diff --git a/Cargo.lock b/Cargo.lock
index cc037e8b5dc..9f7a14a92a1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4121,6 +4121,7 @@ dependencies = [
  "toyos-tmpdir",
  "toyos-update",
  "toyos-userbound",
+ "toyos-vdagent",
  "toyos-wallclock",
  "toyos-xhci",
  "ureq",
@@ -4495,6 +4496,20 @@ dependencies = [
  "toyos-bootmap",
 ]
 
+[[package]]
+name = "toyos-vdagent"
+version = "0.1.0"
+dependencies = [
+ "toyos-untrusted",
+]
+
+[[package]]
+name = "toyos-vdagent-bridge"
+version = "0.1.0"
+dependencies = [
+ "toyos-vdagent",
+]
+
 [[package]]
 name = "toyos-virtio"
 version = "0.1.0"
@@ -4735,6 +4750,21 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
+[[package]]
+name = "vdagent"
+version = "0.0.0"
+dependencies = [
+ "toyos",
+ "toyos-abi",
+ "toyos-device-memory",
+ "toyos-manifest",
+ "toyos-pci-claim",
+ "toyos-vdagent",
+ "toyos-vdagent-bridge",
+ "toyos-virtio",
+ "toyos-window",
+]
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
diff --git a/Cargo.toml b/Cargo.toml
index daaac56ffae..6a5699feb9d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -71,6 +71,7 @@ members = [
     "lib/untrusted",
     "lib/update",
     "lib/userbound",
+    "lib/vdagent",
     "lib/virtio",
     "lib/wallclock",
     "lib/xhci",
@@ -126,6 +127,8 @@ members = [
     "system/update",
     "system/update/copies",
     "system/usbd",
+    "system/vdagent",
+    "system/vdagent/bridge",
     "tests/guest/kernelprobe",
     "tests/guest/metalprobe",
     "tests/guest/test-runner",
@@ -216,6 +219,9 @@ toyos-osrelease = { path = "sdk/osrelease" }
 # The swap port's name and the one program the image may give it to, so the
 # gate on every manifest reads what the supervisor reads.
 toyos-swap = { path = "lib/swap" }
+# QEMU's clipboard channel's port name, id and port count, so the launch reads
+# the declaration the guest's agent drives.
+toyos-vdagent = { path = "lib/vdagent" }
 # The watchdog's parameter name, so the gate over `kernel/src/params.rs` reads
 # the same constant the kernel and the bootloader do.
 toyos-tco = { path = "lib/tco" }
diff --git a/build/build.rs b/build/build.rs
index 0a0019a16c4..7dcec06119b 100644
--- a/build/build.rs
+++ b/build/build.rs
@@ -596,12 +596,14 @@ const SUPERVISOR_SERVED: &[&str] = &[toyos_swap::PORT, "power", toyos_manifest::
 
 /// The ports that one row alone may receive, each with that row: the swap
 /// port, whose holder replaces any service's binary, the grants port, whose
-/// holder writes which folder of the home a package sees, and the prompt
-/// port, whose holder draws above every window and has every key while it does.
+/// holder writes which folder of the home a package sees, the prompt port,
+/// whose holder draws above every window and has every key while it does, and
+/// the clipboard port, whose holder is sent every copy made in the session.
 const HELD_ALONE: &[(&str, &str)] = &[
     (toyos_swap::PORT, toyos_swap::HOLDER),
     (toyos_manifest::grants::PORT, toyos_manifest::grants::HOLDER),
     (toyos_manifest::consent::PROMPT, toyos_manifest::consent::SERVER),
+    (toyos_manifest::clipboard::PORT, toyos_manifest::clipboard::HOLDER),
 ];
 
 /// Who may hold the authorities that change what the machine runs or what a
@@ -3012,6 +3014,7 @@ mod tests {
         "images/diag.toml",
         "images/console.toml",
         "tests/images/acpicase.toml",
+        "tests/images/clipboardcase.toml",
         "tests/images/hostedclangcase.toml",
         "tests/images/jobcase.toml",
         "tests/images/latencycase.toml",
@@ -3098,6 +3101,10 @@ mod tests {
         assert!(held_by_their_holders_alone(&shell).is_err());
         let apps: SystemConfig = toml::from_str("[apps]\nreceives = [\"grants\"]\n").unwrap();
         assert!(held_by_their_holders_alone(&apps).is_err());
+        let vdagent: SystemConfig = toml::from_str("[programs.vdagent]\nreceives = [\"clipboard\"]\n").unwrap();
+        assert!(held_by_their_holders_alone(&vdagent).is_ok());
+        let editor: SystemConfig = toml::from_str("[programs.editor]\nreceives = [\"clipboard\"]\n").unwrap();
+        assert!(held_by_their_holders_alone(&editor).is_err());
     }
 
     /// The prompt port reaches its server alone, and the consent port no row,
diff --git a/build/lib.rs b/build/lib.rs
index 421c86e0d19..c66d1d83e99 100644
--- a/build/lib.rs
+++ b/build/lib.rs
@@ -51,6 +51,7 @@ pub mod sysroot;
 pub mod tether;
 pub mod toolchain;
 pub mod userlandhost;
+pub mod vdagent;
 pub mod wallpaper;
 
 use std::path::{Path, PathBuf};
diff --git a/build/qemu.rs b/build/qemu.rs
index 002c7782844..8b0354010a8 100644
--- a/build/qemu.rs
+++ b/build/qemu.rs
@@ -83,7 +83,8 @@ pub enum Profile {
 struct Shape {
     /// The display device. `Virtio` is the only profile with no firmware GOP.
     virtio_gpu: bool,
-    /// virtio-net, virtio-sound, and the console on virtio-serial.
+    /// virtio-net, virtio-sound, the console on virtio-serial, and the
+    /// clipboard's channel on a virtio-serial function of its own.
     virtio: bool,
     /// A USB HID on the xHCI. The T14's keyboard is PS/2 and its touchpad
     /// I2C-HID; it has no USB HID at all.
@@ -127,6 +128,17 @@ pub struct Options {
 pub fn launch(opts: &Options) {
     let shape = opts.profile.shape();
     let arch = opts.arch;
+    // Before anything launches: every virtio machine carries the clipboard's
+    // channel, and every host's display is the one with its clipboard.
+    let display = display();
+    let wanted = [
+        shape.virtio.then(|| toyos_build::vdagent::available(arch)),
+        (display != "cocoa").then(|| toyos_build::vdagent::gtk(arch)),
+    ];
+    if let Some(refused) = wanted.into_iter().flatten().find_map(Result::err) {
+        eprintln!("Error: {refused}");
+        std::process::exit(1);
+    }
     let mut qemu = Command::new(arch.qemu());
 
     // Without this QEMU runs its default-device pass whenever no network
@@ -155,6 +167,7 @@ pub fn launch(opts: &Options) {
     if let Some(boot) = arch.boot() {
         qemu.arg("-boot").arg(boot);
     }
+    qemu.arg("-display").arg(display);
     qemu.arg("-machine")
         .arg(machine(arch, shape.iommu))
         .arg("-smp")
@@ -243,6 +256,10 @@ pub fn launch(opts: &Options) {
         qemu.arg("-device")
             .arg(format!("virtio-sound-pci,audiodev=audio0,streams=1{platform}"));
 
+        // The clipboard's channel, just before the console's function, so it
+        // enumerates first and the kernel's console rule runs.
+        qemu.args(toyos_build::vdagent::args(platform));
+
         // Console wiring: virtio-console on stdio is the primary I/O channel
         // (the kernel switches to it once virtio-console init completes —
         // see drivers/virtio_console.rs). UART stays on a file so early-boot
@@ -340,6 +357,16 @@ fn iommu_device(arch: Arch) -> Option<&'static str> {
     }
 }
 
+/// The display, with the host's clipboard: QEMU's own on macOS, and GTK's,
+/// whose clipboard QEMU leaves off unless asked, everywhere else.
+fn display() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "cocoa"
+    } else {
+        "gtk,clipboard=on"
+    }
+}
+
 fn audio_backend() -> &'static str {
     if cfg!(target_os = "macos") {
         "coreaudio"
diff --git a/build/vdagent.rs b/build/vdagent.rs
new file mode 100644
index 00000000000..5b0e2a09f0a
--- /dev/null
+++ b/build/vdagent.rs
@@ -0,0 +1,83 @@
+//! QEMU's clipboard channel at the launch: its `qemu-vdagent` chardev, the
+//! virtio-serial function of its own it is on, and the agent's port, from the
+//! one declaration the guest's agent reads (`toyos-vdagent`).
+//!
+//! **A function of its own**, created just before the console's: the console's
+//! function is the kernel's log channel from early boot, and the agent's
+//! enumerates first, so every virtio boot runs the kernel's choice of console
+//! (`toyos_pci::console`).
+//!
+//! **The chardev exists only in a QEMU built with spice-protocol** (QEMU's
+//! `qapi/char.json`, `'if': 'CONFIG_SPICE_PROTOCOL'`), so a launch asks QEMU
+//! for it first and refuses by name; nothing falls back.
+
+use std::process::Command;
+use std::sync::OnceLock;
+
+use toyos_vdagent::{MAX_PORTS, PORT_ID, PORT_NAME};
+
+use crate::arch::Arch;
+
+/// The arguments that give a guest the channel. `platform` is the virtio
+/// function's `iommu_platform` property, as every other virtio function on the
+/// machine is given it.
+pub fn args(platform: &str) -> [String; 6] {
+    [
+        "-chardev".into(),
+        "qemu-vdagent,id=vdagent0,clipboard=on,mouse=off".into(),
+        "-device".into(),
+        format!("virtio-serial-pci-non-transitional,id=vdagent-serial,max_ports={MAX_PORTS}{platform}"),
+        "-device".into(),
+        format!("virtserialport,bus=vdagent-serial.0,nr={PORT_ID},chardev=vdagent0,name={PORT_NAME}"),
+    ]
+}
+
+/// Whether `arch`'s QEMU has the chardev, asked once per process.
+pub fn available(arch: Arch) -> Result<(), String> {
+    static ASKED: [OnceLock<Result<(), String>>; 2] = [OnceLock::new(), OnceLock::new()];
+    let slot = &ASKED[Arch::ALL.iter().position(|a| *a == arch).expect("every Arch is in ALL")];
+    slot.get_or_init(|| {
+        let listed = help(arch, "-chardev")?;
+        named(&listed, "qemu-vdagent").then_some(()).ok_or_else(|| {
+            format!(
+                "{} has no `qemu-vdagent` chardev: it was built without spice-protocol, and every \
+                 virtio machine carries the shared clipboard's channel",
+                arch.qemu()
+            )
+        })
+    })
+    .clone()
+}
+
+/// Whether `arch`'s QEMU has the GTK display, which `cargo run` takes on a
+/// host other than macOS for its clipboard.
+pub fn gtk(arch: Arch) -> Result<(), String> {
+    let listed = help(arch, "-display")?;
+    named(&listed, "gtk").then_some(()).ok_or_else(|| {
+        format!("{} has no GTK display; Debian ships it as `qemu-system-gui`", arch.qemu())
+    })
+}
+
+/// What `<qemu> -machine none <option> help` lists. The machine is named
+/// because `qemu-system-aarch64` has no default one and lists nothing without
+/// it; `none` is the empty machine on both.
+fn help(arch: Arch, option: &str) -> Result<String, String> {
+    let out = Command::new(arch.qemu())
+        .args(["-machine", "none", option, "help"])
+        .output()
+        .map_err(|e| format!("{} -machine none {option} help: {e}", arch.qemu()))?;
+    if !out.status.success() {
+        return Err(format!(
+            "{} -machine none {option} help: {}: {}",
+            arch.qemu(),
+            out.status,
+            String::from_utf8_lossy(&out.stderr)
+        ));
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).into_owned())
+}
+
+/// Whether a help listing names `backend` on a line of its own.
+fn named(listed: &str, backend: &str) -> bool {
+    listed.lines().any(|line| line.trim() == backend)
+}
diff --git a/images/system.toml b/images/system.toml
index bb677b274be..8949e71ce82 100644
--- a/images/system.toml
+++ b/images/system.toml
@@ -19,7 +19,7 @@ assets = ["assets"]
 # while the compositor had no way to ask for a program's *declared* authority —
 # the launcher gives it one, and starting a service from `[boot] start` is not
 # the thing that needed fixing.
-start = ["logkeeper", "diskserver", "fileserver", "compositor", "soundserver", "netstack", "filepicker", "acpiserver"]
+start = ["logkeeper", "diskserver", "fileserver", "compositor", "soundserver", "netstack", "filepicker", "acpiserver", "vdagent"]
 
 # What every program launched out of `/apps` holds, whatever its own directory
 # says. A package is unpacked by `/system/bin/pkg` into a writable directory, so
@@ -69,10 +69,11 @@ receives = ["power"]
 # makes the local desktop a login session, so `swap` and `update` run from its
 # shell. `prompt` is the layer above every window, which `filepicker` alone
 # reaches: serving it makes the sessions its launches open the screen's, whose
-# packages may ask the person at it for a folder.
+# packages may ask the person at it for a folder. `clipboard` is sent every copy
+# made in the session, and `vdagent` alone receives it.
 [programs.compositor]
 service = true
-serves = ["compositor", "prompt"]
+serves = ["compositor", "prompt", "clipboard"]
 receives = ["soundserver", "filepicker"]
 devices = ["framebuffer", "keyboard", "mouse"]
 starts = ["terminal", "files", "/apps"]
@@ -93,6 +94,15 @@ service = true
 serves = ["netstack"]
 devices = ["pci:1af4:1041"]
 
+# The shared clipboard with QEMU's host: the virtio-serial function its
+# vdagent chardev is on, claimed by vendor and device among the functions the
+# kernel does not drive (the kernel's console is `1af4:1043` too), and the
+# compositor's clipboard port. A machine with no such function, the T14 among
+# them, leaves it to say so and exit.
+[programs.vdagent]
+devices = ["pci:1af4:1043"]
+receives = ["clipboard"]
+
 # Every launch it makes is in a login session, the one `update` and `swap`
 # below start in: one it opens when it runs in the machine's session, and the
 # one it was launched in otherwise, as when a desktop shell starts it.
diff --git a/issues/a-cargo-run-boot-claims-every-pcidev-slot.md b/issues/a-cargo-run-boot-claims-every-pcidev-slot.md
new file mode 100644
index 00000000000..9781738e36a
--- /dev/null
+++ b/issues/a-cargo-run-boot-claims-every-pcidev-slot.md
@@ -0,0 +1,26 @@
+---
+status: assigned
+kind: defect
+opened: 2026-10-13
+---
+
+# A `cargo run` boot claims every one of pcidev's slots
+
+Held by the orchestrator.
+
+`images/system.toml`'s rows claim four PCI functions on `cargo run`'s q35:
+virtio-sound (`soundserver`), virtio-net (`netstack`), the NVMe controller
+(`diskserver`) and the clipboard's virtio-serial function (`vdagent`). That is
+every one of `pcidev::MAX_FUNCTIONS` (`kernel/src/pcidev/mod.rs`), so a fifth
+claim on that machine is refused `Exhausted`.
+
+None of them goes back: a virtio function on q35's root bus publishes no power
+management capability and no PCI Express capability, so it has no
+function-level reset, and an ended holder leaves its slot as that function's
+residue (`kernel/pci/src/slot.rs`).
+
+More slots reach both architectures' interrupt tables, which declare one
+interrupt per slot (`kernel/src/arch/x86_64/idt/user_dev.rs`,
+`kernel/src/arch/aarch64/irqchip/its.rs`).
+
+**Exit condition.** A `cargo run` boot leaves a claim slot free.
diff --git a/issues/a-declined-console-function-keeps-a-kernel-mapping-of-its-firmware-bar.md b/issues/a-declined-console-function-keeps-a-kernel-mapping-of-its-firmware-bar.md
new file mode 100644
index 00000000000..bd6fc5e3ea8
--- /dev/null
+++ b/issues/a-declined-console-function-keeps-a-kernel-mapping-of-its-firmware-bar.md
@@ -0,0 +1,26 @@
+---
+status: assigned
+kind: defect
+opened: 2026-10-13
+---
+
+# A declined console function keeps a kernel mapping of its firmware BAR
+
+Held by the orchestrator.
+
+The kernel's console reads every virtio console function's device features
+before it picks one (`kernel/src/drivers/virtio_console.rs`,
+`VirtioDevice::offer` in `kernel/src/drivers/virtio.rs`). That read maps the
+function's capability windows through `map_mmio`, at the BAR addresses
+firmware assigned. A function the console declines is reset and left to a
+claim, and its windows stay mapped in the kernel's direct map and listed in
+x86_64's driven windows (`kernel/src/arch/x86_64/paging.rs`), which nothing
+removes. `pcidev` then moves that BAR when a process claims the function, so
+the kernel keeps a mapping of an address range the function no longer
+decodes. Nothing reads through it today.
+
+Virtio 1.2 §4.1.4.9's PCI configuration access capability reaches a BAR's
+registers through configuration space with nothing mapped.
+
+**Exit condition.** A function the console declines leaves no kernel mapping
+and no driven window behind.
diff --git a/issues/an-aarch64-cargo-run-boot-hands-over-no-pci-claim.md b/issues/an-aarch64-cargo-run-boot-hands-over-no-pci-claim.md
new file mode 100644
index 00000000000..36001b34e3c
--- /dev/null
+++ b/issues/an-aarch64-cargo-run-boot-hands-over-no-pci-claim.md
@@ -0,0 +1,45 @@
+---
+status: open
+kind: defect
+opened: 2026-10-13
+---
+
+# An aarch64 `cargo run` boot hands over no PCI claim
+
+`cargo run -- --arch aarch64` launches `virt,gic-version=3,iommu=smmuv3`
+under HVF (`build/qemu.rs`, `machine`). HVF's own GIC has no ITS, so the
+MADT names none (`ITS: the MADT names none`), and every claim is refused:
+`pcidev: PCI … NOT HANDED OVER — its interrupts would not be remapped on
+this machine`, for diskserver's NVMe, soundserver, netstack and vdagent.
+
+The same launch with only the machine changed to
+`virt,gic-version=3,its=on,iommu=smmuv3,kernel-irqchip=off` (QEMU 11.1.1,
+by hand) arms the ITS and maps each claim's DeviceID to its slot's LPI,
+and still hands over none: each of the four is refused with `its BAR was
+moved onto 8 64-bit address(es) inside the windows firmware declared and
+the function answered at none of them` (lines 343, 418, 450, 487 of
+[the boot's log](https://github.com/ToyOSOrg/evidence/blob/e626cced7ab73c04efdbbfd0b98a2f0a0ff8d86b/fix2-60f08b937/aarch64-its-boot.log)).
+Each answers at its firmware BAR: `0x0f0107ff`, `0x79000000`,
+`0x30bf8024` and `0x00000103` (lines 327, 386, 433, 470). At every
+address it is moved onto the read is `0xffffffff`, except the first,
+`0x4010000000`, the ECAM base (line 212), which line 225 lists among the
+windows firmware declared: there the NVMe's read is `0x00081b36`
+(line 327) and the other three's `0x00000000`.
+The kernel's own xHCI driver is given no LPI there (`not armed — a driver
+in this kernel is given no LPI`) and initialises no controller, so no USB
+keyboard reaches the compositor, which panics on "the manifest gives this
+program the keyboard".
+
+So on aarch64 the clipboard agent's claim and its handshake are unbooted:
+its function is declined by the console driver and the console comes up
+on the next one, and the agent itself exits on "no virtio-serial function
+was handed to this program". Its handshake on aarch64 rests on the code
+that passes on q35.
+
+Owner: the arm64 track, `issues/toyos-runs-on-arm64.md`, whose stage 7
+exit (`ssh` from the host, the desktop on virtio-gpu) a `cargo run` boot
+cannot meet until this is fixed.
+
+**Exit condition.** A `cargo run -- --arch aarch64` boot hands over a
+claim: its console shows diskserver serving its NVMe partitions and
+`vdagent: port 1 open`.
diff --git a/issues/the-shared-clipboard-is-unmeasured-on-linux-and-windows-hosts.md b/issues/the-shared-clipboard-is-unmeasured-on-linux-and-windows-hosts.md
new file mode 100644
index 00000000000..1f63e8c58fc
--- /dev/null
+++ b/issues/the-shared-clipboard-is-unmeasured-on-linux-and-windows-hosts.md
@@ -0,0 +1,20 @@
+---
+status: assigned
+kind: tooling
+opened: 2026-10-13
+---
+
+# The shared clipboard is unmeasured on Linux and Windows hosts
+
+Held by the orchestrator.
+
+`cargo run` gives QEMU the host's clipboard through its cocoa display on macOS
+and through GTK's, `-display gtk,clipboard=on`, on every other host
+(`build/qemu.rs`). Every fact about QEMU 11.1.1's vdagent that
+`/system/bin/vdagent` rests on was measured black-box through QEMU's VNC
+clipboard peer (`system/vdagent/bridge/src/lib.rs`); GTK's peer and cocoa's are
+unmeasured. QEMU documents GTK's clipboard as off by default
+(`qapi/ui.json`), and QEMU issue #1150 reports guest hangs with it on.
+
+**Exit condition.** A copy and a paste each way, measured on a Linux host
+under GTK and on a Windows host.
diff --git a/kernel/pci/src/choose.rs b/kernel/pci/src/choose.rs
new file mode 100644
index 00000000000..19d21a4cdf5
--- /dev/null
+++ b/kernel/pci/src/choose.rs
@@ -0,0 +1,94 @@
+//! Which of the functions one `vendor:device` names is the one asked for: the
+//! decision alone, over what the kernel read of each.
+//!
+//! **Two functions can carry one ID and be two different devices.** QEMU's
+//! virtio-serial is `1af4:1043` whether it carries the kernel's single-port
+//! console or a multiport channel a process drives, so the kernel's console
+//! driver picks by what the device offers ([`console`]), and a claim picks
+//! among the functions the kernel does not drive ([`claimed`]).
+
+/// Virtio 1.2 §5.3.3: the console device's `VIRTIO_CONSOLE_F_MULTIPORT`.
+pub const VIRTIO_CONSOLE_F_MULTIPORT: u64 = 1 << 1;
+
+/// The function the kernel's console drives, among console functions whose
+/// device features are `features`, in enumeration order: the first that does
+/// not offer `VIRTIO_CONSOLE_F_MULTIPORT`.
+///
+/// A single-port driver drives nothing else. A multiport device names its
+/// console ports by `CONSOLE_PORT` messages on control queues (§5.3.6.2),
+/// which a single-port driver has none of.
+pub fn console(features: &[u64]) -> Option<usize> {
+    features.iter().position(|offered| offered & VIRTIO_CONSOLE_F_MULTIPORT == 0)
+}
+
+/// Why a claim's `vendor:device` names no function to hand over.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Unclaimable {
+    /// No function carries it.
+    Absent,
+    /// Two or more functions the kernel does not drive carry it: the name asks
+    /// for one of them and cannot say which.
+    Ambiguous,
+    /// Every function that carries it is the kernel's own.
+    KernelDriven,
+}
+
+/// The function a claim resolves to, among those that carry its
+/// `vendor:device` in enumeration order, each `true` where the kernel drives
+/// it: the one function the kernel does not drive.
+pub fn claimed(driven: impl IntoIterator<Item = bool>) -> Result<usize, Unclaimable> {
+    let mut found = None;
+    let mut any = false;
+    for (at, driven) in driven.into_iter().enumerate() {
+        any = true;
+        if driven {
+            continue;
+        }
+        if found.is_some() {
+            return Err(Unclaimable::Ambiguous);
+        }
+        found = Some(at);
+    }
+    match (found, any) {
+        (Some(at), _) => Ok(at),
+        (None, true) => Err(Unclaimable::KernelDriven),
+        (None, false) => Err(Unclaimable::Absent),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// `VIRTIO_F_VERSION_1` beside each, as QEMU offers it on both functions.
+    const VERSION_1: u64 = 1 << 32;
+    const SINGLE: u64 = VERSION_1;
+    const MULTI: u64 = VERSION_1 | VIRTIO_CONSOLE_F_MULTIPORT;
+
+    #[test]
+    fn the_console_is_the_first_function_without_multiport() {
+        assert_eq!(console(&[MULTI, SINGLE, SINGLE]), Some(1));
+    }
+
+    #[test]
+    fn multiport_functions_alone_give_no_console() {
+        assert_eq!(console(&[MULTI, MULTI]), None);
+        assert_eq!(console(&[]), None);
+    }
+
+    #[test]
+    fn one_undriven_match_among_driven_ones_is_claimed() {
+        assert_eq!(claimed([true, false, true]), Ok(1));
+    }
+
+    #[test]
+    fn two_undriven_matches_are_ambiguous() {
+        assert_eq!(claimed([false, true, false]), Err(Unclaimable::Ambiguous));
+    }
+
+    #[test]
+    fn only_driven_matches_are_kernel_driven() {
+        assert_eq!(claimed([true, true]), Err(Unclaimable::KernelDriven));
+        assert_eq!(claimed([]), Err(Unclaimable::Absent));
+    }
+}
diff --git a/kernel/pci/src/lib.rs b/kernel/pci/src/lib.rs
index 79570482638..265422929da 100644
--- a/kernel/pci/src/lib.rs
+++ b/kernel/pci/src/lib.rs
@@ -32,6 +32,7 @@ pub mod af;
 pub mod bar;
 pub mod bridge;
 pub mod caps;
+pub mod choose;
 pub mod express;
 pub mod msi;
 pub mod msix;
@@ -39,3 +40,5 @@ pub mod placement;
 pub mod pm;
 pub mod probe;
 pub mod slot;
+
+pub use choose::{claimed, console, Unclaimable};
diff --git a/kernel/src/device.rs b/kernel/src/device.rs
index ae655b5c95d..bf369954bcc 100644
--- a/kernel/src/device.rs
+++ b/kernel/src/device.rs
@@ -153,12 +153,13 @@ pub enum ClaimError {
     Owned,
     /// This machine has no such device — no driver ever registered one.
     Absent,
-    /// The name matches more than one function on this machine. Refused rather
-    /// than resolved to the first: a config asking for one of two identical
-    /// cards cannot say which, and picking would be the kernel deciding.
+    /// The name matches more than one function this kernel does not drive.
+    /// Refused rather than resolved to the first: a config asking for one of
+    /// two identical cards cannot say which, and picking would be the kernel
+    /// deciding.
     Ambiguous,
-    /// A driver in this kernel already binds that function; two drivers on one
-    /// device is not something a claim may create.
+    /// A driver in this kernel already binds every function the name matches;
+    /// two drivers on one device is not something a claim may create.
     KernelDriven,
     /// Every slot that can carry a driven function is taken.
     Exhausted,
diff --git a/kernel/src/drivers/virtio.rs b/kernel/src/drivers/virtio.rs
index 131929f8c84..9133258bc5a 100644
--- a/kernel/src/drivers/virtio.rs
+++ b/kernel/src/drivers/virtio.rs
@@ -714,40 +714,30 @@ pub struct VirtioDevice {
     config: VirtioPciConfig,
 }
 
