Merge pull request #362 from saphid/feat/framey-localsend-arm64

Document official LocalSend source match for ARM64

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.49",
+  "version": "0.4.50",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.49",
+      "version": "0.4.50",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.49",
+  "version": "0.4.50",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",

docs/evidence/framey-localsend-source-match-2026-10-27.md

@@ -0,0 +1,55 @@
+# Decky Localsend 0.4.5 source match and ARM64 build, 27 October 2026
+
+The exact official store archive (ID 125, SHA-256
+`e271ccb55eb23f918b99a69f79aec905df4c9b2ef7b23bbf4ec1c2d1a6f0c6b7`)
+remains **blocked** on Frame: it carries an x86_64 `bin/localsend-core`.
+No managed plugin install, transfer, or status promotion was performed.
+
+The archive's `main.py` has SHA-256
+`db03f9201fe50b75dea99a7a05b54ec3f352d1bdfe174115b0e569154198d8ad`,
+identical byte for byte to `main.py` at the upstream Decky plugin tag `v0.45`
+(`7c166bdc33e2a667527ffd511eb5b90d3ce0bd67`). That tag pins its Go
+submodule to `ad28b8e9440e17e44b4735a6c4aa0512009cf333`. All 42 dependency
+versions embedded in the official helper match that source's `go.mod`, which
+declares Go 1.25.7.
+
+Building that pinned Go commit with `CGO_ENABLED=0`, `GOOS=linux`,
+`GOARCH=amd64`, and the flags `-trimpath -buildvcs=false -ldflags='-s -w'`
+produced **byte-identical** official helper bytes: 15,241,400 bytes,
+SHA-256 `d448d03861d578685e6c70ea3ace25eb34fca99cb9d4f98bf51ba23aa5cae843`.
+This resolves the source correspondence gap left by the earlier build from
+the later `66edc509` commit. The same pinned source and flags with
+`GOARCH=arm64` produced a static AArch64 ELF of 11,731,128 bytes, SHA-256
+`e20363237e606ee65eae857792176d21a0bb8ba863489952728eaf2b13277dae`.
+Two ARM64 builds matched byte for byte. The Go core is MIT licensed; the
+separate Decky Python plugin is BSD-3-Clause.
+
+A unique-owner atomic `/tmp/frame-test.lock` preflight on the real Frame read
+SteamVR activity **1**, proximity raw **88.0625**, and battery **35%**.
+Because the headset was active or wearer status was unknown, the probe did
+not upload or execute the ARM64 helper, start a LocalSend service, or send
+input. The task-owned directory was absent and only the owned lock was
+released. This is **not** a worn visual or controller result.
+
+The unmodified plugin backend's `_main` starts a fixed-path Unix notification
+socket but does not start the Go network service. Its explicit `start_backend`
+method starts the helper with a default all-interface setting, HTTPS and
+auto-save disabled. A local follow-up ran that exact Python backend with the
+official x86_64 helper in a disposable user/network namespace. A veth pair
+provided only documentation-range private addresses and there was no default
+route. A private Decky module stub supplied task-owned settings, runtime,
+plugin and log directories; its notification socket was moved into that
+directory. The backend's `start_backend`, `proxy_get` info request and
+`proxy_post` prepare/upload methods passed. One 42-byte public marker
+arrived in the private upload directory with independent SHA-256
+`346373ca56ec52c3f47b8d41de2a6a8479d8ad10d2891ff3b0dc7ea9c3892a39`.
+The backend stopped, its process and private directory were absent, and the
+global notification socket was untouched. This verifies the upstream x86
+backend/proxy/transfer contract locally, **not** Decky 3.3.0 discovery, ARM64
+transfer, an installed Frame plugin or real-network transfer.
+
+Before a managed ARM64 adaptation, verify actual Decky backend discovery/RPC,
+the frontend and a private transfer with the exact-source ARM64 helper;
+package the source, license and exact helper digest. The official x86_64
+archive remains blocked until that work passes. Worn VR and physical
+controller use remain unverified.

docs/evidence/framey-toggle-2026-10-27.json

@@ -0,0 +1,308 @@
+{
+  "date": "2026-10-27",
+  "scope": "Shared standalone Toggle value prop; no plugin-wide status promotion",
+  "affected": [
+    {
+      "id": 7,
+      "name": "CSS Loader",
+      "version": "2.1.3",
+      "sha256": "99beaf1374af82408e6d056e0b0147e5fca544e1035fa7ab88419231697bc231",
+      "status": "partial"
+    },
+    {
+      "id": 13,
+      "name": "Pause Games",
+      "version": "1.0.3",
+      "sha256": "4aefdfb0ef25dea9c6d9fd037731c8b99ee8a1be966c2f7d5b0602112ef29f62",
+      "status": "partial"
+    },
+    {
+      "id": 32,
+      "name": "AutoFlatpaks",
+      "version": "1.6.8",
+      "sha256": "344fce82cfb4800caccb4d6c0ec46e1ad6c9594a622d5baa0bb31286baf2d1a5",
+      "status": "broken"
+    },
+    {
+      "id": 60,
+      "name": "DeckyFileServer",
+      "version": "1.2.0",
+      "sha256": "7dc2ecdcd05aa415d1ac90afaff28ecb17f77809a2bc7a77aee8e92505b976f0",
+      "status": "broken"
+    },
+    {
+      "id": 64,
+      "name": "Syncthing",
+      "version": "0.2.7",
+      "sha256": "27e47379c280c92253d5533435f57c33b332b215f866d2ac4493daf18ec0d1c4",
+      "status": "broken"
+    },
+    {
+      "id": 113,
+      "name": "Decky LSFG-VK",
+      "version": "0.12.2",
+      "sha256": "ec59fc8aceb4e1abe2066b3a0707ed6313cabc4421b7c17765397903e2f8fd26",
+      "status": "partial"
+    },
+    {
+      "id": 116,
+      "name": "Muon",
+      "version": "0.2.1",
+      "sha256": "a7659c79b74110476cc4458cb10530cdcb2539fa11bc8c759038a080eaa81049",
+      "status": "broken"
+    },
+    {
+      "id": 126,
+      "name": "Launch Options",
+      "version": "1.9.2",
+      "sha256": "381ac8b915402176cf768d1ccc1bc29a6b82ea9255675f0a30c0c81ea5427225",
+      "status": "broken"
+    },
+    {
+      "id": 129,
+      "name": "ShadowDeck",
+      "version": "1.1.11",
+      "sha256": "2b97b769a49ac2a45f546090fc96d07e09e146020104d708a0efdad990687f8b",
+      "status": "broken"
+    }
+  ],
+  "browser": {
+    "passed": true,
+    "opaqueOrigin": "null",
+    "checks": [
+      "saved true renders checked",
+      "standalone Toggle has no empty field wrapper",
+      "native click writes boolean false and rerenders",
+      "second click writes boolean true",
+      "external false update renders unchecked",
+      "external true update renders checked",
+      "disabled Toggle stays inert",
+      "ToggleField checked contract preserved"
+    ]
+  },
+  "publishedDeckyRuntime": {
+    "version": "v3.3.0",
+    "architecture": "x86_64",
+    "loaderSha256": "e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181",
+    "totalProbes": 8,
+    "pauseGames": {
+      "id": 13,
+      "name": "Pause Games",
+      "version": "1.0.3",
+      "sha256": "4aefdfb0ef25dea9c6d9fd037731c8b99ee8a1be966c2f7d5b0602112ef29f62",
+      "shim": null,
+      "calls": [
+        {
+          "method": "load_settings",
+          "result": {}
+        },
+        {
+          "method": "save_setting",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true
+          }
+        },
+        {
+          "method": "save_setting",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": false
+          }
+        },
+        {
+          "method": "save_setting",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true
+          }
+        },
+        {
+          "method": "add_no_auto_pause_set",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true,
+            "noAutoPauseSet": [
+              424242
+            ]
+          }
+        },
+        {
+          "method": "remove_no_auto_pause_set",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true,
+            "noAutoPauseSet": []
+          }
+        }
+      ],
+      "discovered": [
+        {
+          "name": "Pause Games",
+          "version": "1.0.3",
+          "load_type": 1,
+          "disabled": false
+        }
+      ],
+      "result": "discovery and Toggle-backed private settings persistence passed; no process actions"
+    }
+  },
+  "realFrame": {
+    "timeUtc": "2026-10-27T01:10:45.197435+00:00",
+    "architecture": "aarch64",
+    "runtime": {
+      "version": "v3.3.0",
+      "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+    },
+    "backend": {
+      "passed": true,
+      "discovered": [
+        {
+          "name": "Pause Games",
+          "version": "1.0.3",
+          "load_type": 1,
+          "disabled": false
+        }
+      ],
+      "privateSettingsPersisted": true,
+      "calls": [
+        {
+          "method": "load_settings",
+          "result": {}
+        },
+        {
+          "method": "save_setting",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true
+          }
+        },
+        {
+          "method": "save_setting",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": false
+          }
+        },
+        {
+          "method": "save_setting",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true,
+            "pauseBeforeSuspend": false,
+            "overlayPause": false,
+            "noAutoPauseSet": []
+          }
+        },
+        {
+          "method": "add_no_auto_pause_set",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true,
+            "pauseBeforeSuspend": false,
+            "overlayPause": false,
+            "noAutoPauseSet": [
+              424242
+            ]
+          }
+        },
+        {
+          "method": "remove_no_auto_pause_set",
+          "result": null
+        },
+        {
+          "method": "load_settings",
+          "result": {
+            "autoPause": true,
+            "pauseBeforeSuspend": false,
+            "overlayPause": false,
+            "noAutoPauseSet": []
+          }
+        }
+      ]
+    },
+    "batteryBefore": [
+      100
+    ],
+    "batteryAfter": [
+      100
+    ],
+    "originalServiceStatesPreserved": true,
+    "cleanup": {
+      "baseAbsent": true,
+      "unitAbsent": true,
+      "archiveAbsent": true
+    },
+    "lockReleased": true,
+    "independentCleanupAudit": {
+      "passed": true,
+      "privateBasesUnitsUploadsAbsent": true,
+      "privateUnitsNotLoaded": true
+    }
+  },
+  "fakeFrame": {
+    "blocked": 55,
+    "installed-removed": 61
+  },
+  "python": {
+    "ran": 1659,
+    "skipped": 16,
+    "result": "OK"
+  },
+  "unverified": [
+    "Other importer plugin backends",
+    "Process pause/resume",
+    "Automatic pausing/suspend",
+    "Physical controller/keyboard",
+    "Worn VR"
+  ],
+  "affectedSnapshot": "Initial independent verification before merging main b963937; DeckyFileServer is partial in the merged catalog.",
+  "mergeValidation": {
+    "mainCommit": "b963937",
+    "catalog": {
+      "works": 6,
+      "partial": 51,
+      "broken": 48,
+      "na": 11
+    },
+    "python": {
+      "ran": 1663,
+      "skipped": 16,
+      "result": "OK"
+    },
+    "publishedDeckyRuntime": {
+      "version": "v3.3.0",
+      "architecture": "x86_64",
+      "probes": 10,
+      "result": "All passed, including Pause Games and DeckyFileServer positive/negative cases"
+    },
+    "hardwareRerun": false
+  }
+}

