InstalledExecutable,
 } from "@dotli/storage/cid-cache";
-import { getDb } from "@dotli/storage/db";
 
-// Recent labels live in localStorage (happy-dom). CIDs live in IndexedDB (fake-indexeddb).
+// Recent labels live in localStorage. Installed executables live in IndexedDB.
 
 describe("getRecentLabels", () => {
   beforeEach(() => {
@@ -116,33 +116,49 @@ describe("removeRecentLabel", () => {
   });
 });
 
-async function clearCidStore(): Promise<void> {
-  const db = await getDb();
-  await new Promise<void>((resolve, reject) => {
-    const tx = db.transaction("cids", "readwrite");
-    tx.objectStore("cids").clear();
-    tx.oncomplete = () => {
-      resolve();
+const NETWORK = "paseo-next-v2";
+const OTHER_NETWORK = "previewnet";
+const OLD_EXECUTABLE: InstalledExecutable = {
+  contenthash: "bafy-old",
+  executableManifest: '{"$v":1,"kind":"app","appVersion":[1,0,0]}',
+};
+const NEW_EXECUTABLE: InstalledExecutable = {
+  contenthash: "bafy-new",
+  executableManifest: '{"$v":1,"kind":"app","appVersion":[2,0,0]}',
+};
+
+interface RawInstalledExecutable extends InstalledExecutable {
+  label: string;
+  network: string;
+  modality: string;
+  timestamp: number;
+}
+
+async function openInstalledExecutableDb(): Promise<IDBDatabase> {
+  return await new Promise((resolve, reject) => {
+    const request = indexedDB.open("dotli-installed-executables", 1);
+    request.onsuccess = () => {
+      resolve(request.result);
     };
-    tx.onerror = () => {
-      reject(tx.error ?? new Error("clear failed"));
+    request.onerror = () => {
+      reject(request.error ?? new Error("DB open failed"));
     };
   });
 }
 
 async function readRawEntry(
   label: string,
-): Promise<{ label: string; cid: string; timestamp: number } | undefined> {
-  const db = await getDb();
+  network = NETWORK,
+  modality = "app",
+): Promise<RawInstalledExecutable | undefined> {
+  const db = await openInstalledExecutableDb();
   return new Promise((resolve, reject) => {
-    const tx = db.transaction("cids", "readonly");
-    const req = tx.objectStore("cids").get(label);
+    const tx = db.transaction("installed_executables", "readonly");
+    const req = tx
+      .objectStore("installed_executables")
+      .get([network, modality, label]);
     req.onsuccess = () => {
-      resolve(
-        req.result as
-          | { label: string; cid: string; timestamp: number }
-          | undefined,
-      );
+      resolve(req.result as RawInstalledExecutable | undefined);
     };
     req.onerror = () => {
       reject(req.error ?? new Error("read failed"));
@@ -150,106 +166,171 @@ async function readRawEntry(
   });
 }
 
-describe("CID IndexedDB round-trip", () => {
+describe("installed executable IndexedDB cache", () => {
   beforeEach(async () => {
-    await clearCidStore();
+    await clearInstalledExecutableCache();
   });
 
-  it("setCachedCid → getCachedCidResult returns hit", async () => {
-    await setCachedCid("myapp", "bafy123");
-    expect(await getCachedCidResult("myapp")).toEqual({
-      kind: "hit",
-      cid: "bafy123",
-    });
-  });
+  it("stores the manifest and contenthash as one record", async () => {
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", OLD_EXECUTABLE);
 
-  it("getCachedCidResult returns miss for unset label", async () => {
-    expect(await getCachedCidResult("never-stored")).toEqual({ kind: "miss" });
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "hit", executable: OLD_EXECUTABLE },
+    );
   });
 
-  it("legacy getCachedCid collapses miss to null", async () => {
-    expect(await getCachedCid("never-stored")).toBeNull();
-  });
+  it("scopes records by network and modality", async () => {
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", OLD_EXECUTABLE);
+    await setCachedInstalledExecutable(
+      "myapp",
+      OTHER_NETWORK,
+      "app",
+      NEW_EXECUTABLE,
+    );
+    await setCachedInstalledExecutable("myapp", NETWORK, "worker", {
+      contenthash: "bafy-worker",
+      executableManifest:
+        '{"$v":1,"kind":"worker","appVersion":[1,0,0],"entrypoint":"worker.js","includes":{"chat":false,"pocket":false}}',
+    });
 