-impl VirtioDevice {
-    /// Initialize a VirtIO PCI device: reset, negotiate features, prepare for queue setup.
-    /// `Err` says why the device was refused — a capability its chain never
-    /// published a usable window for, or a reset it never acknowledged.
-    pub fn init(pci_dev: &PciDevice, accepted_features: u64) -> Result<Self, InitRefusal> {
-        // Bus mastering only after the chain parses: a refused device keeps no DMA,
-        // and firmware may have armed the bit before the kernel ran.
-        let config = match VirtioPciConfig::parse(pci_dev) {
-            Ok(config) => config,
-            Err(missing) => {
-                pci_dev.disable_bus_master();
-                return Err(missing.into());
-            }
-        };
-        pci_dev.enable_bus_master();
-        let common = config.common;
-
-        // Order fixed by virtio 1.2 §3.1.1: reset, ACKNOWLEDGE, DRIVER, negotiate features, FEATURES_OK, verify.
-        common.write_u32(COMMON_DEVICE_STATUS, 0);
-        if !crate::clock::settles(RESET.nanos(), || common.read_u32(COMMON_DEVICE_STATUS) == 0) {
-            pci_dev.disable_bus_master();
-            return Err(InitRefusal::ResetUnanswered);
-        }
-
-        common.write_u32(COMMON_DEVICE_STATUS, STATUS_ACKNOWLEDGE as u32);
+/// A device reset and acknowledged, and the features it offers: virtio 1.2
+/// §3.1.1's first four steps, read before the function masters the bus.
+///
+/// **Before bus mastering because [`PciDevice::enable_bus_master`] is what
+/// records a function as this kernel's**: a driver that reads what a device
+/// offers to decide whether to drive it has not yet driven it.
+pub struct Offered {
+    config: VirtioPciConfig,
+    pub features: u64,
+}
 
-        common.write_u32(COMMON_DEVICE_STATUS,
-            STATUS_ACKNOWLEDGE as u32 | STATUS_DRIVER as u32);
+impl Offered {
+    /// Leave the device to someone else: reset again, so nothing this driver
+    /// wrote outlives the read.
+    pub fn decline(self) {
+        self.config.common.write_u32(COMMON_DEVICE_STATUS, 0);
+    }
 
-        common.write_u32(COMMON_DEVICE_FEATURE_SELECT, 0);
-        let device_features_lo = common.read_u32(COMMON_DEVICE_FEATURE);
-        common.write_u32(COMMON_DEVICE_FEATURE_SELECT, 1);
-        let device_features_hi = common.read_u32(COMMON_DEVICE_FEATURE);
-        let device_features = (device_features_hi as u64) << 32 | device_features_lo as u64;
+    /// The rest of §3.1.1 up to queue setup: the function masters the bus from
+    /// here, and negotiates `accepted_features` of what it offered.
+    pub fn accept(self, pci_dev: &PciDevice, accepted_features: u64) -> Result<VirtioDevice, InitRefusal> {
+        let Self { config, features: device_features } = self;
+        pci_dev.enable_bus_master();
+        let common = config.common;
 
         let features = device_features & (accepted_features | platform_addressing(pci_dev));
         log!(
@@ -773,7 +763,50 @@ impl VirtioDevice {
             return Err(InitRefusal::FeaturesRefused { offered: features, status: answered });
         }
 
-        Ok(Self { config })
+        Ok(VirtioDevice { config })
+    }
+}
+
+impl VirtioDevice {
+    /// Reset `pci_dev` and read what it offers. `Err` says why the device was
+    /// refused — a capability its chain never published a usable window for,
+    /// or a reset it never acknowledged — and it keeps no bus mastering.
+    pub fn offer(pci_dev: &PciDevice) -> Result<Offered, InitRefusal> {
+        // Firmware may have armed bus mastering before the kernel ran, and a
+        // refused device keeps no DMA.
+        let config = match VirtioPciConfig::parse(pci_dev) {
+            Ok(config) => config,
+            Err(missing) => {
+                pci_dev.disable_bus_master();
+                return Err(missing.into());
+            }
+        };
+        pci_dev.enable_memory_space();
+        let common = config.common;
+
+        // Order fixed by virtio 1.2 §3.1.1: reset, ACKNOWLEDGE, DRIVER, read the features.
+        common.write_u32(COMMON_DEVICE_STATUS, 0);
+        if !crate::clock::settles(RESET.nanos(), || common.read_u32(COMMON_DEVICE_STATUS) == 0) {
+            pci_dev.disable_bus_master();
+            return Err(InitRefusal::ResetUnanswered);
+        }
+
+        common.write_u32(COMMON_DEVICE_STATUS, STATUS_ACKNOWLEDGE as u32);
+
+        common.write_u32(COMMON_DEVICE_STATUS,
+            STATUS_ACKNOWLEDGE as u32 | STATUS_DRIVER as u32);
+
+        common.write_u32(COMMON_DEVICE_FEATURE_SELECT, 0);
+        let device_features_lo = common.read_u32(COMMON_DEVICE_FEATURE);
+        common.write_u32(COMMON_DEVICE_FEATURE_SELECT, 1);
+        let device_features_hi = common.read_u32(COMMON_DEVICE_FEATURE);
+        let features = (device_features_hi as u64) << 32 | device_features_lo as u64;
+        Ok(Offered { config, features })
+    }
+
+    /// Initialize a VirtIO PCI device: reset, negotiate features, prepare for queue setup.
+    pub fn init(pci_dev: &PciDevice, accepted_features: u64) -> Result<Self, InitRefusal> {
+        Self::offer(pci_dev)?.accept(pci_dev, accepted_features)
     }
 
     /// Configure a virtqueue's addresses and size; does not enable it — call `enable_queue()` after MSI-X vectors are set.
diff --git a/kernel/src/drivers/virtio_console.rs b/kernel/src/drivers/virtio_console.rs
index dc6cb55ee9f..c31975a2e5a 100644
--- a/kernel/src/drivers/virtio_console.rs
+++ b/kernel/src/drivers/virtio_console.rs
@@ -1,15 +1,20 @@
 //! VirtIO console: single-port (no MULTIPORT), replacing the 16550 UART as
 //! the kernel log channel after init. Uses queues 0 (RX) and 1 (TX).
 //!
+//! **It drives the first console function that does not offer MULTIPORT**
+//! (`toyos_pci::console`), read before any function masters the bus; a
+//! multiport function is reset and left to a claim.
+//!
 //! RX is poll-driven: no UART IRQ handler is wired (see `arch/x86_64/idt/mod.rs`).
 
+use alloc::vec::Vec;
 use core::cell::UnsafeCell;
 use core::mem::MaybeUninit;
 use core::sync::atomic::{AtomicBool, Ordering};
 
 use super::pci::PciDevice;
 use super::serial::BackendGuard;
-use super::virtio::{wait_used, BufDir, DescSlot, Virtqueue, VirtioDevice, VIRTIO_F_VERSION_1};
+use super::virtio::{wait_used, BufDir, DescSlot, Offered, Virtqueue, VirtioDevice, VIRTIO_F_VERSION_1};
 use super::DmaPool;
 use crate::log;
 use crate::mm::{Dma, Unaligned};
@@ -196,12 +201,34 @@ pub fn has_data_locked(_: &BackendGuard) -> bool {
 }
 
 pub fn init(devices: &[PciDevice]) -> bool {
-    let pci_dev = match devices.iter().find(|d| d.is_id(VIRTIO_VENDOR, VIRTIO_CONSOLE_DEVICE)) {
-        Some(d) => *d,
-        None => {
-            log!("virtio-console: no device found");
-            return false;
+    // Every console function's offer, in enumeration order: the one this
+    // driver takes is decided by what each offers (`toyos_pci::console`).
+    let mut offers: Vec<(PciDevice, Offered)> = Vec::new();
+    for pci_dev in devices.iter().filter(|d| d.is_id(VIRTIO_VENDOR, VIRTIO_CONSOLE_DEVICE)) {
+        match VirtioDevice::offer(pci_dev) {
+            Ok(offered) => offers.push((*pci_dev, offered)),
+            Err(why) => log!("virtio-console: PCI {:02x}:{:02x}.{} {why} — device refused",
+                pci_dev.bus, pci_dev.dev, pci_dev.func),
         }
+    }
+    let features: Vec<u64> = offers.iter().map(|(_, offered)| offered.features).collect();
+    let chosen = toyos_pci::console(&features);
+    let mut taken = None;
+    for (at, (pci_dev, offered)) in offers.into_iter().enumerate() {
+        if Some(at) == chosen {
+            taken = Some((pci_dev, offered));
+            continue;
+        }
+        log!(
+            "virtio-console: PCI {:02x}:{:02x}.{} offers MULTIPORT, which this single-port driver \
+             does not drive — reset and left to a claim",
+            pci_dev.bus, pci_dev.dev, pci_dev.func
+        );
+        offered.decline();
+    }
+    let Some((pci_dev, offered)) = taken else {
+        log!("virtio-console: no device found");
+        return false;
     };
     log!("virtio-console: found at PCI {:02x}:{:02x}.{}", pci_dev.bus, pci_dev.dev, pci_dev.func);
 
@@ -212,7 +239,7 @@ pub fn init(devices: &[PciDevice]) -> bool {
     // Before the device is told an address, and after the only mapping it gets.
     space.attach(pci_dev.bus, pci_dev.dev, pci_dev.func);
 
-    let device = match VirtioDevice::init(&pci_dev, VIRTIO_F_VERSION_1) {
+    let device = match offered.accept(&pci_dev, VIRTIO_F_VERSION_1) {
         Ok(device) => device,
         Err(why) => {
             log!("virtio-console: PCI {:02x}:{:02x}.{} {why} — device refused",
diff --git a/kernel/src/pcidev/mod.rs b/kernel/src/pcidev/mod.rs
index acf6686f2d3..b52173a1dc1 100644
--- a/kernel/src/pcidev/mod.rs
+++ b/kernel/src/pcidev/mod.rs
@@ -713,38 +713,42 @@ impl core::fmt::Display for Refusal {
 /// Claim `id`, bring the function up to the point a driver takes over, and
 /// answer what that driver needs to know.
 pub fn claim(id: PciId) -> Result<(PciFunctionInfo, Claim), ClaimError> {
-    let (pci, driven) = {
+    // Among the functions this kernel does not drive (`toyos_pci::claimed`):
+    // the console's virtio-serial and a process's carry one ID.
+    let (matches, resolved) = {
         let machine = MACHINE.lock();
-        let mut found: Option<PciDevice> = None;
-        for device in machine.functions.iter() {
-            if !device.is_id(id.vendor, id.device) {
-                continue;
-            }
-            if found.is_some() {
-                // Refused by name rather than resolved to the first match: a
-                // config that names a card this machine has two of is asking
-                // for one of them and cannot say which.
+        let matches: Vec<PciDevice> =
+            machine.functions.iter().filter(|d| d.is_id(id.vendor, id.device)).copied().collect();
+        let resolved =
+            toyos_pci::claimed(matches.iter().map(|d| machine.kernel_driven.contains(&requester(d))));
+        (matches, resolved)
+    };
+    let pci = match resolved {
+        Ok(at) => matches[at],
+        Err(toyos_pci::Unclaimable::Absent) => return Err(ClaimError::Absent),
+        Err(toyos_pci::Unclaimable::Ambiguous) => {
+            // Refused by name rather than resolved to the first match: a
+            // config that names a card this machine has two of is asking
+            // for one of them and cannot say which.
+            log!(
+                "pcidev: {:04x}:{:04x} names more than one function this kernel does not drive",
+                id.vendor,
+                id.device
+            );
+            return Err(ClaimError::Ambiguous);
+        }
+        Err(toyos_pci::Unclaimable::KernelDriven) => {
+            for pci in &matches {
                 log!(
-                    "pcidev: {:04x}:{:04x} names more than one function on this machine",
-                    id.vendor,
-                    id.device
+                    "pcidev: PCI {:02x}:{:02x}.{} is driven by this kernel and cannot be claimed",
+                    pci.bus,
+                    pci.dev,
+                    pci.func
                 );
-                return Err(ClaimError::Ambiguous);
             }
-            found = Some(*device);
+            return Err(ClaimError::KernelDriven);
         }
-        let pci = found.ok_or(ClaimError::Absent)?;
-        (pci, machine.kernel_driven.contains(&requester(&pci)))
     };
-    if driven {
-        log!(
-            "pcidev: PCI {:02x}:{:02x}.{} is driven by this kernel and cannot be claimed",
-            pci.bus,
-            pci.dev,
-            pci.func
-        );
-        return Err(ClaimError::KernelDriven);
-    }
 
     // `Owned` before `Exhausted`: a second claim on a function somebody holds
     // is a different fact from a machine with no slot left.
diff --git a/lib/manifest/src/clipboard.rs b/lib/manifest/src/clipboard.rs
new file mode 100644
index 00000000000..d374826caad
--- /dev/null
+++ b/lib/manifest/src/clipboard.rs
@@ -0,0 +1,8 @@
+//! The compositor's clipboard port: every copy made in the session is sent to
+//! its one connection, so one row alone may receive it.
+
+/// The port the compositor serves its clipboard's watcher on.
+pub const PORT: &str = "clipboard";
+
+/// The one row the build lets receive [`PORT`]: QEMU's clipboard agent.
+pub const HOLDER: &str = "vdagent";
diff --git a/lib/manifest/src/lib.rs b/lib/manifest/src/lib.rs
index 5e66f47098e..62d9eeb662f 100644
--- a/lib/manifest/src/lib.rs
+++ b/lib/manifest/src/lib.rs
@@ -35,8 +35,10 @@
 //! [`package`] is the other half: what an installed package says about itself,
 //! which is which of its own binaries a launch starts and never what it holds.
 //! [`launch`] is who may start what, [`grants`] which folder of the home a
-//! package is granted, and [`consent`] how the person at the screen is asked.
+//! package is granted, [`consent`] how the person at the screen is asked, and
+//! [`clipboard`] who watches the clipboard.
 
