Merge pull request #344 from saphid/fix/release-publisher-gates

Require exact CI and installer gates before publishing

.github/workflows/decky-runtime.yml

@@ -0,0 +1,32 @@
+name: Decky backend runtime
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  decky-runtime:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, ubuntu-24.04-arm]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Actual Decky 3.3.0 discovery and safe backend probes
+        run: python3 scripts/framey-test-decky-runtime.py --output "$RUNNER_TEMP/decky-runtime.json"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: decky-runtime-${{ matrix.os }}
+          path: ${{ runner.temp }}/decky-runtime.json
+          if-no-files-found: warn

docs/evidence/framey-native-port-blockers-2026-10-26.md

@@ -0,0 +1,44 @@
+# Native plugin packaging blockers, 26 October 2026
+
+This is a static, digest-scoped follow-up. Neither plugin was installed or
+run on the Frame. Their compatibility statuses remain **broken**.
+
+## Decky Cloud Save 1.4.2, store ID 49
+
+The official ZIP SHA-256 is
+`b311d967ddf1b0f0046d36929645855891a40173e3a93f6f0cd8b1576b04b411`.
+It was downloaded and hash-checked without executing any member. Of its 27
+members, `decky-cloud-save/bin/rclone` is a regular executable of **60,776,600
+bytes** with ELF machine **62 (x86_64)**. The installer permits at most 30 MiB
+per member, so this exact ZIP fails before native architecture validation.
+Raising that limit alone would still leave an x86_64 executable on the ARM64
+Frame. No cloud credentials, saves, reads or writes were exercised.
+
+## Emuchievements 2.0.5, store ID 28
+
+The official ZIP SHA-256 is
+`98dcb443e81b9f9011cfe77c69eb659869c8e2df2df8b0a443df66cbfc2f5a89`.
+The [earlier helper check](framey-emuchievements-arm-2026-10-26.md) proved
+one synthetic ROM hash on ARM64, without installing the plugin. The upstream
+source commit `8567e94befffc943434b2adb842487274815f8bb` and its pinned
+libarchive, libchdr and rcheevos submodules were checked out separately for
+this audit. The source is GPL-3.0. An isolated Debian ARM64 cross-build made a
+2.6 MB helper (`c8794558a0d75294930f969a426e7d2ac13a27e3c1ff9bd8aae093e31596b9bd`),
+but it was **not shipped or run on ROM archives**. A complete source bundle
+without Git metadata compressed to about 8 MB; source and license distribution
+would be part of any release-ready port.
+
+The proposed source has an additional blocker. `backend/src/util.cpp` builds
+an extraction destination by appending each raw archive member pathname to
+an owned `/tmp/tmpdir.*` prefix, then passes it to libarchive's disk writer.
+It neither rejects `..`/absolute paths nor enables libarchive's secure path
+flags. `backend/src/main.cpp` later removes the extracted file's parent path.
+With an untrusted archive, those paths may leave the intended temporary
+directory. The plugin's Python backend also invokes `bin/hash` through a
+shell with a path argument. A port needs bounded path validation, secure
+extraction/cleanup, safe subprocess arguments, format coverage and actual
+Decky/backend tests before its official ZIP can be transformed or installed.
+
+The official archive still contains an x86_64 helper. RetroAchievements
+login, real ROM scanning, a packaged ARM64 backend, wearer-visible VR and
+physical controller use remain unverified.

docs/evidence/v0448-release-2026-10-26.md

@@ -0,0 +1,85 @@
+# v0.4.48 release verification and withdrawal, 26 October 2026
+
+The annotated [`v0.4.48` tag](https://github.com/saphid/frame-control/releases/tag/v0.4.48)
+dereferences to main commit `5438e1d9d05ca472f200dcde50799c8ae882fafb`,
+which contains the version bump and [candidate evidence](v0448-candidate-2026-10-26.md).
+The exact-commit [main checks run](https://github.com/saphid/frame-control/actions/runs/40356645911)
+finished successfully: all seven jobs passed, including e2e, iOS, Windows,
+macOS and Linux tests. Its first two attempts had an iOS job stuck in the
+runner queue and were cancelled; attempt 3 ran that job and ended with all
+seven required checks successful. The later documentation-only main commit
+`1ddb6278b8ae0a98ecc79a181bba4d3cc67a52b6` also passed all seven
+[main checks](https://github.com/saphid/frame-control/actions/runs/40406851705).
+
+The exact-tag [release workflow](https://github.com/saphid/frame-control/actions/runs/40406781383)
+finished successfully. Its draft, Linux, Windows, Apple Silicon Mac, Intel
+Mac and checksum jobs all passed; no tagged installer build failed or was
+cancelled. Tagged CI launched the Linux x86_64 AppImage on Xvfb, checked both
+Mac bundles against their runner architecture, installed the Windows Setup
+and compared its installed resources with the unpacked build, and tested its
+packaged Python and native PC libraries.
+
+An earlier [release-PR preview run](https://github.com/saphid/frame-control/actions/runs/40352797572/attempts/1)
+was not a passing gate: its Apple Silicon Mac build was cancelled and its
+checksum job was skipped. [Attempt 2](https://github.com/saphid/frame-control/actions/runs/40352797572/attempts/2)
+completed all four preview installer builds successfully. Publication used the
+separate exact-tag workflow above, whose six jobs all succeeded.
+
+The draft had exactly ten installers and `SHA256SUMS`, each with a GitHub
+SHA-256 digest. An independently downloaded `SHA256SUMS` matched a fresh
+ten-line list generated from GitHub's asset metadata byte for byte. Both
+its downloaded SHA-256 and GitHub's own asset digest were
+`8cf7d8808f0b0b9da08e2590461e83ef557412a0ce2cc780c8e1d02e34ce1a60`.
+Independent downloads on lxso1 matched `SHA256SUMS` for these packages:
+
+| Package | SHA-256 and independent check |
+| --- | --- |
+| Linux x86_64 AppImage | `7c0cbef7c0330c48ecb69f6fcee027a8b45fe84b0458985db31d16b09fc45cbe`; isolated Xvfb launch served HTTP 200 with `FrameControl/1`, then its server stopped. |
+| Linux arm64 DEB | `d3c2cdc4310fc3fed11460ad970a3ff6da8b80a6ec566acf1bcaa5a9570efc3e`; package declares version 0.4.48 and arm64 architecture. |
+| Mac arm64 ZIP | `3c5b0ad0877e4c1e1adbac17a9eb4f1114294a25576330050ac9ce338e0b1c00`; ZIP CRC, bundle version 0.4.48 and main Mach-O arm64 CPU passed. |
+| Mac x64 ZIP | `3bb90246794f0082fd4f34d86113e292ae543671ff8bea4096d888a9273a529c`; ZIP CRC, bundle version 0.4.48 and main Mach-O x86_64 CPU passed. |
+| Windows x64 Setup | `def654c238575778120c6f2a4df1af319b0cd169f64c2fceebe26ddc5e3c68ff`; downloaded file is a PE/Nullsoft installer; tagged Windows CI installed and tested its contents. |
+
+After attaching the final release notes,
+`scripts/publish-release.sh --dry-run v0.4.48` passed the exact tag, ten
+installer digests, checksum asset and update-manifest checks.