-  it("legacy getCachedCid returns the cid on hit", async () => {
-    await setCachedCid("myapp", "bafy456");
-    expect(await getCachedCid("myapp")).toBe("bafy456");
-  });
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "hit", executable: OLD_EXECUTABLE },
+    );
+    expect(
+      await getCachedInstalledExecutable("myapp", OTHER_NETWORK, "app"),
+    ).toEqual({ kind: "hit", executable: NEW_EXECUTABLE });
+    expect(
+      await getCachedInstalledExecutable("myapp", NETWORK, "widget"),
+    ).toEqual({ kind: "miss" });
+  });
+
+  it("atomically replaces both fields and refreshes the timestamp", async () => {
+    const now = vi
+      .spyOn(Date, "now")
+      .mockReturnValueOnce(100)
+      .mockReturnValueOnce(200);
+    try {
+      await setCachedInstalledExecutable(
+        "myapp",
+        NETWORK,
+        "app",
+        OLD_EXECUTABLE,
+      );
+      const before = await readRawEntry("myapp");
 
-  it("setCachedCid overwrites the existing entry and refreshes timestamp", async () => {
-    await setCachedCid("myapp", "bafy-old");
-    const first = await readRawEntry("myapp");
-    expect(first?.cid).toBe("bafy-old");
+      await setCachedInstalledExecutable(
+        "myapp",
+        NETWORK,
+        "app",
+        NEW_EXECUTABLE,
+      );
 
-    // Force a measurable timestamp delta even on fast machines / coarse clocks.
-    await new Promise((resolve) => setTimeout(resolve, 2));
+      const after = await readRawEntry("myapp");
+      expect(after?.contenthash).toBe(NEW_EXECUTABLE.contenthash);
+      expect(after?.executableManifest).toBe(NEW_EXECUTABLE.executableManifest);
+      expect(after?.timestamp ?? 0).toBeGreaterThan(before?.timestamp ?? 0);
+    } finally {
+      now.mockRestore();
+    }
+  });
 
-    await setCachedCid("myapp", "bafy-new");
-    const second = await readRawEntry("myapp");
-    expect(second?.cid).toBe("bafy-new");
-    expect(second?.timestamp ?? 0).toBeGreaterThan(first?.timestamp ?? 0);
+  it("uses a dedicated compound-key store", async () => {
+    const db = await openInstalledExecutableDb();
+    expect(db.objectStoreNames.contains("installed_executables")).toBe(true);
+    expect(
+      db
+        .transaction("installed_executables")
+        .objectStore("installed_executables").keyPath,
+    ).toEqual(["network", "modality", "label"]);
   });
 });
 
-describe("recordRevalidateOutcome", () => {
+describe("reconcileInstalledExecutable", () => {
   beforeEach(async () => {
-    await clearCidStore();
-  });
-
-  it("returns 'match' and refreshes timestamp when fresh CID equals served", async () => {
-    await setCachedCid("myapp", "bafy123");
-    const before = await readRawEntry("myapp");
-    await new Promise((resolve) => setTimeout(resolve, 2));
-
-    const outcome = await recordRevalidateOutcome(
-      "myapp",
-      "bafy123",
-      "bafy123",
+    await clearInstalledExecutableCache();
+  });
+
+  it("preserves the complete pair on a warm reload with the same contenthash", async () => {
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", OLD_EXECUTABLE);
+
+    expect(
+      await reconcileInstalledExecutable(
+        "myapp",
+        NETWORK,
+        "app",
+        OLD_EXECUTABLE,
+        OLD_EXECUTABLE.contenthash,
+      ),
+    ).toEqual({ kind: "match" });
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "hit", executable: OLD_EXECUTABLE },
     );
-    expect(outcome).toEqual({ kind: "match" });
-
-    const after = await readRawEntry("myapp");
-    expect(after?.cid).toBe("bafy123");
-    expect(after?.timestamp ?? 0).toBeGreaterThan(before?.timestamp ?? 0);
   });
 