+pub mod clipboard;
 pub mod consent;
 pub mod grants;
 pub mod launch;
diff --git a/lib/vdagent/Cargo.toml b/lib/vdagent/Cargo.toml
new file mode 100644
index 00000000000..0e3dac86b81
--- /dev/null
+++ b/lib/vdagent/Cargo.toml
@@ -0,0 +1,19 @@
+# A member of the host workspace (root `Cargo.toml`), like toyos-virtio: it is
+# pure and its tests run on the host. It is an input boundary of its own: every
+# word it decodes is the host's, written by QEMU's vdagent chardev and its
+# virtio-serial device.
+
+[package]
+name = "toyos-vdagent"
+description = "QEMU's clipboard channel, pure: the channel's declaration, virtio-serial's control messages and the spice vdagent stream, decoded bounded and encoded byte for byte."
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+publish = false
+
+[dependencies]
+# The type a host word stays in until it has met its bound.
+toyos-untrusted = { path = "../untrusted" }
+
+[lib]
+doctest = false
diff --git a/lib/vdagent/src/control.rs b/lib/vdagent/src/control.rs
new file mode 100644
index 00000000000..fd411e93f19
--- /dev/null
+++ b/lib/vdagent/src/control.rs
@@ -0,0 +1,143 @@
+//! virtio-serial's control messages (virtio 1.2 §5.3.6.2): `struct
+//! virtio_console_control { le32 id; le16 event; le16 value; }`, each in a
+//! buffer of its own on the control queues.
+//!
+//! **A `PORT_NAME`'s name is not decoded.** §5.3.6.2 has it follow the message
+//! "without a NUL terminator", and QEMU 11.1.1 ends it with one; the port is
+//! the declared [`crate::PORT_ID`] instead.
+
+use toyos_untrusted::Untrusted;
+
+/// One control message's bytes.
+pub const BYTES: usize = 8;
+
+/// §5.3.6.2's events.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Event {
+    DeviceReady,
+    DeviceAdd,
+    DeviceRemove,
+    PortReady,
+    ConsolePort,
+    Resize,
+    PortOpen,
+    PortName,
+}
+
+impl Event {
+    const ALL: [Self; 8] = [
+        Self::DeviceReady,
+        Self::DeviceAdd,
+        Self::DeviceRemove,
+        Self::PortReady,
+        Self::ConsolePort,
+        Self::Resize,
+        Self::PortOpen,
+        Self::PortName,
+    ];
+
+    /// The event's number, its index in §5.3.6.2's list.
+    fn number(self) -> u16 {
+        Self::ALL.iter().position(|e| *e == self).expect("every event is in ALL") as u16
+    }
+}
+
+/// One control message.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Control {
+    pub id: u32,
+    pub event: Event,
+    pub value: u16,
+}
+
+/// Why a control buffer the device used is not a control message.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Refused {
+    /// Fewer bytes than a message.
+    Short { len: usize },
+    /// An event §5.3.6.2 does not list.
+    Event { event: u16 },
+    /// A port id at or past the device's `max_nr_ports`.
+    Port { id: u32, max_nr_ports: u32 },
+}
+
+impl core::fmt::Display for Refused {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::Short { len } => write!(f, "a control buffer of {len} byte(s), short of a message's {BYTES}"),
+            Self::Event { event } => write!(f, "a control message of event {event}, which virtio-serial does not define"),
+            Self::Port { id, max_nr_ports } => {
+                write!(f, "a control message for port {id}, of a device with {max_nr_ports} port(s)")
+            }
+        }
+    }
+}
+
+/// The control message at the start of `bytes`, a buffer the device wrote,
+/// for a device of `max_nr_ports` ports. What follows the message — a
+/// `PORT_NAME`'s name — is not read.
+pub fn decode(bytes: &[u8], max_nr_ports: u32) -> Result<Control, Refused> {
+    let Some(message) = bytes.get(..BYTES) else {
+        return Err(Refused::Short { len: bytes.len() });
+    };
+    let id = u32::from_le_bytes([message[0], message[1], message[2], message[3]]);
+    let event = u16::from_le_bytes([message[4], message[5]]);
+    let value = u16::from_le_bytes([message[6], message[7]]);
+    let event = Untrusted::new(event)
+        .index(Event::ALL.len())
+        .map(|at| Event::ALL[at])
+        .map_err(|_| Refused::Event { event })?;
+    Untrusted::new(id)
+        .index(max_nr_ports as usize)
+        .map_err(|_| Refused::Port { id, max_nr_ports })?;
+    Ok(Control { id, event, value })
+}
+
+/// A control message's bytes.
+pub fn encode(control: Control) -> [u8; BYTES] {
+    let mut bytes = [0; BYTES];
+    bytes[..4].copy_from_slice(&control.id.to_le_bytes());
+    bytes[4..6].copy_from_slice(&control.event.number().to_le_bytes());
+    bytes[6..].copy_from_slice(&control.value.to_le_bytes());
+    bytes
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// §5.3.6.2's layout and numbering: `DEVICE_READY` is 0, `PORT_READY` 3,
+    /// `PORT_OPEN` 6, little-endian.
+    #[test]
+    fn each_control_message_is_its_layout() {
+        assert_eq!(encode(Control { id: 0, event: Event::DeviceReady, value: 1 }), [0, 0, 0, 0, 0, 0, 1, 0]);
+        assert_eq!(encode(Control { id: 1, event: Event::PortReady, value: 1 }), [1, 0, 0, 0, 3, 0, 1, 0]);
+        assert_eq!(encode(Control { id: 1, event: Event::PortOpen, value: 0 }), [1, 0, 0, 0, 6, 0, 0, 0]);
+        let numbers: std::vec::Vec<u16> = Event::ALL.iter().map(|e| e.number()).collect();
+        assert_eq!(numbers, [0, 1, 2, 3, 4, 5, 6, 7]);
+    }
+
+    /// A `PORT_NAME` with its name behind it decodes as the message alone.
+    #[test]
+    fn a_port_name_decodes_without_its_name() {
+        let mut buffer = std::vec::Vec::from([1, 0, 0, 0, 7, 0, 1, 0]);
+        buffer.extend_from_slice(b"com.redhat.spice.0\0");
+        assert_eq!(decode(&buffer, 2), Ok(Control { id: 1, event: Event::PortName, value: 1 }));
+    }
+
+    #[test]
+    fn a_port_id_at_max_nr_ports_is_refused() {
+        assert_eq!(decode(&[2, 0, 0, 0, 1, 0, 1, 0], 2), Err(Refused::Port { id: 2, max_nr_ports: 2 }));
+        assert_eq!(decode(&[1, 0, 0, 0, 1, 0, 1, 0], 2), Ok(Control { id: 1, event: Event::DeviceAdd, value: 1 }));
+    }
+
+    #[test]
+    fn an_undefined_event_is_refused() {
+        assert_eq!(decode(&[1, 0, 0, 0, 8, 0, 1, 0], 2), Err(Refused::Event { event: 8 }));
+    }
+
+    #[test]
+    fn a_short_buffer_is_refused() {
+        assert_eq!(decode(&[1, 0, 0, 0, 6, 0, 1], 2), Err(Refused::Short { len: 7 }));
+    }
+}
diff --git a/lib/vdagent/src/encode.rs b/lib/vdagent/src/encode.rs
new file mode 100644
index 00000000000..2e8db3e2e6a
--- /dev/null
+++ b/lib/vdagent/src/encode.rs
@@ -0,0 +1,207 @@
+//! The agent's messages, written byte for byte as `vd_agent.h`'s packed
+//! layouts, each chunked at [`MAX_CHUNK`] for `VDP_CLIENT_PORT`.
+//!
+//! No selection prefix: the agent announces `CLIPBOARD_BY_DEMAND` and
+//! `CLIPBOARD_GRAB_SERIAL` and never `CLIPBOARD_SELECTION`, so every `GRAB`
+//! carries its serial.
+
+use crate::stream::MAX_CHUNK;
+use crate::wire;
+
+/// The capabilities the agent announces.
+pub const GUEST_CAPS: u32 = wire::CAP_CLIPBOARD_BY_DEMAND | wire::CAP_CLIPBOARD_GRAB_SERIAL;
+
+/// Each message's data bytes.
+pub const CAPABILITIES_DATA: usize = 8;
+pub const GRAB_DATA: usize = 8;
+pub const REQUEST_DATA: usize = 4;
+pub const RELEASE_DATA: usize = 0;
+pub const fn clipboard_data(text: usize) -> usize {
+    4 + text
+}
+
+/// The bytes one message of `data` bytes takes on the wire: its header and
+/// data, and a chunk header before every [`MAX_CHUNK`] of them.
+pub const fn message_bytes(data: usize) -> usize {
+    let message = wire::MESSAGE_HEADER + data;
+    message + wire::CHUNK_HEADER * message.div_ceil(MAX_CHUNK)
+}
+
+/// Messages written one after another into a buffer the caller sized.
+///
+/// # Panics
+/// A message past the buffer's end: the caller sizes it to the largest
+/// transmit it makes, so one past it is the caller's bug.
+pub struct Writer<'a> {
+    out: &'a mut [u8],
+    len: usize,
+}
+
+impl<'a> Writer<'a> {
+    pub fn new(out: &'a mut [u8]) -> Self {
+        Self { out, len: 0 }
+    }
+
+    /// The bytes written.
+    pub fn len(&self) -> usize {
+        self.len
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len == 0
+    }
+
+    /// `ANNOUNCE_CAPABILITIES`, `request` 0: the agent never asks for the
+    /// host's.
+    pub fn capabilities(&mut self) {
+        self.message(wire::ANNOUNCE_CAPABILITIES, &[&0u32.to_le_bytes(), &GUEST_CAPS.to_le_bytes()]);
+    }
+
+    /// `GRAB [serial][UTF8_TEXT]`.
+    pub fn grab(&mut self, serial: u32) {
+        self.message(wire::GRAB, &[&serial.to_le_bytes(), &wire::UTF8_TEXT.to_le_bytes()]);
+    }
+
+    /// `REQUEST [UTF8_TEXT]`.
+    pub fn request(&mut self) {
+        self.message(wire::REQUEST, &[&wire::UTF8_TEXT.to_le_bytes()]);
+    }
+
+    /// `CLIPBOARD [UTF8_TEXT, text]`.
+    pub fn clipboard(&mut self, text: &[u8]) {
+        self.message(wire::CLIPBOARD, &[&wire::UTF8_TEXT.to_le_bytes(), text]);
+    }
+
+    /// `RELEASE []`.
+    pub fn release(&mut self) {
+        self.message(wire::RELEASE, &[]);
+    }
+
+    /// A message of `kind` whose data is `parts` in order, chunked.
+    fn message(&mut self, kind: u32, parts: &[&[u8]]) {
+        let data: usize = parts.iter().map(|p| p.len()).sum();
+        let total = message_bytes(data);
+        assert!(
+            self.len + total <= self.out.len(),
+            "vdagent: a {total}-byte message past a {}-byte transmit holding {}",
+            self.out.len(),
+            self.len
+        );
+        let size = u32::try_from(data).expect("a message's data fits its u32 size");
+        let header = [
+            &wire::PROTOCOL.to_le_bytes()[..],
+            &kind.to_le_bytes()[..],
+            &0u64.to_le_bytes()[..],
+            &size.to_le_bytes()[..],
+        ];
+        let mut left = wire::MESSAGE_HEADER + data;
+        let mut in_chunk = 0;
+        for mut part in header.into_iter().chain(parts.iter().copied()) {
+            while !part.is_empty() {
+                if in_chunk == 0 {
+                    let chunk = left.min(MAX_CHUNK);
+                    self.put(&wire::CLIENT_PORT.to_le_bytes());
+                    self.put(&(chunk as u32).to_le_bytes());
+                    in_chunk = chunk;
+                }
+                let take = in_chunk.min(part.len());
+                self.put(&part[..take]);
+                part = &part[take..];
+                in_chunk -= take;
+                left -= take;
+            }
+        }
+    }
+
+    fn put(&mut self, bytes: &[u8]) {
+        self.out[self.len..self.len + bytes.len()].copy_from_slice(bytes);
+        self.len += bytes.len();
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::vec;
+    use std::vec::Vec;
+
+    use super::*;
+
+    fn written(write: impl FnOnce(&mut Writer)) -> Vec<u8> {
+        let mut out = vec![0; crate::LARGEST_TRANSMIT];
+        let mut writer = Writer::new(&mut out);
+        write(&mut writer);
+        let len = writer.len();
+        out.truncate(len);
+        out
+    }
+
+    /// `VDIChunkHeader {port 1, size}` then `VDAgentMessage {protocol 1, type,
+    /// opaque 0, size}`, little-endian and packed.
+    fn single(kind: u8, data: &[u8]) -> Vec<u8> {
+        let size = data.len() as u8;
+        let mut out = vec![1, 0, 0, 0, 20 + size, 0, 0, 0];
+        out.extend([1, 0, 0, 0, kind, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, size, 0, 0, 0]);
+        out.extend_from_slice(data);
+        out
+    }
+
+    #[test]
+    fn capabilities_are_request_0_with_by_demand_and_grab_serial() {
+        assert_eq!(written(|w| w.capabilities()), single(6, &[0, 0, 0, 0, 0x20, 0, 0x02, 0]));
+        assert_eq!(message_bytes(CAPABILITIES_DATA), 36);
+    }
+
+    #[test]
+    fn a_grab_carries_its_serial_and_utf8_text() {
+        assert_eq!(written(|w| w.grab(0x0102_0304)), single(7, &[4, 3, 2, 1, 1, 0, 0, 0]));
+        assert_eq!(message_bytes(GRAB_DATA), 36);
+    }
+
+    #[test]
+    fn a_request_and_a_release_are_their_layouts() {
+        assert_eq!(written(|w| w.request()), single(8, &[1, 0, 0, 0]));
+        assert_eq!(written(|w| w.release()), single(9, &[]));
+        assert_eq!(message_bytes(REQUEST_DATA), 32);
+        assert_eq!(message_bytes(RELEASE_DATA), 28);
+    }
+
+    #[test]
+    fn a_short_clipboard_is_one_chunk() {
+        assert_eq!(written(|w| w.clipboard(b"hi")), single(4, &[1, 0, 0, 0, b'h', b'i']));
+        assert_eq!(written(|w| w.clipboard(b"")), single(4, &[1, 0, 0, 0]));
+    }
+
+    /// A message past one chunk is cut every 2048 bytes of message, header
+    /// included, each cut behind a chunk header of its own size.
+    #[test]
+    fn a_long_clipboard_is_chunked_at_2048() {
+        let text: Vec<u8> = (0..5000u32).map(|i| i as u8).collect();
+        let out = written(|w| w.clipboard(&text));
+        let mut message = single(4, &[1, 0, 0, 0])[8..].to_vec();
+        message[16..20].copy_from_slice(&(4 + text.len() as u32).to_le_bytes());
+        message.extend_from_slice(&text);
+        let expected: Vec<u8> = message
+            .chunks(2048)
+            .flat_map(|c| [1u32.to_le_bytes(), (c.len() as u32).to_le_bytes()].concat().into_iter().chain(c.iter().copied()))
+            .collect();
+        assert_eq!(out, expected);
+        assert_eq!(out.len(), message_bytes(clipboard_data(5000)));
+    }
+
+    /// The largest push is 2,105,412 bytes, the element QEMU 11.1.1 took and
+    /// delivered whole, measured; with the capabilities before it, the largest
+    /// transmit.
+    #[test]
+    fn the_largest_transmit_is_capabilities_and_a_whole_push() {
+        assert_eq!(message_bytes(clipboard_data(crate::MAX_TEXT)), 2_105_376);
+        assert_eq!(message_bytes(GRAB_DATA) + message_bytes(clipboard_data(crate::MAX_TEXT)), 2_105_412);
+        assert_eq!(crate::LARGEST_TRANSMIT, 2_105_448);
+        let text = vec![b'x'; crate::MAX_TEXT];
+        let out = written(|w| {
+            w.capabilities();
+            w.grab(0);
+            w.clipboard(&text);
+        });
+        assert_eq!(out.len(), crate::LARGEST_TRANSMIT);
+    }
+}
diff --git a/lib/vdagent/src/lib.rs b/lib/vdagent/src/lib.rs
new file mode 100644
index 00000000000..923198a7d29
--- /dev/null
+++ b/lib/vdagent/src/lib.rs
@@ -0,0 +1,79 @@
+//! QEMU's clipboard channel, as a guest agent speaks it: the channel's
+//! declaration, virtio-serial's control messages ([`control`]) and the spice
+//! vdagent stream ([`stream`] decodes it, [`encode`] writes it).
+//!
+//! **Every word decoded here is the host's**, written by QEMU's `qemu-vdagent`
+//! chardev through its virtio-serial device. Each is bounded before it sizes a
+//! buffer, and one that fails its bound is a refusal by name: a decode never
+//! panics and never buffers more than arrived.
+//!
+//! What it cites: *Virtual I/O Device (VIRTIO) Version 1.2*, OASIS Committee
+//! Specification 01, §5.3 for the console device and its control messages, and
+//! spice-protocol's `spice/vd_agent.h` at `499cc832` for the stream, its
+//! packed layouts and its numbers. The header leaves a `GRAB`'s serial without
+//! a meaning; what QEMU 11.1.1 does with it is the agent's to state, measured.
+
+#![no_std]
+#![forbid(unsafe_code)]
+
+extern crate alloc;
+#[cfg(test)]
+extern crate std;
+
+pub mod control;
+pub mod encode;
+pub mod stream;
+
+/// The agent's port, as `vd_agent.h:63-68` names it: what the launch names the
+/// `virtserialport` it creates.
+pub const PORT_NAME: &str = "com.redhat.spice.0";
+
+/// The virtio-serial function's `max_ports`: port 0, which nothing uses, and
+/// the agent's.
+pub const MAX_PORTS: u32 = 2;
+
+/// The agent's port id, `nr=` at the launch: the one id the launch and the
+/// agent both read, so a `PORT_NAME`'s bytes are never decoded.
+pub const PORT_ID: u32 = 1;
+
+/// How many control receive buffers the agent keeps posted: virtio-serial drops
+/// a control event that finds none.
+pub const CONTROL_BUFFERS: usize = 8;
+
+/// The longest clipboard text that crosses, in bytes: the compositor's
+/// `window::MAX_CLIPBOARD_BYTES`, which the agent asserts this equals.
+pub const MAX_TEXT: usize = 2 * 1024 * 1024;
+
+/// The largest transmit the agent makes: its capabilities, then a push of
+/// [`MAX_TEXT`] — `GRAB [serial][UTF8_TEXT]` and its `CLIPBOARD` — each message
+/// chunked at [`stream::MAX_CHUNK`].
+pub const LARGEST_TRANSMIT: usize = encode::message_bytes(encode::CAPABILITIES_DATA)
+    + encode::message_bytes(encode::GRAB_DATA)
+    + encode::message_bytes(encode::clipboard_data(MAX_TEXT));
+
+/// `vd_agent.h`'s numbers this channel uses.
+pub mod wire {
+    /// `VDP_CLIENT_PORT`, the only `VDIChunkHeader.port` the agent reads.
+    pub const CLIENT_PORT: u32 = 1;
+    /// `VD_AGENT_PROTOCOL`.
+    pub const PROTOCOL: u32 = 1;
+    /// `VDIChunkHeader`: `port` and `size`.
+    pub const CHUNK_HEADER: usize = 8;
+    /// `VDAgentMessage` up to `data`: `protocol`, `type`, `opaque`, `size`.
+    pub const MESSAGE_HEADER: usize = 20;
+
+    /// The message types.
+    pub const CLIPBOARD: u32 = 4;
+    pub const ANNOUNCE_CAPABILITIES: u32 = 6;
+    pub const GRAB: u32 = 7;
+    pub const REQUEST: u32 = 8;
+    pub const RELEASE: u32 = 9;
+
+    /// `VD_AGENT_CLIPBOARD_UTF8_TEXT`.
+    pub const UTF8_TEXT: u32 = 1;
+
+    /// The capability bits, as `VD_AGENT_SET_CAPABILITY` sets them in the
+    /// first word.
+    pub const CAP_CLIPBOARD_BY_DEMAND: u32 = 1 << 5;
+    pub const CAP_CLIPBOARD_GRAB_SERIAL: u32 = 1 << 17;
+}
diff --git a/lib/vdagent/src/stream.rs b/lib/vdagent/src/stream.rs
new file mode 100644
index 00000000000..ed1e22b3d08
--- /dev/null
+++ b/lib/vdagent/src/stream.rs
@@ -0,0 +1,484 @@
+//! The host's vdagent stream, decoded as a stream: a `VDIChunkHeader {port,
+//! size}` frames each run of a `VDAgentMessage {protocol, type, opaque, size}`
+//! and its data, and a header can straddle two receive buffers.
+//!
+//! **Only a chunk past [`MAX_CHUNK`] ends the decode** ([`Unframed`]): no byte
+//! after it can be placed. Everything else is refused by name and the next
+//! message still decodes ([`Refusal`]): a chunk for another port is skipped, a
+//! message of another protocol, past [`MAX_DATA`], of a type the agent does not
+//! take or of a size its type does not have is refused at its header, and its
+//! data counted off unread.
+//!
+//! **What is buffered grows with the bytes that arrive**, at most to twice
+//! them and never past the size the header declares.
+//!
+//! Each type's size is its layout in `vd_agent.h` without the selection prefix,
+//! which the agent never announces: QEMU 11.1.1 writes the prefix only to a
+//! guest that announced `CLIPBOARD_SELECTION`, measured.
+
+use alloc::vec::Vec;
+
+use toyos_untrusted::Untrusted;
+
+use crate::wire;
+
+/// `VD_AGENT_MAX_DATA_SIZE`: the most one chunk carries.
+pub const MAX_CHUNK: usize = 2048;
+
+/// The most data a message may carry: a `CLIPBOARD`'s type and
+/// [`crate::MAX_TEXT`] of text.
+pub const MAX_DATA: usize = 4 + crate::MAX_TEXT;
+
+/// The most types a `GRAB` may offer.
+pub const MAX_GRAB_TYPES: usize = 16;
+
+/// One message the host sent.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Message {
+    /// `ANNOUNCE_CAPABILITIES`: whether the host asks for the agent's, and its
+    /// first word of capability bits.
+    Capabilities { request: bool, caps: u32 },
+    /// `GRAB [serial][types]`.
+    Grab { serial: u32, types: Vec<u32> },
+    /// `REQUEST [type]`.
+    Request { kind: u32 },
+    /// `CLIPBOARD [type, data]`.
+    Clipboard { kind: u32, data: Vec<u8> },
+    /// `RELEASE []`.
+    Release,
+}
+
+/// A part of the stream that is not a message, passed over.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Refusal {
+    /// A chunk for a port other than `VDP_CLIENT_PORT`, skipped.
+    OtherPort { port: u32 },
+    /// A message whose `protocol` is not `VD_AGENT_PROTOCOL`.
+    Protocol { protocol: u32 },
+    /// A message declaring more than [`MAX_DATA`], counted off unread.
+    TooLarge { kind: u32, size: u32 },
+    /// A message whose size is not one its type has.
+    Size { kind: u32, size: u32 },
+    /// A message of a type the agent does not take.
+    Kind { kind: u32 },
+}
+
+impl core::fmt::Display for Refusal {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::OtherPort { port } => write!(f, "a chunk for port {port}, skipped"),
+            Self::Protocol { protocol } => write!(f, "a message of protocol {protocol}, counted off"),
+            Self::TooLarge { kind, size } => {
+                write!(f, "a type {kind} message of {size} bytes, past {MAX_DATA}, counted off unread")
+            }
+            Self::Size { kind, size } => write!(f, "a type {kind} message of {size} bytes, no size its type has"),
+            Self::Kind { kind } => write!(f, "a message of type {kind}, which this agent does not take"),
+        }
+    }
+}
+
+/// A chunk declared past [`MAX_CHUNK`]: no byte after it can be placed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Unframed {
+    pub size: u32,
+}
+
+impl core::fmt::Display for Unframed {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        write!(f, "a chunk of {} bytes, past {MAX_CHUNK}, leaves the stream unframed", self.size)
+    }
+}
+
+/// A type the agent takes, its size judged against its layout.
+#[derive(Clone, Copy)]
+enum Kind {
+    Capabilities,
+    Grab,
+    Request,
+    Clipboard,
+    Release,
+}
+
+/// Where the decode stands in the current message.
+enum Body {
+    /// Its header, `filled` bytes of it.
+    Header { filled: usize },
+    /// Its data, kept: `left` bytes still to come.
+    Keep { kind: Kind, data: Vec<u8>, left: usize },
+    /// Its data, counted off: `left` bytes still to come.
+    Skip { left: usize },
+}
+
+/// The stream's decoder.
+pub struct Decoder {
+    chunk: [u8; wire::CHUNK_HEADER],
+    /// Bytes of the chunk header read, while a header is being read.
+    chunk_filled: usize,
+    /// Bytes of the current chunk still to come, and whether it is the
+    /// client port's.
+    chunk_left: usize,
+    ours: bool,
+    header: [u8; wire::MESSAGE_HEADER],
+    body: Body,
+}
+
+impl Default for Decoder {
+    fn default() -> Self {
+        Self {
+            chunk: [0; wire::CHUNK_HEADER],
+            chunk_filled: 0,
+            chunk_left: 0,
+            ours: false,
+            header: [0; wire::MESSAGE_HEADER],
+            body: Body::Header { filled: 0 },
+        }
+    }
+}
+
+impl Decoder {
+    /// Decode `bytes`, the next the host sent, handing each message or
+    /// refusal to `each` in order.
+    pub fn feed(&mut self, mut bytes: &[u8], mut each: impl FnMut(Result<Message, Refusal>)) -> Result<(), Unframed> {
+        while !bytes.is_empty() {
+            if self.chunk_left == 0 {
+                let take = (wire::CHUNK_HEADER - self.chunk_filled).min(bytes.len());
+                self.chunk[self.chunk_filled..self.chunk_filled + take].copy_from_slice(&bytes[..take]);
+                self.chunk_filled += take;
+                bytes = &bytes[take..];
+                if self.chunk_filled < wire::CHUNK_HEADER {
+                    break;
+                }
+                self.chunk_filled = 0;
+                let port = word(&self.chunk, 0);
+                let size = word(&self.chunk, 4);
+                self.chunk_left = Untrusted::new(size)
+                    .at_most(MAX_CHUNK as u64)
+                    .map_err(|_| Unframed { size })? as usize;
+                self.ours = port == wire::CLIENT_PORT;
+                if !self.ours {
+                    each(Err(Refusal::OtherPort { port }));
+                }
+                continue;
+            }
+            let take = self.chunk_left.min(bytes.len());
+            if self.ours {
+                self.message_bytes(&bytes[..take], &mut each);
+            }
+            self.chunk_left -= take;
+            bytes = &bytes[take..];
+        }
+        Ok(())
+    }
+
+    /// The client port's chunk payload: the next of the current message.
+    fn message_bytes(&mut self, mut bytes: &[u8], each: &mut impl FnMut(Result<Message, Refusal>)) {
+        while !bytes.is_empty() {
+            match &mut self.body {
+                Body::Header { filled } => {
+                    let take = (wire::MESSAGE_HEADER - *filled).min(bytes.len());
+                    self.header[*filled..*filled + take].copy_from_slice(&bytes[..take]);
+                    *filled += take;
+                    bytes = &bytes[take..];
+                    if *filled == wire::MESSAGE_HEADER {
+                        self.body = self.begin(each);
+                        if let Body::Keep { left: 0, .. } = self.body {
+                            self.finish(each);
+                        }
+                    }
+                }
+                Body::Keep { data, left, .. } => {
+                    let take = (*left).min(bytes.len());
+                    // Doubling, as `Vec` grows, but never past what is declared.
+                    if data.capacity() - data.len() < take {
+                        let want = (data.len() * 2).max(data.len() + take).min(data.len() + *left);
+                        data.reserve_exact(want - data.len());
+                    }
+                    data.extend_from_slice(&bytes[..take]);
+                    *left -= take;
+                    bytes = &bytes[take..];
+                    if *left == 0 {
+                        self.finish(each);
+                    }
+                }
+                Body::Skip { left } => {
+                    let take = (*left).min(bytes.len());
+                    *left -= take;
+                    bytes = &bytes[take..];
+                    if *left == 0 {
+                        self.body = Body::Header { filled: 0 };
+                    }
+                }
+            }
+        }
+    }
+
+    /// A whole message header is in: what its data is to be. Every refusal is
+    /// made here, and the data of a refused message is counted off unread.
+    fn begin(&self, each: &mut impl FnMut(Result<Message, Refusal>)) -> Body {
+        let protocol = word(&self.header, 0);
+        let kind = word(&self.header, 4);
+        let size = word(&self.header, 16);
+        match admit(protocol, kind, size) {
+            Ok(kind) => Body::Keep { kind, data: Vec::new(), left: size as usize },
+            Err(refusal) => {
+                each(Err(refusal));
+                Body::Skip { left: size as usize }
+            }
+        }
+    }
+
+    /// The current message is whole: decode it, and start the next.
+    fn finish(&mut self, each: &mut impl FnMut(Result<Message, Refusal>)) {
+        let Body::Keep { kind, data, .. } = core::mem::replace(&mut self.body, Body::Header { filled: 0 }) else {
+            unreachable!("a message is finished only while its data is kept")
+        };
+        each(Ok(message(kind, data)));
+    }
+}
+
+/// The type of a message of `protocol` declaring `size` bytes, where the agent
+/// takes it and `size` is one its layout has.
+fn admit(protocol: u32, kind: u32, size: u32) -> Result<Kind, Refusal> {
+    if protocol != wire::PROTOCOL {
+        return Err(Refusal::Protocol { protocol });
+    }
+    if Untrusted::new(size).at_most(MAX_DATA as u64).is_err() {
+        return Err(Refusal::TooLarge { kind, size });
+    }
+    let len = size as usize;
+    let (admitted, fits) = match kind {
+        wire::ANNOUNCE_CAPABILITIES => (Kind::Capabilities, len >= 8),
+        wire::GRAB => (Kind::Grab, len >= 4 && len.is_multiple_of(4) && (len - 4) / 4 <= MAX_GRAB_TYPES),
+        wire::REQUEST => (Kind::Request, len == 4),
+        wire::CLIPBOARD => (Kind::Clipboard, len >= 4),
+        wire::RELEASE => (Kind::Release, len == 0),
+        kind => return Err(Refusal::Kind { kind }),
+    };
+    match fits {
+        true => Ok(admitted),
+        false => Err(Refusal::Size { kind, size }),
+    }
+}
+
+/// A whole message's data, whose size [`admit`] held to its type's layout.
+fn message(kind: Kind, data: Vec<u8>) -> Message {
+    match kind {
+        Kind::Capabilities => Message::Capabilities { request: word(&data, 0) != 0, caps: word(&data, 4) },
+        Kind::Grab => Message::Grab {
+            serial: word(&data, 0),
+            types: data[4..].as_chunks::<4>().0.iter().map(|t| u32::from_le_bytes(*t)).collect(),
+        },
+        Kind::Request => Message::Request { kind: word(&data, 0) },
+        Kind::Clipboard => {
+            let clip = word(&data, 0);
+            let mut data = data;
+            data.drain(..4);
+            Message::Clipboard { kind: clip, data }
+        }
+        Kind::Release => Message::Release,
+    }
+}
+
+/// The little-endian `u32` at `at`, which the caller has bounded.
+fn word(bytes: &[u8], at: usize) -> u32 {
+    u32::from_le_bytes([bytes[at], bytes[at + 1], bytes[at + 2], bytes[at + 3]])
+}
+
+#[cfg(test)]
+mod tests {
+    use std::vec;
+    use std::vec::Vec;
+
+    use super::*;
+
+    /// One chunk of `port` carrying `payload`.
+    fn chunk(port: u32, payload: &[u8]) -> Vec<u8> {
+        let mut out = Vec::new();
+        out.extend_from_slice(&port.to_le_bytes());
+        out.extend_from_slice(&(payload.len() as u32).to_le_bytes());
+        out.extend_from_slice(payload);
+        out
+    }
+
+    /// A message header and its data, declaring `size`.
+    fn message_with(protocol: u32, kind: u32, size: u32, data: &[u8]) -> Vec<u8> {
+        let mut out = Vec::new();
+        out.extend_from_slice(&protocol.to_le_bytes());
+        out.extend_from_slice(&kind.to_le_bytes());
+        out.extend_from_slice(&0u64.to_le_bytes());
+        out.extend_from_slice(&size.to_le_bytes());
+        out.extend_from_slice(data);
+        out
+    }
+
+    /// A message the host sends, chunked as QEMU 11.1.1 chunks it: 1024 bytes
+    /// of message at most per chunk, measured.
+    fn host(kind: u32, data: &[u8]) -> Vec<u8> {
+        message_with(1, kind, data.len() as u32, data).chunks(1024).flat_map(|c| chunk(1, c)).collect()
+    }
+
+    fn words(words: &[u32]) -> Vec<u8> {
+        words.iter().flat_map(|w| w.to_le_bytes()).collect()
+    }
+
+    fn decode(bytes: &[u8]) -> (Vec<Result<Message, Refusal>>, Result<(), Unframed>) {
+        let mut out = Vec::new();
+        let end = Decoder::default().feed(bytes, |m| out.push(m));
+        (out, end)
+    }
+
+    fn grab(serial: u32) -> Message {
+        Message::Grab { serial, types: vec![wire::UTF8_TEXT] }
+    }
+
+    /// Every message type, and a text that spans many chunks.
+    fn valid_stream() -> (Vec<u8>, Vec<Result<Message, Refusal>>) {
+        let text: Vec<u8> = (0..5000u32).map(|i| b'a' + (i % 26) as u8).collect();
+        let mut clipboard = words(&[wire::UTF8_TEXT]);
+        clipboard.extend_from_slice(&text);
+        let mut bytes = host(wire::ANNOUNCE_CAPABILITIES, &words(&[1, 0x0002_0060]));
+        bytes.extend(host(wire::GRAB, &words(&[3, wire::UTF8_TEXT])));
+        bytes.extend(host(wire::REQUEST, &words(&[wire::UTF8_TEXT])));
+        bytes.extend(host(wire::CLIPBOARD, &clipboard));
+        bytes.extend(host(wire::RELEASE, &[]));
+        let expected = vec![
+            Ok(Message::Capabilities { request: true, caps: 0x0002_0060 }),
+            Ok(grab(3)),
+            Ok(Message::Request { kind: wire::UTF8_TEXT }),
+            Ok(Message::Clipboard { kind: wire::UTF8_TEXT, data: text }),
+            Ok(Message::Release),
+        ];
+        (bytes, expected)
+    }
+
+    /// A chunk or message header straddling two receive buffers decodes as
+    /// though it had arrived whole, wherever the cut falls.
+    #[test]
+    fn a_valid_stream_decodes_the_same_at_every_split_point() {
+        let (bytes, expected) = valid_stream();
+        assert_eq!(decode(&bytes), (expected.clone(), Ok(())));
+        for cut in 0..=bytes.len() {
+            let mut out = Vec::new();
+            let mut decoder = Decoder::default();
+            decoder.feed(&bytes[..cut], |m| out.push(m)).unwrap();
+            decoder.feed(&bytes[cut..], |m| out.push(m)).unwrap();
+            assert_eq!(out, expected, "cut at {cut}");
+        }
+    }
+
+    #[test]
+    fn a_chunk_over_2048_leaves_the_stream_unframed() {
+        let mut bytes = chunk(1, &[0; 2048]);
+        bytes.extend_from_slice(&1u32.to_le_bytes());
+        bytes.extend_from_slice(&2049u32.to_le_bytes());
+        assert_eq!(decode(&bytes).1, Err(Unframed { size: 2049 }));
+    }
+
+    #[test]
+    fn a_chunk_for_another_port_is_skipped() {
+        let mut bytes = chunk(2, &host(wire::RELEASE, &[]));
+        bytes.extend(host(wire::RELEASE, &[]));
+        assert_eq!(decode(&bytes), (vec![Err(Refusal::OtherPort { port: 2 }), Ok(Message::Release)], Ok(())));
+    }
+
+    #[test]
+    fn another_protocol_is_refused_and_counted_off() {
+        let mut bytes = chunk(1, &message_with(2, wire::REQUEST, 4, &words(&[1])));
+        bytes.extend(host(wire::RELEASE, &[]));
+        assert_eq!(decode(&bytes), (vec![Err(Refusal::Protocol { protocol: 2 }), Ok(Message::Release)], Ok(())));
+    }
+
+    /// A message declaring one byte past the bound is refused at its header,
+    /// its data counted off as it arrives, and the message after it decodes.
+    #[test]
+    fn a_declared_size_past_the_bound_is_counted_off_and_the_next_message_decodes() {
+        let size = MAX_DATA as u32 + 1;
+        let message: Vec<u8> = message_with(1, wire::CLIPBOARD, size, &vec![7; size as usize]);
+        let mut bytes: Vec<u8> = message.chunks(MAX_CHUNK).flat_map(|c| chunk(1, c)).collect();
+        bytes.extend(host(wire::REQUEST, &words(&[wire::UTF8_TEXT])));
+        let mut out = Vec::new();
+        let mut decoder = Decoder::default();
+        decoder.feed(&bytes, |m| out.push(m)).unwrap();
+        assert_eq!(
+            out,
+            vec![
+                Err(Refusal::TooLarge { kind: wire::CLIPBOARD, size }),
+                Ok(Message::Request { kind: wire::UTF8_TEXT })
+            ]
+        );
+        let Body::Header { filled: 0 } = decoder.body else { panic!("the decoder kept a body") };
+    }
+
+    /// The largest message the bound admits decodes whole.
+    #[test]
+    fn a_message_at_the_bound_decodes() {
+        let mut data = words(&[wire::UTF8_TEXT]);
+        data.extend(vec![b'x'; crate::MAX_TEXT]);
+        let (out, end) = decode(&host(wire::CLIPBOARD, &data));
+        assert_eq!(end, Ok(()));
+        assert_eq!(out, vec![Ok(Message::Clipboard { kind: wire::UTF8_TEXT, data: vec![b'x'; crate::MAX_TEXT] })]);
+    }
+
+    #[test]
+    fn each_type_is_held_to_its_size() {
+        for (kind, data) in [
+            (wire::REQUEST, words(&[1, 1])),
+            (wire::REQUEST, vec![1, 0]),
+            (wire::RELEASE, words(&[0])),
+            (wire::ANNOUNCE_CAPABILITIES, words(&[1])),
+            (wire::GRAB, vec![]),
+            (wire::GRAB, vec![0, 0, 0, 0, 1]),
+            (wire::GRAB, words(&[0; 18])),
+            (wire::CLIPBOARD, vec![1, 0, 0]),
+        ] {
+            let size = data.len() as u32;
+            assert_eq!(decode(&host(kind, &data)).0, vec![Err(Refusal::Size { kind, size })], "type {kind}");
+        }
+        assert_eq!(
+            decode(&host(wire::GRAB, &words(&[0; 17]))).0,
+            vec![Ok(Message::Grab { serial: 0, types: vec![0; 16] })]
+        );
+        assert_eq!(decode(&host(wire::GRAB, &words(&[5]))).0, vec![Ok(Message::Grab { serial: 5, types: vec![] })]);
+    }
+
+    /// Only the header has arrived: a message the agent would refuse is named
+    /// before any of its data is buffered.
+    #[test]
+    fn a_refusal_is_named_at_its_header_before_its_data_arrives() {
+        for (protocol, kind, size, refusal) in [
+            (2, wire::REQUEST, 4, Refusal::Protocol { protocol: 2 }),
+            (1, wire::REQUEST, 1000, Refusal::Size { kind: wire::REQUEST, size: 1000 }),
+            (1, wire::RELEASE, 1000, Refusal::Size { kind: wire::RELEASE, size: 1000 }),
+            (1, wire::GRAB, 1000, Refusal::Size { kind: wire::GRAB, size: 1000 }),
+            (1, 1, 1000, Refusal::Kind { kind: 1 }),
+        ] {
+            let header = message_with(protocol, kind, size, &[]);
+            // A chunk declaring the whole message, of which only the header came.
+            let mut bytes = words(&[1, header.len() as u32 + size]);
+            bytes.extend(header);
+            assert_eq!(decode(&bytes), (vec![Err(refusal)], Ok(())), "type {kind}");
+        }
+    }
+
+    /// A message fed as QEMU 11.1.1 chunks it keeps no more than it declares:
+    /// one whose second chunk outgrows twice the first, and the largest the
+    /// bound admits.
+    #[test]
+    fn a_kept_message_buffers_no_more_than_it_declares() {
+        for text in [2048, crate::MAX_TEXT] {
+            let mut data = words(&[wire::UTF8_TEXT]);
+            data.extend(vec![b'x'; text]);
+            let declared = data.len();
+            let (out, _) = decode(&host(wire::CLIPBOARD, &data));
+            let [Ok(Message::Clipboard { data, .. })] = out.as_slice() else { panic!("{} messages", out.len()) };
+            assert!(data.capacity() <= declared, "{} bytes held for {declared} declared", data.capacity());
+        }
+    }
+
+    #[test]
+    fn an_unknown_type_is_refused() {
+        let mut bytes = host(1, &[0; 12]);
+        bytes.extend(host(wire::RELEASE, &[]));
+        assert_eq!(decode(&bytes), (vec![Err(Refusal::Kind { kind: 1 }), Ok(Message::Release)], Ok(())));
+    }
+}
diff --git a/sdk/window/src/lib.rs b/sdk/window/src/lib.rs
index c011b367909..4dbc8e83ad6 100644
--- a/sdk/window/src/lib.rs
+++ b/sdk/window/src/lib.rs
@@ -1,6 +1,7 @@
 mod arch;
 pub mod framebuffer;
 pub mod wait;
+pub mod watcher;
 