docs/evidence/framey-toggle-2026-10-27.md

@@ -0,0 +1,80 @@
+# Shared standalone Toggle contract — 2026-10-27
+
+Framey previously exported `DFL.Toggle` as `ToggleField`. Official standalone
+toggles pass `value`, while ToggleField takes `checked`. A saved true setting
+therefore appeared unchecked, and clicking it could send true again instead of
+turning it off. Toggle now renders a standalone controlled checkbox from
+`value`; ToggleField retains its `checked` contract. Both emit booleans and keep
+disabled controls inert. No official archive or manifest is rewritten.
+
+Nine exact catalog archives use this standalone contract: CSS Loader (7),
+Pause Games (13), AutoFlatpaks (32), DeckyFileServer (60), Syncthing (64),
+Decky LSFG-VK (113), Muon (116), Launch Options (126), and ShadowDeck (129).
+These are affected API consumers, **not nine verified working plugins**.
+Their existing root, native, Steam UI and runtime blockers still apply.
+The catalog records this repair without promoting any status.
+
+## Verification
+
+- The Node regression fails against the old alias: true renders false. It
+  passes with the fix and checks true/false callbacks, disabled behavior and
+  the unchanged ToggleField contract.
+- The pinned, unmodified Pause Games 1.0.3 frontend component renders both
+  persisted exclusion-list states and dispatches only its expected add/remove
+  settings callbacks. This VM fixture does not run effects or process actions.
+- Local Chromium, React 18.3.1 and the production host in an opaque sandboxed
+  iframe pass eight DOM checks: saved true, standalone shape, false/true native
+  clicks and rerenders, external false/true updates, disabled input, and
+  ToggleField. This is a control fixture, not nine end-to-end plugin tests.
+- Actual published Decky 3.3.0 on native amd64 discovers the exact Pause Games
+  archive and uses public API1 instance RPC to save/read true/false settings,
+  add/remove a synthetic exclusion and independently read its private settings
+  file. This is a permanent runtime probe alongside existing backend shims;
+  all eight probes, including historical negative cases, pass. Hosted CI also
+  runs this gate on native ARM64; local ARM64 evidence below is from the Frame.
+- Under the shared headset lock, a bounded, removable private Decky 3.3.0 ARM64
+  user service repeats discovery and those safe settings operations through
+  the normal Steam CEF DeckyBackend bridge. The private file readback matches.
+  The harness never requests pause/resume/kill or suspend operations. Steam's
+  Decky frontend also populated its normal default setting keys during this
+  run; no running-game behavior is claimed.
+- Fake-Frame audit: all 116 archives attempted, 61 installed/removed and 55
+  blocked by existing policy. Full Python suite: 1,659 tests, 16 skipped, OK.
+
+The exact Pause Games archive SHA-256 is
+`4aefdfb0ef25dea9c6d9fd037731c8b99ee8a1be966c2f7d5b0602112ef29f62`.
+The official store refresh still contains 116 entries; all pinned IDs, versions
+and digests are unchanged.
+[Structured results](framey-toggle-2026-10-27.json) include scoped readbacks and
+the nine version/digest pairs.
+
+## Probe retries and cleanup
+
+The first hardware adapter connected directly to Decky's single WebSocket and
+reused a request ID also used by Steam CEF; it received an unrelated cached
+reply. A second adapter retained a CEF connection across Decky's startup reload
+and disconnected. Neither is a successful plugin verification. Both private
+services and files were removed. The successful adapter waits for startup and
+reattaches CEF during discovery, then serializes settings calls through the
+normal DeckyBackend bridge.
+
+All private services, bases and uploaded archives were removed, and the shared
+lock was released. An independent locked audit confirms no matching unit is
+loaded and no private base, unit file or upload remains. Original managed Decky
+and panel states were preserved. Battery stayed 100 → 100 during the successful
+run; no power setting changed.
+
+No plugin gains a works claim. Real process control, other importer backends,
+physical input and worn VR remain unverified. The original independent branch
+had **6 works / 50 partial / 49 broken / 11 N/A**. After merging main's landed
+DeckyFileServer ARM64 support, current totals are **6 works / 51 partial /
+48 broken / 11 N/A**. Its managed-native receipt guard and both runtime probes
+are preserved; its former Toggle display limitation is removed from the current
+catalog reason. The initial verification counts above describe the original
+branch; combined validation is recorded below.
+
+Combined merge validation against main `b963937`: full Python suite passes
+1,663 tests with 16 skips; all ten actual published Decky 3.3.0 native amd64
+probes pass, including Pause Games settings and DeckyFileServer positive/negative
+cases. Generated documentation matches the merged catalog. No hardware rerun
+was needed for these fixture/catalog conflicts.

docs/evidence/v0450-assets-2026-10-27.json

@@ -0,0 +1,76 @@
+{
+  "tag": "v0.4.50",
+  "releaseId": 424993367,
+  "tagNameAtAudit": "v0.4.50",
+  "draftAtAudit": true,
+  "sha256sumsSha256": "85383104a8f08f49ffde24ac867f9c2ead41951e602600a9d22d58bc19bf06f5",
+  "assets": [
+    {
+      "name": "Frame-Control-mac-arm64.dmg",
+      "size": 173090558,
+      "sha256": "d402924394725bac2b28bef17c7945e2f7e4c3093227eace78a42ed80e864be9",
+      "udifTrailer": "ok"
+    },
+    {
+      "name": "Frame-Control-mac-arm64.zip",
+      "size": 172911785,
+      "sha256": "2583937fefdc315706018c1bf794b916726ee55b461e321c3334df21245a110d",
+      "zipCrc": "ok",
+      "members": 1666,
+      "bundleVersion": "0.4.50"
+    },
+    {
+      "name": "Frame-Control-mac-x64.dmg",
+      "size": 180139223,
+      "sha256": "2128c14b15dd1a2a59790c43d42640a25185562056796a3437910d6f88f996c8",
+      "udifTrailer": "ok"
+    },
+    {
+      "name": "Frame-Control-mac-x64.zip",
+      "size": 179998207,
+      "sha256": "ed684023ff087d6741e88d4ca4f8a47e67bec07255fc73fbd18a6bcaa42d14fe",
+      "zipCrc": "ok",
+      "members": 1662,
+      "bundleVersion": "0.4.50"
+    },
+    {
+      "name": "Frame-Control-Setup-x64.exe",
+      "size": 147348168,
+      "sha256": "7c46fcc759cefb9060e1dc2fce39682f6dad306f3666805f77ce707e16ef3e2c",
+      "peMachine": 332
+    },
+    {
+      "name": "Frame-Control-win-x64.zip",
+      "size": 194302082,
+      "sha256": "57e71304bae96dc8aab6b845a64c27ac428931d02bb41ae60b33b19fcd11193f",
+      "zipCrc": "ok",
+      "members": 1510
+    },
+    {
+      "name": "Frame-Control-linux-x86_64.AppImage",
+      "size": 175453095,
+      "sha256": "d2196b9a50d0777203e60721dd19c6edbb5c18a7639148f0a496d420e231b053",
+      "elfMachine": 62
+    },
+    {
+      "name": "Frame-Control-linux-arm64.AppImage",
+      "size": 167036625,
+      "sha256": "49370f9c27931bf6c28676d627dc34553550b544ab38b7f4be8e8f6dbc9b7c4b",
+      "elfMachine": 183
+    },
+    {
+      "name": "Frame-Control-linux-amd64.deb",
+      "size": 142209572,
+      "sha256": "430d057f234557f5f9dbb3e2cff3469829d041d0d7be191e70e6ef7de6663256",
+      "debVersion": "0.4.50",
+      "architecture": "amd64"
+    },
+    {
+      "name": "Frame-Control-linux-arm64.deb",
+      "size": 129291236,
+      "sha256": "6403f8caafcdd5832415547e146ce3886cf7358e0c3a8898f4ee6e9a0a7b05ea",
+      "debVersion": "0.4.50",
+      "architecture": "arm64"
+    }
+  ]
+}

docs/evidence/v0450-candidate-2026-10-27.md

@@ -0,0 +1,52 @@
+# v0.4.50 candidate gate, 27 October 2026
+
+The version bump at `a160043` follows the merged Windows panel-response repair
+[#356](https://github.com/saphid/frame-control/pull/356) and the Framey changes
+[#353](https://github.com/saphid/frame-control/pull/353),
+[#354](https://github.com/saphid/frame-control/pull/354),
+[#355](https://github.com/saphid/frame-control/pull/355),
+[#357](https://github.com/saphid/frame-control/pull/357),
+[#358](https://github.com/saphid/frame-control/pull/358), and
+[#359](https://github.com/saphid/frame-control/pull/359).
+The exact DeckyFileServer catalog entry is **partial**; the shared Toggle fix
+does not promote any plugin status. Worn VR and physical controller behavior
+remain unverified.
+
+## Locked real Frame smoke
+
+Early `scripts/frame-smoke.sh` attempts exited before any headset read or test
+action because lxso2's Tailnet route was down and lxso1 lacked the authorized
+SSH key and pinned host record. No lock was taken by those attempts. The final
+run kept lxso2's existing private key and pinned Frame host key end to end,
+using lxso1 only as a TCP relay. A task-owned localhost tunnel reached the
+devkit endpoint after the runner acquired `/tmp/frame-test.lock`; no global
+SSH, network or security setting was changed.
+
+At **02:25:14 UTC**, `scripts/frame-smoke.sh` ran from candidate commit
+`fcae5d6` on Frame OS **0.5.6**, build `20261022.6153909`. Its locked
+read-only preflight found SteamVR activity **3 (standby)**, proximity raw
+**3.25** and battery **100%**. The result was **12 passed / one optional
+x86_64 launch skipped / zero failed**. ARM64 and Windows/Proton test titles
+installed, launched and were removed. The x86_64 title installed and was
+removed, but Steam Linux Runtime 4 was absent, so no x86_64 launch is claimed.
+Both the initial leftover sweep and final owned cleanup passed; the runner
+released only its lock. The private result is
+`/tmp/frame-control-v0450-smoke-results/2026-10-27T022514Z-20261022.6153909.json`
+(SHA-256 `7b8d88aafb4459bf882edeb10f65c021c5aa25ad9ed2755faf04e3b4a95c1632`).
+
+A separate read-only audit acquired a fresh unique lock after the smoke. It
+found activity **3**, proximity raw **3.25**, battery **100%**, no exact reserved
+`fc_smoke_*` or `fc-smoke-*` title directories or metadata, and no processes
+owned by those paths. That audit released its own lock. The local tunnel was
+stopped; the isolated lxso1 checkout and temporary SSH files were removed.
+There was no wearer confirmation, wake command or worn interaction test.
+
+## Remaining release gates
+
+The candidate needs green exact-head PR CI, e2e, native amd64/ARM64 Decky
+runtime checks and all four installer previews. After the candidate merges,
+its exact main commit needs green CI and e2e. The tagged release then needs
+every installer build, ten assets, matching checksums, release verification,
+independent package checks and publisher dry run. A failed, cancelled, skipped,
+pending or unverified release gate holds publication. The current published
+release remains v0.4.49.