-  it("returns 'update' and writes the new CID when it differs", async () => {
-    await setCachedCid("myapp", "bafy-old");
+  it("evicts the old pair when contenthash changes without caching an unpaired hash", async () => {
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", OLD_EXECUTABLE);
+
+    expect(
+      await reconcileInstalledExecutable(
+        "myapp",
+        NETWORK,
+        "app",
+        OLD_EXECUTABLE,
+        NEW_EXECUTABLE.contenthash,
+      ),
+    ).toEqual({
+      kind: "update",
+      contenthash: NEW_EXECUTABLE.contenthash,
+    });
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "miss" },
+    );
 
-    const outcome = await recordRevalidateOutcome(
-      "myapp",
-      "bafy-old",
-      "bafy-new",
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", NEW_EXECUTABLE);
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "hit", executable: NEW_EXECUTABLE },
     );
-    expect(outcome).toEqual({ kind: "update", cid: "bafy-new" });
-    expect(await getCachedCid("myapp")).toBe("bafy-new");
   });
 
-  it("returns 'cleared' and evicts the cache entry when fresh is null", async () => {
-    await setCachedCid("myapp", "bafy-served");
-    expect(await getCachedCid("myapp")).toBe("bafy-served");
-
-    const outcome = await recordRevalidateOutcome("myapp", "bafy-served", null);
-    expect(outcome).toEqual({ kind: "cleared" });
-    expect(await getCachedCidResult("myapp")).toEqual({ kind: "miss" });
+  it("evicts the pair when contenthash is cleared", async () => {
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", OLD_EXECUTABLE);
+
+    expect(
+      await reconcileInstalledExecutable(
+        "myapp",
+        NETWORK,
+        "app",
+        OLD_EXECUTABLE,
+        null,
+      ),
+    ).toEqual({ kind: "cleared" });
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "miss" },
+    );
   });
 });
 
-describe("evictCachedCid", () => {
+describe("evictCachedInstalledExecutable", () => {
   beforeEach(async () => {
-    await clearCidStore();
+    await clearInstalledExecutableCache();
   });
 
-  it("removes an existing entry", async () => {
-    await setCachedCid("myapp", "bafy-doomed");
-    expect(await getCachedCid("myapp")).toBe("bafy-doomed");
+  it("removes only the selected scoped record", async () => {
+    await setCachedInstalledExecutable("myapp", NETWORK, "app", OLD_EXECUTABLE);
+    await setCachedInstalledExecutable(
+      "myapp",
+      OTHER_NETWORK,
+      "app",
+      NEW_EXECUTABLE,
+    );
 
-    await evictCachedCid("myapp");
-    expect(await getCachedCidResult("myapp")).toEqual({ kind: "miss" });
-  });
+    await evictCachedInstalledExecutable("myapp", NETWORK, "app");
 
-  it("is a no-op for an unset label", async () => {
-    await evictCachedCid("never-stored");
-    expect(await getCachedCidResult("never-stored")).toEqual({ kind: "miss" });
+    expect(await getCachedInstalledExecutable("myapp", NETWORK, "app")).toEqual(
+      { kind: "miss" },
+    );
+    expect(
+      await getCachedInstalledExecutable("myapp", OTHER_NETWORK, "app"),
+    ).toEqual({ kind: "hit", executable: NEW_EXECUTABLE });
   });
 });
diff --git a/packages/truapi-debug/DEBUG_PANEL.md b/packages/truapi-debug/DEBUG_PANEL.md
index fabf6d6e..ff63d500 100644
--- a/packages/truapi-debug/DEBUG_PANEL.md
+++ b/packages/truapi-debug/DEBUG_PANEL.md
@@ -132,8 +132,8 @@ Dotli-internal host-side orchestration, captured by
 `onDotliDebugEvent` from `@dotli/truapi-debug/dotli-debug-bus`.
 