 pub use framebuffer::{Color, Framebuffer, Screen};
 pub use wait::{Waiter, Waker, Woke};
@@ -84,6 +85,15 @@ pub const MSG_COPY_COMMIT: u32 = 14;
 /// Compositor → client, bare: a region the compositor made, as long as the copy
 /// [`MSG_COPY_BEGIN`] announced, sent ahead of the frame.
 pub const MSG_COPY_REGION: u32 = 13;
+/// Watcher → compositor, bare: the first frame on the clipboard port, and the
+/// ask for the next copy ([`watcher`]). Answered, once a client has copied,
+/// with the clipboard in the paste's two encodings, [`MSG_CLIPBOARD_PASTE`] or
+/// [`MSG_CLIPBOARD_PASTE_SHM`], empty included.
+pub const MSG_CLIPBOARD_WATCH: u32 = 15;
+/// Compositor → watcher, bare: the answer to its [`MSG_CLIPBOARD_SET`] or its
+/// [`MSG_COPY_COMMIT`], whether or not the set landed. A watcher has one set
+/// in flight until it is answered.
+pub const MSG_CLIPBOARD_SET_ANSWERED: u32 = 14;
 
 /// The longest clipboard. Policy: a clipboard is text somebody selected.
 pub const MAX_CLIPBOARD_BYTES: usize = 2 * 1024 * 1024;
diff --git a/sdk/window/src/watcher.rs b/sdk/window/src/watcher.rs
new file mode 100644
index 00000000000..dde9ed7c5ac
--- /dev/null
+++ b/sdk/window/src/watcher.rs
@@ -0,0 +1,170 @@
+//! The clipboard's watcher, as its one holder reaches it: every copy made in
+//! the session, and sets of its own.
+//!
+//! **It never blocks.** Every send is a `try_send`, and each answer the
+//! compositor makes — a copy, a region for a set — arrives on the connection
+//! for the holder's own poller ([`Watcher::conn`]) to report.
+//!
+//! **One notification outstanding.** [`MSG_CLIPBOARD_WATCH`] asks for the
+//! next copy, and the watcher asks again only once [`Watcher::poll`] has
+//! handed the last one out.
+//!
+//! **One set in flight**, from [`Watcher::set`] until [`Watched::Answered`]:
+//! the holder keeps what it sets next until then, so its sets never fill the
+//! compositor's pipe. A set lands only while the watcher's ask is outstanding,
+//! which the compositor judges: one made before this end saw a client copy
+//! already in its pipe is refused, and the client's copy stays.
+
+use toyos::endow;
+use toyos::ipc::{FrameRx, RxStep, TrySendError};
+use toyos::shm::SharedMemory;
+use toyos::Connection;
+
+use crate::{
+    copy_fits, ClipboardShmMsg, CreateError, MAX_CLIPBOARD_BYTES, MAX_INLINE_PAYLOAD, MSG_CLIPBOARD_PASTE,
+    MSG_CLIPBOARD_PASTE_SHM, MSG_CLIPBOARD_SET, MSG_CLIPBOARD_SET_ANSWERED, MSG_CLIPBOARD_WATCH, MSG_COPY_BEGIN, MSG_COPY_COMMIT,
+    MSG_COPY_REGION,
+};
+
+/// Why the watch cannot go on.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum WatchError {
+    /// The exchange with the compositor failed.
+    Compositor(CreateError),
+    /// The compositor will not take another frame: it is not reading.
+    NotReading,
+    /// A copy the compositor sent that is not UTF-8.
+    NotText,
+    /// A copy the compositor sent of more than [`MAX_CLIPBOARD_BYTES`].
+    TooLong(usize),
+}
+
+impl std::fmt::Display for WatchError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Compositor(e) => e.fmt(f),
+            Self::NotReading => write!(f, "the compositor takes no more frames from the watcher"),
+            Self::NotText => write!(f, "the compositor sent a copy that is not UTF-8"),
+            Self::TooLong(len) => write!(f, "the compositor sent a copy of {len} bytes, past {MAX_CLIPBOARD_BYTES}"),
+        }
+    }
+}
+
+impl std::error::Error for WatchError {}
+
+impl From<CreateError> for WatchError {
+    fn from(e: CreateError) -> Self {
+        Self::Compositor(e)
+    }
+}
+
+impl From<TrySendError> for WatchError {
+    fn from(e: TrySendError) -> Self {
+        match e {
+            TrySendError::Full => Self::NotReading,
+            TrySendError::Syscall(e) => Self::Compositor(CreateError::Kernel(e)),
+            TrySendError::TooLarge => unreachable!("every frame the watcher sends is within ipc::MAX_FRAME_LEN"),
+        }
+    }
+}
+
+/// What one [`Watcher::poll`] read.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Watched {
+    /// Nothing whole is there yet.
+    Idle,
+    /// A client's copy, empty included: the clipboard, and the next copy is
+    /// asked for.
+    Copy(String),
+    /// The region for the set in flight, written and committed.
+    Committed,
+    /// The set in flight is answered: the next may go.
+    Answered,
+}
+
+/// The clipboard's watcher.
+pub struct Watcher {
+    conn: Connection,
+    rx: FrameRx<{ MAX_INLINE_PAYLOAD + 1 }>,
+    /// A set past [`MAX_INLINE_PAYLOAD`] waiting for its region.
+    region_owed: Option<String>,
+    /// A set is in flight, unanswered.
+    in_flight: bool,
+}
+
+impl Watcher {
+    /// Watch the clipboard through the compositor's port named `port` in this
+    /// program's namespace.
+    pub fn connect(port: &str) -> Result<Self, WatchError> {
+        let conn = endow::service(port).map_err(CreateError::from)?;
+        conn.try_signal(MSG_CLIPBOARD_WATCH)?;
+        Ok(Self { conn, rx: FrameRx::new(), region_owed: None, in_flight: false })
+    }
+
+    /// The connection, for a poller: readable means [`Self::poll`] has a frame
+    /// to read.
+    pub fn conn(&self) -> &Connection {
+        &self.conn
+    }
+
+    /// Read what the compositor sent, one frame at most.
+    pub fn poll(&mut self) -> Result<Watched, WatchError> {
+        let (msg_type, len) = match self.rx.pump(&self.conn) {
+            RxStep::Idle => return Ok(Watched::Idle),
+            RxStep::Eof => return Err(CreateError::CompositorGone.into()),
+            RxStep::Malformed => return Err(CreateError::BrokenOff.into()),
+            RxStep::Frame { msg_type, payload_len } => (msg_type, payload_len),
+        };
+        let payload = self.rx.payload(len);
+        match msg_type {
+            MSG_CLIPBOARD_PASTE if len <= MAX_INLINE_PAYLOAD => {
+                let text = String::from_utf8(payload.to_vec()).map_err(|_| WatchError::NotText)?;
+                self.conn.try_signal(MSG_CLIPBOARD_WATCH)?;
+                Ok(Watched::Copy(text))
+            }
+            MSG_CLIPBOARD_PASTE_SHM => {
+                let info = toyos::ipc::decode_payload::<ClipboardShmMsg>(payload)
+                    .map_err(|_| CreateError::Protocol(msg_type))?;
+                let len = info.len as usize;
+                if !copy_fits(len) {
+                    return Err(WatchError::TooLong(len));
+                }
+                let [region] = self.conn.recv_handles_exact::<1>().ok_or(CreateError::NoHandle)?;
+                let region = SharedMemory::lent(region, len).map_err(CreateError::Lent)?;
+                let text = String::from_utf8(region.as_slice().to_vec()).map_err(|_| WatchError::NotText)?;
+                self.conn.try_signal(MSG_CLIPBOARD_WATCH)?;
+                Ok(Watched::Copy(text))
+            }
+            MSG_COPY_REGION if len == 0 => {
+                let text = self.region_owed.take().ok_or(CreateError::Protocol(msg_type))?;
+                let [region] = self.conn.recv_handles_exact::<1>().ok_or(CreateError::NoHandle)?;
+                let mut region = SharedMemory::lent(region, text.len()).map_err(CreateError::Lent)?;
+                region.as_mut_slice().copy_from_slice(text.as_bytes());
+                self.conn.try_signal(MSG_COPY_COMMIT)?;
+                Ok(Watched::Committed)
+            }
+            MSG_CLIPBOARD_SET_ANSWERED if len == 0 && self.in_flight && self.region_owed.is_none() => {
+                self.in_flight = false;
+                Ok(Watched::Answered)
+            }
+            other => Err(CreateError::Protocol(other).into()),
+        }
+    }
+
+    /// Set the clipboard to `text`, empty included.
+    ///
+    /// # Panics
+    /// `text` longer than [`MAX_CLIPBOARD_BYTES`], or a set already in flight:
+    /// the caller bounds both.
+    pub fn set(&mut self, text: String) -> Result<(), WatchError> {
+        assert!(text.len() <= MAX_CLIPBOARD_BYTES, "window: a set of {} bytes", text.len());
+        assert!(!self.in_flight, "window: a set while one is in flight");
+        self.in_flight = true;
+        if text.len() <= MAX_INLINE_PAYLOAD {
+            return Ok(self.conn.try_send_bytes(MSG_CLIPBOARD_SET, text.as_bytes())?);
+        }
+        self.conn.try_send(MSG_COPY_BEGIN, &ClipboardShmMsg { len: text.len() as u32 })?;
+        self.region_owed = Some(text);
+        Ok(())
+    }
+}
diff --git a/system/compositor/desktop/src/budget.rs b/system/compositor/desktop/src/budget.rs
index 5a37dcb73ea..65480304409 100644
--- a/system/compositor/desktop/src/budget.rs
+++ b/system/compositor/desktop/src/budget.rs
@@ -78,16 +78,27 @@ pub fn create_verdict(requested: (u32, u32), screen: Rect, level: Level, clients
     Verdict::Allow
 }
 
-/// Whether a connection just accepted may wait for its first frame, off
-/// `prompt` or off the clients' port, beside the ones already `waiting` (each
-/// `true` for one off `prompt`): **one off `prompt` has a slot of its own**,
-/// and the clients' share `max`, so no client filling the table keeps the
-/// prompt from being made.
-pub fn pending_admits(prompt: bool, waiting: impl IntoIterator<Item = bool>, max: usize) -> bool {
+/// Which of the compositor's ports a connection came in on.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Port {
+    /// `compositor`, the clients'.
+    Compositor,
+    /// `prompt`, the layer above every window.
+    Prompt,
+    /// `clipboard`, its watcher's.
+    Clipboard,
+}
+
+/// Whether a connection just accepted off `port` may wait for its first frame,
+/// beside the ones already `waiting`: **one off `prompt` and one off
+/// `clipboard` each have a slot of their own**, and the clients' share `max`,
+/// so no client filling the table keeps the prompt from being made or the
+/// clipboard from being watched.
+pub fn pending_admits(port: Port, waiting: impl IntoIterator<Item = Port>, max: usize) -> bool {
     let mut waiting = waiting.into_iter();
-    match prompt {
-        true => !waiting.any(|p| p),
-        false => waiting.filter(|p| !p).count() < max,
+    match port {
+        Port::Compositor => waiting.filter(|p| *p == Port::Compositor).count() < max,
+        own => !waiting.any(|p| p == own),
     }
 }
 
