Record v0.4.48 release verification

docs/evidence/v0448-release-2026-10-26.md

@@ -0,0 +1,56 @@
+# v0.4.48 release verification, 26 October 2026
+
+The annotated [`v0.4.48` tag](https://github.com/saphid/frame-control/releases/tag/v0.4.48)
+dereferences to main commit `5438e1d9d05ca472f200dcde50799c8ae882fafb`,
+which contains the version bump and [candidate evidence](v0448-candidate-2026-10-26.md).
+The exact-commit [main checks run](https://github.com/saphid/frame-control/actions/runs/40356645911)
+finished successfully: all seven jobs passed, including e2e, iOS, Windows,
+macOS and Linux tests. Its first two attempts had an iOS job stuck in the
+runner queue and were cancelled; attempt 3 ran that job and ended with all
+seven required checks successful. The later documentation-only main commit
+`1ddb6278b8ae0a98ecc79a181bba4d3cc67a52b6` also passed all seven
+[main checks](https://github.com/saphid/frame-control/actions/runs/40406851705).
+
+The exact-tag [release workflow](https://github.com/saphid/frame-control/actions/runs/40406781383)
+finished successfully. Its draft, Linux, Windows, Apple Silicon Mac, Intel
+Mac and checksum jobs all passed; no tagged installer build failed or was
+cancelled. Tagged CI launched the Linux x86_64 AppImage on Xvfb, checked both
+Mac bundles against their runner architecture, installed the Windows Setup
+and compared its installed resources with the unpacked build, and tested its
+packaged Python and native PC libraries.
+
+The draft had exactly ten installers and `SHA256SUMS`, each with a GitHub
+SHA-256 digest. An independently downloaded `SHA256SUMS` matched a fresh
+ten-line list generated from GitHub's asset metadata byte for byte. Both
+its downloaded SHA-256 and GitHub's own asset digest were
+`8cf7d8808f0b0b9da08e2590461e83ef557412a0ce2cc780c8e1d02e34ce1a60`.
+Independent downloads on lxso1 matched `SHA256SUMS` for these packages:
+
+| Package | SHA-256 and independent check |
+| --- | --- |
+| Linux x86_64 AppImage | `7c0cbef7c0330c48ecb69f6fcee027a8b45fe84b0458985db31d16b09fc45cbe`; isolated Xvfb launch served HTTP 200 with `FrameControl/1`, then its server stopped. |
+| Linux arm64 DEB | `d3c2cdc4310fc3fed11460ad970a3ff6da8b80a6ec566acf1bcaa5a9570efc3e`; package declares version 0.4.48 and arm64 architecture. |
+| Mac arm64 ZIP | `3c5b0ad0877e4c1e1adbac17a9eb4f1114294a25576330050ac9ce338e0b1c00`; ZIP CRC, bundle version 0.4.48 and main Mach-O arm64 CPU passed. |
+| Mac x64 ZIP | `3bb90246794f0082fd4f34d86113e292ae543671ff8bea4096d888a9273a529c`; ZIP CRC, bundle version 0.4.48 and main Mach-O x86_64 CPU passed. |
+| Windows x64 Setup | `def654c238575778120c6f2a4df1af319b0cd169f64c2fceebe26ddc5e3c68ff`; downloaded file is a PE/Nullsoft installer; tagged Windows CI installed and tested its contents. |
+
+After attaching the final release notes,
+`scripts/publish-release.sh --dry-run v0.4.48` passed the exact tag, ten
+installer digests, checksum asset and update-manifest checks.
+`scripts/publish-release.sh v0.4.48` published the release at
+**21:53:29 UTC**. GitHub's latest-release API read back tag `v0.4.48`,
+`draft=false`, `prerelease=false`, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` reported
+version 0.4.48, the stable release page, ten hashed installers and the worn
+VR limit in its notes.
+
+The [candidate smoke](v0448-candidate-2026-10-26.md) on the real Frame passed
+**12 / one optional x86_64 launch skipped / zero failed**. The optional launch
+needed Steam Linux Runtime 4, which was absent; no x86_64 headset launch was
+claimed. Owned test titles and processes were removed, the lock was released,
+and a fresh locked check found standby and no test-title leftovers. A later
+read-only locked check found SteamVR activity 3 (standby), proximity raw
+3.0625 and battery 100%, then released its own lock. No wearer was confirmed,
+so neither the worn-check script nor physical controller input was run.
+Official-plugin wearer visibility, controller use, VR keyboard, optical comfort
+and physical launch of these exact Mac/Windows installers remain unverified.