 - `boot:*` — `started`, `protocol_warmup_started`, `topbar_ready`,
-  `url_parsed`, `cid_cache_checked`, `landing_page_shown`, `ready`,
-  `failed`.
+  `url_parsed`, `installed_executable_cache_checked`, `landing_page_shown`,
+  `ready`, `failed`.
 - `resolve:*` — `started`, `phase`, `storage_read`, `completed`,
   `failed`.
 - `render:*` — `iframe_begin`, `iframe_ready`.
diff --git a/packages/truapi-debug/src/dotli-debug-types.ts b/packages/truapi-debug/src/dotli-debug-types.ts
index f7a37531..fc25aa8f 100644
--- a/packages/truapi-debug/src/dotli-debug-types.ts
+++ b/packages/truapi-debug/src/dotli-debug-types.ts
@@ -242,13 +242,13 @@ export type BootEvent =
     }
   | {
       layer: "boot";
-      event: "cid_cache_checked";
+      event: "installed_executable_cache_checked";
       flowId: string;
       timestamp: number;
       payload: {
         label: string;
         hit: boolean;
-        cid?: string;
+        contenthash?: string;
       };
     }
   | {
diff --git a/packages/truapi-debug/src/system-explanations.ts b/packages/truapi-debug/src/system-explanations.ts
index 3deeba90..a937e1ac 100644
--- a/packages/truapi-debug/src/system-explanations.ts
+++ b/packages/truapi-debug/src/system-explanations.ts
@@ -55,11 +55,11 @@ Warmup happens in the background and is non-blocking. If a product calls chain s
 \`deepPath\` captures any path / search / hash fragment that will be forwarded into the product iframe after resolution.`,
   },
 
-  "boot:cid_cache_checked": {
-    title: "CID cache lookup",
-    body: `Checked the persistent CID cache (\`@dotli/storage/cid-cache\`, IndexedDB) for a previously resolved \`label → cid\` mapping. A hit triggers the **fast path**: skip resolution entirely, render the cached CID, save ~1–5 seconds of boot time. A miss triggers the **slow path**: run the full resolver against the chosen chain backend.
+  "boot:installed_executable_cache_checked": {
+    title: "Installed executable cache lookup",
+    body: `Checked IndexedDB for a v1 executable previously installed under this network, modality, and label. Each entry stores the executable manifest and its resolved \`contenthash\` as one record.
 
-The cache is populated at the end of each successful slow-path resolution (\`resolve:completed\`) unless the user has explicitly disabled caching in settings.`,
+On a hit, the host re-reads \`contenthash\` before rendering. An unchanged hash reuses the cached manifest/content pair. A changed or cleared hash evicts the entire pair; the new hash is cached only after its matching manifest resolves. A miss runs the full resolver.`,
   },
 
   "boot:landing_page_shown": {
@@ -71,8 +71,8 @@ The cache is populated at the end of each successful slow-path resolution (\`res
     title: "Host boot complete",
     body: `The host has finished bringing up everything it needs for this tab. \`totalMs\` is wall-clock from the page load to this moment. The \`path\` field distinguishes how the tab got here:
 
-• \`fast\` — CID cache hit, went straight to rendering.
-• \`slow\` — full resolution ran against smoldot or the RPC gateway.
+• \`fast\` — a cached installed executable was validated against the current contenthash and reused.
+• \`slow\` — the full manifest/contenthash resolution ran against smoldot or the RPC gateway.
 • \`localhost\` — localhost proxy path (developer workflow).
 
 After this event, the TrUAPI bus starts producing traffic and the product is driving the timeline.`,
diff --git a/packages/truapi-debug/src/system-summary.ts b/packages/truapi-debug/src/system-summary.ts
index 4f0011cb..4a75ab4a 100644
--- a/packages/truapi-debug/src/system-summary.ts
+++ b/packages/truapi-debug/src/system-summary.ts
@@ -32,10 +32,10 @@ export function summariseSystemEvent(ev: StoredSystemEvent): string {
       }
       return "URL parsed: landing page (no subdomain).";
     }
-    case "boot:cid_cache_checked":
+    case "boot:installed_executable_cache_checked":
       return p.hit === true
-        ? `CID cache hit for ${str(p.label)} → ${str(p.cid)}.`
-        : `CID cache miss for ${str(p.label)}.`;
+        ? `Installed executable cache hit for ${str(p.label)} → ${str(p.contenthash)}.`
+        : `Installed executable cache miss for ${str(p.label)}.`;
     case "boot:landing_page_shown":
       return "Landing page rendered (no subdomain to resolve).";
     case "boot:ready":
diff --git a/packages/ui/src/bridge.ts b/packages/ui/src/bridge.ts
index df992590..2cddb258 100644
--- a/packages/ui/src/bridge.ts
+++ b/packages/ui/src/bridge.ts
@@ -120,6 +120,7 @@ type CurrentProduct =
       mode: "subdomain";
       label: string;
       cid: string;
+      executableManifest: string | null;
     };
 