@@ -153,10 +164,19 @@ mod tests {
         }
         assert_eq!(create_verdict((600, 400), HD, Level::Prompt, 10, 10), Verdict::Allow);
         assert_eq!(create_verdict((1921, 400), HD, Level::Prompt, 0, 10), Verdict::TooLarge);
-        let full = [false; 32];
-        assert!(!pending_admits(false, full, 32));
-        assert!(pending_admits(true, full, 32));
-        assert!(!pending_admits(true, full.iter().copied().chain([true]), 32));
-        assert!(pending_admits(false, [true; 1].into_iter().chain([false; 31]), 32));
+        let full = [Port::Compositor; 32];
+        assert!(!pending_admits(Port::Compositor, full, 32));
+        assert!(pending_admits(Port::Prompt, full, 32));
+        assert!(!pending_admits(Port::Prompt, full.iter().copied().chain([Port::Prompt]), 32));
+        assert!(pending_admits(Port::Compositor, [Port::Prompt].into_iter().chain([Port::Compositor; 31]), 32));
+    }
+
+    /// The clipboard's watcher waits in a slot of its own, as the prompt does.
+    #[test]
+    fn the_watcher_is_admitted_past_every_client_ceiling() {
+        let full = [Port::Compositor; 32];
+        assert!(pending_admits(Port::Clipboard, full.iter().copied().chain([Port::Prompt]), 32));
+        assert!(!pending_admits(Port::Clipboard, full.iter().copied().chain([Port::Clipboard]), 32));
+        assert!(pending_admits(Port::Compositor, [Port::Clipboard].into_iter().chain([Port::Compositor; 31]), 32));
     }
 }
diff --git a/system/compositor/desktop/src/clipboard.rs b/system/compositor/desktop/src/clipboard.rs
new file mode 100644
index 00000000000..e1d2831a6b2
--- /dev/null
+++ b/system/compositor/desktop/src/clipboard.rs
@@ -0,0 +1,215 @@
+//! The clipboard's watcher: what it is sent, and which of its sets land.
+//!
+//! **One notification outstanding.** The watcher asks for the next copy, and
+//! a client's copy made while it has asked is sent to it at once; one made
+//! before is sent at its next ask, a copy made before any watcher came
+//! included. Only the latest unsent copy goes, so a client copying in a loop
+//! moves one and never fills the watcher's pipe.
+//!
+//! **A watcher's set lands only while its ask is outstanding**: the ask and the
+//! set travel on one ordered connection, so an outstanding ask means the
+//! watcher had been sent every client copy before its set. An inline set is
+//! judged at its frame; a set through a region lands only if the ask was
+//! outstanding when the region was opened and no copy was sent since. A set
+//! that crossed a delivery is refused, and the client's copy stays the
+//! clipboard.
+//!
+//! **A watcher's set is never sent back to it.**
+
+/// Whether a watcher's set lands.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Landing {
+    Lands,
+    /// It was made before the watcher saw a client copy now in its pipe.
+    Stale,
+}
+
+/// The watcher's ask, the copy it has not been sent, and the region of a set
+/// it is writing (`R`, opaque here) with whether that set can still land.
+///
+/// It lives as long as the compositor: a copy made while no watcher is there
+/// is the next one's.
+pub struct Watch<R> {
+    asked: bool,
+    unsent: bool,
+    region: Option<(R, Landing)>,
+}
+
+impl<R> Default for Watch<R> {
+    fn default() -> Self {
+        Self { asked: false, unsent: false, region: None }
+    }
+}
+
+impl<R> Watch<R> {
+    /// The watcher asks for the next copy. Answers whether the clipboard is to
+    /// be sent to it now.
+    pub fn ask(&mut self) -> bool {
+        self.asked = true;
+        self.deliver()
+    }
+
+    /// A client's copy landed. Answers whether the clipboard is to be sent to
+    /// the watcher now.
+    pub fn client_set(&mut self) -> bool {
+        self.unsent = true;
+        self.deliver()
+    }
+
+    fn deliver(&mut self) -> bool {
+        let now = self.asked && self.unsent;
+        if now {
+            self.asked = false;
+            self.unsent = false;
+            if let Some((_, landing)) = &mut self.region {
+                *landing = Landing::Stale;
+            }
+        }
+        now
+    }
+
+    /// The watcher's set, inline.
+    pub fn set(&self) -> Landing {
+        match self.asked {
+            true => Landing::Lands,
+            false => Landing::Stale,
+        }
+    }
+
+    /// The watcher opens `region` for a set; `Err` gives it back where one is
+    /// already open, which is out of protocol.
+    pub fn begin(&mut self, region: R) -> Result<(), R> {
+        match self.region {
+            Some(_) => Err(region),
+            None => {
+                self.region = Some((region, self.set()));
+                Ok(())
+            }
+        }
+    }
+
+    /// The watcher's set in the open region: the region, and whether what it
+    /// holds lands. `None` where none is open, which is out of protocol.
+    pub fn commit(&mut self) -> Option<(R, Landing)> {
+        self.region.take()
+    }
+
+    /// The watcher is gone: its ask and its region go with it, and a copy it
+    /// was not sent is the next watcher's.
+    pub fn leave(&mut self) {
+        self.asked = false;
+        self.region = None;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn watch() -> Watch<()> {
+        Watch::default()
+    }
+
+    #[test]
+    fn a_bridge_set_is_never_sent_back() {
+        let mut w = watch();
+        assert!(!w.ask());
+        assert_eq!(w.set(), Landing::Lands);
+        assert!(!w.ask(), "the watcher's own set was sent back to it");
+    }
+
+    #[test]
+    fn a_client_set_is_sent_once_asked() {
+        let mut w = watch();
+        assert!(!w.client_set());
+        assert!(w.ask());
+        assert!(!w.ask(), "one copy was sent twice");
+        assert!(w.client_set());
+    }
+
+    #[test]
+    fn only_the_latest_of_two_client_sets_is_sent() {
+        let mut w = watch();
+        assert!(!w.client_set());
+        assert!(!w.client_set());
+        assert!(w.ask());
+        assert!(!w.ask());
+    }
+
+    #[test]
+    fn nothing_is_sent_unasked() {
+        let mut w = watch();
+        w.ask();
+        assert!(w.client_set());
+        assert!(!w.client_set(), "a copy was sent to a watcher that had not asked again");
+    }
+
+    /// The watcher set its text before it saw a client copy that is now in its
+    /// pipe: the client's copy stays.
+    #[test]
+    fn a_bridge_set_made_before_a_delivery_was_seen_is_refused() {
+        let mut w = watch();
+        w.ask();
+        assert!(w.client_set());
+        assert_eq!(w.set(), Landing::Stale);
+    }
+
+    #[test]
+    fn a_delivery_between_begin_and_commit_refuses_the_commit() {
+        let mut w = watch();
+        w.ask();
+        w.begin(()).expect("no region was open");
+        assert!(w.client_set());
+        assert_eq!(w.commit(), Some(((), Landing::Stale)));
+        w.ask();
+        w.begin(()).expect("the commit closed the region");
+        assert_eq!(w.commit(), Some(((), Landing::Lands)));
+    }
+
+    /// The watcher opened its region after a delivery it had not yet read, and
+    /// asked again before the commit: the ask at the commit is the one that
+    /// followed the delivery, and the text was chosen before it.
+    #[test]
+    fn a_region_opened_after_a_delivery_refuses_the_commit_after_the_next_ask() {
+        let mut w = watch();
+        w.ask();
+        assert!(w.client_set());
+        w.begin(()).expect("no region was open");
+        w.ask();
+        assert_eq!(w.commit(), Some(((), Landing::Stale)));
+    }
+
+    /// A copy made while no watcher watches, before the first or after one
+    /// left, is sent at the next watcher's first ask.
+    #[test]
+    fn a_copy_made_while_nobody_watched_is_sent_at_the_next_ask() {
+        let mut w = watch();
+        // A watcher leaves with its ask outstanding, and a client copies.
+        w.ask();
+        w.leave();
+        assert!(!w.client_set(), "a copy was sent to a watcher that had left");
+        assert!(w.ask(), "the copy made while nobody watched was not sent");
+        // A client copies after a delivery, and the watcher leaves before it
+        // asks again.
+        assert!(!w.client_set());
+        w.leave();
+        assert!(w.ask(), "the copy the last watcher was not sent went with it");
+    }
+
+    #[test]
+    fn a_region_is_opened_once_and_committed_once() {
+        let mut w: Watch<u8> = Watch::default();
+        assert_eq!(w.begin(1), Ok(()));
+        assert_eq!(w.begin(2), Err(2));
+        assert_eq!(w.commit().map(|(r, _)| r), Some(1));
+        assert_eq!(w.commit(), None);
+    }
+
+    #[test]
+    fn a_watcher_that_leaves_takes_its_region() {
+        let mut w: Watch<u8> = Watch::default();
+        w.begin(1).expect("no region was open");
+        w.leave();
+        assert_eq!(w.commit(), None);
+    }
+}
diff --git a/system/compositor/desktop/src/lib.rs b/system/compositor/desktop/src/lib.rs
index 0874ce50676..8c9edf6a224 100644
--- a/system/compositor/desktop/src/lib.rs
+++ b/system/compositor/desktop/src/lib.rs
@@ -1,8 +1,9 @@
 //! Everything the desktop decides, as pure functions over pure state.
 //!
 //! Where a window is, what changed since the last frame, what the pointer is
-//! over, who has the keyboard, what a key means, what is visible inside a
-//! damaged region and which pixels of a client's buffer reach the screen. No
+//! over, who has the keyboard, what a key means, what the clipboard's watcher
+//! is sent, what is visible inside a damaged region and which pixels of a
+//! client's buffer reach the screen. No
 //! I/O, no drawing, no shared memory, no connections — those are the
 //! compositor's, and it is the only caller.
 //!
@@ -22,6 +23,7 @@
 extern crate alloc;
 
 pub mod budget;
+pub mod clipboard;
 pub mod damage;
 pub mod hit;
 pub mod input;
@@ -32,7 +34,7 @@ pub mod stack;
 pub mod taskbar;
 pub mod window;
 
-pub use budget::{create_verdict, max_windows, pending_admits, window_bytes, Verdict};
+pub use budget::{create_verdict, max_windows, pending_admits, window_bytes, Port, Verdict};
 pub use damage::{Damage, MAX_DAMAGE_RECTS};
 pub use hit::{hit_test, Hit};
 pub use input::{
diff --git a/system/compositor/src/client.rs b/system/compositor/src/client.rs
index 2f958eda58e..80cdee257bb 100644
--- a/system/compositor/src/client.rs
+++ b/system/compositor/src/client.rs
@@ -21,7 +21,7 @@ use toyos::shm::SharedMemory;
 use toyos::{ipc, AsHandle, Connection, OwnedHandle};
 use toyos_abi::syscall::SyscallError;
 use toyos_abi::RawHandle;
-use toyos_desktop::Window;
+use toyos_desktop::{Port, Window};
 
 /// Connections accepted but not yet identified by a first frame.
 ///
@@ -82,8 +82,8 @@ pub struct ClientFrame {
     pub conn: Option<Connection>,
     /// The connection's [`PendingConn::copy`].
     pub copy: Option<CopyRegion>,
-    /// The connection's [`PendingConn::prompt`].
-    pub prompt: bool,
+    /// The connection's [`PendingConn::port`].
+    pub port: Port,
 }
 
 impl ClientFrame {
@@ -95,7 +95,7 @@ impl ClientFrame {
             payload_len: 0,
             conn: None,
             copy: None,
-            prompt: false,
+            port: Port::Compositor,
         }
     }
 
@@ -118,9 +118,10 @@ pub struct PendingConn {
     pub conn: Connection,
     pub rx: ClientRx,
     pub since: Instant,
-    /// It came in on the prompt port, whose one holder's window goes above every
-    /// other: its first frame may only ask for that window.
-    pub prompt: bool,
+    /// The port it came in on. A connection off the prompt port, whose one
+    /// holder's window goes above every other, may only ask for that window
+    /// with its first frame; one off the clipboard port may only ask to watch.
+    pub port: Port,
     /// The region a `MSG_COPY_BEGIN` was answered with. A connection holding
     /// one may send `MSG_COPY_COMMIT` and nothing else, within
     /// [`HANDSHAKE_TIMEOUT`] of `since`.
@@ -145,6 +146,12 @@ impl CopyRegion {
     }
 }
 
+/// The clipboard's watcher: its connection.
+pub struct Watcher {
+    pub conn: Connection,
+    pub rx: ClientRx,
+}
+
 /// Why a client is going.
 ///
 /// **Every one of these is printed, named by the connection's handle.** A
diff --git a/system/compositor/src/main.rs b/system/compositor/src/main.rs
index 4aedb0063a0..c709f1a1996 100644
--- a/system/compositor/src/main.rs
+++ b/system/compositor/src/main.rs
@@ -47,20 +47,25 @@ pub const FIXED_POLL_HANDLES: u32 = 4;
 /// Hard ceiling on live client windows, from the poller rather than from memory.
 ///
 /// Every window's handle is registered in the same batch as the four fixed
-/// ones, the pending connections and the prompt's two, and [`Poller::MAX_HANDLES`] is the widest set
-/// one poller can carry. Unlike the memory budget this does not move when the
+/// ones, the pending connections, the prompt's two and the clipboard's two,
+/// and [`Poller::MAX_HANDLES`] is the widest set one poller can carry. Unlike the memory budget this does not move when the
 /// resolution does, which is why the poller is sized from it:
 /// `MSG_SET_RESOLUTION` can make windows cheaper mid-run, and a poller sized
 /// for the old screen would then be too small. At any resolution this machine
 /// can actually scan out, the memory budget is far below this and is what
 /// binds.
-pub const MAX_WINDOW_SLOTS: u32 = Poller::MAX_HANDLES - FIXED_POLL_HANDLES - MAX_PENDING_CONNS - PROMPT_POLL_HANDLES;
+pub const MAX_WINDOW_SLOTS: u32 =
+    Poller::MAX_HANDLES - FIXED_POLL_HANDLES - MAX_PENDING_CONNS - PROMPT_POLL_HANDLES - CLIPBOARD_POLL_HANDLES;
 
 /// The prompt's own: its connection waiting for its first frame, and its
 /// window, which no client's ceiling counts (`toyos_desktop::pending_admits`,
 /// `toyos_desktop::create_verdict`).
 pub const PROMPT_POLL_HANDLES: u32 = 2;
 
+/// The clipboard's own: its port's acceptor, and its one connection, waiting
+/// for its first frame or watching (`toyos_desktop::clipboard`).
+pub const CLIPBOARD_POLL_HANDLES: u32 = 2;
+
 /// What the launcher offers before `/apps` is read: the label it shows and the
 /// program it starts.
 pub const BUILT_IN_APPS: &[(&str, &str)] =
diff --git a/system/compositor/src/session.rs b/system/compositor/src/session.rs
index 05e14e7981d..c2f69aef256 100644
--- a/system/compositor/src/session.rs
+++ b/system/compositor/src/session.rs
@@ -6,6 +6,8 @@
 //! devices, draining the client connections without ever blocking on one,
 //! allocating and granting the shared buffers, and handing finished rectangles
 //! to the panel.
+//!
+//! **No clipboard byte is ever logged**: a refusal names a length and a client.
 
 use std::process::Command;
 use std::sync::mpsc;
@@ -20,22 +22,23 @@ use toyos::shm::SharedMemory;
 use toyos::{ipc, system, AsHandle, FramebufferDev, Keyboard, Mouse};
 use toyos_abi::syscall::DeviceType;
 use toyos_abi::RawHandle;
+use toyos_desktop::clipboard::{Landing, Watch};
 use toyos_desktop::{
     cursor_from_abs, cursor_style, fold_mouse, hit_test, key_action, set_mode, tab_action, Chrome,
-    CursorStyle, Damage, Desk, Grab, Held, Hit, KeyAction, Level, Point, PromptGate, Rect, Released,
-    Stack, TabAction, Verdict, Window, WindowId, WindowMode,
+    CursorStyle, Damage, Desk, Grab, Held, Hit, KeyAction, Level, Point, Port, PromptGate, Rect,
+    Released, Stack, TabAction, Verdict, Window, WindowId, WindowMode,
 };
 use window::Screen;
 
 use crate::client::{
     announce, deliver, deliver_signal, deliver_with_handle, mark_dead, note_closed, note_opened,
-    Client, ClientFrame, ClientRx, CopyRegion, Dead, DropReason, PendingConn, Win,
+    Client, ClientFrame, ClientRx, CopyRegion, Dead, DropReason, PendingConn, Watcher, Win,
     HANDSHAKE_TIMEOUT, MAX_KEPT_PAYLOAD, MAX_PENDING_CONNS,
 };
 use crate::render::{self, Assets, BackBuffer, SystemStats, TitleBarIcons};
 use crate::stats::FrameTotals;
 use crate::{
-    launcher_apps, DOUBLE_CLICK_TIME, DRAIN_BUDGET, FIXED_POLL_HANDLES,
+    launcher_apps, CLIPBOARD_POLL_HANDLES, DOUBLE_CLICK_TIME, DRAIN_BUDGET, FIXED_POLL_HANDLES,
     FLAG_HARDWARE_CURSOR, FRAME_INTERVAL, MAX_WINDOW_SLOTS, PROMPT_POLL_HANDLES,
 };
 
@@ -100,6 +103,13 @@ pub struct Session {
     /// The last prompt's gate once it is gone: the releases of what it was
     /// given, which no other window saw the press of.
     owed: PromptGate,
+    /// The clipboard's port ([`toyos_manifest::clipboard::PORT`]), which one
+    /// program alone holds: its one connection is sent every copy.
+    clipboards: Acceptor,
+    watcher: Option<Watcher>,
+    /// What the watcher has asked and is sent, for the compositor's whole life:
+    /// a copy made while no watcher is there is the next one's.
+    watch: Watch<CopyRegion>,
     /// Where a launch is made: off the loop, since the supervisor answers one
     /// whose package asks a question only once the question is answered,
     /// through this loop.
@@ -166,6 +176,8 @@ impl Session {
             .expect("the manifest declares this program serves `compositor`");
         let prompts = endow::acceptor(toyos_manifest::consent::PROMPT)
             .expect("the manifest declares this program serves `prompt`");
+        let clipboards = endow::acceptor(toyos_manifest::clipboard::PORT)
+            .expect("the manifest declares this program serves `clipboard`");
         let kb: Keyboard = endow::device(DeviceType::Keyboard)
             .expect("the manifest gives this program the keyboard");
         let mouse: Mouse = endow::device(DeviceType::Mouse)
@@ -238,14 +250,17 @@ impl Session {
 
         // Sized for the slot ceiling rather than for `max_windows`: the batch
         // between two `wait` calls is the four fixed registrations, one per
-        // live window
-        // and one per pending connection, the prompt's two beside them, and
-        // `MSG_SET_RESOLUTION` can raise `max_windows` mid-run.
-        let poller = Poller::new(FIXED_POLL_HANDLES + MAX_WINDOW_SLOTS + MAX_PENDING_CONNS + PROMPT_POLL_HANDLES);
+        // live window and one per pending connection, the prompt's two and the
+        // clipboard's two beside them, and `MSG_SET_RESOLUTION` can raise
+        // `max_windows` mid-run.
+        let poller = Poller::new(
+            FIXED_POLL_HANDLES + MAX_WINDOW_SLOTS + MAX_PENDING_CONNS + PROMPT_POLL_HANDLES + CLIPBOARD_POLL_HANDLES,
+        );
         poller.watch(&kb, READABLE, kb.as_handle().0 as u64);
         poller.watch(&mouse, READABLE, mouse.as_handle().0 as u64);
         poller.watch(&acceptor, READABLE, acceptor.as_handle().0 as u64);
         poller.watch(&prompts, READABLE, prompts.as_handle().0 as u64);
+        poller.watch(&clipboards, READABLE, clipboards.as_handle().0 as u64);
 
         let cursor = Point { x: desk.screen.w() / 2, y: desk.screen.h() / 2 };
         if hw_cursor {
@@ -264,6 +279,9 @@ impl Session {
             prompts,
             prompt: None,
             owed: PromptGate::default(),
+            clipboards,
+            watcher: None,
+            watch: Watch::default(),
             launcher,
             kb,
             mouse,
@@ -342,8 +360,10 @@ impl Session {
         let mouse_ready = self.is_ready(self.mouse.as_handle());
         let accept_ready = self.is_ready(self.acceptor.as_handle());
         let prompt_ready = self.is_ready(self.prompts.as_handle());
+        let clipboard_ready = self.is_ready(self.clipboards.as_handle());
         let client_ready = self.stack.iter().any(|w| self.is_ready(w.client.conn.as_handle()))
-            || self.pending.iter().any(|p| self.is_ready(p.conn.as_handle()));
+            || self.pending.iter().any(|p| self.is_ready(p.conn.as_handle()))
+            || self.watcher.as_ref().is_some_and(|w| self.is_ready(w.conn.as_handle()));
 
         // A handshake that never completes is the reason this deadline exists,
         // and the sweep has to happen on a pass that found nothing ready too —
@@ -359,7 +379,7 @@ impl Session {
         }
         self.pending.retain(|p| now.duration_since(p.since) < HANDSHAKE_TIMEOUT);
 
-        if !kb_ready && !mouse_ready && !accept_ready && !prompt_ready && !client_ready {
+        if !kb_ready && !mouse_ready && !accept_ready && !prompt_ready && !clipboard_ready && !client_ready {
             return false;
         }
 
@@ -371,16 +391,20 @@ impl Session {
             self.pointer();
         }
         if accept_ready {
-            self.accept(false);
+            self.accept(Port::Compositor);
         }
         if prompt_ready {
-            self.accept(true);
+            self.accept(Port::Prompt);
+        }
+        if clipboard_ready {
+            self.accept(Port::Clipboard);
         }
         let frames = self.take_frames();
         self.dispatch(frames);
+        self.watched();
         self.reap();
         self.prompt_gone();
-        self.rearm(kb_ready, mouse_ready, accept_ready, prompt_ready);
+        self.rearm(kb_ready, mouse_ready, accept_ready, prompt_ready, clipboard_ready);
         true
     }
 
@@ -683,24 +707,34 @@ impl Session {
         }
     }
 
-    /// One connection off `compositor`, or off `prompt` where `prompt`.
-    fn accept(&mut self, prompt: bool) {
+    /// One connection off `port`.
+    fn accept(&mut self, port: Port) {
         // `accept` installs a descriptor, so it answers `ResourceExhausted` on
         // a full handle table — and clients drive that table, one handle per
         // connection. The connection is lost either way; the desktop is not.
-        let acceptor = if prompt { &self.prompts } else { &self.acceptor };
+        let acceptor = match port {
+            Port::Compositor => &self.acceptor,
+            Port::Prompt => &self.prompts,
+            Port::Clipboard => &self.clipboards,
+        };
         match acceptor.accept() {
             Err(e) => eprintln!("compositor: a connection could not be accepted ({e:?})"),
+            Ok(_) if port == Port::Clipboard && self.watcher.is_some() => {
+                eprintln!("compositor: refusing a clipboard watcher's connection — one is watching");
+            }
             Ok(conn)
                 if !toyos_desktop::pending_admits(
-                    prompt,
-                    self.pending.iter().map(|p| p.prompt),
+                    port,
+                    self.pending.iter().map(|p| p.port),
                     MAX_PENDING_CONNS as usize,
                 ) =>
             {
-                match prompt {
-                    true => eprintln!("compositor: refusing a prompt's connection — another is waiting"),
-                    false => eprintln!(
+                match port {
+                    Port::Prompt => eprintln!("compositor: refusing a prompt's connection — another is waiting"),
+                    Port::Clipboard => {
+                        eprintln!("compositor: refusing a clipboard watcher's connection — another is waiting")
+                    }
+                    Port::Compositor => eprintln!(
                         "compositor: refusing client {} — {MAX_PENDING_CONNS} connections are already \
                          waiting to say what they want",
                         conn.as_handle().0
@@ -714,7 +748,7 @@ impl Session {
                     rx: ClientRx::new(),
                     since: Instant::now(),
                     copy: None,
-                    prompt,
+                    port,
                 });
             }
         }
@@ -758,7 +792,7 @@ impl Session {
                     let p = self.pending.remove(i);
                     frame.conn = Some(p.conn);
                     frame.copy = p.copy;
-                    frame.prompt = p.prompt;
+                    frame.port = p.port;
                     out.push(frame);
                     break;
                 }
@@ -815,10 +849,17 @@ impl Session {
                 }
                 (None, _) => {}
             }
-            // A connection on the prompt port is for its window and nothing else.
-            if frame.prompt && frame.msg_type != window::MSG_CREATE_WINDOW {
-                mark_dead(&mut self.dead, handle, DropReason::OutOfProtocol);
-                continue;
+            match (frame.port, frame.msg_type) {
+                // A connection on the prompt port is for its window and nothing else.
+                (Port::Prompt, window::MSG_CREATE_WINDOW) | (Port::Compositor, _) => {}
+                (Port::Clipboard, window::MSG_CLIPBOARD_WATCH) if frame.payload().is_empty() => {
+                    self.watch_begins(frame);
+                    continue;
+                }
+                (Port::Prompt | Port::Clipboard, _) => {
+                    mark_dead(&mut self.dead, handle, DropReason::OutOfProtocol);
+                    continue;
+                }
             }
             match frame.msg_type {
                 window::MSG_CREATE_WINDOW => self.create_window(frame),
@@ -843,7 +884,7 @@ impl Session {
                         self.damage_all();
                     }
                 }
-                window::MSG_CLIPBOARD_SET => self.set_clipboard(handle, frame.payload().to_vec()),
+                window::MSG_CLIPBOARD_SET => self.client_copy(handle, frame.payload().to_vec()),
                 window::MSG_RETIRED_CLIPBOARD_SET_SHM => {
                     mark_dead(&mut self.dead, handle, DropReason::Retired);
                 }
@@ -911,10 +952,10 @@ impl Session {
             return;
         };
 
-        let level = match (frame.prompt, req.flags & window::WINDOW_FLAG_TOPMOST != 0) {
-            (true, _) => Level::Prompt,
-            (false, true) => Level::Topmost,
-            (false, false) => Level::Ordinary,
+        let level = match (frame.port, req.flags & window::WINDOW_FLAG_TOPMOST != 0) {
+            (Port::Prompt, _) => Level::Prompt,
+            (_, true) => Level::Topmost,
+            (_, false) => Level::Ordinary,
         };
         // One prompt at a time: the prompt layer is full.
         if !self.stack.admits(level) {
@@ -1090,7 +1131,7 @@ impl Session {
             rx: ClientRx::new(),
             since: Instant::now(),
             copy: Some(CopyRegion::new(region)),
-            prompt: false,
+            port: Port::Compositor,
         });
     }
 
