Clarify two official Framey compatibility limits

docs/evidence/framey-static-limits-2026-10-28.md

@@ -0,0 +1,27 @@
+# Static limits for two official Decky archives, 28 October 2026
+
+The published archives below were downloaded from Decky's version CDN and
+checked against the catalog's exact SHA-256 before inspection. No plugin code,
+backend, plugin-initiated network request or headset operation ran in this
+audit. Their status labels remain unchanged.
+
+## IsThereAnyDeal for Deck 1.1.1
+
+Store ID 81, SHA-256
+`18e133b2e6203f16fd1ee2ed83b5a90bad34491515bef7ec1c82d525f0bfadef`.
+The backend exposes settings load/save. The published frontend uses
+`fetchNoCors` for deal lookups with an embedded upstream API key and attempts
+to find a Steam store debugger tab through `localhost:8080/json`. The key was
+not decoded or used. The existing real Frame country read and local settings
+render remain the verified scope; live deals, settings writes and Steam page
+integration remain unverified. Status stays **partial**.
+
+## Decky Clipboard 1.0.1
+
+Store ID 119, SHA-256
+`d283bd9a5c35b3fac3788391736a6763f3e8c4615831a7c560c9fa6e6c0950ac`.
+The manifest requests root and the ZIP bundles an x86-64 `bin/xclip`. In the
+published `main.py`, `auto_start` defaults to true; `WebServer.start` binds
+`0.0.0.0:8765`, and the clipboard GET/POST routes have no authentication
+check. A managed adaptation would need to address that behavior before any
+Frame install. The archive remains **broken** and was not installed or run.

docs/framey-compatibility.md

@@ -97,7 +97,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 78: Brightness Bar 1.0.4 | legacy / legacy | N/A | Not supported on Frame: Targets Steam/QAM brightness shortcuts and a global Steam overlay; neither is attached to the Framey panel. | static archive, local browser, fake-Frame |
 | 79: Decky Notifications 1.0.1 | legacy / legacy | partial | Initializer succeeds; device/account setup and notification delivery unverified. | static archive, local browser, fake-Frame |
 | 80: MagicBlack 2.0.2 | 1 / 2 | N/A | Not supported on Frame: Targets a global Steam Deck screen-black overlay; the isolated panel cannot black out the Frame compositor. | static archive, local browser, fake-Frame |
-| 81: IsThereAnyDeal for Deck 1.1.1 | legacy / legacy | partial | Country settings render and select the real Frame Steam country through the read-only bridge. Settings writes, deal lookups and Steam page integration remain unverified; plugin backend calls were denied. | static archive, local browser, fake-Frame, real Frame SSH |
+| 81: IsThereAnyDeal for Deck 1.1.1 | legacy / legacy | partial | Country settings render and select the real Frame Steam country through the read-only bridge. The published frontend attempts deal lookups with an embedded upstream API key and a Steam store CDP tab; neither was exercised in Framey. Settings writes and Steam page integration remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 82: MagicPods 2.0.21 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: MagicPodsDecky/bin/magicpodscore. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
 | 84: Junk-Store 1.1.13 | legacy / legacy | partial | Official Decky 3.3.0 ARM64 static menu/backend calls pass; local Chromium Games/Epic navigation, About/Dependencies tabs, Back and reopen render with real Frame library metadata. Legendary is absent; dependency install, login, game operations, RSS, optional websocket and worn VR remain unverified. Existing installs need update/reinstall for script permissions. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
 | 85: Decky-Undervolt 1.0.8 | 1 / 2 | N/A | Not supported on Frame: RyzenAdj Curve Optimizer requires an AMD CPU; Frame is ARM64. | static archive, local browser, fake-Frame |
@@ -133,7 +133,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 116: Muon 0.2.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 117: DeckyParty File Manager 1.0.0 | legacy / legacy | partial | Initializer succeeds; privileged file operations and backend are unverified. No file changes were run. | static archive, local browser, fake-Frame |
 | 118: Speed Test 1.0.2 | 1 / 2 | partial | Initializer succeeds; automatic bandwidth tests were blocked by the audit network policy. | static archive, local browser, fake-Frame |
-| 119: Decky Clipboard 1.0.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-clipboard/bin/xclip. | static archive, local browser, fake-Frame |
+| 119: Decky Clipboard 1.0.1 | 1 / 2 | broken | The exact archive is blocked by its x86-64 xclip binary and root request. Its published backend defaults to auto-starting an unauthenticated clipboard GET/POST API on 0.0.0.0:8765; this was inspected statically and never run on Frame. | static archive, local browser, fake-Frame |
 | 120: Reroll 0.2.1 | 1 / 2 | broken | Frontend now initializes with inert game-action subscriptions, but the archive contains x86_64 memscan.so and requests root. No process-memory access was run. | static archive, local browser, fake-Frame |
 | 121: DeckPass 1.1.1 | 1 / 2 | partial | Initializer succeeds; KeePass Flatpak discovery and secrets integration were not exercised. | static archive, local browser, fake-Frame |
 | 123: Steam Status 1.2.3 | 2 / 2 | partial | Settings/public status rendered locally; cache errors fixed. Read-only get_settings RPC returned actual Decky 3.3.0 defaults on ARM64 Frame. Persistence, live backend diagnostics and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH |

ui/framey-compatibility.json

@@ -6322,7 +6322,7 @@
         "https://github.com/JtdeGraaf/IsThereAnyDeal-DeckyPlugin.git"
       ],
       "status": "partial",
-      "reason": "Country settings render and select the real Frame Steam country through the read-only bridge. Settings writes, deal lookups and Steam page integration remain unverified; plugin backend calls were denied.",
+      "reason": "Country settings render and select the real Frame Steam country through the read-only bridge. The published frontend attempts deal lookups with an embedded upstream API key and a Steam store CDP tab; neither was exercised in Framey. Settings writes and Steam page integration remain unverified.",
       "blockInstall": false,
       "verification": [
         "static archive",
@@ -10546,7 +10546,7 @@
         "https://github.com/astrand/xclip"
       ],
       "status": "broken",
-      "reason": "Plugin contains a non-ARM64 Linux binary: decky-clipboard/bin/xclip.",
+      "reason": "The exact archive is blocked by its x86-64 xclip binary and root request. Its published backend defaults to auto-starting an unauthenticated clipboard GET/POST API on 0.0.0.0:8765; this was inspected statically and never run on Frame.",
       "blockInstall": true,
       "verification": [
         "static archive",