 const LANDING_AUTH_LABEL = "dotli";
@@ -250,7 +251,11 @@ function rerenderProduct(product: CurrentProduct): void {
       ? renderIframe(product.url, product.label, {
           productId: product.productId,
         })
-      : renderAppSubdomain(product.cid, product.label);
+      : renderAppSubdomain(
+          product.cid,
+          product.label,
+          product.executableManifest,
+        );
   void render.catch((error: unknown) => {
     // A newer render superseded this one, so its result owns the UI now.
     if (renderGeneration !== expectedGeneration) {
@@ -282,23 +287,20 @@ window.addEventListener("dotli:device-permission-changed", () => {
   }
 });
 
-// The sandbox strips its contract params after a successful boot, so a
-// reload of the sandbox window (a dApp calling `location.reload()`, a
-// browser restoring a crashed frame) boots without `?cid=` and cannot
-// recover on its own. It posts a recover request and the host rebuilds
-// the iframe from the tracked product state. The origin gate restricts
-// the request to the product currently rendered. The interval guard stops
-// a reload-looping product from pinning the host in endless re-renders.
-// A rate-limited sandbox shows its own contract error once its
-// `TIMEOUTS.SANDBOX_RECOVER` grace expires.
+// A sandbox reload asks the host to rebuild the iframe from tracked product
+// state. A schema mismatch is different: re-rendering would resend the same
+// stale contract, so forward a host-update event to the PWA coordinator.
+// Both messages are origin-gated to the product currently rendered. Recovery
+// is rate-limited so a reload-looping product cannot pin the host in endless
+// re-renders; update activation has its own idempotence guard in `pwa.ts`.
 const RECOVER_MIN_INTERVAL_MS = 5_000;
 let lastRecoverAt = 0;
 window.addEventListener("message", (event: MessageEvent) => {
   const data = event.data as Record<string, unknown> | null;
+  const type = data?.type;
   if (
-    data === null ||
-    typeof data !== "object" ||
-    data.type !== "dotli:sandbox-recover"
+    type !== "dotli:sandbox-recover" &&
+    type !== "dotli:host-update-required"
   ) {
     return;
   }
@@ -309,6 +311,10 @@ window.addEventListener("message", (event: MessageEvent) => {
   ) {
     return;
   }
+  if (type === "dotli:host-update-required") {
+    window.dispatchEvent(new Event("dotli:host-update-required"));
+    return;
+  }
   const now = Date.now();
   if (now - lastRecoverAt < RECOVER_MIN_INTERVAL_MS) {
     return;
@@ -725,6 +731,11 @@ async function createHost(args: {
     disposePipe = null;
     productProvider = null;
   };
+  const connectProductPort = (port: MessagePort): void => {
+    cleanupProductSide();
+    productProvider = createMessagePortProvider(port);
+    disposePipe = pipeProviders(productProvider, coreProvider, pipeArgs);
+  };
   try {
     const allow = `${await buildAllowAttribute(args.label)}; cross-origin-isolated`;
     const host = createIframeHost({
@@ -733,10 +744,7 @@ async function createHost(args: {
       allow,
       sandbox: args.sandbox,
       container: args.container,
-      onPort: (port) => {
-        productProvider = createMessagePortProvider(port);
-        disposePipe = pipeProviders(productProvider, coreProvider, pipeArgs);
-      },
+      onPort: connectProductPort,
     });
 