@@ -1101,20 +1142,148 @@ impl Session {
             mark_dead(&mut self.dead, frame.handle, DropReason::OutOfProtocol);
             return;
         }
-        self.set_clipboard(frame.handle, region.take());
+        self.client_copy(frame.handle, region.take());
     }
 
-    /// The clipboard, from bytes that are the compositor's own: validated
-    /// only once no client can change them.
-    fn set_clipboard(&mut self, from: RawHandle, bytes: Vec<u8>) {
-        match String::from_utf8(bytes) {
-            Ok(text) => self.clipboard = text,
-            Err(e) => eprintln!(
-                "compositor: refusing a clipboard from client {} — it is not UTF-8 ({})",
-                from.0,
-                e.utf8_error()
+    /// A client's copy: the clipboard, and the watcher's next delivery.
+    fn client_copy(&mut self, from: RawHandle, bytes: Vec<u8>) {
+        let Some(text) = text(from, bytes) else { return };
+        self.clipboard = text;
+        if self.watch.client_set() {
+            self.deliver_clipboard();
+        }
+    }
+
+    /// `MSG_CLIPBOARD_WATCH` as the first frame off the clipboard port: the
+    /// connection is the watcher, and has asked.
+    fn watch_begins(&mut self, frame: ClientFrame) {
+        let Some(conn) = frame.conn else {
+            mark_dead(&mut self.dead, frame.handle, DropReason::OutOfProtocol);
+            return;
+        };
+        self.poller.watch(&conn, READABLE, frame.handle.0 as u64);
+        println!("compositor: the clipboard is watched by client {}", frame.handle.0);
+        self.watcher = Some(Watcher { conn, rx: ClientRx::new() });
+        self.watcher_asks();
+    }
+
+    /// One frame off the watcher's connection, if it sent a whole one.
+    fn watched(&mut self) {
+        let Some(w) = self.watcher.as_mut() else { return };
+        let handle = w.conn.as_handle();
+        if !self.ready.contains(&(handle.0 as u64)) {
+            return;
+        }
+        let (msg_type, len) = match w.rx.pump(&w.conn) {
+            RxStep::Idle => return,
+            RxStep::Eof => return mark_dead(&mut self.dead, handle, DropReason::Gone),
+            RxStep::Malformed => return mark_dead(&mut self.dead, handle, DropReason::OutOfProtocol),
+            RxStep::Frame { msg_type, payload_len } => (msg_type, payload_len),
+        };
+        if len >= MAX_KEPT_PAYLOAD {
+            return mark_dead(&mut self.dead, handle, DropReason::OutOfProtocol);
+        }
+        let payload = w.rx.payload(len).to_vec();
+        match msg_type {
+            window::MSG_CLIPBOARD_WATCH if payload.is_empty() => self.watcher_asks(),
+            window::MSG_CLIPBOARD_SET => {
+                let landing = self.watch.set();
+                self.watcher_sets(handle, landing, payload);
+            }
+            window::MSG_COPY_BEGIN => self.watcher_begins(handle, &payload),
+            window::MSG_COPY_COMMIT if payload.is_empty() => {
+                let Some((region, landing)) = self.watch.commit() else {
+                    return mark_dead(&mut self.dead, handle, DropReason::OutOfProtocol);
+                };
+                self.watcher_sets(handle, landing, region.take());
+            }
+            _ => mark_dead(&mut self.dead, handle, DropReason::OutOfProtocol),
+        }
+    }
+
+    fn watcher_asks(&mut self) {
+        if self.watch.ask() {
+            self.deliver_clipboard();
+        }
+    }
+
+    /// The watcher's set: it lands only where `toyos_desktop::clipboard` says,
+    /// and is answered whether or not it did, so the watcher has one in flight.
+    fn watcher_sets(&mut self, from: RawHandle, landing: Landing, bytes: Vec<u8>) {
+        match (landing, text(from, bytes)) {
+            (_, None) => {}
+            (Landing::Lands, Some(text)) => self.clipboard = text,
+            (Landing::Stale, Some(text)) => eprintln!(
+                "compositor: refusing a clipboard of {} bytes from the watcher, client {} — it was \
+                 made before the watcher saw the copy now in its pipe",
+                text.len(),
+                from.0
             ),
         }
+        let w = self.watcher.as_ref().expect("a set is read only off the watcher");
+        if let Err(e) = w.conn.try_signal(window::MSG_CLIPBOARD_SET_ANSWERED) {
+            mark_dead(&mut self.dead, from, e.into());
+        }
+    }
+
+    /// `MSG_COPY_BEGIN` from the watcher: the region its set goes into, held
+    /// until its commit.
+    fn watcher_begins(&mut self, from: RawHandle, payload: &[u8]) {
+        let exact = payload.len() == std::mem::size_of::<window::ClipboardShmMsg>();
+        let (Ok(info), true) = (ipc::decode_payload::<window::ClipboardShmMsg>(payload), exact) else {
+            return mark_dead(&mut self.dead, from, DropReason::OutOfProtocol);
+        };
+        let len = info.len as usize;
+        if !window::copy_fits(len) {
+            return mark_dead(&mut self.dead, from, DropReason::OutOfProtocol);
+        }
+        let (region, theirs) = match SharedMemory::create(len).and_then(|r| r.share().map(|h| (r, h))) {
+            Ok(made) => made,
+            Err(e) => {
+                eprintln!("compositor: the watcher gets no region — no memory for {len} bytes ({e:?})");
+                return mark_dead(&mut self.dead, from, DropReason::Refused(e));
+            }
+        };
+        if self.watch.begin(CopyRegion::new(region)).is_err() {
+            return mark_dead(&mut self.dead, from, DropReason::OutOfProtocol);
+        }
+        let w = self.watcher.as_ref().expect("a region is opened only off the watcher");
+        if let Err(e) = w.conn.send_handles([theirs]) {
+            return mark_dead(&mut self.dead, from, e.into());
+        }
+        if let Err(e) = w.conn.try_signal(window::MSG_COPY_REGION) {
+            mark_dead(&mut self.dead, from, e.into());
+        }
+    }
+
+    /// Send the watcher the clipboard, in the paste's two encodings, empty
+    /// included. A refused send drops it by name.
+    fn deliver_clipboard(&mut self) {
+        let w = self.watcher.as_ref().expect("an ask is outstanding only while a watcher watches");
+        let handle = w.conn.as_handle();
+        let len = self.clipboard.len();
+        let sent = if len <= window::MAX_INLINE_PAYLOAD {
+            w.conn.try_send_bytes(window::MSG_CLIPBOARD_PASTE, self.clipboard.as_bytes()).map_err(DropReason::from)
+        } else {
+            match SharedMemory::create(len).and_then(|mut r| {
+                r.as_mut_slice()[..len].copy_from_slice(self.clipboard.as_bytes());
+                r.share()
+            }) {
+                Ok(theirs) => w
+                    .conn
+                    .send_handles([theirs])
+                    .map_err(DropReason::from)
+                    .and_then(|()| {
+                        w.conn
+                            .try_send(window::MSG_CLIPBOARD_PASTE_SHM, &window::ClipboardShmMsg { len: len as u32 })
+                            .map_err(DropReason::from)
+                    }),
+                Err(e) => Err(DropReason::Refused(e)),
+            }
+        };
+        if let Err(reason) = sent {
+            mark_dead(&mut self.dead, handle, reason);
+        }
     }
 
     fn answer_resolution(&mut self, handle: RawHandle) {
@@ -1199,6 +1368,10 @@ impl Session {
         let dead = std::mem::take(&mut self.dead);
         self.stack.retain(|w| !dead.iter().any(|(handle, _)| *handle == w.client.conn.as_handle()));
         self.pending.retain(|p| !dead.iter().any(|(handle, _)| *handle == p.conn.as_handle()));
+        if self.watcher.as_ref().is_some_and(|w| dead.iter().any(|(handle, _)| *handle == w.conn.as_handle())) {
+            self.watcher = None;
+            self.watch.leave();
+        }
         self.dead = dead;
         if self.stack.len() != before {
             for rect in vacated {
@@ -1209,10 +1382,19 @@ impl Session {
     }
 
     /// Re-arm the one-shot poll registrations for every handle that fired.
-    fn rearm(&mut self, kb: bool, mouse: bool, acceptor: bool, prompts: bool) {
+    fn rearm(&mut self, kb: bool, mouse: bool, acceptor: bool, prompts: bool, clipboards: bool) {
         if prompts {
             self.poller.watch(&self.prompts, READABLE, self.prompts.as_handle().0 as u64);
         }
+        if clipboards {
+            self.poller.watch(&self.clipboards, READABLE, self.clipboards.as_handle().0 as u64);
+        }
+        if let Some(w) = &self.watcher {
+            let handle = w.conn.as_handle();
+            if self.is_ready(handle) {
+                self.poller.watch(&w.conn, READABLE, handle.0 as u64);
+            }
+        }
         if kb {
             self.poller.watch(&self.kb, READABLE, self.kb.as_handle().0 as u64);
         }
@@ -1471,6 +1653,20 @@ impl Session {
     }
 }
 
