Fix Simple Timer cancellation and backend restarts

Merge pull request #348 from saphid/release/v0.4.49
Prepare Frame Control v0.4.49 repair candidate
2026-10-27 05:01:44 +01:00 · 2026-10-26 23:33:18 +00:00 · 2026-10-26 23:05:19 +00:00 · 2026-10-26 22:51:00 +00:00 · 2026-10-26 22:48:02 +00:00 · 2026-10-26 22:46:48 +00:00
30 changed files with 840 additions and 106 deletions
@@ -1,12 +1,12 @@
 {
  "name": "frame-control",
-  "version": "0.4.48",
+  "version": "0.4.49",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "frame-control",
-      "version": "0.4.48",
+      "version": "0.4.49",
      "license": "MIT",
      "devDependencies": {
        "electron": "^44.4.5",
@@ -1,7 +1,7 @@
 {
  "name": "frame-control",
  "productName": "Frame Control",
-  "version": "0.4.48",
+  "version": "0.4.49",
  "description": "Desktop app for managing a Valve Steam Frame over SSH",
  "private": true,
  "main": "main.js",
@@ -0,0 +1,119 @@
+{
+  "timeUtc": "2026-10-26T23:23:16.239735+00:00",
+  "plugin": {
+    "id": 96,
+    "version": "1.0.0",
+    "sha256": "973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312"
+  },
+  "scope": "Silent private timer settings/events only; local Chromium with actual Frame ARM64 backend. No sound, physical power actions or worn VR.",
+  "runtime": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+  },
+  "realFrameLifecycle": {
+    "lifecycle": {
+      "freshCancel": true,
+      "replacementSuppressesOldCompletion": true,
+      "completionClearsEnd": true,
+      "activeRestartPreservesDeadlineAndRecents": true,
+      "canceledRestartIdle": true,
+      "expiredRestartIdle": true
+    },
+    "actualDecky330": true
+  },
+  "browser": {
+    "uiBegin300": true,
+    "uiCancel": true,
+    "liveCountdown": true,
+    "completionToast": true,
+    "subtleMode": true
+  },
+  "iframeSandbox": "allow-scripts allow-popups; no allow-same-origin",
+  "isolatedNativeAmd64": [
+    {
+      "discovered": [
+        {
+          "name": "Simple Timer",
+          "version": "1.0.0",
+          "load_type": 1,
+          "disabled": false
+        }
+      ],
+      "lifecycle": {
+        "freshCancel": true,
+        "replacementSuppressesOldCompletion": true,
+        "completionClearsEnd": true,
+        "lateExpiryEmitsWithoutSelfCancel": true,
+        "activeRestartPreservesDeadlineAndRecents": true,
+        "canceledRestartIdle": true,
+        "expiredRestartIdle": true
+      },
+      "result": "discovery, cancel, replace, completion and persistent restart passed"
+    },
+    {
+      "discovered": [
+        {
+          "name": "Simple Timer",
+          "version": "1.0.0",
+          "load_type": 1,
+          "disabled": false
+        }
+      ],
+      "lifecycle": {
+        "freshCancelError": {
+          "type": -1,
+          "id": 2,
+          "error": {
+            "name": "Exception",
+            "message": "'Plugin' object has no attribute 'timer_task'",
+            "traceback": "Traceback (most recent call last):\n  File \"decky_loader/wsrouter.py\", line 70, in _call_route\n  File \"decky_loader/loader.py\", line 232, in handle_plugin_method_call\n  File \"decky_loader/loader.py\", line 229, in handle_plugin_method_call\n  File \"decky_loader/plugin/plugin.py\", line 137, in execute_method\n  File \"decky_loader/plugin/messages.py\", line 44, in wait_for_result\nException: 'Plugin' object has no attribute 'timer_task'\n"
+          }
+        },
+        "cancelRetainsEnd": true,
+        "replacedTimerStillFires": true,
+        "expiredRestartError": true
+      },
+      "result": "upstream timer lifecycle regressions reproduced"
+    }
+  ],
+  "fakeFrame": "Pinned official archive installed and removed through real HTTP/SSH harness; backend execution stubbed.",
+  "before": {
+    "arch": "aarch64",
+    "decky": "failed",
+    "panel": "inactive",
+    "battery": [
+      99
+    ]
+  },
+  "after": {
+    "arch": "aarch64",
+    "decky": "failed",
+    "panel": "inactive",
+    "battery": [
+      99
+    ]
+  },
+  "cleanup": {
+    "baseAbsent": true,
+    "unitAbsent": true,
+    "sharedLockAbsent": true,
+    "service": "MainPID=0\nLoadState=not-found\nActiveState=inactive",
+    "testProcesses": []
+  },
+  "lockReleased": true,
+  "limits": [
+    "Sound and suspend unsupported",
+    "No alert delivery while Framey panel is closed",
+    "Worn VR, controller and keyboard unverified",
+    "UI recents after asynchronous reopen not asserted; persisted recents verified through actual backend restart"
+  ],
+  "localValidation": {
+    "pythonTestsRun": 1648,
+    "pythonSkipped": 16,
+    "pythonResult": "OK",
+    "actualDeckyNativeAmd64Cases": 6,
+    "fakeFramePinnedInstallRemove": "PASS",
+    "officialStoreEntriesRefreshed": 116,
+    "officialStoreDigestsChanged": 0
+  }
+}
@@ -0,0 +1,58 @@
+# Simple Timer lifecycle on Frame
+
+The exact official Simple Timer 1.0.0 archive (store ID 96, SHA-256
+`973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312`)
+now qualifies as **works for silent in-panel session timers** after a managed
+update/reinstall. The upstream BSD license and API1 manifest remain unchanged.
+[Redacted observations](framey-simple-timer-2026-10-26.json) accompany this report.
+
+## Reproduced failures and repair
+
+The unmodified archive, discovered and called by the actual published Decky
