@@ -8,7 +8,7 @@
 /example/cmake-build-debug
 
 
-/build
+/build*
 
 /.opencode
 /AGENTS.md
 
@@ -149,15 +149,19 @@ if(APPLE)
     find_library(CORE_MEDIA CoreMedia REQUIRED)
     find_library(CORE_VIDEO CoreVideo REQUIRED)
     find_library(APP_KIT AppKit REQUIRED)
-    # Platform framework types appear only in the platform .cpp/.mm files
-    # (behind the backend interfaces), so the dependencies are PRIVATE. Carbon
-    # is intentionally NOT used.
-    target_link_libraries(robot PRIVATE
-        ${APPLICATION_SERVICES}
-        ${SCREEN_CAPTURE_KIT}
-        ${CORE_MEDIA}
-        ${CORE_VIDEO}
-        ${APP_KIT})
+    # Most platform framework types appear only in the platform .cpp/.mm files
+    # (behind the backend interfaces), so those dependencies are PRIVATE.
+    # CoreVideo is PUBLIC because the installed robot/mac/VideoFrame.h bridge
+    # hands consumers a CVPixelBufferRef they lock through CoreVideo calls.
+    # Carbon is intentionally NOT used.
+    target_link_libraries(robot
+        PUBLIC
+            ${CORE_VIDEO}
+        PRIVATE
+            ${APPLICATION_SERVICES}
+            ${SCREEN_CAPTURE_KIT}
+            ${CORE_MEDIA}
+            ${APP_KIT})
 elseif(WIN32)
     # user32/gdi32 for SendInput, hooks, GDI capture. Shcore and the DPI context
     # API are resolved at runtime (see WinDpi.cpp / WinScreenBackend.cpp), so they
 
@@ -28,7 +28,7 @@ robot-cpp is built around the distinctions those libraries collapse:
 
 | Platform          | Backend                       | Injection                       | Capture | Window streaming | Recording |
 | ----------------- | ----------------------------- | ------------------------------- | ------- | ---------------- | --------- |
-| macOS             | Quartz + ScreenCaptureKit     | yes (needs Accessibility)       | yes (needs Screen Recording) | yes (needs Screen Recording) | yes (needs Accessibility) |
+| macOS             | Quartz + ScreenCaptureKit     | yes (needs Accessibility)       | yes (needs Screen Recording) | yes (macOS 14+, needs Screen Recording) | yes (needs Accessibility) |
 | Windows           | SendInput + GDI               | yes                             | yes     | no               | yes       |
 | Linux (X11)       | XTest + XRandR + XRecord      | yes                             | yes     | no               | yes       |
 | Linux (Wayland)   | uinput (opt-in)               | keyboard + relative mouse only  | no      | no               | no        |
 
@@ -12,7 +12,7 @@ class IWindowStreamBackend;
 }
 
 struct WindowStreamOptions {
-  double maxFps = 60.0;
+  double maxFps = 60.0;  // must be finite and in [1, 1000]
   bool showsCursor = true;
 };
 
@@ -24,7 +24,9 @@ using VideoFrameCallback = std::function<void(const VideoFrame&)>;
 
 // Invoked on the same capture thread (serialized with frame delivery) when
 // the stream dies outside stop(): the window closed, the OS revoked capture,
-// the display reconfigured. After it fires, isRunning() is false and no
+// the display reconfigured. Fires at most once; a death that happens before a
+// concurrent stop() is always reported, while stop() winning the race means a
+// clean stop and no error. After it fires, isRunning() is false and no
 // further frames arrive. Same rules as VideoFrameCallback.
 using StreamErrorCallback = std::function<void(const Error&)>;
 
 
@@ -1,5 +1,7 @@
 #include "robot/Windows.h"
 
+#include <cmath>
+#include <format>
 #include <utility>
 
 #include "robot/backend/IWindowBackend.h"
@@ -69,6 +71,12 @@ std::expected<WindowStream, Error> Windows::stream(
         Error::invalidArgument("stream() requires a frame callback")
     );
   }
+  if (!std::isfinite(options.maxFps) || options.maxFps < 1.0 ||
+      options.maxFps > 1000.0) {
+    return std::unexpected(Error::invalidArgument(std::format(
+        "maxFps must be a finite value in [1, 1000], got {}", options.maxFps
+    )));
+  }
 
   auto stream = backend_->startStream(
       windowId, options, std::move(onFrame), std::move(onError)
 
@@ -5,6 +5,8 @@
 #import <CoreMedia/CoreMedia.h>
 #import <ScreenCaptureKit/ScreenCaptureKit.h>
 