docs/evidence/v0450-release-2026-10-27.md

@@ -0,0 +1,75 @@
+# v0.4.50 tagged release verification, 27 October 2026
+
+The annotated `v0.4.50` tag dereferences to merged main commit
+`2797212d8c95311deb8ba73043d0f90ba10bc962`. Its tree exactly matched
+the reviewed [candidate PR #360](https://github.com/saphid/frame-control/pull/360)
+head `dab13fa8763b4f836cd49d398d152124655ea8dc`. The candidate includes
+the Framey and Windows changes listed in the public release notes and the
+publisher gate that checks every workflow run attempt.
+
+## Exact commit and tagged build gates
+
+- [Main checks](https://github.com/saphid/frame-control/actions/runs/40440862876)
+  completed successfully on the tag commit: seven of seven jobs, including
+  e2e, iOS, Windows, macOS, Linux and the aggregate gate.
+- [Native Decky runtime](https://github.com/saphid/frame-control/actions/runs/40440862867)
+  completed successfully on that commit: AMD64 and ARM64 actual Decky 3.3.0
+  discovery and safe probes.
+- An exact-main [installer preview](https://github.com/saphid/frame-control/actions/runs/40441532929)
+  built Windows, Linux, Apple Silicon Mac and Intel Mac installers successfully
+  before tagging. Its draft and checksum jobs were inapplicable to the manual
+  preview and skipped by their tag-only conditions; they were not release gates.
+- The [exact-tag release workflow](https://github.com/saphid/frame-control/actions/runs/40442228066)
+  then passed all six jobs on its first attempt: draft, four platform builds,
+  and checksums. No tagged job failed, was cancelled, skipped or overridden.
+
+The draft contained exactly ten installer assets and `SHA256SUMS` before
+publication. Every installer was independently downloaded by GitHub asset ID,
+one file at a time. Its downloaded size and SHA-256 matched GitHub's asset
+metadata and the downloaded `SHA256SUMS`; the latter's SHA-256 was
+`85383104a8f08f49ffde24ac867f9c2ead41951e602600a9d22d58bc19bf06f5`.
+The [sanitized audit result](v0450-assets-2026-10-27.json) records all ten
+names, sizes, hashes and package checks. The audit also checked both Mac ZIP
+CRCs and bundle version `0.4.50`, both DMG UDIF trailers, the Windows ZIP
+CRC and PE installer header, both AppImage ELF architectures, and both DEB
+version and architecture fields. The Windows NSIS installer itself has a
+32-bit PE launcher; tagged Windows CI installed its x64 payload and checked
+packaged resources and Python libraries.
+
+The independently downloaded Linux x86_64 AppImage had SHA-256
+`d2196b9a50d0777203e60721dd19c6edbb5c18a7639148f0a496d420e231b053`.
+Its first local launch exited inside the workspace sandbox before the server
+answered. The same bytes then passed outside that sandbox under isolated Xvfb:
+HTTP 200 with `FrameControl/1`, followed by a stopped server. The launcher
+used a temporary profile and disabled telemetry and update checks. Tagged
+Linux CI also launched its own built AppImage. No physical Mac or Windows
+launch of these exact installers was performed.
+
+## Real Frame and publication
+
+The [candidate evidence](v0450-candidate-2026-10-27.md) records a unique-lock
+real Frame smoke on the version-bumped source: **12 passed, one optional
+x86_64 launch skipped, zero failed**. Steam Linux Runtime 4 was absent, so no
+x86_64 launch is claimed. A separate fresh-lock cleanup audit found no owned
+test title directories, metadata or processes; both locks were released.
+SteamVR activity was 3 (standby), proximity raw 3.25 and battery 100%.
+There was no wearer confirmation, wake command or worn interaction test.
+The private smoke result's SHA-256 is
+`7b8d88aafb4459bf882edeb10f65c021c5aa25ad9ed2755faf04e3b4a95c1632`.
+
+`scripts/publish-release.sh --dry-run v0.4.50` passed the exact main,
+native runtime and tagged release jobs, all ten installer hashes, regenerated
+`SHA256SUMS`, draft notes and update-manifest checks. The real publisher
+repeated those gates, attached `update.json`, and published
+[v0.4.50](https://github.com/saphid/frame-control/releases/tag/v0.4.50) at
+**03:19:21 UTC**. GitHub's latest-release API returned `draft=false`,
+`prerelease=false`, ten installers, `SHA256SUMS` and `update.json`. A fresh
+public latest-download of `update.json` reported version `0.4.50`, the
+correct release page, ten hashes matching the independent downloads, and the
+worn-headset limit in its notes.
+
+The exact-version official Decky catalog is **6 works / 51 partial /
+48 broken / 11 N/A**. These statuses have the scoped evidence in
+[the compatibility table](../framey-compatibility.md). Worn headset
+visibility, physical controller input, VR keyboard and optical comfort remain
+unverified. The hourly shared-lock worn check remains enabled.

docs/frame-plugin-author.md

@@ -64,7 +64,8 @@ none of these frontend controls has passed a worn-headset check yet.
 | `PanelSection`, rows, buttons, toggles, dropdowns | Local touch-sized controls; disabled controls stay inert during a backend call | Local browser and host unit test |
 | `TextField`, `SliderField`, grouped `Dropdown` options | Native text, range and select controls in the panel; disabled state, numeric slider callback and basic input types | Host unit test; worn VR use unverified |
 | Scrollable panel content | Visible Scroll plugin up/down buttons move the last region reached by a trusted pointer, or the document if that region disappears. Hold either button to repeat; keyboard activation still moves one step. Plugins may use ordinary CSS overflow containers. | Parent/iframe message tests and a real Frame synthetic OpenVR pointer hold; physical controller scroll and hold remain unverified |
-| `Tabs`, `SidebarNavigation`, spinners, dialog/menu wrappers, progress bars | Local tab navigation and ordinary HTML controls; no Steam navigation or controller focus tree | Host tests and catalog frontend smoke checks in local Chromium |
+| `Tabs`, `SidebarNavigation`, spinners, dialog/menu wrappers | Local tab navigation and ordinary HTML controls; no Steam navigation or controller focus tree | Host tests and catalog frontend smoke checks in local Chromium |
+| `ProgressBar`, `ProgressBarItem`, `ProgressBarWithInfo` | Native progress control; `indeterminate` omits its value so it animates as unfinished, and `sOperationText` appears with the bar. Estimated completion time is not shown. | Host contract tests; official plugin progress behavior in worn VR remains unverified. |
 | `SteamUIStore` / `DFL.Router.RunningApps`, `MainRunningApp` | Bounded detached Steam CEF reads while the panel is open; refresh about every two seconds; no MobX observation. Failed reads clear stale context. | Locked real Frame empty-list reads; nonempty local Chromium fixtures. Real running-game selection unverified. |
 | `GameSessions.RegisterForAppLifetimeNotifications` | Actual Steam callbacks, bounded queue and disposable `.unregister()` handle; no events inferred from snapshot changes; lease cleanup after lost panels | Real Frame registration/poll/close; launch/exit, retry, expiry and duplicate tests use explicit fixtures. Real game transitions unverified. |
 | Other `SteamClient` subscriptions | Explicit inert registration methods return disposable handles; no fabricated power/input/game-action events. Mutating Steam/power methods are unavailable. | Host contract tests; safe fallbacks only |
@@ -76,7 +77,7 @@ none of these frontend controls has passed a worn-headset check yet.
 | `localStorage` | Synchronous, per-plugin cache backed by the Frame Control panel origin. Up to 64 keys, 64 KiB per value and 128 KiB total; `clear()` removes only this plugin's cache. Falls back to memory if panel storage is denied. | Parent/iframe round-trip and reopen in the local host test; real headset persistence remains unverified. |
 | `SteamClient.Storage.GetJSON` / `SetObject` | Uses the same bounded per-plugin cache; a missing key rejects with `Not found`. It cannot read Steam account or global storage. | Host contract tests and local Chromium settings views; headset persistence after reopen remains unverified. |
 | IndexedDB / localForage | IndexedDB is deliberately absent inside the opaque iframe so feature detection chooses the bounded localStorage driver. Plugins requiring IndexedDB directly remain unsupported. | HLTB official frontend in local Chromium: its previous `IDBFactory.open` SecurityError disappeared. No live HLTB data request was run. |
-| `routerHook.addRoute` / `removeRoute`, `Navigation.Navigate` / `NavigateBack`, `useParams` | Local routes inside this plugin panel, with named segments such as `/plugin/game/:appid/:view?`; `useParams()` reads the current segment values | Host unit test; VR navigation unverified |
+| `routerHook.addRoute` / `removeRoute`, `Navigation.Navigate` / `NavigateBack`, `useParams` | Local routes inside this plugin panel, with named segments such as `/plugin/game/:appid/:view?`; `useParams()` reads the current segment values. Back walks up to 32 local page transitions and skips routes removed since navigation. | Host unit test; VR navigation unverified |
 | `routerHook.addPatch`, global components | No-op; cannot patch Steam routes | Not applicable |
 | `findModule`, `findModuleChild`, `findModuleExport`, class lookup and module mapping | Searches a finite registry of Framey controls and CSS maps. Unknown Steam modules return `undefined` or an empty mapping. The optional UI-audio export cannot play sound. | Host contract tests; pinned TabMaster 2.15.1 QAM and documentation render in local Chromium. Steam library editing and worn VR remain unverified. |
 | `Navigation.CloseSideMenus` | Returns to this plugin's main panel | Pinned HLTB for Deck 2.0.12 shallow settings view in local host test. Live HLTB search remains unverified. |
@@ -90,6 +91,9 @@ Frame Control store; only paths registered by that same plugin can navigate.
 Optional route segments must be at the end. Framey accepts local path segments
 only; query strings, external URLs, Steam library routes and duplicate parameter
 names are rejected. Removing an active route returns to the plugin panel.
+`Navigation.NavigateBack()` returns to the preceding local page, then the
+plugin root. `Navigation.CloseSideMenus()` returns directly to the root and
+clears that panel's history. Neither operation navigates Steam's own UI.
 Toasts stay inside the panel, so keep essential errors in the plugin UI too.
 Treat module lookup results as Framey-local exports. Do not depend on Steam
 webpack IDs, function-source signatures, or Steam-only CSS class names; a

docs/framey-compatibility.md

@@ -29,7 +29,7 @@ A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates
 
 The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.
 
