docs: record v0.4.42 tagged release verification

Framey: bridge running-game context and Steam lifetime notifications

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.41",
+  "version": "0.4.42",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.41",
+      "version": "0.4.42",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.41",
+  "version": "0.4.42",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",

docs/evidence/v0442-candidate-2026-10-26.md

@@ -0,0 +1,9 @@
+# v0.4.42 candidate gate, 26 October 2026
+
+This branch bumps the app and lockfile to 0.4.42. It includes the [v0.4.41 release evidence](v0441-release-2026-10-26.md), the Framey panel lifecycle change in PR #299, the truthful optional-runtime smoke result in PR #300, the physical Intel Mac acceptance and host-test fixes in PR #303 (`fe1da43171883dc31161ff607c6b5a6ddf75f6ef`), and the receipt-bound API guard in PR #301 (`ad57662d40d3bbf6c850dd80ddc275280d389c86`). All 11 hosted checks passed on PR #301's exact head before its normal merge. The combined release candidate's own headset gates passed; exact-head CI and installer previews remain pending.
+
+The exact v0.4.42 candidate at `27af46dd20d7af30dde4c3f954d7b57b94843594` ran `scripts/frame-smoke.sh` under its unique shared lock at 05:40 UTC. Locked preflight found standby activity 3, proximity 6.25 and battery 99%. It recorded **12 passed / 1 skipped / 0 failed** on Frame OS 0.5.6 build `20261022.6153909`; ARM64 and Proton test executables launched. The x86_64 launch was skipped because Steam Linux Runtime 4 was not installed. Cleanup passed and the command exited 0. The private detailed result is `tests/smoke/results/2026-10-26T054014Z-20261022.6153909.json` in the candidate checkout. The prior PR #300 result is documented [separately](frame-smoke-runtime-skip-2026-10-26.md).
+
+The exact candidate then ran `scripts/framey-vr-check.py --exercise` under a fresh owned lock at 05:41 UTC. Preflight again found activity 3 and battery 99%. The real Decky sample setting saved `enabled=true` and survived a fresh iframe; the quick action read the same value. A trusted synthetic OpenVR pointer reached the panel; the sample slider reached 50 and CDP text entry after OpenVR focus reached `framey-ci`. Stereo compositor hashes changed from `38265343e13f5915869c9622ab1ceda7c31ab2e9b050f44564cfb9b6dc9f6e6d` to `64cc4c6f865bb8b2f756632c922d17dee12af40d480171586f2e9a51797b83e6`; the mirror capture hash was `165289dca9ad2bd895eb544f5be5d5fa2db7d2f635a927ac68a0c74267f69ee2`. The exercise exited 0 with `passed=true`, battery 99% afterward, original power values restored (`false` / `5.000000`), recovery timer removed, no cleanup errors and its own lock released. Its private full result is `/tmp/framey-v0442-exercise/result.json` on the test host. Synthetic scroll events left `scrollTop=0` and produced no wheel events. No person wore the Frame; physical controller interaction, official plugin VR panels, optical readability, VR keyboard and comfort remain unverified. The earlier [receipt-guard exercise](framey-receipt-live-2026-10-26.md) is separate evidence.
+
+The release tag and published installers do not exist at this candidate stage. Publication remains gated on this combined head's exact-head CI, then tagged installer checksums, package checks and public updater readback. The 116 exact-version Decky catalog remains **3 works / 48 partial / 54 broken / 11 N/A**; the two additional works claims are restricted to tested per-app silent-stream volume control. The official v0.4.39 Intel installer ran on a physical MacBook Air, but no tagged v0.4.42 Mac launch or real OBS audio/video check is claimed.

docs/evidence/v0442-release-2026-10-26.md

@@ -0,0 +1,62 @@
+# v0.4.42 tagged release, 26 October 2026
+
+The annotated `v0.4.42` tag dereferences to main merge commit
+`98909cb54374a7bd7ec1f665f50eda20fa196f32` from PR #302. The app and
+lockfile both report 0.4.42. The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40276685171)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs.
+The Linux job launched its built AppImage under isolated Xvfb. CI does not prove
+a physical Windows or Mac launch.
+
+## Real Frame, exact tag
+
+From an exact tag checkout, `scripts/frame-smoke.sh` acquired its own unique
+owner in `/tmp/frame-test.lock` before reading the headset. Preflight found
+SteamVR activity 3 (standby), proximity 6.25 and battery 100%. On Frame OS 0.5.6
+build `20261022.6153909`, it recorded **12 passed / 1 skipped / 0 failed** and
+exited 0. ARM64 and Proton test executables launched. The x86_64 title was
+installed and removed, but its launch was skipped because optional Steam Linux
+Runtime 4 was absent. Test title/process cleanup passed and only the run's lock
+was released. The private result is
+`tests/smoke/results/2026-10-26T055940Z-20261022.6153909.json` in the exact tag
+checkout.
+
+The separate [unworn Framey candidate exercise](v0442-candidate-2026-10-26.md)
+passed real sample setting save/reopen, synthetic OpenVR pointer delivery and
+stereo compositor change, with power restored and cleanup complete. It was run
+on the release branch's code before the evidence-only final commit. No person
+wore the Frame. Neither run verifies official plugin VR panels, physical
+controller usability, native scrolling, VR keyboard or optical comfort. The
+hourly worn check remains enabled.
+
+## Installer, checksum and updater checks
+
+The draft held ten installers plus `SHA256SUMS`, each with a GitHub SHA-256
+digest. `scripts/publish-release.sh --dry-run v0.4.42` checked the exact remote
+tag and every installer digest, regenerated the checksum list from those
+metadata digests, and matched the uploaded `SHA256SUMS` digest. A fresh
+checksum-list download independently matched
+`e5c85f5a46d789dccafae5259bd00b9b048dd10ca4f2a6cdc52d1f432a6db989`.
+
+A fresh Linux x86_64 AppImage download matched
+`16fc9fbe448bccbe59aa4206bc171c6bfc741973d2b4da0a79652a5c11d837b3`.
+`scripts/check-appimage-launch.py` launched those exact bytes under isolated
+Xvfb: the bundled server answered HTTP 200 with `FrameControl/1` and then
+stopped. Fresh Mac ZIP downloads matched GitHub digests: arm64
+`394d6088e732a19289b7b92366dd247f14f7293a345d57ed5c4e9c83a50abad3`
+and x64 `66d4606e38210d02af59dc87e4d1216282ad9e968056d7096f247fcc51e72395`.
+Both bundles report version 0.4.42; their main Mach-O CPU types are arm64 and
+x86_64 respectively. Neither tagged Mac ZIP was launched on a physical Mac.
+
+`scripts/publish-release.sh v0.4.42` published
+[v0.4.42](https://github.com/saphid/frame-control/releases/tag/v0.4.42) at
+2026-10-26 06:02:20 UTC. GitHub's latest-release API read back `draft=false`,
+`prerelease=false`, the expected tag, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` parsed as
+version 0.4.42 with the stable release page and ten SHA-256 installer digests.
+The tag contains #299, #300, #301 and #303 through #302's release merge.
+#304 merged after the tag and is not in this release.
+
+The exact-version official Decky table for v0.4.42 is **3 works / 48 partial /
+54 broken / 11 N/A**. The two additional works labels are restricted to tested
+per-app silent-stream volume control. Audible playback and official-plugin
+worn VR remain unverified.