+`scripts/publish-release.sh v0.4.48` published the release at
+**21:53:29 UTC**. GitHub's latest-release API read back tag `v0.4.48`,
+`draft=false`, `prerelease=false`, ten installers, `SHA256SUMS` and
+`update.json`. Immediately after publication, a fresh public latest-download
+of `update.json` reported version 0.4.48, the release page, ten hashed
+installers and the worn VR limit in its notes. This is historical evidence,
+not the current update-channel state.
+
+## Withdrawn after a real Decky regression was confirmed
+
+The all-green release gate did not include Music Control's actual Decky 3.3.0
+legacy class calling convention. [PR #338](https://github.com/saphid/frame-control/pull/338)
+reproduced a regression in the #335 digest-scoped Music Control 1.1.7 install
+shim: it removes explicit `self` from calls that the real legacy runtime needs,
+so player discovery fails with `_get_dbus_env() missing 1 required positional
+argument: 'self'`. The earlier fixture had instantiated `Plugin()` and missed
+this behavior. A passing CI run therefore did not prove this plugin path worked.
+
+At **22:01:20 UTC**, v0.4.48 was returned to draft and the previously green
+v0.4.47 was marked latest. The v0.4.48 tag and build artifacts were preserved;
+no tag or installer was deleted. The preserved draft's notes now begin with a
+withdrawal notice. GitHub's latest-release API and a fresh public
+`releases/latest/download/update.json` now both point to **v0.4.47** with ten
+hashed installers. Existing v0.4.48 installations do not auto-downgrade.
+The repair in #338 merged at `04cde721c862c80a18dad17c2aab0c86ca8d3082`.
+It requires green post-merge main checks, a new release candidate and all
+release gates before any replacement version is offered. An app update alone
+does not rewrite the bad installed plugin shim: affected users need an explicit
+managed plugin update or remove/reinstall after the repair ships.
+
+The [candidate smoke](v0448-candidate-2026-10-26.md) on the real Frame passed
+**12 / one optional x86_64 launch skipped / zero failed**. The optional launch
+needed Steam Linux Runtime 4, which was absent; no x86_64 headset launch was
+claimed. Owned test titles and processes were removed, the lock was released,
+and a fresh locked check found standby and no test-title leftovers. A later
+read-only locked check found SteamVR activity 3 (standby), proximity raw
+3.0625 and battery 100%, then released its own lock. No wearer was confirmed,
+so neither the worn-check script nor physical controller input was run.
+Official-plugin wearer visibility, controller use, VR keyboard, optical comfort
+and physical launch of these exact Mac/Windows installers remain unverified.

docs/framey-compatibility.md

@@ -65,7 +65,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 44: DeckMTP 1.0.5 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: DeckMTP/bin/umtprd. | static archive, local browser, fake-Frame |
 | 46: Steamback 1.0.0-1 | legacy / legacy | partial | Panel opens using the real Frame current-user/library snapshot. Account setup and empty save-list reads pass through actual Decky 3.3.0 amd64 in isolation. ARM64 backend, supported-save discovery, automatic backups and restore remain unverified; no backup/restore ran. | static archive, local browser, fake-Frame, real Frame SSH |
 | 48: Quick Launch 1.2.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
-| 49: Decky Cloud Save 1.4.2 | legacy / legacy | broken | Unsafe plugin archive member. | static archive, local browser, fake-Frame |
+| 49: Decky Cloud Save 1.4.2 | legacy / legacy | broken | The exact official ZIP contains a 60,776,600-byte x86_64 rclone member, above the 30 MiB member limit and unusable on ARM64. Installation remains blocked. | static archive, local browser, fake-Frame |
 | 50: Storage Cleaner 1.4.0 | 1 / 2 | partial | Empty-data panel rendered; cleanup was deliberately not run because it can remove local data. | static archive, local browser, fake-Frame |
 | 52: Game Theme Music 1.7.1-1 | 1 / 2 | partial | An inert local component lets the exact frontend initialize and render its Settings view in opaque Chromium. Backend get_setting and plugin network were denied in the audit; Steam game-page theme injection has no verified target in Framey. Music search, playback, downloads, settings persistence and worn VR remain unverified. | static archive, local browser, fake-Frame |
 | 53: Shotty 0.1.0 | legacy / legacy | partial | The frontend starts with the read-only Frame library snapshot. Frame Control adds a digest-scoped click.get_app_dir compatibility module to the managed install; the exact backend then imports and copies a synthetic Steam screenshot into a temporary Pictures folder in isolated Python. Actual Decky 3.3.0 ARM64 loading, live screenshots/rescue, in-VR panel and physical controller use remain unverified. | static archive, local browser, fake-Frame, real Frame SSH, isolated Python backend |
@@ -288,11 +288,11 @@ All published Linux native payloads in this snapshot are x86_64; no published aa
 | Fantastic | bin/backend | Fan backend/driver is Deck-specific; an ARM64 rebuild would not provide compatible Frame hardware. |
 | PowerTools | bin/libryzenadj.so, bin/ryzenadj, bin/backend | RyzenAdj and AMD power backend cannot control an ARM64 Frame SoC. |
 | Memory Deck | bin/libscanmem.so.1.0.0 | libscanmem must be rebuilt for aarch64 and validated against target process architecture; memory writes were not tested. |
-| Emuchievements | bin/hash | A source-matched ARM64 bin/hash helper matched the official x86_64 helper on one synthetic ROM on the real Frame (docs/evidence/framey-emuchievements-arm-2026-10-26.md). The official ZIP still bundles x86_64 bytes and remains blocked; format coverage, packaging, plugin backend/UI, login and worn VR are unverified. |
+| Emuchievements | bin/hash | A source-matched ARM64 helper matched one synthetic ROM on the real Frame (docs/evidence/framey-emuchievements-arm-2026-10-26.md). The pinned upstream source proposed for packaging also has unsafe archive extraction and cleanup paths (docs/evidence/framey-native-port-blockers-2026-10-26.md); fix and test those before shipping an ARM64 binary. The official x86_64 ZIP remains blocked; format coverage, plugin backend/UI, login and worn VR are unverified. |
 | MoonDeck | python/externals/yarl/_quoting_c.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_http_parser.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_websocket/reader_c.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_websocket/mask.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_http_writer.cpython-313-x86_64-linux-gnu.so, … 26 total; full list in JSON | Rebuild vendored CPython 3.13 extension wheels for the headset Python ABI and ARM64; buddy/helper dependencies also need ports. |
 | Controller Tools | bin/backend | Native backend needs an ARM64 build and controller/HID dependencies; its direct websocket also bypasses the Framey bridge. |
 | DeckMTP | bin/umtprd | umtprd needs ARM64 libusb/MTP dependencies and USB gadget permissions; root user-service blocker remains. |
-| Decky Cloud Save | bin/rclone | rclone needs an ARM64 artifact; this ZIP also fails safe member validation. Cloud writes were not exercised. |
+| Decky Cloud Save | bin/rclone | An ARM64 rclone artifact and safe package policy are needed; the official 60,776,600-byte x86_64 member fails archive validation. No cloud writes were run (docs/evidence/framey-native-port-blockers-2026-10-26.md). |
 | DeckyFileServer | bin/backend | Native file-server backend needs ARM64 dependencies; root requirement also blocks the user service. |
 | TS3 QuickAccess | bin/ts3-qs4sd.so | TeamSpeak client plugin must match an ARM64 TeamSpeak client and SDK ABI, not merely rebuild the .so. |
 | Syncthing | bin/decky-syncthing-watchdog | The watchdog needs an ARM64 build, plus a supported Syncthing runtime/package and safe path validation. |

docs/releasing.md

@@ -34,13 +34,27 @@ count. So a build reaches people only when you publish it, after testing it.