-After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. That initial pass left Simple Timer partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSSLine truncated
+After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. That initial pass left Simple Timer partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSSLine truncated
 
 ## Every current plugin
 
@@ -38,11 +38,11 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | Plugin / version | Manifest / bundle API | Status | Reason | Verified by |
 | --- | --- | --- | --- | --- |
 | 1: XR Gaming 1.6.2 | 1 / 2 | N/A | Not supported on Frame: Requires supported external XR glasses and the Breezy/XRLinuxDriver stack; it does not target Steam Frame displays. | static archive, local browser, fake-Frame |
-| 7: CSS Loader 2.1.3 | legacy / legacy | partial | Panel initialization succeeds; CSS themes patch Steam UI and cannot theme the isolated VR shell. | static archive, local browser, fake-Frame |
+| 7: CSS Loader 2.1.3 | legacy / legacy | partial | Panel initialization succeeds; CSS themes patch Steam UI and cannot theme the isolated VR shell. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 10: vibrantDeck 2.0.1 | legacy / legacy | N/A | Not supported on Frame: Changes X11 gamescope color properties, not the Frame SteamVR compositor. | static archive, local browser, fake-Frame |
 | 11: Fantastic 0.5.1 | legacy / legacy | N/A | Not supported on Frame: Targets Steam Deck fan hardware; no Frame fan-control mapping is provided. | static archive, local browser, fake-Frame |
 | 12: MusicControl 1.1.6 | legacy / legacy | partial | Managed reinstall preserves Decky’s legacy calling convention and repairs the Frame OS shell library-path failure. Chromium transport/seek/volume against a silent MPRIS fixture and real ARM64 empty-player discovery pass; actual Frame media playback, album art and worn VR remain unverified. Reinstall existing copies to apply. | static archive, local browser, fake-Frame, isolated Decky 3.3.0 + MPRIS fixture, real Frame SSH |
-| 13: Pause Games 1.0.3 | 1 / 2 | partial | Settings and running-game list initialize in local Chromium with an explicit synthetic game; live Frame empty-list reads and lifetime registration/cleanup passed. Process pause/resume, automatic pausing and suspend integration remain unverified/unsupported; backend writes were denied. | static archive, local browser, fake-Frame |
+| 13: Pause Games 1.0.3 | 1 / 2 | partial | Settings and a synthetic running-game list render locally. Actual Decky 3.3.0 discovery, private settings writes/readback and exclusion-list persistence pass on amd64 and ARM64 Frame; standalone Toggle now honors its value prop. Live empty-list/lifetime checks passed earlier. Real process pause/resume, automatic pausing, suspend integration and worn VR remain unverified/unsupported. | static archive, local browser, fake-Frame, real Frame SSH |
 | 14: ProtonDB Badges 1.3.4 | 2 / 2 | partial | Settings render locally and read-only get_setting RPC returned the default through real Decky 3.3.0 on ARM64 Frame. Steam game-page badges have no patch target; live writes and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 16: Audio Loader 1.6.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. Steam UI sound lookup is present as explicitly unsupported; the frontend still requires Steam m_GamepadUIAudioStore.m_AudioPlaybackManager, which is unavailable in the isolated panel. | static archive, local browser, fake-Frame |
 | 18: Bluetooth 3.1.1 | 1 / 2 | partial | Controls render with fixture replies; actual Bluetooth discovery, labels and connections remain unverified. | static archive, local browser, fake-Frame |
@@ -55,7 +55,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 27: AutoSuspend 2.2.0 | legacy / legacy | broken | Frontend audit failed: Cannot read properties of null (reading '6'). | static archive, local browser, fake-Frame |
 | 28: Emuchievements 2.0.5 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: Emuchievements/bin/hash. | static archive, local browser, fake-Frame |
 | 30: TunnelDeck 1.0.4 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
-| 32: AutoFlatpaks 1.6.8 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 32: AutoFlatpaks 1.6.8 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 35: MoonDeck 1.13.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: moondeck/python/externals/yarl/_quoting_c.cpython-313-x86_64-linux-gnu.so. Frontend initializes; native CPython wheels and executables in the published archive are x86_64. | static archive, local browser, fake-Frame |
 | 36: SteamGridDB 1.8.1 | 1 / 2 | broken | Local module mapping is available; frontend still requires the Steam LibraryContextMenu implementation, which has no target in the isolated Framey panel. | static archive, local browser, fake-Frame |
 | 37: Discord Status 1.5.0 | 1 / 2 | partial | Disconnected panel renders; running-activity construction accepts a synthetic game in local Chromium. Exact official is_connected returned false in real Decky 3.3.0 ARM64. Empty live running-list reads and lifetime registration/cleanup passed. Real game transitions, Discord shortcut detection/connection/activity, local custom artwork and worn VR remain unverified/unsupported. | static archive, local browser, fake-Frame, real Frame SSH |
@@ -72,11 +72,11 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 56: MangoPeel 0.0.7 | 1 / 2 | partial | Initializer succeeds; gamescope/MangoHud actions and backend are unverified. | static archive, local browser, fake-Frame |
 | 58: Volume Boost 0.0.7 | legacy / legacy | works | Default-sink controls pass in local Chromium through real Decky 3.3.0 ARM64: linked slider/keyboard and numeric writes, separate channels, re-link and reopen, with independent Pulse readback including 125%/150% while muted. Exact original volume/mute restored. Audible output, Bluetooth sinks and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
 | 59: Web Browser 1.4.3 | legacy / legacy | broken | The exact frontend now initializes with a null Steam React-root lookup. The browser itself still requires Steam GamepadUI CDP injection and a backend WebSocket unavailable in Framey; no working browser tab was verified. | static archive, local browser, fake-Frame, focused local browser |
-| 60: DeckyFileServer 1.2.0 | 1 / 2 | partial | Managed install supplies a native ARM64 helper and removes the exact archive's unnecessary root request. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. Frontend address/picker and thumbnail-toggle display limitations remain; use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. | static archive, local browser, fake-Frame, real Decky 3.3.0 amd64, real Frame SSH |
+| 60: DeckyFileServer 1.2.0 | 1 / 2 | partial | Managed install supplies a native ARM64 helper and removes the exact archive's unnecessary root request. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. Frontend address/picker limitations remain; use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame, real Decky 3.3.0 amd64, real Frame SSH |
 | 61: TabMaster 2.15.1 | 1 / 2 | partial | Local Chromium rendered the QAM and navigable Overview/Filters documentation with an actual Decky 3.3.0 amd64 backend. Library-tab editing remains unavailable: Steam login/library patches and MobX reactions have no target. ARM64 and worn VR unverified. | static archive, local browser, fake-Frame |
 | 62: TS3 QuickAccess 1.2.0 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: ts3-qs4sd/bin/ts3-qs4sd.so. | static archive, local browser, fake-Frame |
 | 63: Free Loader 1.6.0 | 1 / 2 | partial | The exact archive's duplicate names contain identical bytes and differ only in execute bits; the guarded installer now accepts them, and a private local install/remove transaction passed. The current opaque Chromium host renders Free Games but cannot load deals with backend/network denied. Exact official Python settings and empty local-deals methods passed in a no-network container with a Decky stub. Real Decky, feed refresh, notifications and worn VR remain unverified. | static archive, local browser, fake-Frame pinned install/remove, local exact-archive transaction, isolated Python backend |
-| 64: Syncthing 0.2.7 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog. | static archive, local browser, fake-Frame |
+| 64: Syncthing 0.2.7 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 65: Decky Terminal 0.5.3 | 1 / 2 | partial | Local routes initialize after parameter-route support; no shell commands were run. | static archive, local browser, fake-Frame |
 | 66: PlayTime 3.2.5 | 1 / 2 | partial | Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. Running snapshots are now exposed, but its private MobX observation is unsupported; automatic recording and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 67: Battery Tracker 0.2.0 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
@@ -121,10 +121,10 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 110: Dimmer Deck 0.0.4 | 1 / 2 | N/A | Not supported on Frame: Changes gamescope/X11 dimming properties; no mapping to Frame VR display brightness exists. | static archive, local browser, fake-Frame |
 | 111: Music Control 1.1.7 | legacy / legacy | partial | Managed reinstall preserves Decky’s legacy calling convention and repairs the Frame OS shell library-path failure. Chromium transport/seek/volume against a silent MPRIS fixture and real ARM64 empty-player discovery pass; actual Frame media playback, album art and worn VR remain unverified. Reinstall existing copies to apply. | static archive, local browser, fake-Frame, isolated Python backend, isolated Decky 3.3.0 + MPRIS fixture, real Frame SSH |
 | 112: Better Keyboard 0.3.4 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Frontend audit failed: window.SteamClient.UI.GetUIMode is not a function. | static archive, local browser, fake-Frame |
-| 113: Decky LSFG-VK 0.12.2 | 1 / 2 | partial | Initializer succeeds; runtime LSFG/Windows DLL downloads and Vulkan integration are not ARM64-validated. | static archive, local browser, fake-Frame |
+| 113: Decky LSFG-VK 0.12.2 | 1 / 2 | partial | Initializer succeeds; runtime LSFG/Windows DLL downloads and Vulkan integration are not ARM64-validated. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 114: Network Sentinel 1.0.4 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 115: Decky Clash 1.3.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
-| 116: Muon 0.2.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 116: Muon 0.2.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 117: DeckyParty File Manager 1.0.0 | legacy / legacy | partial | Initializer succeeds; privileged file operations and backend are unverified. No file changes were run. | static archive, local browser, fake-Frame |
 | 118: Speed Test 1.0.2 | 1 / 2 | partial | Initializer succeeds; automatic bandwidth tests were blocked by the audit network policy. | static archive, local browser, fake-Frame |
 | 119: Decky Clipboard 1.0.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-clipboard/bin/xclip. | static archive, local browser, fake-Frame |
@@ -133,10 +133,10 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 123: Steam Status 1.2.3 | 2 / 2 | partial | Settings/public status rendered locally; cache errors fixed. Read-only get_settings RPC returned actual Decky 3.3.0 defaults on ARM64 Frame. Persistence, live backend diagnostics and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 124: AlarMe 1.6.3 | 1 / 2 | partial | Silent labeled timer create/ticks/pause/cancel, preset save/cancel-confirm/delete and stopwatch start/lap/pause/reset/reopen pass in local Chromium with the official Decky 3.3.0 ARM64 backend. Audio, alarms/reminders, suspend inhibition, Steam overlays and worn VR remain unverified; notifications require the panel to stay open. | static archive, local browser, fake-Frame, real Frame SSH |
 | 125: Decky Localsend 0.4.5 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-localsend/bin/localsend-core. | static archive, local browser, fake-Frame |
-| 126: Launch Options 1.9.2 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello. Frontend audit failed: Cannot convert undefined or null to object. | static archive, local browser, fake-Frame |
+| 126: Launch Options 1.9.2 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello. Frontend audit failed: Cannot convert undefined or null to object. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 127: Decky Translator 0.9.0 | 1 / 2 | partial | Initializer succeeds; x86_64 download and hidraw/controller assumptions need an ARM64 audit. OCR/translation not exercised. | static archive, local browser, fake-Frame |
 | 128: Quick User Switcher 1.0.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
-| 129: ShadowDeck 1.1.11 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 129: ShadowDeck 1.1.11 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 130: Games Prefix Manager 1.0.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 131: Download All 1.1.0 | 1 / 2 | broken | Initializer succeeds; Steam download registration is absent, so the primary action is unavailable. | static archive, local browser, fake-Frame |
 | 132: SuggestMe 1.5.3 | 1 / 2 | partial | Initializer succeeds; recommendation backend and Steam library data unverified. | static archive, local browser, fake-Frame |
@@ -283,7 +283,7 @@ All published Linux native payloads in this snapshot are x86_64; no published aa
 
 A [DeckyFileServer ARM64 follow-up](evidence/framey-fileserver-arm64-2026-10-27.md) ships an offline, digest-checked GPL helper build, corresponding vendored source and a build recipe. Only its exact managed archive can replace the x86 helper and remove its unnecessary root flag. Actual Decky 3.3.0 discovery/RPC and real Frame HTTPS private-fixture listing/download pass; uploads stay disabled. Hostname-DNS failures and empty optional arguments are repaired. Decky 3.3.0 still exposes `decky.HOME`; that call is unchanged. The plugin moves from broken to partial: its frontend advertises HTTP/steamdeck URLs and needs a Steam folder picker. Use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR remain unverified.
 
