diff --git a/AGENTS.md b/AGENTS.md
index a8facf46..7a98f6fc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -78,7 +78,7 @@ Private simulator behavior is implemented locally in:
 - Accessibility bridge: `packages/server/native/XCWAccessibilityBridge.*`
 
 The current repo uses the private boot path, private display bridge, and private accessibility translation bridge directly. The browser streams frames from that bridge, injects touch and keyboard events through the same native session layer, inspects accessibility through `AccessibilityPlatformTranslation`, and renders device chrome from `packages/server/native/XCWChromeRenderer.*`.
-CoreSimulator service contexts resolve the active developer directory from `DEVELOPER_DIR`, then `xcode-select -p`, then `/Applications/Xcode.app/Contents/Developer`. The display bridge prefers direct CoreSimulator screen IOSurface callbacks and activates the SimulatorKit offscreen renderable view only if direct callbacks are unavailable.
+CoreSimulator service contexts resolve the active developer directory from `DEVELOPER_DIR`, then `xcode-select -p`, then `/Applications/Xcode.app/Contents/Developer`. SimulatorKit is loaded from `Contents/SharedFrameworks` on Xcode 27 and newer, and from `Contents/Developer/Library/PrivateFrameworks` on earlier versions. The display bridge prefers direct CoreSimulator screen IOSurface callbacks and activates the SimulatorKit offscreen renderable view only if direct callbacks are unavailable.
 Accessibility recovery may use simulator launchctl UIKit application state plus hit-tested translations to recover candidate foreground pids; the returned tree must still be rooted at tokenized `AXPTranslator` application objects, because `translationApplicationObjectForPid:` can omit the bridge delegate token after private display lifecycle changes. Full-tree snapshots merge those recovered roots with the private frontmost application translation. Shallow snapshots with `maxDepth <= 2` use the tokenized frontmost application translation directly when it is available, and only run the expensive recovery sweep if frontmost lookup fails, so agent-oriented describe loops avoid launchctl and hit-test recovery overhead. Interactive-only snapshots also prune non-actionable native AX leaves during Objective-C serialization before the Rust-side compacting pass; keep this native pruning conservative so selector taps still retain actionable rows plus their ancestors. When multiple candidate application roots are discovered, serialize all of them in preferred order: non-extension app roots first, then largest translated roots, with `.appex`/PlugIns processes de-prioritized so SpringBoard and Safari app roots stay primary while widgets and WebContent roots remain debuggable. Widget renderer extension roots may report local frames; normalize those roots and children against matching SpringBoard widget placeholder frames before returning the snapshot.
 Physical chrome button support uses DeviceKit `chrome.json` input geometry for browser hit targets. Volume, action, mute, Apple Watch digital crown, Watch side button, and Watch left-side button dispatch through `IndigoHIDMessageForHIDArbitrary` with consumer/telephony/vendor HID usage pairs from the device chrome metadata; home, lock, and app-switcher remain on the existing SimulatorKit button paths. Apple Watch Digital Crown rotation dispatches through `IndigoHIDMessageForDigitalCrownEvent` when SimulatorKit exposes it, with `IndigoHIDMessageForScrollEvent(..., target=0x34)` as the fallback. Browser mouse/trackpad wheel input over the device screen sends the normalized screen point with the scroll delta, moves the SimulatorKit pointer target there, then dispatches native scroll packets through `IndigoHIDMessageForScrollEvent(..., target=0x2)` with a digitizer-target fallback instead of synthesizing touch drags. tvOS simulators do not support direct screen touch; browser/API tap maps to Enter, swipe maps to arrow keys, and the native bridge rejects tvOS touch packets before they reach guest `SimulatorHID`. watchOS/tvOS skip dynamic pointer/mouse service warm-up because those guest runtimes abort on unsupported virtual services. Apple TV and Apple Watch simulators are fixed-orientation devices, so client and server rotation paths must not expose or dispatch device rotation for those families.
 On macOS/Xcode 27-era CoreSimulator profiles, `mainScreenWidth`, `mainScreenHeight`, and `mainScreenScale` may be absent from `profile.plist`; DeviceKit chrome rendering must read `capabilities.plist` `ScreenDimensionsCapability` or the primary `displays` entry before falling back to the framebuffer mask PDF. If none of those sources produce usable display geometry, the chrome profile must fail instead of returning a tiny synthetic bezel that hides the stream.
diff --git a/packages/client/src/features/stream/streamWorkerClient.test.ts b/packages/client/src/features/stream/streamWorkerClient.test.ts
index ef3293c4..cb979391 100644
--- a/packages/client/src/features/stream/streamWorkerClient.test.ts
+++ b/packages/client/src/features/stream/streamWorkerClient.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 
 import {
   buildStreamTarget,
+  createWebRtcPeerConnection,
   initialStreamBackend,
   preferredStreamBackend,
 } from "./streamWorkerClient";
@@ -61,4 +62,46 @@ describe("streamWorkerClient", () => {
       ).RTCPeerConnection = previousPeerConnection;
     }
   });
+
+  it("creates exactly the requested connection without a disposable probe", () => {
+    const previous = globalThis.RTCPeerConnection;
+    const configuration = { iceServers: [] };
+    let constructions = 0;
+    class Peer {
+      constructor(readonly config: RTCConfiguration) {
+        constructions++;
+      }
+      close() {
+        throw new Error("The live connection must not be closed by a probe");
+      }
+    }
+    globalThis.RTCPeerConnection = Peer as unknown as typeof RTCPeerConnection;
+    try {
+      const peer = createWebRtcPeerConnection(configuration);
+      expect(constructions).toBe(1);
+      expect((peer as unknown as Peer).config).toBe(configuration);
+    } finally {
+      globalThis.RTCPeerConnection = previous;
+    }
+  });
+
+  it("preserves the actual initialization error without a second attempt", () => {
+    const previous = globalThis.RTCPeerConnection;
+    const cause = new Error("Connection denied by browser policy");
+    let constructions = 0;
+    globalThis.RTCPeerConnection = class {
+      constructor() {
+        constructions++;
+        throw cause;
+      }
+    } as unknown as typeof RTCPeerConnection;
+    try {
+      expect(() => createWebRtcPeerConnection({})).toThrow(
+        "Connection denied by browser policy",
+      );
+      expect(constructions).toBe(1);
+    } finally {
+      globalThis.RTCPeerConnection = previous;
+    }
+  });
 });
diff --git a/packages/client/src/features/stream/streamWorkerClient.ts b/packages/client/src/features/stream/streamWorkerClient.ts
index 60f7b01b..f1d031ef 100644
--- a/packages/client/src/features/stream/streamWorkerClient.ts
+++ b/packages/client/src/features/stream/streamWorkerClient.ts
@@ -1,8 +1,4 @@
-import {
-  accessTokenFromLocation,
-  apiHeaders,
-  fetchHealth,
-} from "../../api/client";
+import { apiHeaders, fetchHealth } from "../../api/client";
 import { apiUrl } from "../../api/config";
 import type { HealthResponse } from "../../api/types";
 import { createEmptyStreamStats } from "./stats";
@@ -31,7 +27,6 @@ const CONTROL_BACKLOG_DROP_BYTES = 4096;
 
