Document running receipt guard and its verification boundary

docs/evidence/framey-running-context-2026-10-26.json

@@ -2682,5 +2682,15 @@
     "Local custom artwork",
     "Closed-panel automation, suspend/input and private MobX observation",
     "Worn VR and physical controller/keyboard use"
-  ]
+  ],
+  "receiptIntegration": {
+    "prerequisite": "#301 merged at ad57662",
+    "verification": "Local Python/Node tests; hardware checks above preceded this authorization-only change",
+    "checks": [
+      "Parent poll and both close paths include pinned SHA-256",
+      "Missing/stale receipts rejected before CEF for active polls and close after plugin replacement",
+      "Reopened panel accepts current receipt for poll and close",
+      "Finite subscription lease unchanged for rejected stale close"
+    ]
+  }
 }

docs/evidence/framey-running-context-2026-10-26.md

@@ -69,3 +69,10 @@ suspend/input events, game actions or closed-panel automation.
 Discord shortcut detection, real IPC connection/activity, local custom artwork,
 actual running-game transitions, worn VR and physical controller/keyboard use
 remain unverified. None of the new fixture checks promotes a plugin to works.
+
+After #301 merged, running polls and both close paths adopted its pinned SHA-256
+receipt guard. Local Python/Node tests verify the parent carries that receipt,
+missing/stale receipts are rejected before CEF after plugin replacement, and a
+reopened panel can poll and close with the new receipt. Rejected stale closes
+retain the tested finite-lease cleanup. This authorization-only follow-up did
+not repeat the device checks above; their recorded hardware scope is unchanged.

docs/framey-loader.md

@@ -115,9 +115,9 @@ Its cleanup actions were not tested; they may remove local game saves.
 
 Framey also supplies local tabs/sidebar pages, spinners, dialog/menu wrappers
 and progress bars. Its explicit SteamClient subscription fallbacks return
-disposable handles without emitting fabricated events. There is no attached
-running game in `DFL.Router`, and power, app launch and hardware mutation methods
-are not supplied. Plugins that need live Steam stores still require integration
+disposable handles without emitting fabricated events. Running-game reads and
+lifetime notifications use the scoped bridge described below; power, app launch
+and hardware mutation methods are not supplied. Other live Steam stores require integration
 work. IndexedDB is hidden because the browser exposes it but denies access in
 an opaque iframe; localForage can then select Framey's bounded localStorage.
 Direct IndexedDB users remain unsupported.