-[LocalSend ARM64 build/runtime evidence](evidence/framey-localsend-arm64-2026-10-26.md) covers a reproducible MIT helper build and its isolated real-Frame protocol 2.0 info response. The official x86 archive remains blocked; full plugin integration and file transfers are unverified.
+[LocalSend ARM64 build/runtime evidence](evidence/framey-localsend-arm64-2026-10-26.md) covers an isolated real-Frame protocol 2.0 info response from an earlier helper build. [Exact official source matching](evidence/framey-localsend-source-match-2026-10-27.md) now identifies the official helper source and a reproducible ARM64 build from that revision. The exact official x86 backend passed one local private-namespace transfer. The official x86 archive remains blocked on Frame; ARM64 transfer and full plugin integration are unverified.
 
 | Plugin | Native payloads | ARM64 result / remaining blocker |
 | --- | --- | --- |
@@ -308,7 +308,7 @@ A [DeckyFileServer ARM64 follow-up](evidence/framey-fileserver-arm64-2026-10-27.
 | HueSync | bin/hello, py_modules/portio.so | portio and handheld LED backends depend on x86 I/O/unsupported hardware; ARM64 compilation alone is insufficient. |
 | Decky Clipboard | bin/xclip | xclip needs ARM64 X11 libraries/server; root and gamescope assumptions also block this archive. |
 | Reroll | bin/memscan.so | memscan.so needs ARM64 process-memory support and ABI testing; root requirement remains. Frontend initializes but no memory access was tested. |
-| Decky Localsend | bin/localsend-core | MIT LocalSend-Go 66edc509a28b9f877e7374504892dcbc653a4da4 reproducibly cross-built with Go 1.25.7/CGO_ENABLED=0 for ARM64; SHA-256 e79238f6051ce34f172f765ae918d3d902b819e27377989a55e5b1eba10e46f9. Help/official backend CLI flags and protocol 2.0 info endpoint passed on real Frame in an isolated network namespace. No file transfer or full plugin/CEF integration tested; exact source match to shipped helper unproven. Official ZIP stays x86_64 and blocked. |
+| Decky Localsend | bin/localsend-core | Official 0.4.5 ZIP main.py matches plugin tag v0.45 byte for byte; its pinned LocalSend-Go ad28b8e9 source reproduces the official x86 helper byte for byte with Go 1.25.7 and a static ARM64 helper twice (SHA-256 e20363237e606ee65eae857792176d21a0bb8ba863489952728eaf2b13277dae). Earlier build from a later source revision answered protocol 2.0 info on real Frame in an isolated namespace. The official x86 backend/proxy passed a marker transfer in a private no-route namespace. The exact-source ARM64 helper has not run on Frame; actual Decky discovery, ARM64 transfer, frontend and managed adaptation remain unverified. Official ZIP stays x86_64 and blocked (docs/evidence/framey-localsend-source-match-2026-10-27.md). |
 | Launch Options | bin/hello | Remove the template x86 bin/hello or publish an ARM64 rebuild; missing Steam module mapping also prevents frontend initialization. |
 | Decky-Clipper | bin/gstreamer-1.0/libgstproxy.so, bin/gstreamer-1.0/libgstmidi.so, bin/gstreamer-1.0/libgstmpegtsmux.so, bin/gstreamer-1.0/gst-plugin-scanner, bin/gstreamer-1.0/libgstivfparse.so, … 115 total; full list in JSON | Rebuild all bundled GStreamer libraries/plugins for ARM64 and verify capture/codec ABI against Frame SteamVR; gamescope capture differs. |
 

docs/releasing.md

@@ -51,7 +51,7 @@ count. So a build reaches people only when you publish it, after testing it.
    The script checks that the tag is on GitHub, that exact-commit main CI
    (including e2e), native amd64/ARM64 Decky runtime checks, and the tagged
    release workflow are green with no failed,
-   cancelled, skipped or running jobs, and that all ten installers
+   cancelled, skipped or running jobs in any run attempt, and that all ten installers
    are attached, each with the SHA-256 digest GitHub records. It also checks
    that the draft does not begin with a `WITHDRAWN` notice, so the preserved
    v0.4.48 draft cannot accidentally be offered again. It checks

scripts/framey-compatibility-doc.py

@@ -97,7 +97,12 @@ def render(data):
         'the real ARM64 Frame repeats those lifecycle checks under the shared lock. Local Chromium with that live backend verifies '
         'Begin/Cancel, countdown and a silent completion toast. Simple Timer qualifies as works for silent in-panel session timers. '
         'Update/reinstall is required; old receipts stay partial. Sound/suspend are unsupported, closed-panel alerts and worn VR unverified. '
-        'The private service, files, test listeners and processes were removed; independent cleanup audit passed and battery stayed 99 → 99.', '',
+        'The private service, files, test listeners and processes were removed; independent cleanup audit passed and battery stayed 99 → 99. '
+        'A [shared Toggle follow-up](evidence/framey-toggle-2026-10-27.md) separates standalone Toggle.value from ToggleField.checked. '
+        'Nine official archives consume this API; their remaining blockers and status labels are preserved. '
+        'Local opaque Chromium controls and the exact Pause Games frontend callback pass. Actual published Decky 3.3.0 discovery and '
+        'private settings/exclusion-list persistence pass on amd64 and the ARM64 Frame through the normal CEF bridge. '
+        'Process control and worn VR remain unverified; independent cleanup audit passed.', '',
         '## Every current plugin', '',
         'The API column shows manifest / actual bundled frontend API. Many manifests say v1 while their bundle connects API2. '
         'Missing manifest API is labelled legacy; an unrecognized bundle is unknown. Globals and hardware are static signals, not exhaustive dependencies.', '',
@@ -125,8 +130,11 @@ def render(data):
         'Hostname-DNS failures and empty optional arguments are repaired. Decky 3.3.0 still exposes `decky.HOME`; that call is unchanged. '
         'The plugin moves from broken to partial: its frontend advertises HTTP/steamdeck URLs and needs a Steam folder picker. Use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR remain unverified.', '',
         '[LocalSend ARM64 build/runtime evidence](evidence/framey-localsend-arm64-2026-10-26.md) '
-        'covers a reproducible MIT helper build and its isolated real-Frame protocol 2.0 info response. '
-        'The official x86 archive remains blocked; full plugin integration and file transfers are unverified.', '',
+        'covers an isolated real-Frame protocol 2.0 info response from an earlier helper build. '
+        '[Exact official source matching](evidence/framey-localsend-source-match-2026-10-27.md) '
+        'now identifies the official helper source and a reproducible ARM64 build from that revision. '
+        'The exact official x86 backend passed one local private-namespace transfer. '
+        'The official x86 archive remains blocked on Frame; ARM64 transfer and full plugin integration are unverified.', '',
         '| Plugin | Native payloads | ARM64 result / remaining blocker |', '| --- | --- | --- |']
     for p in data['plugins']:
         if p['native']:

scripts/framey-test-decky-runtime.py

@@ -40,7 +40,8 @@ def check_coverage():
                 raise ValueError('Managed shims must declare a literal name for runtime test coverage')
             shims.add(node.args[0].value)
     cases = json.loads((ROOT/'tests/decky-runtime/cases.json').read_text())
-    if shims != {case['shim'] for case in cases}:
+    # Frontend-only compatibility probes need no archive/backend adaptation.
+    if shims != {case['shim'] for case in cases if case['shim'] is not None}:
         raise ValueError('Every managed shim needs an actual Decky runtime case')
     return cases
 

scripts/verify-release-gates.py

@@ -77,19 +77,25 @@ def successful_jobs(run, required):
     attempt = run.get("run_attempt")
     if not isinstance(attempt, int) or attempt < 1:
         raise GateError(f"run {run['id']} has no valid attempt number")
-    data = api(f"actions/runs/{run['id']}/attempts/{attempt}/jobs?per_page=100")
-    jobs = data.get("jobs") or []
-    if data.get("total_count") != len(jobs):
-        raise GateError(f"run {run['id']} has more jobs than the gate inspected")
-    names = [job.get("name") for job in jobs]
-    if len(names) != len(set(names)) or not required.issubset(names):
+    latest_jobs = None
+    for number in range(1, attempt + 1):
+        data = api(f"actions/runs/{run['id']}/attempts/{number}/jobs?per_page=100")
+        jobs = data.get("jobs") or []
+        if data.get("total_count") != len(jobs):
+            raise GateError(f"run {run['id']} attempt {number} has more jobs than the gate inspected")
+        names = [job.get("name") for job in jobs]
+        if not jobs or len(names) != len(set(names)):
+            raise GateError(f"run {run['id']} attempt {number} has missing or duplicate jobs")
+        bad = [f"{job.get('name')}: {job.get('status')}/{job.get('conclusion')}"
+               for job in jobs if job.get("status") != "completed" or job.get("conclusion") != "success"]
+        if bad:
+            raise GateError(f"run {run['id']} attempt {number} has unfinished, failed, cancelled, or skipped jobs: {bad}")
+        latest_jobs = jobs
+    names = [job.get("name") for job in latest_jobs]
+    if not required.issubset(names):
         missing = sorted(required.difference(names))
-        raise GateError(f"run {run['id']} has missing or duplicate jobs: {missing}")
-    bad = [f"{job.get('name')}: {job.get('status')}/{job.get('conclusion')}"
-           for job in jobs if job.get("status") != "completed" or job.get("conclusion") != "success"]
-    if bad:
-        raise GateError(f"run {run['id']} has unfinished, failed, cancelled, or skipped jobs: {bad}")
-    print(f"gate passed: {run.get('html_url')} ({len(jobs)} jobs)")
+        raise GateError(f"run {run['id']} has missing jobs in its latest attempt: {missing}")
+    print(f"gate passed: {run.get('html_url')} ({len(latest_jobs)} jobs, {attempt} attempts)")
 