 let activeWebRtcControlChannel: RTCDataChannel | null = null;
 let activeWebRtcTelemetryChannel: RTCDataChannel | null = null;
-let activeInputSocket: WebSocket | null = null;
 let activeStreamClient: StreamWorkerClient | null = null;
 
 export type StreamBackend = "webrtc";
@@ -40,10 +35,7 @@ export function sendWebRtcControlMessage(
   encoded: string,
   options: { dropIfBacklogged?: boolean } = {},
 ): boolean {
-  return (
-    sendDataChannelMessage(activeWebRtcControlChannel, encoded, options) ||
-    sendWebSocketMessage(activeInputSocket, encoded, options)
-  );
+  return sendDataChannelMessage(activeWebRtcControlChannel, encoded, options);
 }
 
 export function sendStreamClientStats(stats: unknown): boolean {
@@ -89,24 +81,6 @@ function sendDataChannelMessage(
   return true;
 }
 
-function sendWebSocketMessage(
-  socket: WebSocket | null,
-  encoded: string,
-  options: { dropIfBacklogged?: boolean } = {},
-): boolean {
-  if (socket?.readyState !== WebSocket.OPEN) {
-    return false;
-  }
-  if (
-    options.dropIfBacklogged &&
-    socket.bufferedAmount > CONTROL_BACKLOG_DROP_BYTES
-  ) {
-    return true;
-  }
-  socket.send(encoded);
-  return true;
-}
-
 function compareVideoToImage(
   video: HTMLVideoElement,
   source: ImageBitmap,
@@ -210,18 +184,23 @@ export function buildStreamTarget(
   };
 }
 
-function webSocketApiUrl(path: string): string {
-  const url = new URL(apiUrl(path), window.location.href);
-  const token = accessTokenFromLocation();
-  if (token) {
-    url.searchParams.set("simdeckToken", token);
+class WebRtcInitializationError extends Error {
+  constructor(cause: unknown) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    super(`Could not initialize WebRTC video: ${detail}`, { cause });
+    this.name = "WebRtcInitializationError";
   }
-  url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-  return url.toString();
 }
 