 
 4. Publish:
 
+   Confirm the exact tag commit's main CI and e2e, the locked real Frame smoke,
+   release verification, independent package checks, and all four tagged
+   installer builds have passed. Hold the release if any gate is failed,
+   cancelled, skipped, still running, or unverified. The publisher also reads
+   the exact commit's GitHub CI, native Decky runtime gate, and tagged build
+   job records and refuses to
+   publish unless every required job succeeded; it cannot prove physical
+   headset or installer behavior on its own.
+
    ```sh
    scripts/publish-release.sh --dry-run v0.4.0   # checks and shows update.json, changes nothing
    scripts/publish-release.sh v0.4.0
    ```
 
-   The script checks that the tag is on GitHub and that all ten installers
+   The script checks that the tag is on GitHub, that exact-commit main CI
+   (including e2e), native amd64/ARM64 Decky runtime checks, and the tagged
+   release workflow are green with no failed,
+   cancelled, skipped or running jobs, and that all ten installers
    are attached, each with the SHA-256 digest GitHub records. It also checks
+   that the draft does not begin with a `WITHDRAWN` notice, so the preserved
+   v0.4.48 draft cannot accidentally be offered again. It checks
    that the uploaded `SHA256SUMS` digest matches a fresh list of those ten
    installer digests. It attaches
    `update.json` (the version, the notes, the release page and each

docs/testing.md

@@ -549,3 +549,41 @@ Fixtures cover duplicate instance identity, unknown states, GUID matching,
 localised/denied channel data and 6 GHz ambiguity. No tests contact a real Frame.
 A Windows CI runner/VM cannot prove physical Steam dongle behaviour or audio RF
 interference. See [sources and limits](windows-wireless-doctor.md).
+
+### Actual Decky backend shim gate
+
+Fake-Frame tests stub plugin execution, so they cannot prove Decky's Python
+calling convention. `Decky backend runtime` CI separately runs the published,
+SHA-256-pinned **Decky 3.3.0** executable on native amd64 and ARM64 Linux.
+The loader discovers production-managed official archives and calls their public
+methods over its actual websocket API. No test imports or instantiates `Plugin`.
+
+```sh
+python3 scripts/framey-test-decky-runtime.py --output /tmp/decky-runtime.json
+# Offline loader cache (still checked against its pinned native digest):
+python3 scripts/framey-test-decky-runtime.py --loader /path/to/PluginLoader --output /tmp/decky-runtime.json
+```
+
+Run on Linux with Docker. Image build and the pinned loader download need network;
+plugin execution has no network, published ports, host home/audio/D-Bus/device
+mounts, capabilities or writable repository. Each case has its own unprivileged
+container, private tmpfs home and temporary files. Nothing contacts the headset
+or its shared lock. Failed/timed-out containers and the private image tag are
+removed by the runner.
+
+Every `compat_shims.append` in the managed installer must have a case in
+`tests/decky-runtime/cases.json`. Add each affected pinned official archive and
+a safe public-method probe when introducing a shim. Ordinary unit tests reject
+uncovered shim names. The runtime job verifies the managed receipt, loader
+plugin discovery, and a successful backend call; a discovery listing alone
+could conceal a crashed backend process.
+
+Current cases cover both Music Control entries and Shotty. Music Control uses
+the private silent MPRIS fixture to check discovery, metadata, play/pause,
+next/previous, seek and volume, with independent service-state readbacks.
+Shotty checks backend import, rescuer state and empty screenshot aggregation
+inside its disposable home. A fourth negative-control case deliberately
+reintroduces #335's incorrect bound-method transformation and must reproduce
+the real loader's legacy backend-call failure. The gate fails if that regression goes
+undetected. These checks verify backend behavior in a container; they do not
+upgrade any plugin's Frame, actual media playback or worn-VR compatibility claim.

scripts/framey-test-decky-runtime.py

@@ -0,0 +1,114 @@
+#!/usr/bin/env python3
+"""Run every managed backend shim in native, isolated, published Decky 3.3.0.
+
+Downloads a digest-pinned loader, or accepts --loader for an offline cached copy.
+Only image build/download use network. All official plugin execution is in
+network/device/session-isolated disposable Docker containers. Never uses Frame.
+"""
+import argparse
+import ast
+import hashlib
+import json
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import sys
+import tempfile
+import urllib.request
+import uuid
+
+ROOT = Path(__file__).resolve().parents[1]
+RELEASE = 'v3.3.0'
+LOADERS = {
+    'x86_64': ('PluginLoader', 'e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181', 62),
+    'aarch64': ('PluginLoader-arm64', '8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6', 183),
+}
+
+
+def check_coverage():
+    """A new production shim must declare an actual-runtime probe before CI runs."""