 
 def main(tag):

tests/decky-runtime/cases.json

@@ -1,4 +1,9 @@
 [
+  {
+    "id": 13,
+    "shim": null,
+    "probe": "toggle-settings"
+  },
   {
     "id": 12,
     "shim": "music-control-system-dbus-env",

tests/decky-runtime/check.py

@@ -90,7 +90,7 @@ def main():
     plugin = base/'plugins'/record['folder']
     receipt = json.loads((plugin/'.frame-control-store.json').read_text())
     if not args.reproduce_timer_regression:
-        assert receipt['compatShims'] == [case['shim']], receipt
+        assert receipt.get('compatShims', []) == ([case['shim']] if case['shim'] else []), receipt
     else:
         assert record['id'] == 96
         with zipfile.ZipFile(io.BytesIO(data)) as original:
@@ -187,6 +187,24 @@ def main():
                 report['result'] = ('original empty argument bug reproduced: thumbnail policy ignored'
                     if args.reproduce_fileserver_empty_flag_regression else
                     'discovery, API1 settings, native HTTPS listing/download, thumbnail policy and stop passed; uploads disabled')
+            elif case['probe'] == 'toggle-settings':
+                def call(method, *values):
+                    result = rpc('loader/call_plugin_method', record['name'], method, *values)
+                    report['calls'].append({'method': method, 'result': result})
+                    return result
+
+                assert call('load_settings') == {}
+                # Settings only. Never call pause/resume/kill or signal a process.
+                for value in (True, False, True):
+                    call('save_setting', 'autoPause', value)
+                    assert call('load_settings')['autoPause'] is value
+                call('add_no_auto_pause_set', 424242)
+                assert call('load_settings')['noAutoPauseSet'] == [424242]
+                call('remove_no_auto_pause_set', 424242)
+                assert call('load_settings')['noAutoPauseSet'] == []
+                settings = json.loads((base/'settings'/record['folder']/'settings.json').read_text())
+                assert settings['autoPause'] is True and settings['noAutoPauseSet'] == []
+                report['result'] = 'discovery and Toggle-backed private settings persistence passed; no process actions'
             elif case['probe'] == 'timer-lifecycle':
                 from timer_lifecycle import probe
 

tests/fakegh/gh

@@ -91,17 +91,22 @@ elif method == "GET" and endpoint.startswith(repo + "actions/workflows/"):
     is_main = workflow != "release.yml"
     run_id = {"checks.yml": 501, "release.yml": 502, "decky-runtime.yml": 503}[workflow]
     run = {"id": run_id, "head_sha": gate.get("main_sha" if is_main else "release_sha", commit),
-           "head_branch": branch, "event": "push", "run_attempt": 1,
+           "head_branch": branch, "event": "push", "run_attempt": gate.get("release_attempts", 1) if run_id == 502 else 1,
            "status": gate.get("decky_status" if run_id == 503 else ("main_status" if is_main else "release_status"), "completed"),
            "conclusion": gate.get("decky_conclusion" if run_id == 503 else ("main_conclusion" if is_main else "release_conclusion"), "success"),
            "html_url": "https://github.com/saphid/frame-control/actions/runs/%s" % run_id}
     print(json.dumps({"workflow_runs": [run]}))
 elif method == "GET" and endpoint.startswith(repo + "actions/runs/"):
-    run_id = endpoint[len(repo + "actions/runs/"):].split("/")[0]
+    parts = endpoint[len(repo + "actions/runs/"):].split("/")
+    run_id = parts[0]
+    attempt = int(parts[2])
     names = {"501": main_jobs, "502": release_jobs, "503": decky_jobs}[run_id]
     names = [name for name in names if name != gate.get("omit_job")]
     jobs = [{"name": name, "status": "completed",
-             "conclusion": gate.get("bad_job_conclusion", "success") if name == gate.get("bad_job") else "success"}
+             "conclusion": (gate.get("prior_bad_job_conclusion", "failure")
+                            if run_id == "502" and attempt == 1 and name == gate.get("prior_bad_job")
+                            else gate.get("bad_job_conclusion", "success") if name == gate.get("bad_job")
+                            else "success")}
             for name in names]
     print(json.dumps({"total_count": len(jobs), "jobs": jobs}))
 elif method == "GET" and endpoint.startswith(repo + "releases?"):

tests/fixtures/framey-official/README.md

@@ -1,13 +1,15 @@
 # Pinned Decky store test archives
 
 These are unmodified ZIPs downloaded from the official Decky store CDN on
-2026-10-25, except `96.zip` and `111.zip` downloaded on 2026-10-26 and `60.zip` on 2026-10-27. Each ZIP includes its
-upstream `LICENSE`. They are test data, not plugins shipped or installed by
+2026-10-25, except `96.zip` and `111.zip` downloaded on 2026-10-26 and `60.zip` on
+2026-10-27; `13.zip` was added from the digest-verified audit cache on 2026-10-27.
+Each ZIP includes its upstream `LICENSE`. They are test data, not plugins shipped or installed by
 Frame Control. The fake Frame tests serve them
 from a local fixture so CI does not depend on the store being online.
 
 | File | Official plugin | Version | Store SHA-256 |
 | --- | --- | --- | --- |
+| `13.zip` | Pause Games | 1.0.3 | `4aefdfb0ef25dea9c6d9fd037731c8b99ee8a1be966c2f7d5b0602112ef29f62` |
 | `60.zip` | DeckyFileServer | 1.2.0 | `7dc2ecdcd05aa415d1ac90afaff28ecb17f77809a2bc7a77aee8e92505b976f0` |
 | `96.zip` | Simple Timer | 1.0.0 | `973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312` |
 | `7.zip` | CSS Loader | 2.1.3 | `99beaf1374af82408e6d056e0b0147e5fca544e1035fa7ab88419231697bc231` |
@@ -50,6 +52,10 @@ active/canceled/expired backend restarts are regression checks; the unmodified
 archive must reproduce its historical lifecycle errors. Only private silent
 timers/settings are used. The upstream BSD license stays unchanged.
 
+Pause Games runs through actual published Decky 3.3.0 discovery and instance RPC
+for private settings and a synthetic exclusion list. No process-control method
+is called. The official frontend's standalone Toggle component separately
+checks saved true/false state and matching settings callbacks; effects are inert.
 DeckyFileServer also runs through actual Decky 3.3.0 discovery/API1 RPC with a
 native helper replacement. HTTPS listing/download use only public markers in a
 private directory; uploads remain disabled. The exact source build, GPL licenses

tests/framey_official.py

@@ -4,6 +4,8 @@ from pathlib import Path
 
 ROOT = Path(__file__).parent / 'fixtures/framey-official'
 PLUGINS = (
+    {'id': 13, 'name': 'Pause Games', 'version': '1.0.3', 'api_version': 1,
+     'folder': 'SDH-PauseGames', 'sha256': '4aefdfb0ef25dea9c6d9fd037731c8b99ee8a1be966c2f7d5b0602112ef29f62'},
     {'id': 60, 'name': 'DeckyFileServer', 'version': '1.2.0', 'api_version': 1,
      'folder': 'DeckyFileServer', 'sha256': '7dc2ecdcd05aa415d1ac90afaff28ecb17f77809a2bc7a77aee8e92505b976f0'},
     {'id': 89, 'name': 'DeckySpy', 'version': '0.6.7', 'api_version': 'legacy',

tests/page/framey_actions.mjs

@@ -46,6 +46,22 @@ const nodes=(tree,type)=>Array.isArray(tree)?tree.flatMap(child=>nodes(child,typ
   [...(tree?.type===type?[tree]:[]),...(tree?.children||[]).flatMap(child=>nodes(child,type))];
 // Disabled controls stay inert even if a caller invokes their handlers directly.
 let changed=0;
+// DFL.Toggle is a standalone value-controlled input. ToggleField uses checked.
+const toggleChanges=[];
+for(const value of [true,false]) {
+  const input=nodes(window.DFL.Toggle({value,onChange:v=>toggleChanges.push(v)}),'input')[0];
+  assert.equal(input.props.checked,value,'Toggle must render its value prop');
+  input.props.onChange({target:{checked:!value}});
+}
+assert.deepEqual(toggleChanges,[false,true]);
+const disabledToggle=nodes(window.DFL.Toggle({value:true,disabled:true,
+  onChange:()=>changed++}),'input')[0];
+assert.equal(disabledToggle.props.checked,true);
+assert.equal(disabledToggle.props.disabled,true);
+disabledToggle.props.onChange({target:{checked:false}});
+assert.equal(changed,0);
+const fieldToggle=nodes(window.DFL.ToggleField({checked:true,value:false}),'input')[0];
+assert.equal(fieldToggle.props.checked,true,'ToggleField must retain its checked contract');
 const toggle=nodes(window.DFL.ToggleField({label:'Enabled',checked:true,disabled:true,
   onChange:()=>changed++}),'input')[0];
 const options=[{label:'Modes',options:[{label:'Slow',data:'slow'},{label:'Fast',data:'fast'}]}];
@@ -253,6 +269,14 @@ nodes(tabs,'button')[2].props.onClick();
 assert.deepEqual(tabChanges,['one']);
 assert.equal(window.DFL.Spinner({}).props.role,'status');
 assert.equal(window.DFL.ProgressBar({nProgress:120}).props.value,100);
+assert.equal(window.DFL.ProgressBar({nProgress:40,indeterminate:true}).props.value,undefined,
+  'an indeterminate progress element must omit its value');
+assert.equal(window.DFL.ProgressBarItem({nProgress:35}).props.value,35);
+const progressInfo=window.DFL.ProgressBarWithInfo({indeterminate:true,
+  sOperationText:'Downloading plugin'});
+assert.equal(nodes(progressInfo,'progress')[0].props.value,undefined);
+assert.equal(nodes(progressInfo,'small')[0].props.role,'status');
+assert.equal(nodes(progressInfo,'small')[0].children[0],'Downloading plugin');
 assert.equal(window.DFL.joinClassNames('one',null,'two'),'one two');
 let eventCount=0;
 const unsubscribe=window.SteamClient.GameSessions.RegisterForAppLifetimeNotifications(()=>eventCount++);
@@ -464,11 +488,47 @@ assert.equal(window.DFL.useParams().view,'art');
 assert.equal(window.DFL.Navigation.Navigate('/plugin/game/123/art/extra'),false);
 assert.equal(window.DFL.Navigation.Navigate('/plugin/game/123?admin=1'),false);
 assert.equal(window.DFL.Navigation.Navigate('/plugin/game//art'),false);
+assert.equal(window.DFL.Navigation.NavigateBack(),true);
+assert.equal(window.DFL.useParams().appid,'123');
+assert.equal(window.DFL.useParams().view,undefined,'Back returns to the previous local page');
+assert.equal(window.DFL.Navigation.NavigateBack(),true);
+assert.equal(window.DFL.useParams().appid,undefined,'A second Back returns to the plugin root');
+assert.equal(window.DFL.Navigation.Navigate('/plugin/game/123'),true);
+assert.equal(window.DFL.Navigation.Navigate('/plugin/game/123'),true);
+assert.equal(window.DFL.Navigation.Navigate('/plugin/game/123/art'),true);
+assert.equal(window.DFL.Navigation.NavigateBack(),true);
+assert.equal(window.DFL.useParams().view,undefined,'Navigating to the same page did not add a history entry');
+assert.equal(window.DFL.Navigation.NavigateBack(),true);
+assert.equal(window.DFL.useParams().appid,undefined);
 assert.throws(()=>api.routerHook.addRoute('/plugin/:id/:id',GameRoute));
 assert.throws(()=>api.routerHook.addRoute('/plugin/:id?/art',GameRoute));
+api.routerHook.addRoute('/plugin/other',LocalRoute);
+assert.equal(window.DFL.Navigation.Navigate('/plugin/game/123'),true);
+assert.equal(window.DFL.Navigation.Navigate('/plugin/other'),true);
 removeGame();
+assert.equal(window.DFL.Navigation.NavigateBack(),true);
+assert.equal(nodes(window.__surface({plugin}),LocalRoute).length,0,
+  'Back skips a route that the plugin unregistered');
 assert.equal(window.DFL.useParams().appid,undefined);
 assert.equal(nodes(window.__surface({plugin}),GameRoute).length,0);
+api.routerHook.removeRoute('/plugin/other');
+api.routerHook.addRoute('/plugin/first',LocalRoute);
+api.routerHook.addRoute('/plugin/second',LocalRoute);
+for(let index=0;index<40;index++)
+  assert.equal(window.DFL.Navigation.Navigate(index%2 ? '/plugin/first' : '/plugin/second'),true);
+for(let index=0;index<32;index++)window.DFL.Navigation.NavigateBack();
+assert.equal(nodes(window.__surface({plugin}),LocalRoute).length,1);
+window.DFL.Navigation.NavigateBack();
+assert.equal(nodes(window.__surface({plugin}),LocalRoute).length,0,
+  'local route history is bounded and falls back to the plugin root');
+window.DFL.Navigation.Navigate('/plugin/first');
+window.DFL.Navigation.Navigate('/plugin/second');
+window.DFL.Navigation.CloseSideMenus();
+window.DFL.Navigation.NavigateBack();
+assert.equal(nodes(window.__surface({plugin}),LocalRoute).length,0,
+  'CloseSideMenus clears the local route history');
+api.routerHook.removeRoute('/plugin/first');
+api.routerHook.removeRoute('/plugin/second');
 