+/// Bytes a client sent as clipboard text, validated only once no client can
+/// change them.
+fn text(from: RawHandle, bytes: Vec<u8>) -> Option<String> {
+    String::from_utf8(bytes)
+        .map_err(|e| {
+            eprintln!(
+                "compositor: refusing a clipboard from client {} — it is not UTF-8 ({})",
+                from.0,
+                e.utf8_error()
+            )
+        })
+        .ok()
+}
+
 /// The thread every launch is made on, and the channel to it: one at a time,
 /// in order, since a launch waits as long as its question does.
 fn launcher() -> mpsc::Sender<String> {
diff --git a/system/vdagent/Cargo.toml b/system/vdagent/Cargo.toml
new file mode 100644
index 00000000000..a0e3f50a109
--- /dev/null
+++ b/system/vdagent/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "vdagent"
+description = "The shared clipboard with QEMU's host: the virtio-serial function its vdagent chardev is on, claimed from the kernel and driven here, bridged to the compositor's clipboard."
+edition = "2024"
+license = "MIT OR Apache-2.0"
+
+[dependencies]
+toyos-abi = { path = "../../sdk/abi" }
+toyos = { path = "../../sdk/toyos" }
+toyos-device-memory = { path = "../../lib/device-memory" }
+toyos-virtio = { path = "../../lib/virtio" }
+toyos-pci-claim = { path = "../../lib/pci-claim" }
+toyos-vdagent = { path = "../../lib/vdagent" }
+toyos-vdagent-bridge = { path = "bridge" }
+toyos-manifest = { path = "../../lib/manifest" }
+toyos-window = { path = "../../sdk/window" }
+
+[package.metadata.toyos.host]
+exempt.owns = "the virtio-serial function QEMU's clipboard channel is on, and the compositor's clipboard port"
diff --git a/system/vdagent/bridge/Cargo.toml b/system/vdagent/bridge/Cargo.toml
new file mode 100644
index 00000000000..6aad1f518db
--- /dev/null
+++ b/system/vdagent/bridge/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "toyos-vdagent-bridge"
+description = "Every decision the clipboard agent makes between QEMU's vdagent and the compositor, pure: who owns the clipboard, the grab serials, and what each transmit owes."
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+publish = false
+
+[dependencies]
+toyos-vdagent = { path = "../../../lib/vdagent" }
+
+[lib]
+doctest = false
diff --git a/system/vdagent/bridge/src/lib.rs b/system/vdagent/bridge/src/lib.rs
new file mode 100644
index 00000000000..cbe284d93bf
--- /dev/null
+++ b/system/vdagent/bridge/src/lib.rs
@@ -0,0 +1,308 @@
+//! Every decision the clipboard agent makes between QEMU's vdagent and the
+//! compositor: who owns the clipboard, the grab serials, what each transmit
+//! owes, and when a set goes to the compositor ([`sets`]). Pure, and
+//! host-tested.
+//!
+//! **Every statement here about what QEMU does is QEMU 11.1.1's behaviour,
+//! measured black-box** against its `qemu-vdagent` chardev with a VNC client as
+//! the host's clipboard; spice-protocol's `vd_agent.h` defines the messages and
+//! leaves a `GRAB`'s serial without a meaning. What the measurement says:
+//!
+//! - Each session starts when the guest opens its port: the host announces its
+//!   capabilities with `request` 1 and starts its serial counter *C* at 0. A
+//!   second guest announcement in one session closes the host's end.
+//! - A host `GRAB` carries *C*, and *C* then goes up by one. A guest `GRAB`
+//!   with serial *g* is kept if and only if *g* ≥ *C*, and a kept one sets
+//!   *C* := *g*; a discarded one makes the `CLIPBOARD` or `RELEASE` after it
+//!   reach the host as nothing.
+//! - A guest `REQUEST` that no grab answers is answered with `CLIPBOARD
+//!   [UTF8_TEXT]` and no data.
+//! - A kept guest `GRAB` with its `CLIPBOARD` in one element gives the host
+//!   the text: a host paste after it is served without a `REQUEST`. A guest
+//!   `GRAB` with a `RELEASE` empties the host's clipboard, and the host sends a
+//!   `RELEASE` back.
+//! - A host paste that reaches the guest as a `REQUEST` is settled by a push's
+//!   second message when it falls between the push's two, abandoned by the
+//!   host's own grab when one crosses it, and an answer after either reaches
+//!   the host as nothing.
+//!
+//! **So the bridge answers no host `REQUEST`**, and pushes every guest copy
+//! with its text: after the push the host holds the text, and no host paste
+//! waits on the guest.
+//!
+//! **Why the serial rule is right.** A crossing is a guest grab *g* and a host
+//! grab *s* in flight at once. The host's *s* is its *C*, and it then holds
+//! *C* = *s* + 1, so it keeps *g* if and only if *g* > *s*. The bridge keeps
+//! *s* if and only if *s* ≥ *g*. Exactly one side wins, and both agree which.
+//! Without a crossing, a host grab carries at least the last guest grab the
+//! host kept, so the bridge keeps it, and the bridge's next grab carries *s* +
+//! 1, the host's *C*. Both sides start each session at 0.
+//!
+//! **No clipboard byte is ever named**: a [`Named`] carries lengths and
+//! numbers only.
+
+#![no_std]
+#![forbid(unsafe_code)]
+
+extern crate alloc;
+#[cfg(test)]
+extern crate std;
+
+use alloc::string::String;
+use alloc::vec::Vec;
+
+use toyos_vdagent::encode::Writer;
+use toyos_vdagent::stream::Message;
+use toyos_vdagent::wire;
+
+pub mod sets;
+
+/// Who holds the clipboard's current text.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Owner {
+    None,
+    Host,
+    /// The guest, and its text, which is never empty.
+    Guest(String),
+}
+
+/// What an event does to the guest's clipboard, or what it says.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Effect {
+    None,
+    /// The guest's clipboard becomes this text, empty included.
+    Guest(String),
+    /// Named in the log, and nothing done.
+    Named(Named),
+}
+
+/// An event the bridge passes over, by name.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Named {
+    /// The host announced capabilities without `CLIPBOARD_BY_DEMAND` or
+    /// `CLIPBOARD_GRAB_SERIAL`: nothing flows this session.
+    HostLacks { caps: u32 },
+    /// Capabilities with `request` 0, which the host sends only in reply to a
+    /// guest asking for them, and this agent never asks.
+    Unasked,
+    /// A clipboard message outside a session that flows.
+    NoSession,
+    /// A host grab older than the guest's last.
+    GrabDiscarded { serial: u32, last: u32 },
+    /// Host clipboard data that does not become the guest's: `Owner::Host` is
+    /// not the owner, the type is not text, or the text is not UTF-8.
+    ClipboardRefused { kind: u32, len: usize },
+    /// A host `REQUEST`, which owes nothing.
+    Request { kind: u32 },
+    /// A host `RELEASE` while the host does not own the clipboard.
+    ReleaseIgnored,
+    /// A grab would carry a serial past `u32::MAX`: the session ends.
+    SerialsExhausted,
+}
+
+impl core::fmt::Display for Named {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        match self {
+            Self::HostLacks { caps } => write!(
+                f,
+                "the host's capabilities {caps:#x} lack CLIPBOARD_BY_DEMAND or CLIPBOARD_GRAB_SERIAL: \
+                 nothing flows this session"
+            ),
+            Self::Unasked => write!(f, "host capabilities with request 0, which this agent never asked for, refused"),
+            Self::NoSession => write!(f, "a clipboard message outside a session that flows, ignored"),
+            Self::GrabDiscarded { serial, last } => {
+                write!(f, "a host grab with serial {serial}, older than the guest's {last}, discarded")
+            }
+            Self::ClipboardRefused { kind, len } => write!(
+                f,
+                "host clipboard data of type {kind} and {len} bytes refused: the host does not own the \
+                 clipboard, or it is not UTF-8 text"
+            ),
+            Self::Request { kind } => write!(f, "a host request for type {kind}, which owes nothing"),
+            Self::ReleaseIgnored => write!(f, "a host release while the host does not own the clipboard, ignored"),
+            Self::SerialsExhausted => write!(f, "the grab serials passed u32::MAX: this session ends"),
+        }
+    }
+}
+
+/// A push: a guest grab with its text or with a `RELEASE`, and the serial
+/// assigned at its copy.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Push {
+    Text { serial: u32 },
+    Release { serial: u32 },
+}
+
+/// What the next transmit carries. Each kind at most once, and a `REQUEST`
+/// never with a push.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+struct Owed {
+    capabilities: bool,
+    request: bool,
+    push: Option<Push>,
+}
+
+/// Where the session stands.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Session {
+    /// The port is closed, or the host has not announced itself.
+    Closed,
+    /// The host announced itself and nothing flows until it does again.
+    Silent,
+    /// `last` is the serial of the guest's last grab in this session, and
+    /// `next` what its next grab carries; never wrapped.
+    Open { last: Option<u32>, next: u64 },
+}
+
+pub struct Bridge {
+    owner: Owner,
+    session: Session,
+    owed: Owed,
+}
+
+impl Default for Bridge {
+    fn default() -> Self {
+        Self { owner: Owner::None, session: Session::Closed, owed: Owed::default() }
+    }
+}
+
+impl Bridge {
+    pub fn owner(&self) -> &Owner {
+        &self.owner
+    }
+
+    /// Whether a transmit is owed.
+    pub fn owes(&self) -> bool {
+        self.owed != Owed::default()
+    }
+
+    /// A message the host sent.
+    pub fn host(&mut self, message: Message) -> Effect {
+        match message {
+            Message::Capabilities { request: true, caps } => self.session(caps),
+            Message::Capabilities { request: false, .. } => Effect::Named(Named::Unasked),
+            Message::Grab { serial, types } => self.host_grab(serial, &types),
+            Message::Clipboard { kind, data } => self.host_clipboard(kind, data),
+            Message::Request { kind } => Effect::Named(Named::Request { kind }),
+            Message::Release if self.owner == Owner::Host => {
+                self.owner = Owner::None;
+                Effect::Guest(String::new())
+            }
+            Message::Release => Effect::Named(Named::ReleaseIgnored),
+        }
+    }
+
+    /// A new session: the bridge answers with its capabilities once, and
+    /// pushes the guest's copy or asks for the host's text.
+    fn session(&mut self, caps: u32) -> Effect {
+        self.owed = Owed { capabilities: true, ..Owed::default() };
+        let wanted = wire::CAP_CLIPBOARD_BY_DEMAND | wire::CAP_CLIPBOARD_GRAB_SERIAL;
+        if caps & wanted != wanted {
+            self.session = Session::Silent;
+            return Effect::Named(Named::HostLacks { caps });
+        }
+        self.session = Session::Open { last: None, next: 0 };
+        match self.owner {
+            Owner::Guest(_) => self.push(false),
+            Owner::None | Owner::Host => {
+                self.owner = Owner::Host;
+                self.owed.request = true;
+                Effect::None
+            }
+        }
+    }
+
+    fn host_grab(&mut self, serial: u32, types: &[u32]) -> Effect {
+        let Session::Open { last, next } = &mut self.session else {
+            return Effect::Named(Named::NoSession);
+        };
+        if let Some(last) = *last {
+            if serial < last {
+                return Effect::Named(Named::GrabDiscarded { serial, last });
+            }
+        }
+        *next = (*next).max(serial as u64 + 1);
+        // QEMU would discard an unsent push: its serial is at most this one.
+        self.owed.push = None;
+        self.owner = Owner::Host;
+        self.owed.request = types.contains(&wire::UTF8_TEXT);
+        Effect::Guest(String::new())
+    }
+
+    fn host_clipboard(&mut self, kind: u32, data: Vec<u8>) -> Effect {
+        let len = data.len();
+        if self.owner != Owner::Host || kind != wire::UTF8_TEXT {
+            return Effect::Named(Named::ClipboardRefused { kind, len });
+        }
+        match String::from_utf8(data) {
+            Ok(text) => Effect::Guest(text),
+            Err(_) => Effect::Named(Named::ClipboardRefused { kind, len }),
+        }
+    }
+
+    /// The guest copied `text`, empty for a copy of nothing.
+    pub fn copy(&mut self, text: String) -> Effect {
+        self.owed.request = false;
+        let empty = text.is_empty();
+        self.owner = if empty { Owner::None } else { Owner::Guest(text) };
+        self.push(empty)
+    }
+
+    /// The owner's push, on the next serial, where the session flows.
+    fn push(&mut self, empty: bool) -> Effect {
+        let Session::Open { last, next } = &mut self.session else {
+            return Effect::None;
+        };
+        let Ok(serial) = u32::try_from(*next) else {
+            self.session = Session::Silent;
+            self.owed.push = None;
+            return Effect::Named(Named::SerialsExhausted);
+        };
+        *last = Some(serial);
+        *next += 1;
+        self.owed.push = Some(if empty { Push::Release { serial } } else { Push::Text { serial } });
+        Effect::None
+    }
+
+    /// The host closed its end: the serials go, the owner stays, and nothing is
+    /// owed until its next announcement.
+    pub fn closed(&mut self) {
+        self.session = Session::Closed;
+        self.owed = Owed::default();
+    }
+
+    /// Write what is owed into `out`, in order — capabilities, `REQUEST`, the
+    /// push — and owe nothing more. Answers the bytes written.
+    ///
+    /// # Panics
+    /// `out` shorter than what is owed: the caller sizes it
+    /// [`toyos_vdagent::LARGEST_TRANSMIT`].
+    pub fn transmit(&mut self, out: &mut [u8]) -> usize {
+        let owed = core::mem::take(&mut self.owed);
+        let mut writer = Writer::new(out);
+        if owed.capabilities {
+            writer.capabilities();
+        }
+        if owed.request {
+            writer.request();
+        }
+        match owed.push {
+            None => {}
+            Some(Push::Text { serial }) => {
+                let Owner::Guest(text) = &self.owner else {
+                    unreachable!("a text push is owed only while the guest owns the clipboard")
+                };
+                writer.grab(serial);
+                writer.clipboard(text.as_bytes());
+            }
+            Some(Push::Release { serial }) => {
+                writer.grab(serial);
+                writer.release();
+            }
+        }
+        writer.len()
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/system/vdagent/bridge/src/sets.rs b/system/vdagent/bridge/src/sets.rs
new file mode 100644
index 00000000000..6190d247e10
--- /dev/null
+++ b/system/vdagent/bridge/src/sets.rs
@@ -0,0 +1,78 @@
+//! The guest clipboard's sets, as the agent makes them through the
+//! compositor's watcher.
+//!
+//! **One in flight** until the compositor answers it, and only the newest
+//! behind it: a host copying at any rate never fills the compositor's pipe.
+//!
+//! **A guest copy the compositor delivers drops the set behind**: its text was
+//! taken before that copy, and sent after the watcher's next ask it would land
+//! over the copy.
+
+use alloc::string::String;
+
+#[derive(Default)]
+pub struct Sets {
+    in_flight: bool,
+    queued: Option<String>,
+}
+
+impl Sets {
+    /// The guest's clipboard is to become `text`. Answers it where it goes now.
+    pub fn set(&mut self, text: String) -> Option<String> {
+        if self.in_flight {
+            self.queued = Some(text);
+            return None;
+        }
+        self.in_flight = true;
+        Some(text)
+    }
+
+    /// The compositor answered the set in flight. Answers the next to go.
+    pub fn answered(&mut self) -> Option<String> {
+        self.in_flight = false;
+        let next = self.queued.take()?;
+        self.in_flight = true;
+        Some(next)
+    }
+
+    /// The compositor delivered a guest copy.
+    pub fn delivered(&mut self) {
+        self.queued = None;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::string::ToString;
+
+    use super::*;
+
+    #[test]
+    fn a_set_waits_for_the_answer_to_the_one_in_flight() {
+        let mut sets = Sets::default();
+        assert_eq!(sets.set("first".to_string()), Some("first".to_string()));
+        assert_eq!(sets.set("second".to_string()), None);
+        assert_eq!(sets.answered(), Some("second".to_string()));
+        assert_eq!(sets.answered(), None);
+        assert_eq!(sets.set("third".to_string()), Some("third".to_string()));
+    }
+
+    #[test]
+    fn only_the_newest_set_waits() {
+        let mut sets = Sets::default();
+        sets.set("first".to_string());
+        sets.set("second".to_string());
+        sets.set("third".to_string());
+        assert_eq!(sets.answered(), Some("third".to_string()));
+        assert_eq!(sets.answered(), None);
+    }
+
+    #[test]
+    fn a_delivered_guest_copy_drops_the_set_behind() {
+        let mut sets = Sets::default();
+        sets.set("in flight".to_string());
+        sets.set("host text".to_string());
+        sets.delivered();
+        assert_eq!(sets.answered(), None);
+    }
+}
diff --git a/system/vdagent/bridge/src/tests.rs b/system/vdagent/bridge/src/tests.rs
new file mode 100644
index 00000000000..169492e3b67
--- /dev/null
+++ b/system/vdagent/bridge/src/tests.rs
@@ -0,0 +1,295 @@
+//! One test per row of the bridge's table. The oracle for QEMU's side is its
+//! 11.1.1 behaviour, measured black-box; the transmit's bytes are read back
+//! with the codec's own decoder, whose layouts `vd_agent.h` gives.
+
+use std::string::{String, ToString};
+use std::vec;
+use std::vec::Vec;
+
+use toyos_vdagent::encode::{message_bytes, CAPABILITIES_DATA, GRAB_DATA, RELEASE_DATA, REQUEST_DATA};
+use toyos_vdagent::stream::{Decoder, Message};
+use toyos_vdagent::{wire, LARGEST_TRANSMIT, MAX_TEXT};
+
+use super::*;
+
+/// What QEMU 11.1.1 announces: `CLIPBOARD_BY_DEMAND | CLIPBOARD_SELECTION |
+/// CLIPBOARD_GRAB_SERIAL`.
+const HOST_CAPS: u32 = 0x0002_0060;
+
+fn opening() -> Message {
+    Message::Capabilities { request: true, caps: HOST_CAPS }
+}
+
+/// `GRAB [serial][UTF8_TEXT]`, either way.
+fn grab(serial: u32) -> Message {
+    Message::Grab { serial, types: vec![wire::UTF8_TEXT] }
+}
+
+/// `CLIPBOARD [UTF8_TEXT, data]`, either way.
+fn clipboard(data: &str) -> Message {
+    Message::Clipboard { kind: wire::UTF8_TEXT, data: data.as_bytes().to_vec() }
+}
+
+/// What the bridge owes, encoded into a [`LARGEST_TRANSMIT`] buffer, and its
+/// length.
+fn transmit(bridge: &mut Bridge) -> (Vec<Message>, usize) {
+    let mut out = vec![0; LARGEST_TRANSMIT];
+    let len = bridge.transmit(&mut out);
+    let mut messages = Vec::new();
+    Decoder::default()
+        .feed(&out[..len], |m| messages.push(m.expect("the bridge writes only messages the codec decodes")))
+        .expect("the bridge's transmit is framed");
+    (messages, len)
+}
+
+fn capabilities() -> Message {
+    Message::Capabilities { request: false, caps: toyos_vdagent::encode::GUEST_CAPS }
+}
+
+/// A bridge whose session is open with nothing owed and nobody owning.
+fn settled() -> Bridge {
+    let mut bridge = Bridge::default();
+    bridge.host(opening());
+    transmit(&mut bridge);
+    assert_eq!(bridge.host(clipboard("")), Effect::Guest(String::new()));
+    assert_eq!(bridge.owner(), &Owner::Host);
+    bridge
+}
+
+/// The opening asks for the host's text, and QEMU answers a request nobody
+/// grabbed with no data: that answer is the guest's clipboard.
+#[test]
+fn the_answer_to_the_opening_request_lands() {
+    let mut bridge = Bridge::default();
+    assert_eq!(bridge.host(opening()), Effect::None);
+    assert_eq!(transmit(&mut bridge).0, [capabilities(), Message::Request { kind: wire::UTF8_TEXT }]);
+    assert_eq!(bridge.host(clipboard("host text")), Effect::Guest("host text".to_string()));
+}
+
+#[test]
+fn the_opening_grabs_a_copy_made_before_the_port_opened() {
+    let mut bridge = Bridge::default();
+    assert_eq!(bridge.copy("early".to_string()), Effect::None);
+    assert!(!bridge.owes(), "a copy while the port is closed owes nothing");
+    bridge.host(opening());
+    assert_eq!(transmit(&mut bridge).0, [capabilities(), grab(0), clipboard("early")]);
+    // The session's next grab carries 1.
+    bridge.copy("later".to_string());
+    assert_eq!(transmit(&mut bridge).0, [grab(1), clipboard("later")]);
+}
+
+#[test]
+fn capabilities_are_answered_once_per_session() {
+    let mut bridge = settled();
+    assert_eq!(bridge.host(Message::Capabilities { request: false, caps: HOST_CAPS }), Effect::Named(Named::Unasked));
+    assert!(!bridge.owes(), "a host announcement without request was answered");
+}
+
+/// Refused, with no answer: QEMU 11.1.1 closes the session on a second guest
+/// announcement.
+#[test]
+fn a_host_announcement_without_request_is_refused() {
+    let mut bridge = Bridge::default();
+    assert_eq!(bridge.host(Message::Capabilities { request: false, caps: HOST_CAPS }), Effect::Named(Named::Unasked));
+    assert!(!bridge.owes());
+    assert_eq!(bridge.owner(), &Owner::None);
+}
+
+#[test]
+fn a_host_without_by_demand_or_grab_serial_gets_nothing_flowing() {
+    for caps in [HOST_CAPS & !wire::CAP_CLIPBOARD_BY_DEMAND, HOST_CAPS & !wire::CAP_CLIPBOARD_GRAB_SERIAL] {
+        let mut bridge = Bridge::default();
+        assert_eq!(bridge.host(Message::Capabilities { request: true, caps }), Effect::Named(Named::HostLacks { caps }));
+        assert_eq!(transmit(&mut bridge).0, [capabilities()]);
+        assert_eq!(bridge.copy("text".to_string()), Effect::None);
+        assert!(!bridge.owes(), "a copy flowed to a host that lacks {caps:#x}");
+        assert_eq!(bridge.host(grab(0)), Effect::Named(Named::NoSession));
+    }
+}
+
+/// The host's reply crossed a guest copy: it does not land over the guest's
+/// text.
+#[test]
+fn host_text_that_lost_to_a_guest_copy_is_refused() {
+    let mut bridge = Bridge::default();
+    bridge.host(opening());
+    transmit(&mut bridge);
+    bridge.copy("guest".to_string());
+    assert_eq!(
+        bridge.host(clipboard("host")),
+        Effect::Named(Named::ClipboardRefused { kind: wire::UTF8_TEXT, len: 4 })
+    );
+    assert_eq!(bridge.owner(), &Owner::Guest("guest".to_string()));
+}
+
+#[test]
+fn host_data_that_is_not_utf8_text_is_refused() {
+    let mut bridge = settled();
+    let png = Message::Clipboard { kind: 2, data: vec![1, 2, 3] };
+    assert_eq!(bridge.host(png), Effect::Named(Named::ClipboardRefused { kind: 2, len: 3 }));
+    let broken = Message::Clipboard { kind: wire::UTF8_TEXT, data: vec![0xff] };
+    assert_eq!(bridge.host(broken), Effect::Named(Named::ClipboardRefused { kind: wire::UTF8_TEXT, len: 1 }));
+}
+
+/// The guest's grab 1 and the host's grab 0 cross: QEMU keeps 1, since 1 ≥
+/// its counter after its own grab 0, so the bridge discards the host's.
+#[test]
+fn a_crossing_host_grab_older_than_the_guests_is_discarded() {
+    let mut bridge = settled();
+    bridge.copy("first".to_string());
+    transmit(&mut bridge);
+    bridge.copy("second".to_string());
+    assert_eq!(transmit(&mut bridge).0, [grab(1), clipboard("second")]);
+    assert_eq!(bridge.host(grab(0)), Effect::Named(Named::GrabDiscarded { serial: 0, last: 1 }));
+    assert_eq!(bridge.owner(), &Owner::Guest("second".to_string()));
+    assert!(!bridge.owes());
+}
+
+/// The guest's grab 0 and the host's grab 0 cross: QEMU discards the guest's,
+/// since 0 is below its counter after its own grab 0, so the bridge keeps the
+/// host's and both hold the host's text.
+#[test]
+fn a_crossing_host_grab_as_old_as_the_guests_is_kept() {
+    let mut bridge = settled();
+    bridge.copy("guest".to_string());
+    assert_eq!(transmit(&mut bridge).0, [grab(0), clipboard("guest")]);
+    assert_eq!(bridge.host(grab(0)), Effect::Guest(String::new()));
+    assert_eq!(bridge.owner(), &Owner::Host);
+    assert_eq!(transmit(&mut bridge).0, [Message::Request { kind: wire::UTF8_TEXT }]);
+    // The bridge's next grab carries 1, the host's counter after its grab 0.
+    bridge.copy("again".to_string());
+    assert_eq!(transmit(&mut bridge).0, [grab(1), clipboard("again")]);
+}
+
+#[test]
+fn a_host_grab_without_text_empties_the_guest_and_requests_nothing() {
+    let mut bridge = settled();
+    let png = Message::Grab { serial: 0, types: vec![2] };
+    assert_eq!(bridge.host(png), Effect::Guest(String::new()));
+    assert_eq!(bridge.owner(), &Owner::Host);
+    assert!(!bridge.owes());
+}
+
+#[test]
+fn a_guest_grab_carries_its_text_in_the_same_transmit() {
+    let mut bridge = settled();
+    bridge.copy("copied".to_string());
+    assert_eq!(transmit(&mut bridge).0, [grab(0), clipboard("copied")]);
+}
+
+/// A copy of nothing grabs and releases whoever owned before: QEMU 11.1.1
+/// empties its clipboard on a kept guest grab and its release, and an empty
+/// `CLIPBOARD` pushed instead leaves a host paste with nothing.
+#[test]
+fn an_empty_copy_grabs_and_releases_whoever_owned() {
+    for guest_owned in [false, true] {
+        let mut bridge = settled();
+        if guest_owned {
+            bridge.copy("text".to_string());
+            transmit(&mut bridge);
+        }
+        let serial = u32::from(guest_owned);
+        assert_eq!(bridge.copy(String::new()), Effect::None);
+        assert_eq!(bridge.owner(), &Owner::None);
+        assert_eq!(transmit(&mut bridge).0, [grab(serial), Message::Release]);
+    }
+}
+
+/// QEMU 11.1.1 sends a `RELEASE` back after the guest's own.
+#[test]
+fn the_release_after_our_own_is_ignored() {
+    let mut bridge = settled();
+    bridge.copy("text".to_string());
+    bridge.copy(String::new());
+    transmit(&mut bridge);
+    assert_eq!(bridge.host(Message::Release), Effect::Named(Named::ReleaseIgnored));
+    bridge.copy("again".to_string());
+    assert_eq!(bridge.host(Message::Release), Effect::Named(Named::ReleaseIgnored));
+    assert_eq!(bridge.owner(), &Owner::Guest("again".to_string()));
+}
+
+#[test]
+fn a_host_release_empties_a_host_owned_clipboard() {
+    let mut bridge = settled();
+    assert_eq!(bridge.host(Message::Release), Effect::Guest(String::new()));
+    assert_eq!(bridge.owner(), &Owner::None);
+}
+
+/// Host capabilities with nobody owning owe capabilities and a `REQUEST`; a
+/// copy of [`MAX_TEXT`] before the encode withdraws the `REQUEST`.
+#[test]
+fn a_guest_copy_withdraws_the_owed_request() {
+    let mut bridge = Bridge::default();
+    bridge.host(opening());
+    bridge.copy("x".repeat(MAX_TEXT));
+    let (messages, len) = transmit(&mut bridge);
+    assert_eq!(len, LARGEST_TRANSMIT);
+    assert_eq!(messages, [capabilities(), grab(0), clipboard(&"x".repeat(MAX_TEXT))]);
+}
+
+/// QEMU never received the guest's grab and keeps its own, so both sides hold
+/// the host's text.
+#[test]
+fn a_host_grab_kept_after_an_unsent_copy_wins_on_both_sides() {
+    let mut bridge = Bridge::default();
+    bridge.host(opening());
+    bridge.copy("x".repeat(MAX_TEXT));
+    assert_eq!(bridge.host(grab(0)), Effect::Guest(String::new()));
+    assert_eq!(bridge.owner(), &Owner::Host);
+    let (messages, len) = transmit(&mut bridge);
+    assert_eq!(messages, [capabilities(), Message::Request { kind: wire::UTF8_TEXT }]);
+    assert_eq!(len, message_bytes(CAPABILITIES_DATA) + message_bytes(REQUEST_DATA));
+}
+
+/// Every guest grab goes out with its `CLIPBOARD` or its `RELEASE`, so after it
+/// QEMU serves a host paste itself, and an answer to a host `REQUEST` reaches
+/// the host as nothing or, after two folded pastes, as stale text.
+#[test]
+fn a_host_request_owes_nothing() {
+    let mut bridge = Bridge::default();
+    bridge.copy("x".repeat(MAX_TEXT));
+    bridge.host(opening());
+    let (_, first) = transmit(&mut bridge);
+    assert_eq!(first, 2_105_448);
+    assert_eq!(bridge.host(Message::Request { kind: wire::UTF8_TEXT }), Effect::Named(Named::Request { kind: 1 }));
+    assert_eq!(transmit(&mut bridge).1, 0);
+    bridge.copy(String::new());
+    assert_eq!(transmit(&mut bridge).1, message_bytes(GRAB_DATA) + message_bytes(RELEASE_DATA));
+    assert_eq!(bridge.host(Message::Request { kind: wire::UTF8_TEXT }), Effect::Named(Named::Request { kind: 1 }));
+    assert_eq!(transmit(&mut bridge).1, 0);
+}
+
+#[test]
+fn the_hosts_close_clears_the_serials_and_keeps_the_owner() {
+    let mut bridge = settled();
+    bridge.copy("first".to_string());
+    transmit(&mut bridge);
+    bridge.copy("kept".to_string());
+    bridge.closed();
+    assert!(!bridge.owes(), "the close left a transmit owed");
+    assert_eq!(bridge.owner(), &Owner::Guest("kept".to_string()));
+    // The reopened session starts at 0, as QEMU's does.
+    bridge.host(opening());
+    assert_eq!(transmit(&mut bridge).0, [capabilities(), grab(0), clipboard("kept")]);
+}
+
+#[test]
+fn a_copy_while_the_port_is_closed_only_sets_the_owner() {
+    let mut bridge = settled();
+    bridge.closed();
+    assert_eq!(bridge.copy("closed".to_string()), Effect::None);
+    assert!(!bridge.owes());
+    assert_eq!(bridge.owner(), &Owner::Guest("closed".to_string()));
+}
+
+/// A host grab of `u32::MAX` leaves no serial for the guest's next grab, and
+/// the session ends by name rather than wrapping.
+#[test]
+fn a_session_past_the_last_serial_ends() {
+    let mut bridge = settled();
+    bridge.host(grab(u32::MAX));
+    transmit(&mut bridge);
+    assert_eq!(bridge.copy("text".to_string()), Effect::Named(Named::SerialsExhausted));
+    assert!(!bridge.owes());
+    assert_eq!(bridge.host(grab(0)), Effect::Named(Named::NoSession));
+}
diff --git a/system/vdagent/src/channel.rs b/system/vdagent/src/channel.rs
new file mode 100644
index 00000000000..15ca240ec2c
--- /dev/null
+++ b/system/vdagent/src/channel.rs
@@ -0,0 +1,321 @@
+//! The virtio-serial function QEMU's clipboard channel is on, driven here
+//! over its claim: a multiport console device (virtio 1.2 §5.3) whose port
+//! [`toyos_vdagent::PORT_ID`] carries the vdagent stream.
+//!
+//! **The transport and the rings are `toyos-virtio`'s**, over
+//! `toyos-pci-claim`'s register window and grant. What is this file's is the
+//! console device: its six queues (§5.3.2) — port 0's two, which nothing uses,
+//! the control pair and the agent's port's pair — on the one MSI-X entry the
+//! kernel programs, and which buffer goes with which head.
+//!
+//! **Every receive buffer is posted at its own head**, so a completion's head
+//! *is* the buffer it filled and nothing the device wrote is an index. **A
+//! control receive buffer is posted again as soon as it is read**, before its
+//! message is handled: QEMU 11.1.1 drops a control event that finds none
+//! posted, measured.
+//!
+//! **A used ring the device is not believed on ends this program** by the
+//! refusal's own name: every message after it is one that silently never
+//! arrives.
+
+use std::time::Instant;
+
+use toyos::shm::SharedMemory;
+use toyos::{DmaRegion, PciDev};
+use toyos_abi::syscall::SyscallError;
+use toyos_device_memory::DmaBuffers;
+use toyos_pci_claim::virtio::{negotiate, Negotiated, Refusal};
+use toyos_pci_claim::{Bar, Grant};
+use toyos_vdagent::control::{self, Control};
+use toyos_vdagent::{CONTROL_BUFFERS, LARGEST_TRANSMIT, MAX_PORTS};
+use toyos_virtio::pci::Live;
+use toyos_virtio::queue::{Buffer, Parts, Used, Virtqueue};
+
+/// §5.3.3: the device has control queues and more than one port.
+const VIRTIO_CONSOLE_F_MULTIPORT: u64 = 1 << 1;
+
+/// §5.3.4: `max_nr_ports`, after `cols` and `rows`.
+const MAX_NR_PORTS: usize = 4;
+
+/// The one MSI-X table entry the kernel programs.
+const MSIX_ENTRY: u16 = 0;
+
+/// §5.3.2: port 0's receive and transmit queues, the control pair, then a
+/// pair per further port.
+const PORT0_RX: u16 = 0;
+const PORT0_TX: u16 = 1;
+const CONTROL_RX: u16 = 2;
+const CONTROL_TX: u16 = 3;
+const PORT_RX: u16 = 4;
+const PORT_TX: u16 = 5;
+
+/// Port 0 exists and is never posted to.
+const PORT0_SIZE: u16 = 1;
+const CONTROL_RX_SIZE: u16 = CONTROL_BUFFERS as u16;
+/// The control messages the agent can have in flight at once: at most a
+/// `DEVICE_READY`, a `PORT_READY` and two `PORT_OPEN`s between two reads of
+/// the used ring.
+const CONTROL_TX_SIZE: u16 = 4;
+const PORT_RX_SIZE: u16 = 16;
+/// One transmit, of every message owed, in one element.
+const PORT_TX_SIZE: u16 = 1;
+
+/// A control buffer holds a message and a `PORT_NAME`'s name, which is not
+/// read: a longer name is cut where the buffer ends.
+const CONTROL_RX_BYTES: usize = 64;
+const PORT_RX_BYTES: usize = 4096;
+
+/// Each queue's parts, one after another on the descriptor table's alignment.
+const fn after(parts: Parts, size: u16) -> usize {
+    (parts.end(size) + 15) & !15
+}
+const Q_PORT0_RX: Parts = Parts::contiguous(0, PORT0_SIZE);
+const Q_PORT0_TX: Parts = Parts::contiguous(after(Q_PORT0_RX, PORT0_SIZE), PORT0_SIZE);
+const Q_CONTROL_RX: Parts = Parts::contiguous(after(Q_PORT0_TX, PORT0_SIZE), CONTROL_RX_SIZE);
+const Q_CONTROL_TX: Parts = Parts::contiguous(after(Q_CONTROL_RX, CONTROL_RX_SIZE), CONTROL_TX_SIZE);
+const Q_PORT_RX: Parts = Parts::contiguous(after(Q_CONTROL_TX, CONTROL_TX_SIZE), PORT_RX_SIZE);
+const Q_PORT_TX: Parts = Parts::contiguous(after(Q_PORT_RX, PORT_RX_SIZE), PORT_TX_SIZE);
+
+const PAGE: usize = 0x1000;
+const OFF_CONTROL_RX: usize = (Q_PORT_TX.end(PORT_TX_SIZE) + PAGE - 1) & !(PAGE - 1);
+const OFF_CONTROL_TX: usize = OFF_CONTROL_RX + CONTROL_RX_SIZE as usize * CONTROL_RX_BYTES;
+const OFF_PORT_RX: usize = (OFF_CONTROL_TX + CONTROL_TX_SIZE as usize * control::BYTES + PAGE - 1) & !(PAGE - 1);
+const OFF_PORT_TX: usize = OFF_PORT_RX + PORT_RX_SIZE as usize * PORT_RX_BYTES;
+const GRANT_BYTES: u64 = (OFF_PORT_TX + LARGEST_TRANSMIT) as u64;
+
+/// Why the function is not the agent's to drive.
+pub enum NotOpened {
+    Bringup(Refusal),
+    /// It negotiated no `VIRTIO_CONSOLE_F_MULTIPORT`, so it has no port but 0.
+    NotMultiport,
+    /// Its `max_nr_ports` is not the launch's `max_ports`.
+    Ports(u32),
+}
+
+impl std::fmt::Display for NotOpened {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Bringup(why) => write!(f, "{why}"),
+            Self::NotMultiport => write!(f, "it negotiated no VIRTIO_CONSOLE_F_MULTIPORT"),
+            Self::Ports(n) => write!(f, "its max_nr_ports reads {n}, where the launch declares {MAX_PORTS}"),
+        }
+    }
+}
+
+impl From<Refusal> for NotOpened {
+    fn from(why: Refusal) -> Self {
+        Self::Bringup(why)
+    }
+}
+
+impl From<toyos_virtio::pci::Refusal> for NotOpened {
+    fn from(why: toyos_virtio::pci::Refusal) -> Self {
+        Self::Bringup(why.into())
+    }
+}
+
+impl From<toyos_pci_claim::KernelRefused> for NotOpened {
+    fn from(why: toyos_pci_claim::KernelRefused) -> Self {
+        Self::Bringup(why.into())
+    }
+}
+
+/// The next chain the device has finished with on `rings`, or `None`; a used
+/// ring the device is not believed on ends the program.
+fn finished(rings: &mut Virtqueue<Grant>) -> Option<Used> {
+    rings
+        .poll_used()
+        .unwrap_or_else(|why| panic!("vdagent: this device cannot be driven on — {why}"))
+}
+
+/// The function, brought up and driving.
+pub struct Channel {
+    dev: PciDev,
+    device: Live<Bar>,
+    /// Held for their mappings' lives: the register window points into the
+    /// first and the grant's into the second.
+    _bar: SharedMemory,
+    _region: DmaRegion,
+    grant: Grant,
+    /// Held for the device's life: it has queues 0 and 1 and is never posted to.
+    _port0: [Virtqueue<Grant>; 2],
+    control_rx: Virtqueue<Grant>,
+    control_tx: Virtqueue<Grant>,
+    /// Control transmit heads nothing is in flight on.
+    control_free: Vec<u16>,
+    port_rx: Virtqueue<Grant>,
+    port_tx: Virtqueue<Grant>,
+    /// When the transmit in flight was made available.
+    sent: Option<Instant>,
+}
+
+impl Channel {
+    /// Bring the function up — §3.1.1's order, every queue before
+    /// `DRIVER_OK` — post every receive buffer, and send `DEVICE_READY`.
+    pub fn open(dev: PciDev) -> Result<Self, NotOpened> {
+        let Negotiated { setup, mapping, features } = negotiate(&dev, VIRTIO_CONSOLE_F_MULTIPORT)?;
+        toyos::say!("vdagent: {features}");
+        if setup.features() & VIRTIO_CONSOLE_F_MULTIPORT == 0 {
+            return Err(NotOpened::NotMultiport);
+        }
+        let (setup, ports) = setup.device_read32(MAX_NR_PORTS)?;
+        if ports != MAX_PORTS {
+            return Err(NotOpened::Ports(ports));
+        }
+
+        let (grant, region) = Grant::alloc(&dev, GRANT_BYTES)?;
+        let port0 = [
+            Virtqueue::new(grant, PORT0_RX, PORT0_SIZE, Q_PORT0_RX),
+            Virtqueue::new(grant, PORT0_TX, PORT0_SIZE, Q_PORT0_TX),
+        ];
+        let control_rx = Virtqueue::new(grant, CONTROL_RX, CONTROL_RX_SIZE, Q_CONTROL_RX);
+        let control_tx = Virtqueue::new(grant, CONTROL_TX, CONTROL_TX_SIZE, Q_CONTROL_TX);
+        let port_rx = Virtqueue::new(grant, PORT_RX, PORT_RX_SIZE, Q_PORT_RX);
+        let port_tx = Virtqueue::new(grant, PORT_TX, PORT_TX_SIZE, Q_PORT_TX);
+        let setup = setup
+            .config_vector(MSIX_ENTRY)?
+            .enable(&port0[0], MSIX_ENTRY)?
+            .enable(&port0[1], MSIX_ENTRY)?
+            .enable(&control_rx, MSIX_ENTRY)?
+            .enable(&control_tx, MSIX_ENTRY)?
+            .enable(&port_rx, MSIX_ENTRY)?
+            .enable(&port_tx, MSIX_ENTRY)?;
+
+        let mut channel = Self {
+            dev,
+            device: setup.driver_ok(),
+            _bar: mapping,
+            _region: region,
+            grant,
+            _port0: port0,
+            control_rx,
+            control_tx,
+            control_free: (0..CONTROL_TX_SIZE).rev().collect(),
+            port_rx,
+            port_tx,
+            sent: None,
+        };
+        for head in 0..CONTROL_RX_SIZE {
+            channel.post_control(head);
+        }
+        for head in 0..PORT_RX_SIZE {
+            channel.post_port(head);
+        }
+        channel.send_control(Control { id: 0, event: control::Event::DeviceReady, value: 1 });
+        Ok(channel)
+    }
+
+    /// The claim, for the poller: readable means an interrupt has landed.
+    pub fn claim(&self) -> &PciDev {
+        &self.dev
+    }
+
+    /// Drain the interrupt record, so the claim stops reading ready. What a
+    /// message meant is in the rings.
+    pub fn take_interrupt(&self) {
+        match self.dev.irq() {
+            Ok(_) | Err(SyscallError::WouldBlock) => {}
+            Err(why) => panic!("vdagent: the claim refused its interrupt record: {why:?}"),
+        }
+    }
+
+    fn post_control(&mut self, head: u16) {
+        let at = OFF_CONTROL_RX + head as usize * CONTROL_RX_BYTES;
+        let buffer = Buffer::writable(self.grant.device_addr(at), CONTROL_RX_BYTES as u32);
+        let published = self.control_rx.publish(head, &[buffer]);
+        self.device.notify(published);
+    }
+
+    fn post_port(&mut self, head: u16) {
+        let at = OFF_PORT_RX + head as usize * PORT_RX_BYTES;
+        let buffer = Buffer::writable(self.grant.device_addr(at), PORT_RX_BYTES as u32);
+        let published = self.port_rx.publish(head, &[buffer]);
+        self.device.notify(published);
+    }
+
+    /// The next control message the host sent, its buffer posted again
+    /// before it is answered.
+    pub fn control(&mut self) -> Option<Result<Control, control::Refused>> {
+        let Used { head, written } = finished(&mut self.control_rx)?;
+        let at = OFF_CONTROL_RX + head as usize * CONTROL_RX_BYTES;
+        let mut bytes = [0u8; control::BYTES];
+        let len = (written as usize).min(control::BYTES);
+        for (i, byte) in bytes[..len].iter_mut().enumerate() {
+            *byte = self.grant.window().read(at + i);
+        }
+        self.post_control(head);
+        Some(control::decode(&bytes[..len], MAX_PORTS))
+    }
+
+    /// Send `message` on the control queue.
+    ///
+    /// # Panics
+    /// With every control head still in flight: the device has taken back none
+    /// of [`CONTROL_TX_SIZE`] messages, which no device that is reading does.
+    pub fn send_control(&mut self, message: Control) {
+        while let Some(done) = finished(&mut self.control_tx) {
+            self.control_free.push(done.head);
+        }
+        let head = self
+            .control_free
+            .pop()
+            .unwrap_or_else(|| panic!("vdagent: the device took back none of {CONTROL_TX_SIZE} control messages"));
+        let at = OFF_CONTROL_TX + head as usize * control::BYTES;
+        for (i, byte) in control::encode(message).into_iter().enumerate() {
+            self.grant.window().write(at + i, byte);
+        }
+        let frame = Buffer::readable(self.grant.device_addr(at), control::BYTES as u32);
+        let published = self.control_tx.publish(head, &[frame]);
+        self.device.notify(published);
+    }
+
+    /// Hand every buffer the host filled on the agent's port to `each`, and
+    /// post it again.
+    pub fn received(&mut self, mut each: impl FnMut(&[u8])) {
+        while let Some(Used { head, written }) = finished(&mut self.port_rx) {
+            let window = self.grant.window().sub(OFF_PORT_RX + head as usize * PORT_RX_BYTES, written as usize);
+            // SAFETY: the window is inside the grant, which lives as long as
+            // `self`; the device has finished with this buffer — its used
+            // element said so, and `written` is at most the buffer's length —
+            // and it is not posted again until `each` has returned.
+            each(unsafe { std::slice::from_raw_parts(window.as_ptr() as *const u8, written as usize) });
+            self.post_port(head);
+        }
+    }
+
+    /// Whether the device has taken the last transmit back, so a new one can
+    /// be made.
+    pub fn transmit_free(&mut self) -> bool {
+        if finished(&mut self.port_tx).is_some() {
+            self.sent = None;
+        }
+        self.sent.is_none()
+    }
+
+    /// When the transmit in flight was made, if one is.
+    pub fn sent(&self) -> Option<Instant> {
+        self.sent
+    }
+
+    /// One transmit on the agent's port, of the bytes `fill` writes into a
+    /// [`LARGEST_TRANSMIT`] buffer, and `fill` answers how many. Nothing is
+    /// sent for 0.
+    ///
+    /// # Panics
+    /// With a transmit in flight: the caller asks [`Self::transmit_free`].
+    pub fn transmit(&mut self, fill: impl FnOnce(&mut [u8]) -> usize) {
+        assert!(self.sent.is_none(), "vdagent: a transmit was made over the one in flight");
+        let window = self.grant.window().sub(OFF_PORT_TX, LARGEST_TRANSMIT);
+        // SAFETY: the window is inside the grant, which lives as long as
+        // `self`; the device is not reading it, because no transmit is in
+        // flight and the buffer is published only after `fill` returns.
+        let len = fill(unsafe { std::slice::from_raw_parts_mut(window.as_ptr(), LARGEST_TRANSMIT) });
+        if len == 0 {
+            return;
+        }
+        let frame = Buffer::readable(self.grant.device_addr(OFF_PORT_TX), len as u32);
+        let published = self.port_tx.publish(0, &[frame]);
+        self.device.notify(published);
+        self.sent = Some(Instant::now());
+    }
+}
diff --git a/system/vdagent/src/main.rs b/system/vdagent/src/main.rs
new file mode 100644
index 00000000000..2cc4b472c8c
--- /dev/null
+++ b/system/vdagent/src/main.rs
@@ -0,0 +1,212 @@
+//! The shared clipboard with QEMU's host: the guest agent of QEMU's
+//! `qemu-vdagent` chardev, between the virtio-serial function it is on and
+//! the compositor's clipboard.
+//!
+//! **What is here is the loop and the device's handshake.** The function is
+//! [`channel`]'s; the stream is `toyos-vdagent`'s; every decision about who
+//! owns the clipboard and what a transmit owes is `toyos-vdagent-bridge`'s;
+//! the compositor's side is `window::watcher`'s.
+//!
+//! **The handshake is virtio 1.2 §5.3.6.2's**: `DEVICE_READY`, the device's
+//! `DEVICE_ADD` of [`PORT_ID`] answered with `PORT_READY`, and the agent's
+//! port opened once the host's `PORT_OPEN(1)` has come. The host's
+//! `PORT_OPEN(0)` is answered with the agent's `PORT_OPEN(0)`, and its
+//! `PORT_OPEN(1)` with `PORT_OPEN(1)`: QEMU 11.1.1 then starts a new session
+//! with its capabilities, measured. Any other port the device adds, a console
+//! port, the removal of the agent's port, an unframed stream and a used ring
+//! the device is not believed on end the program by name. It is not started
+//! again: one that ended says why and stays down for the boot.
+//!
+//! **A transmit the device has not taken back within [`TRANSMIT_BOUND`] ends
+//! the program**: QEMU 11.1.1 takes the largest one at once, measured, and a
+//! device holding one holds every message after it.
+//!
+//! **No clipboard byte is ever logged**: lengths, serials and refusals only.
+
+use std::time::{Duration, Instant};
+
+use toyos::endow;
+use toyos::poller::{Poller, READABLE};
+use toyos::say;
+use toyos::PciDev;
+use toyos_abi::syscall::PciId;
+use toyos_vdagent::control::{Control, Event};
+use toyos_vdagent::stream::{Decoder, Message};
+use toyos_vdagent::PORT_ID;
+use toyos_vdagent_bridge::sets::Sets;
+use toyos_vdagent_bridge::{Bridge, Effect};
+use window::watcher::{Watched, Watcher};
+
+mod channel;
+
+use channel::Channel;
+
+/// One declaration of the clipboard's bound, read by the codec and the
+/// compositor alike.
+const _: () = assert!(toyos_vdagent::MAX_TEXT == window::MAX_CLIPBOARD_BYTES);
+
+/// Virtio 1.2 §5.3.1: the console device is `0x1040 + 3`.
+const VIRTIO_SERIAL: PciId = PciId { vendor: 0x1af4, device: 0x1043 };
+
+/// How long a transmit may stay with the device. Policy, far past any time
+/// QEMU 11.1.1 took, measured: it took every element at once.
+const TRANSMIT_BOUND: Duration = Duration::from_secs(5);
+
+const TOKEN_CLAIM: u64 = 0;
+const TOKEN_WATCHER: u64 = 1;
+
+/// The agent's state beside the bridge's: the device's handshake and the
+/// stream's decode.
+struct Agent {
+    bridge: Bridge,
+    decoder: Decoder,
+    watcher: Watcher,
+    sets: Sets,
+    /// The guest's end of the agent's port is open.
+    open: bool,
+}
+
+impl Agent {
+    fn control(&mut self, channel: &mut Channel, control: Result<Control, toyos_vdagent::control::Refused>) {
+        let Control { id, event, value } = match control {
+            Ok(control) => control,
+            Err(why) => return say!("vdagent: {why}, ignored"),
+        };
+        let reply = |event, value| Control { id: PORT_ID, event, value };
+        match event {
+            Event::DeviceAdd if id == PORT_ID => channel.send_control(reply(Event::PortReady, 1)),
+            Event::DeviceAdd => panic!("vdagent: the device added port {id}, and the launch declares port {PORT_ID} alone"),
+            Event::ConsolePort => panic!("vdagent: the device made port {id} a console port"),
+            Event::DeviceRemove if id == PORT_ID => panic!("vdagent: the device removed port {PORT_ID}"),
+            Event::PortOpen if id == PORT_ID && value != 0 => {
+                if !self.open {
+                    channel.send_control(reply(Event::PortOpen, 1));
+                    self.open = true;
+                }
+            }
+            Event::PortOpen if id == PORT_ID => {
+                say!("vdagent: the host closed port {PORT_ID}");
+                self.bridge.closed();
+                self.decoder = Decoder::default();
+                if self.open {
+                    channel.send_control(reply(Event::PortOpen, 0));
+                    self.open = false;
+                }
+            }
+            // Its name is not read: the port is the declared id.
+            Event::PortName => {}
+            other => say!("vdagent: control {other:?} for port {id}, ignored"),
+        }
+    }
+
+    /// A message the host sent, named in the log by what it is and never by
+    /// its bytes.
+    fn host(&mut self, message: Message) {
+        match &message {
+            Message::Capabilities { request: true, caps } => {
+                say!("vdagent: port {PORT_ID} open, the host announces capabilities {caps:#010x}")
+            }
+            Message::Grab { serial, types } => {
+                say!("vdagent: the host grabs the clipboard, serial {serial}, {} type(s)", types.len())
+            }
+            Message::Clipboard { data, .. } => say!("vdagent: the host's clipboard, {} bytes", data.len()),
+            Message::Release => say!("vdagent: the host releases the clipboard"),
+            Message::Capabilities { request: false, .. } | Message::Request { .. } => {}
+        }
+        let effect = self.bridge.host(message);
+        self.apply(effect);
+    }
+
+    fn apply(&mut self, effect: Effect) {
+        match effect {
+            Effect::None => {}
+            Effect::Guest(text) => {
+                if let Some(text) = self.sets.set(text) {
+                    self.send(text);
+                }
+            }
+            Effect::Named(named) => say!("vdagent: {named}"),
+        }
+    }
+
+    fn send(&mut self, text: String) {
+        self.watcher.set(text).unwrap_or_else(|why| panic!("vdagent: the compositor's clipboard: {why}"))
+    }
+
+    /// Every frame the compositor sent.
+    fn watched(&mut self) {
+        loop {
+            match self.watcher.poll() {
+                Ok(Watched::Idle) => return,
+                Ok(Watched::Committed) => {}
+                Ok(Watched::Answered) => {
+                    if let Some(text) = self.sets.answered() {
+                        self.send(text);
+                    }
+                }
+                Ok(Watched::Copy(text)) => {
+                    say!("vdagent: a guest copy of {} bytes", text.len());
+                    self.sets.delivered();
+                    let effect = self.bridge.copy(text);
+                    self.apply(effect);
+                }
+                Err(why) => panic!("vdagent: the compositor's clipboard: {why}"),
+            }
+        }
+    }
+}
+
+fn main() {
+    let Some(claim) = endow::pci_function::<PciDev>(VIRTIO_SERIAL) else {
+        say!("vdagent: no virtio-serial function was handed to this program, exiting");
+        return;
+    };
+    let watcher = Watcher::connect(toyos_manifest::clipboard::PORT)
+        .unwrap_or_else(|why| panic!("vdagent: the compositor's clipboard: {why}"));
+    let mut channel = Channel::open(claim).unwrap_or_else(|why| panic!("vdagent: the function is not driven: {why}"));
+    let mut agent = Agent { bridge: Bridge::default(), decoder: Decoder::default(), watcher, sets: Sets::default(), open: false };
+
+    let poller = Poller::new(2);
+    poller.watch(channel.claim(), READABLE, TOKEN_CLAIM);
+    poller.watch(agent.watcher.conn(), READABLE, TOKEN_WATCHER);
+    loop {
+        while let Some(control) = channel.control() {
+            agent.control(&mut channel, control);
+        }
+        let Agent { decoder, .. } = &mut agent;
+        let mut messages = Vec::new();
+        channel.received(|bytes| {
+            decoder
+                .feed(bytes, |m| messages.push(m))
+                .unwrap_or_else(|unframed| panic!("vdagent: {unframed}"))
+        });
+        for message in messages {
+            match message {
+                Ok(message) => agent.host(message),
+                Err(refusal) => say!("vdagent: {refusal}"),
+            }
+        }
+        if channel.transmit_free() {
+            if agent.bridge.owes() {
+                channel.transmit(|out| agent.bridge.transmit(out));
+            }
+        } else if channel.sent().is_some_and(|at| at.elapsed() > TRANSMIT_BOUND) {
+            panic!("vdagent: the device has not taken a transmit back within {TRANSMIT_BOUND:?}");
+        }
+
+        let timeout = channel.sent().map_or(u64::MAX, |at| {
+            let left = (at + TRANSMIT_BOUND).saturating_duration_since(Instant::now());
+            u64::try_from(left.as_nanos()).unwrap_or(u64::MAX)
+        });
+        let mut ready = [false; 2];
+        poller.wait(1, timeout, |token| ready[token as usize] = true);
+        if ready[TOKEN_CLAIM as usize] {
+            channel.take_interrupt();
+            poller.watch(channel.claim(), READABLE, TOKEN_CLAIM);
+        }
+        if ready[TOKEN_WATCHER as usize] {
+            agent.watched();
+            poller.watch(agent.watcher.conn(), READABLE, TOKEN_WATCHER);
+        }
+    }
+}
diff --git a/tests/common/iommu.rs b/tests/common/iommu.rs
index 3f8e6ebd9e8..eb9625969d9 100644
--- a/tests/common/iommu.rs
+++ b/tests/common/iommu.rs
@@ -106,8 +106,9 @@ pub fn iommu_virtio_platform(test_config: &Path) -> Result<(), String> {
         }
 
