# Remote desktop — initial implementation

## Operator flow
Open a device → Operations → Remote assistance. The device must be online and advertise remote_desktop.v1. Current agents wake the screen to present the request; a secure keyguard still requires local unlocking. The terminal user approves the UIC screen-sharing prompt and Android MediaProjection prompt. Enable UIC remote input in Android Accessibility to use taps, swipes and Back/Home/Recents. A foreground notification allows the terminal user to stop sharing. The portal provides End session.

## Transport and admission
The secure DesktopSession primitive lives under TMS.RemoteControlRelay and is linked into the MVC portal host for this initial deployment. The copied legacy relay runtime remains disabled; its shared API-key admission and legacy database are not activated. The Android client connects over pinned TLS WebSockets on the existing package HTTPS endpoint (15102 locally), while the browser uses a same-origin authenticated WebSocket. No AWS components are required.

The operator starts through an authenticated CSRF-protected POST. A 256-bit random terminal ticket is delivered through the device-scoped MQTT command, used in an HTTPS header, and never embedded in the viewer page or URL. Admission lasts two minutes. Sessions last at most ten minutes, support one terminal/viewer, and end when either connection disconnects. The browser origin, operator session, customer membership, device assignment epoch and enabled status are checked; authorization is revalidated every five seconds. The session table is bounded at 100 entries. Frames and input are size/rate limited; slow peers are disconnected instead of accumulating frames. No screen recording is stored.

## Screen and input
The Android MediaProjection foreground service produces JPEG frames at up to approximately three frames per second, scaled to 480 pixels wide, with backpressure. This is an initial support-oriented desktop stream, not the legacy H.264/WebRTC path. Android protected surfaces remain protected. An accessibility service handles only normalized gestures and Back/Home/Recents during an active session. It does not retrieve accessibility window contents or auto-approve permission prompts.

## Limits and qualification
Current screen dimensions are fixed when capture starts; rotate the device before starting a session. Current agents use a wake-capable approval activity. The remote command result means the consent request was delivered to the agent; only incoming frames prove screen sharing is live. Sessions live in memory and do not survive a portal restart. Session-end audit events and standalone relay hosting are follow-up work; the start command uses the existing command audit. NEWPOS/NEXGO builds compile, but each vendor must be physically qualified.

145 integration checks passed, including authenticated session creation, duplicate-session rejection, no ticket in viewer HTML, terminal admission rejection without TLS/ticket, explicit end, and rejecting ended sessions. Agent 3.6.0-dev (9) was installed on the NEWPOS test terminal. Live screen/input verification awaits the operator approving Android permissions.

## Remote input readiness
The terminal reports accessibility-service readiness once per second during sharing. The portal shows a localized View only notice with activation instructions and disables touch/navigation controls while unavailable. Enabling the service updates the viewer without restarting the session. The NEWPOS test user enabled the service after confirming screen sharing worked.

## Wake for remote approval
UIC Home 3.6.1-dev (10) validates the request and wakes a sleeping display with a bounded wake lock, then presents the approval activity using the enabled accessibility service when available. It does not dismiss a secure keyguard or approve MediaProjection consent. The visible request keeps the display on only until the command expires or the activity closes. Verified physically on NEW9810: before request, power state Dozing; after the portal request, Awake with RemotePermissionActivity resumed. Both NEWPOS and NEXGO builds passed; NEXGO wake behavior has not been physically tested.