+    sys.path.insert(0, str(ROOT/'ui'))
+    import frame_decky_store
+    tree = ast.parse(frame_decky_store.APPLY)
+    shims = set()
+    for node in ast.walk(tree):
+        if (isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute)
+                and isinstance(node.func.value, ast.Name)
+                and node.func.value.id == 'compat_shims' and node.func.attr == 'append'):
+            if len(node.args) != 1 or not isinstance(node.args[0], ast.Constant) or not isinstance(node.args[0].value, str):
+                raise ValueError('Managed shims must declare a literal name for runtime test coverage')
+            shims.add(node.args[0].value)
+    cases = json.loads((ROOT/'tests/decky-runtime/cases.json').read_text())
+    if shims != {case['shim'] for case in cases}:
+        raise ValueError('Every managed shim needs an actual Decky runtime case')
+    return cases
+
+
+def loader_bytes(path):
+    arch = platform.machine()
+    if arch not in LOADERS:
+        raise ValueError('Run on native Linux x86_64 or aarch64')
+    asset, digest, machine = LOADERS[arch]
+    if path:
+        data = path.read_bytes()
+    else:
+        url = f'https://github.com/SteamDeckHomebrew/decky-loader/releases/download/{RELEASE}/{asset}'
+        request = urllib.request.Request(url, headers={'User-Agent': 'Frame-Control-runtime-tests'})
+        with urllib.request.urlopen(request, timeout=60) as response:
+            data = response.read(80*1024*1024+1)
+    if hashlib.sha256(data).hexdigest() != digest:
+        raise ValueError('Decky 3.3.0 loader digest mismatch')
+    if data[:4] != b'\x7fELF' or int.from_bytes(data[18:20], 'little') != machine:
+        raise ValueError('Loader architecture does not match the native runner')
+    return data, digest
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--loader', type=Path, help='Optional cached, digest-verified native Decky 3.3.0 binary')
+    parser.add_argument('--output', type=Path, required=True)
+    args = parser.parse_args()
+    if sys.platform != 'linux' or not shutil.which('docker'):
+        parser.error('Linux with Docker is required')
+    cases = check_coverage()
+    data, digest = loader_bytes(args.loader)
+    tag = 'framey-decky-runtime:'+uuid.uuid4().hex[:12]
+    report = {'decky': RELEASE, 'architecture': platform.machine(), 'loaderSha256': digest, 'cases': []}
+    try:
+        subprocess.run(['docker', 'build', '-q', '-t', tag, '-f', str(ROOT/'tests/decky-runtime/Containerfile'),
+                        str(ROOT/'tests/decky-runtime')], check=True, timeout=300)
+        with tempfile.TemporaryDirectory(prefix='framey-decky-runtime-') as temp:
+            loader = Path(temp)/'PluginLoader'
+            loader.write_bytes(data)
+            loader.chmod(0o644)  # Private container user copies/chmods its own executable.
+            probes = [(case['id'], False) for case in cases] + [(111, True)]
+            for plugin_id, negative in probes:
+                name = 'framey-decky-'+uuid.uuid4().hex[:12]
+                command = ['docker', 'run', '--rm', '--name', name, '--network', 'none', '--read-only',
+                    '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--pids-limit', '128',
+                    '--tmpfs', '/tmp:rw,exec,mode=1777',
+                    '--tmpfs', '/home/tester:rw,exec,uid=1100,gid=1100,mode=700',
+                    '--tmpfs', '/run/user/1100:rw,uid=1100,gid=1100,mode=700',
+                    '--mount', f'type=bind,source={ROOT},target=/repo,readonly',
+                    '--mount', f'type=bind,source={loader},target=/input/PluginLoader,readonly',
+                    tag, str(plugin_id)]
+                if negative:
+                    command.append('--reproduce-bound-method-regression')
+                try:
+                    result = subprocess.run(command, capture_output=True, text=True, timeout=120)
+                    if result.returncode:
+                        raise RuntimeError(f'Decky runtime case {plugin_id} failed:\n{result.stdout}\n{result.stderr}')
+                    observation = json.loads(result.stdout)
+                    report['cases'].append(observation)
+                    print(f"PASS {plugin_id}: {observation['result']}", flush=True)
+                finally:
+                    subprocess.run(['docker', 'rm', '-f', name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    finally:
+        args.output.parent.mkdir(parents=True, exist_ok=True)
+        args.output.write_text(json.dumps(report, indent=2)+'\n')
+        subprocess.run(['docker', 'image', 'rm', tag], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
+
+if __name__ == '__main__':
+    main()

scripts/publish-release.sh

@@ -31,6 +31,11 @@ trap 'rm -rf "$tmp"' EXIT
 gh api "repos/$repo/git/ref/tags/$tag" >/dev/null 2>&1 \
   || { echo "tag $tag isn't on GitHub; push it first (git push origin $tag)" >&2; exit 1; }
 
+# A complete asset list is insufficient: a cancelled installer build can leave
+# old uploaded bytes behind. Check the exact tagged commit's main/e2e jobs and
+# the latest exact-tag release attempt before any release mutation.
+python3 "$(dirname "$0")/verify-release-gates.py" "$tag"
+
 # Every release, drafts included, one JSON object per line.
 gh api --paginate "repos/$repo/releases?per_page=100" --jq '.[]' > "$tmp/releases"
 # The release whose tag_name is the tag; failing that, the one untagged-... draft
@@ -56,6 +61,12 @@ json.dump(r, sys.stdout)
 EOF
 id=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "$tmp/release.json")
 echo "release  $id ($(python3 -c 'import json,sys; r=json.load(open(sys.argv[1])); print(("draft" if r["draft"] else "published") + ", tag_name " + str(r["tag_name"]))' "$tmp/release.json"))"
+python3 - "$tmp/release.json" <<'EOF'
+import json, sys
+release = json.load(open(sys.argv[1]))
+if (release.get("body") or "").lstrip().startswith("> **WITHDRAWN"):
+    sys.exit("not publishing: this release is marked WITHDRAWN")
+EOF
 
 missing=""
 for name in $expected; do

scripts/verify-release-gates.py

@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Refuse publication unless the exact tag commit and tagged installers passed CI.
+
+This checks GitHub's current run and job records, not a prior PR's check marks.
+The real Frame smoke and independent package checks remain release-procedure
+gates documented in docs/releasing.md.
+"""
+import json
+import subprocess
+import sys
+from urllib.parse import quote
+
+
+REPO = "saphid/frame-control"
+MAIN_JOBS = {
+    "checks", "e2e", "ios", "wireless-windows",
+    "server-tests (ubuntu-latest, 3.13)",
+    "server-tests (macos-latest, 3.12)",
+    "server-tests (windows-latest, 3.12)",
+}
+RELEASE_JOBS = {
+    "draft", "checksums",
+    "build (windows-latest, dist:win, app/dist/*.exe app/dist/*.zip)",
+    "build (ubuntu-latest, dist:linux, app/dist/*.AppImage app/dist/*.deb)",
+    "build (macos-15-intel, dist:mac:x64, app/dist/*.dmg app/dist/*.zip)",
+    "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)",
+}
+DECKY_JOBS = {"decky-runtime (ubuntu-latest)", "decky-runtime (ubuntu-24.04-arm)"}
+
+
+class GateError(Exception):
+    pass
+
+
+def api(path):
+    # publish-release.sh already requires sh. Resolve gh through that same
+    # shell: on Git Bash, Python's Windows CreateProcess skips an extensionless
+    # test gh shim in PATH and accidentally launches the real gh.exe instead.