-export function canUseWebRtc(): boolean {
-  return typeof RTCPeerConnection === "function";
+/** Create the actual connection; do not make disposable capability probes. */
+export function createWebRtcPeerConnection(
+  configuration: RTCConfiguration,
+): RTCPeerConnection {
+  try {
+    return new RTCPeerConnection(configuration);
+  } catch (error) {
+    throw new WebRtcInitializationError(error);
+  }
 }
 
 interface StreamClientBackend {
@@ -380,7 +359,7 @@ class WebRtcStreamClient implements StreamClientBackend {
       if (generation !== this.connectGeneration) {
         return;
       }
-      const peerConnection = new RTCPeerConnection({
+      const peerConnection = createWebRtcPeerConnection({
         iceServers: iceServers(health),
         iceTransportPolicy: iceTransportPolicy(health),
       });
@@ -520,6 +499,18 @@ class WebRtcStreamClient implements StreamClientBackend {
       });
       this.scheduleFrameWatchdog(target, generation);
     } catch (error) {
+      if (error instanceof WebRtcInitializationError) {
+        if (generation !== this.connectGeneration) return;
+        // A constructor failure is not a dropped network connection. Avoid
+        // repeated initialization attempts; a new explicit connect can retry.
+        this.shouldReconnect = false;
+        this.closeActiveConnection();
+        this.onMessage({
+          type: "status",
+          status: { error: error.message, state: "error" },
+        });
+        return;
+      }
       this.handleConnectionError(target, generation, error);
     }
   }
@@ -1213,8 +1204,7 @@ class WebRtcStreamClient implements StreamClientBackend {
         this.stats.packetsLost = Math.max(0, video.packetsLost);
       }
       const codecStats = codec as
-        | (RTCStats & { mimeType?: string; payloadType?: number })
-        | undefined;
+        (RTCStats & { mimeType?: string; payloadType?: number }) | undefined;
       if (codecStats?.mimeType) {
         this.stats.codec = codecStats.payloadType
           ? `${codecStats.mimeType}/${codecStats.payloadType}`
diff --git a/packages/server/native/DFPrivateSimulatorDisplayBridge.m b/packages/server/native/DFPrivateSimulatorDisplayBridge.m
index 83855db7..2ad20cf0 100644
--- a/packages/server/native/DFPrivateSimulatorDisplayBridge.m
+++ b/packages/server/native/DFPrivateSimulatorDisplayBridge.m
@@ -149,12 +149,33 @@ typedef NS_ENUM(NSInteger, DFSimulatorInputFamily) {
     return @"/Applications/Xcode.app/Contents/Developer";
 }
 
+static NSInteger DFXcodeMajorVersion(NSString *developerDir) {
+    NSString *versionPlistPath = [[developerDir stringByDeletingLastPathComponent] stringByAppendingPathComponent:@"version.plist"];
+    NSDictionary *versionInfo = [NSDictionary dictionaryWithContentsOfFile:versionPlistPath];
+    id version = versionInfo[@"CFBundleShortVersionString"];
+    if (![version isKindOfClass:[NSString class]]) {
+        return 0;
+    }
+    return [(NSString *)version integerValue];
+}
+
 static NSString *DFSimulatorKitExecutablePath(void) {
     NSString *developerDir = DFActiveDeveloperDirectory();
-    if (developerDir.length > 0) {
-        return [developerDir stringByAppendingPathComponent:@"Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit"];
+    if (developerDir.length == 0) {
+        developerDir = @"/Applications/Xcode.app/Contents/Developer";
+    }
+
+    // Xcode 27 moved SimulatorKit from Contents/Developer/Library/PrivateFrameworks to Contents/SharedFrameworks.
+    NSString *sharedPath = [[developerDir stringByDeletingLastPathComponent] stringByAppendingPathComponent:@"SharedFrameworks/SimulatorKit.framework/SimulatorKit"];
+    NSString *legacyPath = [developerDir stringByAppendingPathComponent:@"Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit"];
+    NSArray<NSString *> *candidates = DFXcodeMajorVersion(developerDir) >= 27 ? @[sharedPath, legacyPath] : @[legacyPath, sharedPath];
+    NSFileManager *fileManager = [NSFileManager defaultManager];
+    for (NSString *candidate in candidates) {
+        if ([fileManager fileExistsAtPath:candidate]) {
+            return candidate;
+        }
     }
-    return @"/Applications/Xcode.app/Contents/Developer/Library/PrivateFrameworks/SimulatorKit.framework/SimulatorKit";
+    return candidates.firstObject;
 }
 
 typedef struct {