Publish README.md from marimo

README.md

@@ -280,7 +280,8 @@ Xvfb on Linux, and a `--doctor` preflight on macOS. The Windows job is
 accepts injected input. Trigger it from the Actions tab. The repo needs a GitHub mirror -
 Hugging Face does not run GitHub Actions.
 
-**2. A local QEMU VM without KVM.** Measured on the headless container above:
+**2. A local QEMU VM without KVM.** Measured on the headless container above - this is
+what the box actually reported, not what the docs claim:
 
 ```
 /dev/kvm absent                     -> no hardware virtualization
@@ -289,16 +290,31 @@ qemu-system-x86_64 -accel kvm       -> Could not access KVM kernel module: No su
 qemu-system-x86_64 -accel tcg       -> boots (reached "No bootable device.")
 ```
 
-So a Windows guest is *possible* with no KVM at all, but entirely under software
-emulation. TCG runs roughly 10-50x slower than native, which turns a 20-minute Windows
-install into many hours - and the harness's OCR would then run on an emulated CPU inside
-the guest. Use this only when no CI runner and no cloud box is available:
+The rest of the Windows 11 ingredient list was then checked rather than assumed - UEFI
+firmware and a TPM 2.0, both under pure TCG:
+
+```
+apt-get install -y ovmf swtpm       -> /usr/share/OVMF/OVMF_CODE_4M.fd + swtpm 0.7.1
+swtpm socket --tpm2 --tpmstate dir=/tmp/tpmstate       --ctrl type=unixio,path=/tmp/swtpm-sock &
+qemu-system-x86_64 -accel tcg -machine q35 -m 4G -smp 4       -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE_4M.fd       -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.fd       -chardev socket,id=chrtpm,path=/tmp/swtpm-sock       -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -nographic
+
+  -> UEFI Interactive Shell v2.2
+     EDK II
+     UEFI v2.70 (Debian distribution of EDK II, 0x00010000)
+```
+
+So the whole stack works here: UEFI boot, an emulated TPM 2.0, and software-only
+emulation. A Windows 11 guest is genuinely installable - just slow, because TCG runs
+roughly 10-50x slower than native, turning a 20-minute install into many hours, after
+which the harness's OCR would run on an emulated CPU inside the guest. Use it only when
+no CI runner and no cloud box is available:
 
 ```bash
 qemu-img create -f qcow2 win.qcow2 64G
-qemu-system-x86_64 -accel tcg -m 8G -smp 4   -drive file=win.qcow2,format=qcow2,if=virtio   -cdrom Win11_Eval_x64.iso -boot d   -device virtio-vga -vnc :1     # then RDP/VNC in, pip install the harness inside
+qemu-system-x86_64 -accel tcg -m 8G -smp 4 -machine q35   -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE_4M.fd   -drive if=pflash,format=raw,file=/tmp/OVMF_VARS.fd   -chardev socket,id=chrtpm,path=/tmp/swtpm-sock   -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0   -drive file=win.qcow2,format=qcow2,if=virtio   -cdrom Win11_Eval_x64.iso -boot d   -device virtio-vga -vnc :1     # VNC/RDP in, then pip install the harness inside
 ```
 
+
 **3. A cloud Windows box.** Any Windows VM reachable over RDP gives a native desktop, a
 real `SendInput` path and real DPI scaling. Untested here; it is the closest thing to
 "a user's actual laptop".
@@ -364,6 +380,7 @@ when no verifier is given.
 - [x] Blind-grid-click guard, echo detection, no-progress guard
 - [ ] Make the VLM reliable on a live screen (it echoes the prompt instead of choosing)
 - [ ] Windows run of the live test - workflow committed; needs a GitHub mirror with Actions on
+- [x] Windows VM ingredients verified locally (UEFI + TPM 2.0 boot under TCG; no KVM here)
 - [ ] Accessibility-tree detector (AT-SPI on Linux, UI Automation on Windows)
 - [ ] Score episodes: replay a trace and count how often the choice was right
 - [ ] marimo console: live screen preview, action log, pause / resume / step