+    command = ["sh", "-c", 'gh api "$1"', "sh", f"repos/{REPO}/{path}"]
+    result = subprocess.run(command, text=True, capture_output=True, check=False)
+    if result.returncode:
+        raise GateError(f"GitHub gate read failed for {path}: {result.stderr.strip()}")
+    try:
+        return json.loads(result.stdout)
+    except json.JSONDecodeError as error:
+        raise GateError(f"invalid GitHub gate response for {path}: {error}") from error
+
+
+def tag_commit(tag):
+    target = api(f"git/ref/tags/{quote(tag, safe='')}").get("object") or {}
+    for _ in range(5):
+        kind, sha = target.get("type"), target.get("sha")
+        if not isinstance(sha, str) or len(sha) != 40:
+            raise GateError(f"{tag} has no valid tag target")
+        if kind == "commit":
+            return sha
+        if kind != "tag":
+            raise GateError(f"{tag} points to unsupported Git object {kind!r}")
+        target = api(f"git/tags/{sha}").get("object") or {}
+    raise GateError(f"{tag} has too many nested tag objects")
+
+
+def exact_run(workflow, branch, sha, event):
+    query = f"actions/workflows/{workflow}/runs?branch={quote(branch, safe='')}&head_sha={sha}&per_page=100"
+    runs = api(query).get("workflow_runs") or []
+    matching = [run for run in runs if run.get("head_sha") == sha
+                and run.get("head_branch") == branch and run.get("event") == event]
+    if not matching:
+        raise GateError(f"no exact {workflow} {event} run for {branch} at {sha}")
+    run = max(matching, key=lambda item: item["id"])
+    if run.get("status") != "completed" or run.get("conclusion") != "success":
+        raise GateError(f"{workflow} run {run['id']} is {run.get('status')}/{run.get('conclusion')}")
+    return run
+
+
+def successful_jobs(run, required):
+    attempt = run.get("run_attempt")
+    if not isinstance(attempt, int) or attempt < 1:
+        raise GateError(f"run {run['id']} has no valid attempt number")
+    data = api(f"actions/runs/{run['id']}/attempts/{attempt}/jobs?per_page=100")
+    jobs = data.get("jobs") or []
+    if data.get("total_count") != len(jobs):
+        raise GateError(f"run {run['id']} has more jobs than the gate inspected")
+    names = [job.get("name") for job in jobs]
+    if len(names) != len(set(names)) or not required.issubset(names):
+        missing = sorted(required.difference(names))
+        raise GateError(f"run {run['id']} has missing or duplicate jobs: {missing}")
+    bad = [f"{job.get('name')}: {job.get('status')}/{job.get('conclusion')}"
+           for job in jobs if job.get("status") != "completed" or job.get("conclusion") != "success"]
+    if bad:
+        raise GateError(f"run {run['id']} has unfinished, failed, cancelled, or skipped jobs: {bad}")
+    print(f"gate passed: {run.get('html_url')} ({len(jobs)} jobs)")
+
+
+def main(tag):
+    if not tag.startswith("v") or not tag[1:]:
+        raise GateError("expected a version tag beginning with v")
+    sha = tag_commit(tag)
+    successful_jobs(exact_run("checks.yml", "main", sha, "push"), MAIN_JOBS)
+    successful_jobs(exact_run("decky-runtime.yml", "main", sha, "push"), DECKY_JOBS)
+    successful_jobs(exact_run("release.yml", tag, sha, "push"), RELEASE_JOBS)
+    print(f"exact release commit: {sha}")
+
+
+if __name__ == "__main__":
+    try:
+        main(sys.argv[1])
+    except (IndexError, GateError) as error:
+        sys.exit(f"release gate failed: {error}")

tests/decky-runtime/Containerfile

@@ -0,0 +1,12 @@
+# Native amd64 or ARM64; no emulation, host session bus, audio, devices or home.
+FROM debian:trixie-slim
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      python3 python3-dbus python3-gi python3-websockets dbus-bin dbus-daemon \
+      ca-certificates zlib1g \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd -m -u 1100 -s /bin/sh tester \
+    && mkdir -p /run/user/1100 && chown tester:tester /run/user/1100
+ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 XDG_RUNTIME_DIR=/run/user/1100
+USER tester
+WORKDIR /repo
+ENTRYPOINT ["python3", "/repo/tests/decky-runtime/check.py"]

tests/decky-runtime/cases.json

@@ -0,0 +1,5 @@
+[
+  {"id": 12, "shim": "music-control-system-dbus-env", "probe": "mpris"},
+  {"id": 111, "shim": "music-control-system-dbus-env", "probe": "mpris"},
+  {"id": 53, "shim": "shotty-click-app-dir", "probe": "screenshots"}
+]

tests/decky-runtime/check.py

@@ -0,0 +1,199 @@
+"""Container-only real Decky backend discovery and smoke tests; no host services."""
+import argparse
+import asyncio
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import signal
+import subprocess
+import sys
+import time
+import urllib.request
+
+import websockets
+from websockets.exceptions import WebSocketException
+
+ROOT = Path('/repo')
+sys.path[:0] = [str(ROOT/'ui'), str(ROOT/'tests')]
+import frame_decky_store
+from framey_official import PLUGINS, archive
+
+
+async def request(route, args):
+    token = urllib.request.urlopen('http://127.0.0.1:1337/auth/token', timeout=2).read().decode()
+    async with websockets.connect('ws://127.0.0.1:1337/ws?auth='+token,
+                                  open_timeout=3, close_timeout=2) as ws:
+        await ws.send(json.dumps({'type': 0, 'id': 1, 'route': route, 'args': args}))
+        while True:
+            response = json.loads(await asyncio.wait_for(ws.recv(), timeout=8))
+            if response.get('id') != 1:
+                continue
+            await ws.send(json.dumps({'type': 3, 'id': 1}))
+            assert response['type'] == 1, response
+            return response['result']
+
+
+def rpc(route, *args):
+    return asyncio.run(request(route, list(args)))
+
+
+def until_ready(read, description):
+    deadline = time.monotonic()+20
+    last = None
+    while time.monotonic() < deadline:
+        try:
+            value = read()
+            if value:
+                return value
+        except (OSError, ValueError, KeyError, TimeoutError, WebSocketException) as error:
+            last = str(error)
+        time.sleep(.1)
+    raise RuntimeError(f'{description} not ready: {last}')
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('id', type=int)
+    parser.add_argument('--reproduce-bound-method-regression', action='store_true')
+    args = parser.parse_args()
+    assert os.getuid() == 1100 and ROOT.is_dir(), 'Run through framey-test-decky-runtime.py'
+    record = next(p for p in PLUGINS if p['id'] == args.id)
+    case = next(p for p in json.loads((ROOT/'tests/decky-runtime/cases.json').read_text()) if p['id'] == args.id)
+    data = archive(record)
+    assert hashlib.sha256(data).hexdigest() == record['sha256']
+    assert frame_decky_store.archive_info(data, record['sha256'], record['name']) == record['folder']
+    home = Path.home()
+    base = home/'.local/share/frame-control/decky'
+    (base/'plugins').mkdir(parents=True)
+    unit = home/'.config/systemd/user/frame-control-decky.service'
+    unit.parent.mkdir(parents=True)
+    unit.write_text('# Private fixture marker; no real service manager is contacted.\n')
+    tools = home/'bin'
+    tools.mkdir()
+    systemctl = tools/'systemctl'
+    systemctl.write_text('#!/bin/sh\ncase "$*" in *is-active*) exit 3;; *) exit 0;; esac\n')
+    systemctl.chmod(0o700)
+    env = dict(os.environ, PATH=str(tools)+':'+os.environ['PATH'])
+    Path('/tmp/frame-control-decky-plugin-runtime-test').write_bytes(data)
+    install = subprocess.run([sys.executable, '-', 'install', 'runtime-test', str(record['id']),
+        record['sha256'], record['folder'], record['version'], '-'], input=frame_decky_store.APPLY,
+        capture_output=True, text=True, env=env, timeout=15)
+    assert install.returncode == 0, install.stderr
+    plugin = base/'plugins'/record['folder']
+    receipt = json.loads((plugin/'.frame-control-store.json').read_text())
+    assert receipt['compatShims'] == [case['shim']], receipt
+    # Exercise the production manifest's API convention, never import Plugin ourselves.