 // Event subscription is acknowledged before a method that immediately emits.
 const onMessage=listeners.find(x=>x.type==='message').handler;

tests/page/framey_toggle.mjs

@@ -0,0 +1,46 @@
+// Exact official Pause Games component and settings callbacks; effects/process
+// actions never execute here. Actual Decky discovery/RPC has a separate gate.
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import vm from 'node:vm';
+
+const bundle=readFileSync(process.argv[2],'utf8');
+const official=bundle.replace(/export \{ index as default \};/,
+  'window.__toggleTest = {AppItem, Settings};');
+assert.notEqual(official,bundle);
+const source=readFileSync(new URL('../../ui/framey-host.js',import.meta.url),'utf8');
+const host=source.replace(/\n  start\(\);\n\}\)\(\);\s*$/, '\n})();');
+assert.notEqual(host,source);
+const React={Fragment:'fragment',Component:class {},
+  createElement:(type,props,...children)=>({type,props:props||{},children}),
+  createContext:()=>({}),useState:value=>[value,()=>{}],useEffect(){},
+  useRef:value=>({current:value}),useMemo:fn=>fn(),useCallback:fn=>fn};
+const messages=[],listeners=[];
+const parent={postMessage:message=>messages.push(message)};
+const window={React,ReactDOM:{createRoot:()=>({render(){}})},location:{hash:''}};
+const context=vm.createContext({window,parent,navigator:{language:'en'},
+  document:{getElementById:()=>({})},console,URL,Blob,
+  addEventListener:(type,handler)=>listeners.push({type,handler}),setTimeout:()=>1,clearTimeout(){}});
+vm.runInContext(host,context);
+Object.assign(context,{DFL:window.DFL,SP_REACT:React});
+vm.runInContext(official,context,{timeout:2000});
+const {AppItem,Settings}=window.__toggleTest;
+const find=(node,type)=>node?.type===type?node:(node?.children||[]).flat(Infinity)
+  .map(child=>find(child,type)).find(Boolean);
+for(const excluded of [false,true]) {
+  vm.runInContext(`window.__toggleTest.Settings.data.noAutoPauseSet=new Set(${excluded?'[424242]':'[]'});`,context);
+  const row=AppItem({app:{appid:'424242',display_name:'Private fixture'},autoPause:true});
+  const toggle=find(row,window.DFL.Toggle);
+  assert.ok(toggle);
+  const input=window.DFL.Toggle(toggle.props);
+  assert.equal(input.props.checked,!excluded,'official persisted exclusion must display correctly');
+  input.props.onChange({target:{checked:excluded}});
+  const call=messages.at(-1);
+  assert.equal(call.type,'framey:call');
+  assert.equal(call.method,excluded?'remove_no_auto_pause_set':'add_no_auto_pause_set');
+  assert.deepEqual(Array.from(call.args),[424242]);
+  assert.equal(Settings.data.noAutoPauseSet.has(424242),!excluded);
+  listeners.find(x=>x.type==='message').handler({source:parent,
+    data:{type:'framey:reply',id:call.id,result:null}});
+}
+assert.equal(messages.filter(x=>x.type==='framey:call').length,2);

tests/test_framey_decky_runtime.py

@@ -19,7 +19,8 @@ class RuntimeCoverage(unittest.TestCase):
         self.assertEqual(len(cases), len({case['id'] for case in cases}))
         for case in cases:
             self.assertIn(case['id'], official)
-            self.assertIn(case['probe'], ('mpris', 'screenshots', 'system-monitor', 'timer-lifecycle', 'fileserver'))
+            self.assertIn(case['probe'], ('mpris', 'screenshots', 'system-monitor', 'timer-lifecycle',
+                                         'toggle-settings', 'fileserver'))
 
     def test_new_shim_without_runtime_case_fails_coverage(self):
         import frame_decky_store

tests/test_framey_official.py

@@ -21,6 +21,16 @@ from framey_official import LEGACY_PLUGINS, PLUGINS, archive
 
 
 class OfficialBundles(unittest.TestCase):
+    @unittest.skipUnless(shutil.which('node'), 'Node is needed for the official frontend check')
+    def test_pause_games_toggle_renders_saved_value_and_dispatches_settings_only(self):
+        plugin = next(p for p in PLUGINS if p['id'] == 13)
+        with zipfile.ZipFile(io.BytesIO(archive(plugin))) as bundle, tempfile.TemporaryDirectory() as root:
+            frontend = Path(root)/'index.js'
+            frontend.write_bytes(bundle.read(plugin['folder']+'/dist/index.js'))
+            result = subprocess.run(['node', str(Path(__file__).parent/'page/framey_toggle.mjs'), str(frontend)],
+                                    capture_output=True, text=True, timeout=10)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
     def test_legacy_css_loader_store_archive_has_unversioned_frontend(self):
         plugin = LEGACY_PLUGINS[0]
         data = archive(plugin)

tests/test_publish_release.py

@@ -134,6 +134,17 @@ class PublishRelease(unittest.TestCase):
             self.assertIsNone(upload)
             self.assertFalse(any("-X" in call for call in log))
 
+    def test_refuses_a_prior_cancelled_installer_after_successful_rerun(self):
+        gates = {"release_attempts": 2,
+                 "prior_bad_job": "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)",
+                 "prior_bad_job_conclusion": "cancelled"}
+        p, log, upload = self.run_script([draft()], "v9.8.7", gates=gates)
+        self.assertNotEqual(p.returncode, 0)
+        self.assertIn("attempt 1", p.stderr)
+        self.assertIn("cancelled", p.stderr)
+        self.assertIsNone(upload)
+        self.assertFalse(any("-X" in call for call in log))
+
     def test_refuses_missing_or_nonexact_gate_results(self):
         for gates in ({"omit_job": "e2e"}, {"main_sha": "c" * 40},
                       {"decky_conclusion": "failure"}, {"release_conclusion": "failure"},