     // DEPRECATED legacy host-API support. Modern products announce themselves
@@ -754,9 +762,6 @@ async function createHost(args: {
     // `onPort` is the only wiring.
     let probeMode: "pending" | "modern" | "legacy" = "pending";
     const onProbe = (event: MessageEvent): void => {
-      if (probeMode !== "pending") {
-        return;
-      }
       const targetWindow = host.iframe.contentWindow;
       if (
         !targetWindow ||
@@ -765,6 +770,23 @@ async function createHost(args: {
       ) {
         return;
       }
+      if ((event.data as { type?: unknown } | null)?.type === "truapi-ready") {
+        if (probeMode === "modern") {
+          const channel = new MessageChannel();
+          connectProductPort(channel.port1);
+          targetWindow.postMessage(
+            { type: "truapi-init" },
+            args.allowedOrigin,
+            [channel.port2],
+          );
+        } else if (probeMode === "pending") {
+          probeMode = "modern";
+        }
+        return;
+      }
+      if (probeMode !== "pending") {
+        return;
+      }
       if (event.data instanceof Uint8Array) {
         probeMode = "legacy";
         legacyProbeCleanup?.();
@@ -782,11 +804,6 @@ async function createHost(args: {
         disposePipe = pipeProviders(legacyProvider, coreProvider, pipeArgs);
         // Replay the handshake frame the probe just consumed.
         windowProvider.injectInbound(event.data);
-      } else if (
-        (event.data as { type?: unknown } | null)?.type === "truapi-ready"
-      ) {
-        probeMode = "modern";
-        legacyProbeCleanup?.();
       }
     };
     window.addEventListener("message", onProbe);
@@ -1086,6 +1103,7 @@ export async function renderIframe(
 export async function renderAppSubdomain(
   cid: string,
   label: string,
+  executableManifest: string | null = null,
 ): Promise<void> {
   const myRenderGeneration = ++renderGeneration;
   const renderFlowId = newFlowId("render");
@@ -1101,6 +1119,7 @@ export async function renderAppSubdomain(
     mode: "subdomain",
     label,
     cid,
+    executableManifest,
   };
 
   // Propagate the current sandbox contract. The `?mode=` preset param is no
@@ -1139,6 +1158,12 @@ export async function renderAppSubdomain(
     chainBackend,
   );
   parsedUrl.searchParams.set(SANDBOX_CONTRACT_PARAMS.network, network);
+  if (executableManifest !== null) {
+    parsedUrl.searchParams.set(
+      SANDBOX_CONTRACT_PARAMS.executableManifest,
+      executableManifest,
+    );
+  }
   if (cache.skipArchiveCache) {
     parsedUrl.searchParams.set(SANDBOX_CONTRACT_PARAMS.skipArchiveCache, "1");
   }
diff --git a/packages/ui/src/topbar.ts b/packages/ui/src/topbar.ts
index 30423a48..38251d21 100644
--- a/packages/ui/src/topbar.ts
+++ b/packages/ui/src/topbar.ts
@@ -28,7 +28,7 @@ import {
   type Backend,
   type CacheSettings,
 } from "@dotli/config/mode";
-import { clearCidCache } from "@dotli/storage/cid-cache";
+import { clearInstalledExecutableCache } from "@dotli/storage/cid-cache";
 import {
   getEnabledNetworks,
   getNetwork,
@@ -1622,7 +1622,7 @@ async function applyAndReset(
         draft.cache.skipArchiveCache && !prior.cache.skipArchiveCache;
 
       if (cidTurnedOff) {
-        await clearCidCache();
+        await clearInstalledExecutableCache();
       }
       if (archiveTurnedOff) {
         // Archive cache lives on the sandbox origin, unreachable from here.
diff --git a/packages/ui/tests/bridge.test.ts b/packages/ui/tests/bridge.test.ts
index a99a589e..6fbea1e3 100644
--- a/packages/ui/tests/bridge.test.ts
+++ b/packages/ui/tests/bridge.test.ts
@@ -373,6 +373,95 @@ describe("bridge render lifecycle", () => {
     );
   }, 10_000);
 