+3.3.0 loader, fails cancel before its first timer and expired-deadline startup
+with an annotation-only `timer_task` attribute. Cancel leaves `timer_end` saved,
+so canceled timers resume after restart. Starting a replacement leaves the first
+task alive; it still sends its own completion event.
+
+The managed installer repairs only this exact ID/digest/folder. Lifecycle state
+is initialized before startup cancellation. A lock and cancellation/join give one
+task ownership of the timer. Explicit cancel and completion clear the persisted
+deadline. Backend unload stops the task while preserving an active deadline;
+startup resumes that exact deadline without duplicating recent timers. Late
+expiry emits its silent notice without canceling itself midway. Older installed
+copies remain partial until their receipt includes `simple-timer-lifecycle`.
+
+## Verification
+
+- **Actual published Decky 3.3.0, isolated native amd64:** production managed
+  install, API1 discovery and public instance RPC/events; fresh cancel,
+  replacement suppression, one completion, clearing persisted end, active
+  restart preserving deadline/recents, canceled restart and expired restart.
+  A separate unmodified-archive case must reproduce the original failures.
+  The same gate runs on native ARM64 CI; this report does not preclaim its result.
+- **Real Frame ARM64, Frame OS 0.5.6:** the same lifecycle assertions through
+  Steam CEF's existing `DeckyBackend`, with a bounded private Decky 3.3.0 user
+  service and private settings. No plugin class was manually instantiated.
+- **Local Chromium:** actual headset host and official frontend in a sandbox
+  without `allow-same-origin`; method/event bridge relayed to that real ARM64
+  backend. Begin created a 300-second timer; Cancel returned to idle. A safe
+  five-second backend timer updated the panel and produced the visible silent
+  completion toast. Backend tests verify persisted recents across restart;
+  asynchronous UI recents after reopen were not asserted.
+- **Fake Frame:** exact pinned archive installed and removed through the real
+  HTTP/SSH store harness; execution is stubbed, so this verifies packaging only.
+
+Only private settings and silent timers changed. The shared `/tmp/frame-test.lock`
+was held for execution and then released. Successful run battery was 99 → 99;
+normal Decky remained failed and the headset panel remained inactive as found.
+An independent audit confirmed the private base/unit/archive absent, MainPID 0,
+unit not found and no test client processes. Job-owned CEF event listeners and
+private Chromium were removed. Two earlier test-client attempts were cleaned up:
+one competed with Steam's single Decky websocket; the other lacked a bounded
+quiet-event wait. Battery across those attempts was 100 → 99. These were test
+adapter failures; the final run used CEF and passed.
+
+Sound and suspend are unsupported. Alerts require the plugin panel to remain
+open. Worn VR, physical controller/keyboard and sleep/wake notification delivery
+remain unverified. A resumed timer is persisted backend behavior, not a promise
+of notification delivery while the panel is closed.
@@ -0,0 +1,37 @@
+# v0.4.49 candidate gate, 26 October 2026
+
+The version bump at `6247dfb` follows the merged Music Control repair
+([#338](https://github.com/saphid/frame-control/pull/338)), the real Decky
+runtime gate ([#343](https://github.com/saphid/frame-control/pull/343)), and
+the fail-closed publisher ([#344](https://github.com/saphid/frame-control/pull/344)).
+The published v0.4.48 draft remains withdrawn. This candidate is not a
+published update.
+
+## Locked real Frame smoke
+
+At 22:48 UTC, `scripts/frame-smoke.sh` ran from exact version-bumped source
+commit `6247dfb` on SteamOS 0.5.6, build `20261022.6153909`. It acquired a
+unique `/tmp/frame-test.lock` owner before reading status. SteamVR activity was
+**3 (standby)**, proximity raw **3.0625**, and battery **99%**. The result was
+**12 passed / one optional x86_64 launch skipped / zero failed**. The x86_64
+title could not launch because Steam Linux Runtime 4 was not installed; no
+x86_64 launch is claimed. ARM64 and Windows/Proton test titles installed,
+launched and were removed. The script's owned cleanup passed and exited 0.
+The private result is
+`tests/smoke/results/2026-10-26T224816Z-20261022.6153909.json`.
+
+A separate read-only audit acquired a fresh unique lock after the smoke. It
+found activity **3**, proximity raw **3.0**, battery **99%**, no `fc_smoke_*`
+or `fc-smoke-*` title folders and no matching test processes. The audit
+released only its own lock. Neither run woke the headset or ran the worn
+interaction script. No wearer was confirmed; official-plugin wearer
+visibility, physical controller input, VR keyboard and optical comfort remain
+unverified.
+
+## Remaining publication gates
+
+The final candidate head needs green PR CI, native amd64 and ARM64 Decky
+runtime checks, all four installer previews, post-merge exact-commit main CI,
+tagged builds of all ten installers, checksums, independent package
+verification, publisher dry run and public update-channel readback. A gate
+that fails, is cancelled or remains pending holds publication.
@@ -4,7 +4,7 @@ Snapshot: 2026-10-26T06:10:58.537029+00:00; 116 current visible official plugins