+    manifest = json.loads((plugin/'plugin.json').read_text())
+    assert 'api_version' not in manifest, manifest
+    if args.reproduce_bound_method_regression:
+        assert record['id'] == 111
+        source = (plugin/'main.py').read_text()
+        for old, new in [('self._get_dbus_env(self)', 'self._get_dbus_env()'),
+                         ('self._sp_player_dbus(self,', 'self._sp_player_dbus(')]:
+            assert old in source
+            source = source.replace(old, new)
+        (plugin/'main.py').write_text(source)
+
+    (home/'.local/share/Steam/steamui/images').mkdir(parents=True)
+    loader = base/'PluginLoader'
+    shutil.copy('/input/PluginLoader', loader)
+    loader.chmod(0o700)
+    env.update(UNPRIVILEGED_PATH=str(base), PRIVILEGED_PATH=str(base), CHOWN_PLUGIN_PATH='0',
+               LIVE_RELOAD='0', USE_CEF_CLOSE_WORKAROUND='0', KEEP_SYSTEMD_SERVICE='1',
+               DBUS_SESSION_BUS_ADDRESS='unix:path=/run/user/1100/bus')
+    processes = []
+    report = {'id': record['id'], 'name': record['name'], 'version': record['version'],
+              'sha256': record['sha256'], 'shim': case['shim'], 'calls': []}
+    with (home/'runtime.log').open('w+') as log:
+        try:
+            if case['probe'] == 'mpris':
+                bus = subprocess.Popen(['dbus-daemon', '--session', '--nofork',
+                    '--address='+env['DBUS_SESSION_BUS_ADDRESS']], env=env, stdout=log, stderr=log,
+                    start_new_session=True)
+                processes.append(bus)
+                until_ready(lambda: Path('/run/user/1100/bus').is_socket(), 'private session bus')
+                player = subprocess.Popen([sys.executable, str(ROOT/'tests/fixtures/framey-mpris/player.py')],
+                    env=env, stdout=log, stderr=log, start_new_session=True)
+                processes.append(player)
+                until_ready(lambda: Path('/tmp/mpris-state.json').is_file(), 'silent MPRIS player')
+            backend = subprocess.Popen([str(loader)], env=env, stdout=log, stderr=log, start_new_session=True)
+            processes.append(backend)
+            discovered = until_ready(lambda: rpc('loader/get_plugins'), 'published Decky plugin discovery')
+            assert len(discovered) == 1 and discovered[0]['name'] == record['name'], discovered
+            assert discovered[0]['version'] == record['version'] and not discovered[0]['disabled'], discovered
+            report['discovered'] = discovered
+
+            def legacy(method, **kwargs):
+                response = rpc('loader/call_legacy_plugin_method', record['name'], method, kwargs)
+                assert response['success'] is True, (method, response)
+                report['calls'].append({'method': method, 'result': response['result']})
+                return response['result']
+
+            if args.reproduce_bound_method_regression:
+                response = rpc('loader/call_legacy_plugin_method', record['name'], 'sp_list_media_players', {})
+                assert response['success'] is False and 'self' in response['result'], response
+                report['expectedRegression'] = response
+                report['result'] = 'historical bad shim rejected by actual Decky legacy dispatch'
+            elif case['probe'] == 'mpris':
+                player_name = 'org.mpris.MediaPlayer2.FrameySilent'
+                assert legacy('sp_list_media_players') == player_name
+                legacy('sp_set_media_player', player=player_name)
+                assert legacy('sp_get_media_player') == player_name
+                assert legacy('sp_identity', orgPath=player_name) == 'Player'  # Upstream truncation.