+  it("threads exact executable manifest text into the sandbox contract", async () => {
+    const executableManifest =
+      '{"$v":2,"kind":"app","appVersion":[0,1,7],"runtime":{"kind":"web","entrypoint":"index.html"}}';
+    const { renderAppSubdomain } = await import("@dotli/ui/bridge");
+
+    const render = renderAppSubdomain(
+      "manifest-cid",
+      "manifest-app",
+      executableManifest,
+    );
+    await waitForProviderRequests(1);
+    mocks.coreProviderDefers[0].resolve(makeProvider());
+    await render;
+
+    const iframeUrl = new URL(mocks.iframeHosts[0].iframeUrl);
+    expect(iframeUrl.searchParams.get("executableManifest")).toBe(
+      executableManifest,
+    );
+  });
+
+  it("reconnects the TrUAPI MessagePort after a product iframe reload", async () => {
+    const { renderAppSubdomain } = await import("@dotli/ui/bridge");
+    const addEventListener = vi.spyOn(window, "addEventListener");
+    const render = renderAppSubdomain("reload-cid", "reload-app");
+    await waitForProviderRequests(1);
+    mocks.coreProviderDefers[0].resolve(makeProvider());
+    await render;
+
+    const created = mocks.iframeHosts[0];
+    const targetWindow = created.iframe.contentWindow;
+    expect(targetWindow).not.toBeNull();
+    const postMessage = vi
+      .spyOn(targetWindow!, "postMessage")
+      .mockImplementation(() => {});
+    const probe = addEventListener.mock.calls
+      .filter(([type]) => type === "message")
+      .at(-1)?.[1] as EventListener | undefined;
+    addEventListener.mockRestore();
+    expect(probe).toBeTypeOf("function");
+    const ready = (): void => {
+      probe?.({
+        data: { type: "truapi-ready" },
+        origin: created.allowedOrigin,
+        source: targetWindow,
+      } as MessageEvent);
+    };
+
+    ready();
+    expect(postMessage).not.toHaveBeenCalled();
+    ready();
+
+    expect(postMessage).toHaveBeenCalledTimes(1);
+    const [message, origin, ports] = postMessage.mock.calls[0];
+    expect(message).toEqual({ type: "truapi-init" });
+    expect(origin).toBe(created.allowedOrigin);
+    expect(ports).toHaveLength(1);
+    expect(ports?.[0]).toHaveProperty("postMessage");
+  });
+
+  it("forwards a sandbox schema mismatch as a host PWA update request", async () => {
+    const { renderAppSubdomain } = await import("@dotli/ui/bridge");
+    const render = renderAppSubdomain("manifest-cid", "manifest-app");
+    await waitForProviderRequests(1);
+    mocks.coreProviderDefers[0].resolve(makeProvider());
+    await render;
+
+    const updateRequired = vi.fn();
+    window.addEventListener("dotli:host-update-required", updateRequired, {
+      once: true,
+    });
+    const appOrigin = new URL(mocks.iframeHosts[0].iframeUrl).origin;
+
+    window.dispatchEvent(
+      new MessageEvent("message", {
+        data: { type: "dotli:host-update-required" },
+        origin: "https://evil.example",
+      }),
+    );
+    expect(updateRequired).not.toHaveBeenCalled();
+
+    window.dispatchEvent(
+      new MessageEvent("message", {
+        data: { type: "dotli:host-update-required" },
+        origin: appOrigin,
+      }),
+    );
+    expect(updateRequired).toHaveBeenCalledTimes(1);
+  });
+
   it.each(["/x.dot@evil.com/pay", "/foo.dotify/pay"])(
     "As a user, the host keeps an adversarial deep path on the app sandbox origin: %s",
     async (path) => {
diff --git a/scripts/pvm-runtime.lock.json b/scripts/pvm-runtime.lock.json
new file mode 100644
index 00000000..8e66014f
--- /dev/null
+++ b/scripts/pvm-runtime.lock.json
@@ -0,0 +1,13 @@
+{
+  "schemaVersion": 1,
+  "bridgeRepository": "https://github.com/paritytech/host-rust-core.git",
+  "bridgeRevision": "b8def25b8130d2c9579e8d507981df015cc67485",
+  "runtimeRepository": "https://github.com/paritytech/pvm-host-runtime",
+  "runtimeRevision": "cdc8811b7ab6ca0046aa6132b9ad5f553f2aea06",
+  "releaseTag": "v0.1.6",
+  "assets": {
+    "pvm-browser-runtime.wasm": "690ca3aef4b4cc397af89df0b642a9b9f579e86a150468c13c4f80cbb005ad15",