+#include <mach/mach_time.h>
+
 #include <atomic>
 #include <chrono>
 #include <memory>
@@ -52,6 +54,7 @@ - (void)stream:(SCStream*)stream
   double scaleFactor = 0.0;
   double contentScale = 0.0;
   CGRect contentRect = CGRectZero;
+  std::optional<std::uint64_t> displayTicks;
   CFArrayRef attachments =
       CMSampleBufferGetSampleAttachmentsArray(sampleBuffer, false);
   if (attachments != nullptr && CFArrayGetCount(attachments) > 0) {
@@ -88,19 +91,45 @@ - (void)stream:(SCStream*)stream
     if (contentRectDict != nullptr) {
       CGRectMakeWithDictionaryRepresentation(contentRectDict, &contentRect);
     }
+    const auto* displayTimeNumber =
+        static_cast<CFNumberRef>(CFDictionaryGetValue(
+            attachment, (__bridge CFStringRef)SCStreamFrameInfoDisplayTime
+        ));
+    if (displayTimeNumber != nullptr) {
+      std::int64_t ticks = 0;
+      CFNumberGetValue(displayTimeNumber, kCFNumberSInt64Type, &ticks);
+      if (ticks > 0) displayTicks = static_cast<std::uint64_t>(ticks);
+    }
   }
 
   CVPixelBufferRef pixels = CMSampleBufferGetImageBuffer(sampleBuffer);
   if (pixels == nullptr) return;
 
   // Stamp the frame with when it was presented, not when this callback ran -
   // a sample delayed inside ScreenCaptureKit must not look fresh to
-  // freshness-gated consumers. Presentation time and the host clock share the
-  // same time base, so the age subtraction is exact.
+  // freshness-gated consumers. SCStreamFrameInfoDisplayTime is the display
+  // time in mach absolute ticks, the same clock mach_absolute_time() reads,
+  // so the age subtraction stays within one clock domain. When the attachment
+  // is absent, fall back to the sample's presentation timestamp measured
+  // against the CoreMedia host clock it is produced on.
   auto capturedAt = std::chrono::steady_clock::now();
-  const CMTime presentation =
-      CMSampleBufferGetPresentationTimeStamp(sampleBuffer);
-  if (CMTIME_IS_VALID(presentation)) {
+  if (displayTicks) {
+    static const double nanosPerTick = [] {
+      mach_timebase_info_data_t timebase{};
+      mach_timebase_info(&timebase);
+      return static_cast<double>(timebase.numer) /
+             static_cast<double>(timebase.denom);
+    }();
+    const double ageNanos =
+        (static_cast<double>(mach_absolute_time()) -
+         static_cast<double>(*displayTicks)) *
+        nanosPerTick;
+    capturedAt -= std::chrono::duration_cast<std::chrono::steady_clock::duration>(
+        std::chrono::duration<double, std::nano>(ageNanos)
+    );
+  } else if (const CMTime presentation =
+                 CMSampleBufferGetPresentationTimeStamp(sampleBuffer);
+             CMTIME_IS_VALID(presentation)) {
     const CMTime hostNow = CMClockGetTime(CMClockGetHostTimeClock());
     const double ageSeconds =
         CMTimeGetSeconds(CMTimeSubtract(hostNow, presentation));
@@ -135,21 +164,33 @@ - (void)stream:(SCStream*)stream
   ));
 }
 
-- (void)stream:(SCStream*)stream didStopWithError:(NSError*)error {
-  const auto chan = self->channel;
+// Shared death path for didStopWithError and streamDidBecomeInactive. The
+// active flag flips synchronously on the delegate thread, so a death that
+// happens before a concurrent stop() wins the exchange and its report cannot
+// be suppressed; delivery still hops onto the sample handler queue so it is
+// serialized with frame delivery and covered by stop()'s drain.
+static void reportStreamDeath(
+    const std::shared_ptr<robot::mac::StreamChannel>& chan, NSString* message
+) {
   if (chan == nullptr || chan->queue == nil) return;
-  // Delegate callbacks arrive on ScreenCaptureKit's own queue; hop onto the
-  // sample handler queue so error delivery is serialized with frame delivery
-  // and covered by stop()'s drain. Only report deaths the caller did not
-  // initiate - stop() deactivates the channel first.
-  NSString* message = error.localizedDescription;
+  if (!chan->active.exchange(false)) return;  // stop() already initiated
+  if (chan->onError == nullptr) return;
   dispatch_async(chan->queue, ^{
-    if (chan->active.exchange(false) && chan->onError != nullptr) {
-      chan->onError(robot::Error::captureFailed(message.UTF8String));
-    }
+    chan->onError(robot::Error::captureFailed(message.UTF8String));
   });
 }
 
+- (void)stream:(SCStream*)stream didStopWithError:(NSError*)error {
+  reportStreamDeath(self->channel, error.localizedDescription);
+}
+
+- (void)streamDidBecomeInactive:(SCStream*)stream {
+  reportStreamDeath(
+      self->channel,
+      @"stream became inactive (the captured window closed or capture ended)"
+  );
+}
+
 @end
 
 namespace robot::mac {
@@ -379,6 +420,16 @@ void stop() override {
     const std::uint32_t windowId, const WindowStreamOptions& options,
     VideoFrameCallback onFrame, StreamErrorCallback onError
 ) {
+  // SCContentFilter.pointPixelScale and .contentRect - the metadata the whole
+  // coordinate contract rests on - exist since macOS 14.
+  if (@available(macOS 14.0, *)) {
+    // Streaming is available; continue below.
+  } else {
+    return std::unexpected(
+        Error::unsupported("window streaming requires macOS 14 or newer")
+    );
+  }
+
   auto contentResult = fetchShareableContent();
   if (!contentResult) return std::unexpected(contentResult.error());