+                metadata = legacy('get_meta_data')
+                assert 'title|Silent Test Track' in metadata and 'length|180000000' in metadata, metadata
+                assert legacy('sp_track_status') == 'Paused'
+                assert legacy('sp_track_progress') == '12000000'
+                assert legacy('sp_can_seek') == 'true'
+                assert float(legacy('sp_get_volume')) == .4
+                assert legacy('sp_test_volume_control') == 'true'
+                assert json.loads(Path('/tmp/mpris-state.json').read_text())['Volume'] == .4
+                legacy('sp_play')
+                assert legacy('sp_track_status') == 'Playing'
+                legacy('sp_pause')
+                legacy('sp_next')
+                legacy('sp_previous')
+                legacy('sp_seek', amount=2000000)
+                assert legacy('sp_track_progress') == '14000000'
+                legacy('sp_set_position', position=45000000, trackid='/org/framey/TestTrack/1')
+                legacy('sp_set_volume', volume=.25)
+                state = json.loads(Path('/tmp/mpris-state.json').read_text())
+                assert state['PlaybackStatus'] == 'Paused' and state['Volume'] == .25, state
+                assert state['next'] == state['previous'] == 1 and state['Position'] == 45000000, state
+                report['independentState'] = state
+                report['result'] = 'discovery, metadata, transport, seek and volume passed'
+            else:
+                assert case['probe'] == 'screenshots'
+                assert legacy('was_rescued') is False
+                assert legacy('aggregate_all', allapps=[]) == 0
+                report['result'] = 'discovery, backend import and empty screenshot aggregation passed'
+            log.flush()
+            log.seek(0)
+            assert 'Starting Decky version v3.3.0' in log.read()
+            print(json.dumps(report))
+        except Exception:
+            log.flush()
+            log.seek(0)
+            print(log.read()[-12000:], file=sys.stderr)
+            raise
+        finally:
+            for process in reversed(processes):
+                if process.poll() is None:
+                    try:
+                        os.killpg(process.pid, signal.SIGTERM)
+                    except ProcessLookupError:
+                        continue
+                    try:
+                        process.wait(timeout=4)
+                    except subprocess.TimeoutExpired:
+                        try:
+                            os.killpg(process.pid, signal.SIGKILL)
+                        except ProcessLookupError:
+                            pass
+                        process.wait(timeout=4)
+
+
+if __name__ == '__main__':
+    main()

tests/fakegh/gh

@@ -13,6 +13,7 @@ import os
 import shutil
 import subprocess
 import sys
+from urllib.parse import parse_qs
 
 args = sys.argv[1:]
 with open(os.environ["FAKEGH_LOG"], "a") as f:
@@ -49,6 +50,18 @@ while i < len(args):
 
 releases = json.load(open(os.environ["FAKEGH_RELEASES"]))
 repo = "repos/saphid/frame-control/"
+gate = json.load(open(os.environ["FAKEGH_GATES"])) if os.environ.get("FAKEGH_GATES") else {}
+commit = gate.get("tag_commit", "a" * 40)
+tag_object = "b" * 40
+main_jobs = ("checks", "e2e", "ios", "wireless-windows",
+             "server-tests (ubuntu-latest, 3.13)", "server-tests (macos-latest, 3.12)",
+             "server-tests (windows-latest, 3.12)")
+release_jobs = ("draft", "checksums",
+                "build (windows-latest, dist:win, app/dist/*.exe app/dist/*.zip)",
+                "build (ubuntu-latest, dist:linux, app/dist/*.AppImage app/dist/*.deb)",
+                "build (macos-15-intel, dist:mac:x64, app/dist/*.dmg app/dist/*.zip)",
+                "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)")
+decky_jobs = ("decky-runtime (ubuntu-latest)", "decky-runtime (ubuntu-24.04-arm)")
 
 
 def answer(response, fallback):
@@ -67,7 +80,30 @@ if method == "GET" and endpoint.startswith(repo + "git/ref/tags/"):
     tag = endpoint.rsplit("/", 1)[1]
     if tag not in os.environ.get("FAKEGH_TAGS", "").split():
         sys.exit("gh: Not Found (HTTP 404)")
-    print(json.dumps({"ref": "refs/tags/" + tag}))
+    print(json.dumps({"ref": "refs/tags/" + tag,
+                      "object": {"type": "tag", "sha": tag_object}}))
+elif method == "GET" and endpoint == repo + "git/tags/" + tag_object:
+    print(json.dumps({"object": {"type": "commit", "sha": commit}}))
+elif method == "GET" and endpoint.startswith(repo + "actions/workflows/"):
+    path, _, query = endpoint.partition("?")
+    workflow = path.split("/")[5]
+    branch = parse_qs(query).get("branch", [""])[0]
+    is_main = workflow != "release.yml"
+    run_id = {"checks.yml": 501, "release.yml": 502, "decky-runtime.yml": 503}[workflow]
+    run = {"id": run_id, "head_sha": gate.get("main_sha" if is_main else "release_sha", commit),
+           "head_branch": branch, "event": "push", "run_attempt": 1,
+           "status": gate.get("decky_status" if run_id == 503 else ("main_status" if is_main else "release_status"), "completed"),
+           "conclusion": gate.get("decky_conclusion" if run_id == 503 else ("main_conclusion" if is_main else "release_conclusion"), "success"),
+           "html_url": "https://github.com/saphid/frame-control/actions/runs/%s" % run_id}
+    print(json.dumps({"workflow_runs": [run]}))
+elif method == "GET" and endpoint.startswith(repo + "actions/runs/"):
+    run_id = endpoint[len(repo + "actions/runs/"):].split("/")[0]
+    names = {"501": main_jobs, "502": release_jobs, "503": decky_jobs}[run_id]
+    names = [name for name in names if name != gate.get("omit_job")]
+    jobs = [{"name": name, "status": "completed",
+             "conclusion": gate.get("bad_job_conclusion", "success") if name == gate.get("bad_job") else "success"}
+            for name in names]
+    print(json.dumps({"total_count": len(jobs), "jobs": jobs}))
 elif method == "GET" and endpoint.startswith(repo + "releases?"):
     # The fallback is what --jq '.[]' prints.
     answer(releases, "\n".join(json.dumps(r) for r in releases))

tests/test_frame_android_library.py

@@ -276,12 +276,29 @@ class ArtworkTests(unittest.TestCase):
         import threading
         from apk_sources import _images
         gate = threading.Event()
-        with patch.object(_images.socket, 'getaddrinfo', side_effect=lambda *a, **k: gate.wait(5) and []):
-            start = time.monotonic()
-            with self.assertRaisesRegex(_images.SourceError, 'too long'):
-                _images.get('https://example.org/a.png', deadline=start + 0.1)
-            self.assertLess(time.monotonic() - start, 0.4)
-        gate.set()
+        real_join = threading.Thread.join
+        waits = []
+
+        def bounded_join(worker, timeout=None):
+            waits.append(timeout)
+            return real_join(worker, timeout)
+
+        try:
+            with patch.object(_images.socket, 'getaddrinfo', side_effect=lambda *a, **k: gate.wait(5) and []), \
+                    patch.object(_images.threading.Thread, 'join', bounded_join):
+                start = time.monotonic()
+                deadline = start + 0.1
+                with self.assertRaisesRegex(_images.SourceError, 'too long'):
+                    _images.get('https://example.org/a.png', deadline=deadline)
+            # Check the requested wait, not elapsed runner time: a loaded CI
+            # host can deschedule this test after the bounded join returns.
+            self.assertEqual(len(waits), 1)
+            self.assertIsNotNone(waits[0])
+            self.assertGreaterEqual(waits[0], 0)
+            self.assertLessEqual(waits[0], deadline - start)
+        finally:
+            gate.set()
+        wait_for_idle_resolvers()
         with self.assertRaisesRegex(_images.SourceError, 'too long'):
             _images.get('https://example.org/a.png', deadline=time.monotonic() - 1)
 

tests/test_framey_decky_runtime.py

@@ -0,0 +1,36 @@
+"""Managed backend shims must stay covered by the actual-Decky CI gate."""