ui/framey-compatibility.json

@@ -183,7 +183,7 @@
         "https://github.com/suchmememanyskill/SDH-CssLoader.git"
       ],
       "status": "partial",
-      "reason": "Panel initialization succeeds; CSS themes patch Steam UI and cannot theme the isolated VR shell.",
+      "reason": "Panel initialization succeeds; CSS themes patch Steam UI and cannot theme the isolated VR shell. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": false,
       "verification": [
         "static archive",
@@ -238,6 +238,11 @@
         "sha256": "99beaf1374af82408e6d056e0b0147e5fca544e1035fa7ab88419231697bc231",
         "archiveValidation": "accepted",
         "result": "installed-removed"
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -584,12 +589,13 @@
         "https://github.com/wynn1212/SDH-PauseGames.git"
       ],
       "status": "partial",
-      "reason": "Settings and running-game list initialize in local Chromium with an explicit synthetic game; live Frame empty-list reads and lifetime registration/cleanup passed. Process pause/resume, automatic pausing and suspend integration remain unverified/unsupported; backend writes were denied.",
+      "reason": "Settings and a synthetic running-game list render locally. Actual Decky 3.3.0 discovery, private settings writes/readback and exclusion-list persistence pass on amd64 and ARM64 Frame; standalone Toggle now honors its value prop. Live empty-list/lifetime checks passed earlier. Real process pause/resume, automatic pausing, suspend integration and worn VR remain unverified/unsupported.",
       "blockInstall": false,
       "verification": [
         "static archive",
         "local browser",
-        "fake-Frame"
+        "fake-Frame",
+        "real Frame SSH"
       ],
       "browser": {
         "id": 13,
@@ -622,6 +628,11 @@
         "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
         "mode": "synthetic nonempty running/library replay; backend and network denied",
         "frontendReady": true
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": true
       }
     },
     {
@@ -1962,7 +1973,7 @@
         "https://github.com/jurassicplayer/decky-autoflatpaks.git"
       ],
       "status": "broken",
-      "reason": "This plugin needs root and is not supported by the Frame user service.",
+      "reason": "This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": true,
       "verification": [
         "static archive",
@@ -2004,6 +2015,11 @@
         "archiveValidation": "This plugin needs root and is not supported by the Frame user service",
         "result": "blocked",
         "reason": "ValueError: Root plugins are not supported by the Frame user service"
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -4333,7 +4349,7 @@
         "https://github.com/grimkor/DeckyFileServer"
       ],
       "status": "partial",
-      "reason": "Managed install supplies a native ARM64 helper and removes the exact archive's unnecessary root request. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. Frontend address/picker and thumbnail-toggle display limitations remain; use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified.",
+      "reason": "Managed install supplies a native ARM64 helper and removes the exact archive's unnecessary root request. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. Frontend address/picker limitations remain; use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": false,
       "verification": [
         "static archive",
@@ -4376,6 +4392,11 @@
         "helperSha256": "86b80021ebd62ed619eba065757c1122defa5a74b2c045aa44a0c6b4403a508a",
         "sourceCommit": "dcf3f3ce5104d05811fa8c156c4f58632b84b313",
         "verification": "Real Decky discovery/public RPC and private read-only HTTPS fixture; docs/evidence/framey-fileserver-arm64-2026-10-27.md"
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -4802,7 +4823,7 @@
         "https://github.com/theCapypara/steamdeck-decky-syncthing.git"
       ],
       "status": "broken",
-      "reason": "Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog.",
+      "reason": "Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": true,
       "verification": [
         "static archive",
@@ -4843,6 +4864,11 @@
         "archiveValidation": "Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog",
         "result": "blocked",
         "reason": "ValueError: Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog."
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -9841,7 +9867,7 @@
         "https://github.com/xXJSONDeruloXx/lsfg-vk"
       ],
       "status": "partial",
-      "reason": "Initializer succeeds; runtime LSFG/Windows DLL downloads and Vulkan integration are not ARM64-validated.",
+      "reason": "Initializer succeeds; runtime LSFG/Windows DLL downloads and Vulkan integration are not ARM64-validated. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": false,
       "verification": [
         "static archive",
@@ -9890,6 +9916,11 @@
         "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
         "mode": "synthetic nonempty running/library replay; backend and network denied",
         "frontendReady": true
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -10211,7 +10242,7 @@
         "https://github.com/wtlnetwork/muon.git"
       ],
       "status": "broken",
-      "reason": "This plugin needs root and is not supported by the Frame user service.",
+      "reason": "This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": true,
       "verification": [
         "static archive",
@@ -10255,6 +10286,11 @@
         "archiveValidation": "This plugin needs root and is not supported by the Frame user service",
         "result": "blocked",
         "reason": "ValueError: Root plugins are not supported by the Frame user service"
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -11138,7 +11174,7 @@
       },
       "backend": "Python + native payload",
       "hardware": "No specific hardware requirement detected statically; runtime requirements unverified.",
-      "nativePort": "MIT LocalSend-Go 66edc509a28b9f877e7374504892dcbc653a4da4 reproducibly cross-built with Go 1.25.7/CGO_ENABLED=0 for ARM64; SHA-256 e79238f6051ce34f172f765ae918d3d902b819e27377989a55e5b1eba10e46f9. Help/official backend CLI flags and protocol 2.0 info endpoint passed on real Frame in an isolated network namespace. No file transfer or full plugin/CEF integration tested; exact source match to shipped helper unproven. Official ZIP stays x86_64 and blocked.",
+      "nativePort": "Official 0.4.5 ZIP main.py matches plugin tag v0.45 byte for byte; its pinned LocalSend-Go ad28b8e9 source reproduces the official x86 helper byte for byte with Go 1.25.7 and a static ARM64 helper twice (SHA-256 e20363237e606ee65eae857792176d21a0bb8ba863489952728eaf2b13277dae). Earlier build from a later source revision answered protocol 2.0 info on real Frame in an isolated namespace. The official x86 backend/proxy passed a marker transfer in a private no-route namespace. The exact-source ARM64 helper has not run on Frame; actual Decky discovery, ARM64 transfer, frontend and managed adaptation remain unverified. Official ZIP stays x86_64 and blocked (docs/evidence/framey-localsend-source-match-2026-10-27.md).",
       "uiSurfaces": [
         "local/Steam routes",
         "toasts",
@@ -11238,7 +11274,7 @@
         "https://github.com/casey/just"
       ],
       "status": "broken",
-      "reason": "Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello. Frontend audit failed: Cannot convert undefined or null to object.",
+      "reason": "Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello. Frontend audit failed: Cannot convert undefined or null to object. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": true,
       "verification": [
         "static archive",
@@ -11272,6 +11308,11 @@
         "archiveValidation": "Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello",
         "result": "blocked",
         "reason": "ValueError: Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello. Frontend audit failed: Cannot convert undefined or null to object."
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {
@@ -11556,7 +11597,7 @@
         "https://github.com/tikh-iv/ShadowDeck.git"
       ],
       "status": "broken",
-      "reason": "This plugin needs root and is not supported by the Frame user service.",
+      "reason": "This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain.",
       "blockInstall": true,
       "verification": [
         "static archive",
@@ -11594,6 +11635,11 @@
         "archiveValidation": "This plugin needs root and is not supported by the Frame user service",
         "result": "blocked",
         "reason": "ValueError: Root plugins are not supported by the Frame user service"
+      },
+      "toggleContract": {
+        "verified": "local browser control fixture; official Pause Games callback regression",
+        "evidence": "docs/evidence/framey-toggle-2026-10-27.md",
+        "backendVerified": false
       }
     },
     {

ui/framey-host.js

@@ -56,6 +56,7 @@
   const pending = new Map();
   const routes = new Map();
   const routeListeners = new Set();
+  const routeHistory = [];
   let currentRoute = null;
   let currentParams = {};
   let nextId = 0;
@@ -219,6 +220,11 @@
   };
   const Field = ({label, description, children}) => R.createElement('label', null,
     R.createElement('strong', null, label), description && R.createElement('small', null, description), children);
+  // DFL/@decky/ui Toggle uses value; ToggleField uses checked. Keep the
+  // standalone control separate so persisted true settings render correctly.
+  const Toggle = ({value, disabled, onChange}) => R.createElement('input', {
+    type:'checkbox', checked:!!value, disabled:!!disabled,
+    onChange:e=>{if(!disabled)onChange?.(e.target.checked);}});
   const ToggleField = ({label, description, checked, disabled, onChange}) => R.createElement(Field, {label, description},
     R.createElement('input', {type:'checkbox', checked:!!checked, disabled:!!disabled,
       onChange:e=>{if(!disabled)onChange?.(e.target.checked);}}));
@@ -278,8 +284,10 @@
     title && R.createElement('h2', null, title), R.createElement(Tabs, {
       tabs:pages.filter(page=>page.visible!==false).map((page,index)=>({
         id:page.route || String(index), title:page.title, content:page.content}))}));
-  const ProgressBar = ({nProgress=0, value, max=100}) => R.createElement('progress', {
-    value:Math.max(0,Math.min(max,Number(value ?? nProgress)||0)), max});
+  const ProgressBar = ({nProgress=0, value, max=100, indeterminate=false}) => R.createElement('progress', {
+    value:indeterminate ? undefined : Math.max(0,Math.min(max,Number(value ?? nProgress)||0)), max});
+  const ProgressBarWithInfo = ({sOperationText, ...props}) => R.createElement('div', null,
+    ProgressBar(props), sOperationText == null ? null : R.createElement('small', {role:'status'}, sOperationText));
   const MenuItem = ({children, disabled, bDisabled, onClick, onSelected}) =>
     R.createElement('button', {type:'button',disabled:!!(disabled || bDisabled),
       onClick:event=>{if(!disabled && !bDisabled)(onClick || onSelected)?.(event);}}, children);
@@ -368,15 +376,31 @@
     }
     return null;
   }
-  function navigate(path) {
-    if (path !== null && !localPath(path)) return false;
-    const match = path === null ? null : activeRoute(path);
-    if (path !== null && !match) return false;
+  function showRoute(path, match) {
     currentRoute = path;
     currentParams = match?.params || {};
     for (const listener of routeListeners) listener(path);
     return true;
   }
+  function navigate(path) {
+    if (path !== null && !localPath(path)) return false;
+    const match = path === null ? null : activeRoute(path);
+    if (path !== null && !match) return false;
+    if (path === null) routeHistory.length = 0;
+    else if (path !== currentRoute) {
+      routeHistory.push(currentRoute);
+      if (routeHistory.length > 32) routeHistory.shift();
+    }
+    return showRoute(path, match);
+  }
+  function navigateBack() {
+    while (routeHistory.length) {
+      const previous = routeHistory.pop();
+      const match = previous === null ? null : activeRoute(previous);
+      if (previous === null || match) return showRoute(previous, match);
+    }
+    return navigate(null);
+  }
   const routerHook = {
     addRoute(path, component) {
       if (!routePattern(path) ||
@@ -476,7 +500,7 @@
     Focusable, ScrollPanel: passthrough('div'), ScrollPanelGroup: passthrough('div'),
     DialogButton: passthrough('button'), DialogButtonPrimary: passthrough('button'), ConfirmModal,
     DialogButtonSecondary: passthrough('button'), Button: ButtonItem, GamepadButton: passthrough('button'),
-    Toggle: ToggleField, Spinner, SteamSpinner:Spinner, Tabs, SidebarNavigation,
+    Toggle, Spinner, SteamSpinner:Spinner, Tabs, SidebarNavigation,
     SuspensefulImage:({alt='', ...props})=>R.createElement('img', {...props, alt}),
     Marquee:passthrough('span'), DialogBody:passthrough('div'), DialogBodyText:passthrough('p'),
     DialogHeader:passthrough('h2'), DialogSubHeader:passthrough('h3'), DialogFooter:passthrough('footer'),
@@ -484,14 +508,14 @@
     DialogControlsSectionHeader:passthrough('h3'), ModalRoot:passthrough('section'),
     ModalPosition:passthrough('div'),
     Menu:passthrough('div'), MenuGroup:passthrough('section'), MenuItem,
-    ProgressBar, ProgressBarWithInfo:ProgressBar,
+    ProgressBar, ProgressBarItem:ProgressBar, ProgressBarWithInfo,
     gamepadDialogClasses:{}, quickAccessMenuClasses:{}, gamepadTabbedPageClasses:{},
     gamepadSliderClasses:{}, gamepadContextMenuClasses:{}, scrollPanelClasses:{},
     quickAccessControlsClasses:{}, mainMenuAppRunningClasses:{}, libraryAssetImageClasses:{},
     joinClassNames:(...names)=>names.filter(Boolean).join(' '),
     sleep:ms=>new Promise(resolve=>setTimeout(resolve,Math.max(0,Number(ms)||0))),
     staticClasses: {Title:'framey-title'},
-    Navigation: {Navigate:navigate, NavigateBack:()=>navigate(null), CloseSideMenus:()=>navigate(null),
+    Navigation: {Navigate:navigate, NavigateBack:navigateBack, CloseSideMenus:()=>navigate(null),
       NavigateToExternalWeb: url => { if (/^https:\/\//.test(url)) window.open(url, '_blank', 'noopener'); }},
     showModal, showContextMenu:showModal,
     // Steam app, library, and store patches have no target inside this panel.