         // Every function the kernel drives itself: all QEMU created but the
-        // NIC and the sound function, whose drivers are processes.
-        let expected = created.len() - 2;
+        // NIC, the sound function and the clipboard's channel, whose drivers
+        // are processes.
+        let expected = created.len() - 3;
         let mut negotiated = Vec::new();
         for line in log.text().lines().filter(|line| is_kernel_line(line)) {
             let Some(rest) = line.split("VirtIO: PCI ").nth(1) else { continue };
diff --git a/tests/common/qemu.rs b/tests/common/qemu.rs
index 99b646adc29..d95fbe0397c 100644
--- a/tests/common/qemu.rs
+++ b/tests/common/qemu.rs
@@ -888,7 +888,8 @@ struct Shape {
     /// *size* is a shape dimension exactly as a disk's is, and the tests that
     /// read pixels were all blind to the remainder until one profile had one.
     panel: Option<(u32, u32)>,
-    /// virtio-sound and the console on virtio-serial.
+    /// virtio-sound, the console on virtio-serial, and the clipboard's
+    /// channel on a virtio-serial function of its own.
     virtio: Virtio,
     nic: Nic,
     /// The `-device` argument for each xHCI controller, port and slot counts
@@ -2300,6 +2301,11 @@ fn qemu_command(
                 .arg("-device")
                 .arg(format!("virtio-sound-pci,audiodev=audio0,streams=1{platform}"));
         }
+        // The clipboard's channel, just before the console's function, so it
+        // enumerates first and every virtio boot runs the kernel's console
+        // rule. Refused by name where QEMU has no `qemu-vdagent`.
+        toyos_build::vdagent::available(arch).unwrap_or_else(|why| panic!("[qemu] {why}"));
+        qemu.args(toyos_build::vdagent::args(platform));
         qemu
             // virtio-console on stdio is the primary I/O channel; UART goes to
             // a temp file so early-boot logs and panic fallback still land
diff --git a/tests/images/clipboardcase.toml b/tests/images/clipboardcase.toml
new file mode 100644
index 00000000000..703e2d26356
--- /dev/null
+++ b/tests/images/clipboardcase.toml
@@ -0,0 +1,27 @@
+# The boot `the_opening_exchange_with_qemus_agent_completes` reads: the
+# clipboard agent against QEMU's own vdagent, with the compositor whose
+# clipboard it watches, on `Profile::HeadlessVirtioGpu`, the one virtio machine
+# with a framebuffer for the compositor to claim.
+#
+# test-runner makes the boot announce itself.
+
+assets = ["assets"]
+
+[boot]
+start = ["logkeeper", "compositor", "vdagent", "test-runner"]
+
+# `every_boot_config_runs_logkeeper` is what refuses a boot config without it.
+[programs.logkeeper]
+service = true
+syscap = ["logread"]
+
+[programs.compositor]
+service = true
+serves = ["compositor", "prompt", "clipboard"]
+devices = ["framebuffer", "keyboard", "mouse"]
+
+[programs.vdagent]
+devices = ["pci:1af4:1043"]
+receives = ["clipboard"]
+
+[programs.test-runner]
diff --git a/tests/images/metalcase.toml b/tests/images/metalcase.toml
index bc04f3dc996..8589fa8c5b6 100644
--- a/tests/images/metalcase.toml
+++ b/tests/images/metalcase.toml
@@ -24,7 +24,7 @@ syscap = ["logread"]
 
 [programs.compositor]
 service = true
-serves = ["compositor", "prompt"]
+serves = ["compositor", "prompt", "clipboard"]
 receives = ["soundserver"]
 devices = ["framebuffer", "keyboard", "mouse"]
 
diff --git a/tests/images/panelcase.toml b/tests/images/panelcase.toml
index 39a6dd60c7b..9d2e5bc4144 100644
--- a/tests/images/panelcase.toml
+++ b/tests/images/panelcase.toml
@@ -16,5 +16,5 @@ syscap = ["logread"]
 
 [programs.compositor]
 service = true
-serves = ["compositor", "prompt"]
+serves = ["compositor", "prompt", "clipboard"]
 devices = ["framebuffer", "keyboard", "mouse"]
diff --git a/tests/toyos.rs b/tests/toyos.rs
index 564a66606b8..a217035a99d 100644
--- a/tests/toyos.rs
+++ b/tests/toyos.rs
@@ -384,6 +384,11 @@ const MACHINE_TESTS: &[&str] = &[
     // run is the benches'; this is TCG's, whose XSAVE is QEMU's own reading of
     // the SDM, and the KVM runner's CPU.
     "vector_state_survives_a_switch",
+    // The clipboard agent's opening exchange with QEMU's own vdagent: the
+    // device exists only under QEMU, so no metal row reaches it, and the other
+    // end of the handshake and of the request is QEMU's vdagent chardev and
+    // virtio-serial device, which no host test runs.
+    "the_opening_exchange_with_qemus_agent_completes",
 ];
 
 /// **The metal profile**: which registrations run on the ThinkPad T14, what
@@ -3402,10 +3407,35 @@ fn run_machine_test(name: &str, test_config: &Path) -> Result<(), String> {
         "usbd_drives_the_spare" => usbd_drives_the_spare(test_config),
         "usb_keyboard_rollover" => usb_keyboard_rollover(test_config),
         "vector_state_survives_a_switch" => vector_state_survives_a_switch(test_config),
+        "the_opening_exchange_with_qemus_agent_completes" => the_opening_exchange_with_qemus_agent_completes(),
         other => Err(format!("unknown machine test {other}")),
     }
 }
 
+/// The clipboard agent opens its port and QEMU's vdagent answers its opening
+/// `REQUEST` with no data, since `-display none` gives QEMU's clipboard no
+/// peer: the agent said both, in this order.
+fn the_opening_exchange_with_qemus_agent_completes() -> Result<(), String> {
+    const OPEN: &str = "vdagent: port 1 open, the host announces capabilities 0x00020060";
+    const ANSWERED: &str = "vdagent: the host's clipboard, 0 bytes";
+    let mut qemu = QemuInstance::boot_with_options(
+        &compile::repo_root().join("tests/images/clipboardcase.toml"),
+        &[],
+        &[],
+        BootOptions { profile: qemu::Profile::HeadlessVirtioGpu, ..Default::default() },
+    );
+    let mut console = format!("{}\n", qemu.boot_log());
+    await_guest(&mut qemu, &mut console, "the agent's opening exchange", |t| t.contains(ANSWERED))
+        .map_err(|e| format!("{e}\n{console}"))?;
+    let said = serial::Serial::named("the clipboard boot", console);
+    said.must_be_clean()?;
+    let text = said.text();
+    match (text.find(OPEN), text.find(ANSWERED)) {
+        (Some(open), Some(answered)) if open < answered => Ok(()),
+        _ => Err(format!("the agent did not say {OPEN:?} before {ANSWERED:?}:\n{text}")),
+    }
+}
+
 /// A machine with one NVMe disk and no USB controller boots the image off
 /// that disk to ready, and says nothing a clean boot does not.
 fn nvme_disk_boots(test_config: &Path) -> Result<(), String> {