+import sandbox  # noqa: F401
+import importlib.util
+from pathlib import Path
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+spec = importlib.util.spec_from_file_location('decky_runtime_gate', ROOT/'scripts/framey-test-decky-runtime.py')
+gate = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(gate)
+
+
+class RuntimeCoverage(unittest.TestCase):
+    def test_current_shims_have_unique_official_archive_probes(self):
+        from framey_official import PLUGINS
+        cases = gate.check_coverage()
+        official = {record['id'] for record in PLUGINS}
+        self.assertEqual(len(cases), len({case['id'] for case in cases}))
+        for case in cases:
+            self.assertIn(case['id'], official)
+            self.assertIn(case['probe'], ('mpris', 'screenshots'))
+
+    def test_new_shim_without_runtime_case_fails_coverage(self):
+        import frame_decky_store
+        with patch.object(frame_decky_store, 'APPLY', frame_decky_store.APPLY+
+                          '\ncompat_shims.append("uncovered-new-shim")\n'):
+            with self.assertRaisesRegex(ValueError, 'Every managed shim'):
+                gate.check_coverage()
+
+    def test_dynamic_shim_names_cannot_evade_inventory(self):
+        import frame_decky_store
+        with patch.object(frame_decky_store, 'APPLY', frame_decky_store.APPLY+
+                          '\ncompat_shims.append(variable_name)\n'):
+            with self.assertRaisesRegex(ValueError, 'literal name'):
+                gate.check_coverage()

tests/test_publish_release.py

@@ -37,12 +37,14 @@ def draft(tag_name="untagged-c6ddfed7f75d67db2e99", name="Frame Control 9.8.7",
 
 
 class PublishRelease(unittest.TestCase):
-    def run_script(self, releases, *args, tags="v9.8.7"):
+    def run_script(self, releases, *args, tags="v9.8.7", gates=None):
         d = Path(tempfile.mkdtemp())
         (d / "releases.json").write_text(json.dumps(releases))
+        (d / "gates.json").write_text(json.dumps(gates or {}))
         env = dict(os.environ, PATH="%s:%s" % (FAKEGH, os.environ["PATH"]),
                    FAKEGH_RELEASES=str(d / "releases.json"), FAKEGH_TAGS=tags,
-                   FAKEGH_LOG=str(d / "log"), FAKEGH_UPLOAD=str(d / "upload.json"))
+                   FAKEGH_LOG=str(d / "log"), FAKEGH_UPLOAD=str(d / "upload.json"),
+                   FAKEGH_GATES=str(d / "gates.json"))
         p = subprocess.run(["sh", str(SCRIPT), *args], env=env, capture_output=True, text=True, timeout=30)
         log = [json.loads(line) for line in (d / "log").read_text().splitlines()] if (d / "log").exists() else []
         upload = json.loads((d / "upload.json").read_text()) if (d / "upload.json").exists() else None
@@ -120,6 +122,36 @@ class PublishRelease(unittest.TestCase):
         self.assertIsNone(upload)
         self.assertTrue(all("-X" not in c for c in log))
 
+    def test_refuses_failed_e2e_or_cancelled_installer_before_mutation(self):
+        for gates in ({"bad_job": "e2e", "bad_job_conclusion": "failure"},
+                      {"bad_job": "decky-runtime (ubuntu-24.04-arm)",
+                       "bad_job_conclusion": "failure"},
+                      {"bad_job": "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)",
+                       "bad_job_conclusion": "cancelled"}):
+            p, log, upload = self.run_script([draft()], "v9.8.7", gates=gates)
+            self.assertNotEqual(p.returncode, 0)
+            self.assertIn("release gate failed", p.stderr)
+            self.assertIsNone(upload)
+            self.assertFalse(any("-X" in call for call in log))
+
+    def test_refuses_missing_or_nonexact_gate_results(self):
+        for gates in ({"omit_job": "e2e"}, {"main_sha": "c" * 40},
+                      {"decky_conclusion": "failure"}, {"release_conclusion": "failure"},
+                      {"release_status": "in_progress"}):
+            p, log, upload = self.run_script([draft()], "v9.8.7", gates=gates)
+            self.assertNotEqual(p.returncode, 0)
+            self.assertIn("release gate failed", p.stderr)
+            self.assertIsNone(upload)
+            self.assertFalse(any("-X" in call for call in log))
+
+    def test_refuses_a_withdrawn_release_even_when_ci_is_green(self):
+        rel = dict(draft(), body="> **WITHDRAWN 26 October 2026.** Do not install.\n\n# Notes")
+        p, log, upload = self.run_script([rel], "v9.8.7")
+        self.assertNotEqual(p.returncode, 0)
+        self.assertIn("marked WITHDRAWN", p.stderr)
+        self.assertIsNone(upload)
+        self.assertFalse(any("-X" in call for call in log))
+
 
 if __name__ == "__main__":
     unittest.main()

ui/framey-compatibility.json

@@ -1794,7 +1794,7 @@
       },
       "backend": "Python + native payload",
       "hardware": "No specific hardware requirement detected statically; runtime requirements unverified.",
-      "nativePort": "A source-matched ARM64 bin/hash helper matched the official x86_64 helper on one synthetic ROM on the real Frame (docs/evidence/framey-emuchievements-arm-2026-10-26.md). The official ZIP still bundles x86_64 bytes and remains blocked; format coverage, packaging, plugin backend/UI, login and worn VR are unverified.",
+      "nativePort": "A source-matched ARM64 helper matched one synthetic ROM on the real Frame (docs/evidence/framey-emuchievements-arm-2026-10-26.md). The pinned upstream source proposed for packaging also has unsafe archive extraction and cleanup paths (docs/evidence/framey-native-port-blockers-2026-10-26.md); fix and test those before shipping an ARM64 binary. The official x86_64 ZIP remains blocked; format coverage, plugin backend/UI, login and worn VR are unverified.",
       "uiSurfaces": [
         "local/Steam routes",
         "toasts",
@@ -3597,7 +3597,7 @@
         "https://github.com/GedasFX/decky-cloud-save.git"
       ],
       "status": "broken",
-      "reason": "Unsafe plugin archive member.",
+      "reason": "The exact official ZIP contains a 60,776,600-byte x86_64 rclone member, above the 30 MiB member limit and unusable on ARM64. Installation remains blocked.",
       "blockInstall": true,
       "verification": [
         "static archive",
@@ -3632,7 +3632,7 @@
       },
       "backend": "Python + native payload",
       "hardware": "No specific hardware requirement detected statically; runtime requirements unverified.",
-      "nativePort": "rclone needs an ARM64 artifact; this ZIP also fails safe member validation. Cloud writes were not exercised.",
+      "nativePort": "An ARM64 rclone artifact and safe package policy are needed; the official 60,776,600-byte x86_64 member fails archive validation. No cloud writes were run (docs/evidence/framey-native-port-blockers-2026-10-26.md).",
       "uiSurfaces": [
         "local/Steam routes",
         "toasts",