+    "pvm-wasm-worker.js": "5710ca2ec904640de4e01c29a4538707630313a9a45de9ddf1fbc815dbe81f8d",
+    "pvm-gpu-worker.js": "33418e2c81c117539569eb4cf91af4d058cdfae7dd4556b13f3687f6d6b3bae4"
+  }
+}
diff --git a/scripts/sync-pvm-runtime-assets.mjs b/scripts/sync-pvm-runtime-assets.mjs
new file mode 100644
index 00000000..319adf64
--- /dev/null
+++ b/scripts/sync-pvm-runtime-assets.mjs
@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import { execFileSync, spawnSync } from "node:child_process";
+import { copyFile, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const checkOnly = process.argv[2] === "--check";
+if (process.argv.length > 2 && !checkOnly) {
+  throw new Error("usage: sync-pvm-runtime-assets.mjs [--check]");
+}
+const lock = JSON.parse(
+  await readFile(resolve(root, "scripts/pvm-runtime.lock.json"), "utf8"),
+);
+const temporary = await mkdtemp(resolve(tmpdir(), "dotli-pvm-assets-"));
+let checkout = process.env.PVM_BRIDGE_ROOT;
+try {
+  if (!checkout) {
+    checkout = resolve(temporary, "host-rust-core");
+    execFileSync("git", ["init", "-q", checkout]);
+    execFileSync("git", [
+      "-C",
+      checkout,
+      "fetch",
+      "-q",
+      "--depth=1",
+      lock.bridgeRepository,
+      lock.bridgeRevision,
+    ]);
+    execFileSync("git", [
+      "-C",
+      checkout,
+      "checkout",
+      "-q",
+      "--detach",
+      "FETCH_HEAD",
+    ]);
+  }
+  const head = execFileSync("git", ["-C", checkout, "rev-parse", "HEAD"], {
+    encoding: "utf8",
+  }).trim();
+  if (head !== lock.bridgeRevision) {
+    throw new Error(
+      `bridge checkout ${head} does not match ${lock.bridgeRevision}`,
+    );
+  }
+
+  const exportedRoot = resolve(temporary, "exported");
+  const exported = spawnSync(
+    "cargo",
+    [
+      "run",
+      "--locked",
+      "--manifest-path",
+      resolve(checkout, "Cargo.toml"),
+      "-p",
+      "truapi-pvm-host",
+      "--features",
+      "browser-assets",
+      "--bin",
+      "pvm-assets-export",
+      "--",
+      "--output",
+      exportedRoot,
+    ],
+    { cwd: root, stdio: "inherit" },
+  );
+  if (exported.status !== 0) process.exit(exported.status ?? 1);
+
+  const mappings = new Map([
+    ["pvm-browser-runtime.wasm", "pvm-browser-runtime.wasm"],
+    ["pvm-worker.js", "pvm-wasm-worker.js"],
+    ["pvm-gpu-worker.js", "pvm-gpu-worker.js"],
+  ]);
+  const destination = resolve(root, "apps/sandbox/public/pvm-runtime");
+  const source = `PolkaVM App v2 browser runtime
+Bridge repository: ${lock.bridgeRepository}
+Bridge commit: ${lock.bridgeRevision}
+Runtime repository: ${lock.runtimeRepository}
+Runtime commit: ${lock.runtimeRevision}
+Release: ${lock.releaseTag}
+
+Bridge-owned artifacts:
+${[...mappings.values()].map((path) => `- ${path}`).join("\n")}
+`;
+
+  for (const [exportedName, destinationName] of mappings) {
+    const bytes = await readFile(resolve(exportedRoot, exportedName));
+    const actual = createHash("sha256").update(bytes).digest("hex");
+    if (actual !== lock.assets[destinationName]) {
+      throw new Error(`${destinationName} has unexpected digest ${actual}`);
+    }
+    const path = resolve(destination, destinationName);
+    if (checkOnly) {
+      if (!(await readFile(path)).equals(bytes)) {
+        throw new Error(`stale PVM runtime asset: ${path}`);
+      }
+    } else {
+      await copyFile(resolve(exportedRoot, exportedName), path);
+    }
+  }
+  const sourcePath = resolve(destination, "SOURCE");
+  if (checkOnly) {
+    if ((await readFile(sourcePath, "utf8")) !== source) {
+      throw new Error(`stale PVM runtime provenance: ${sourcePath}`);
+    }
+  } else {
+    await writeFile(sourcePath, source);
+  }
+  console.log(
+    `${checkOnly ? "Verified" : "Synchronized"} bridge-owned PVM assets from ${lock.bridgeRevision}`,
+  );
+} finally {
+  await rm(temporary, { recursive: true, force: true });
+}
\ No newline at end of file