 This table and both store views use [`ui/framey-compatibility.json`](../ui/framey-compatibility.json). Results apply only to the exact store ID, version and SHA-256. A changed digest/version is **unverified**. Regenerate this document with `python3 scripts/framey-compatibility-doc.py`; use `--check` in review.

-**Works: 4 · Partial: 52 · Broken: 49 · N/A: 11.**
+**Works: 5 · Partial: 51 · Broken: 49 · N/A: 11.**

 - **Works** requires verified useful plugin behavior with its real backend. Read the reason for the verified scope and remaining limits; it does not imply worn-VR verification.
 - **Partial** means only a subset or a local fixture scope was verified, often just frontend/settings initialization. The remaining backend/device functionality is unverified; read the reason for the exact scope.
@@ -29,7 +29,7 @@ A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates

 The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.

-After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. Simple Timer remains partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSS, the optional Line truncated
+After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. That initial pass left Simple Timer partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSSLine truncated

 ## Every current plugin

@@ -104,7 +104,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 93: Deck Settings 1.2.6 | 1 / 2 | partial | Game picker renders with detached real Frame library/install-folder reads; search modal opens in local Chromium. Snapshot refreshes on panel reopen. Remote reports/proxy fetch, settings changes and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 94: Decky DoT DNS 0.0.2 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 95: Decky-SpoofDPI 0.12.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-spoof-dpi/bin/spoofdpi. | static archive, local browser, fake-Frame |
-| 96: Simple Timer 1.0.0 | 1 / 2 | partial | Live start/cancel, countdown events, completion toast, persisted recents/subtle mode verified in Chromium with real ARM64 Decky. Upstream expired-timer restart raises missing timer_task. Audio/suspend unsupported; alerts require an open panel; worn VR unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 96: Simple Timer 1.0.0 | 1 / 2 | works | Verified for silent in-panel session timers: Chromium Begin/Cancel/countdown/toast with real ARM64 Decky 3.3.0; repaired cancel, replace, completion and active/canceled/expired restarts pass actual loader RPC/events. Update/reinstall required. Sound and suspend unsupported; alerts require an open panel; worn VR unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 97: Decky-Framegen 0.11.15 | 1 / 2 | broken | Plugin archive size or SHA-256 did not match the store. | static archive, local browser, fake-Frame |
 | 98: Decky-Lookup 0.1.0 | 1 / 2 | partial | Initializer succeeds; game-page context actions and live lookups remain unverified. | static archive, local browser, fake-Frame |
 | 99: Decky Zerotier 0.3.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
@@ -70,9 +70,13 @@ The [26 October live checks](evidence/framey-events-backend-2026-10-26.json)
 used the actual official Notebook and Simple Timer Python backends in a private
 removable ARM64 Decky service. Notebook's default notebook saved a pointer stroke
 and loaded it after a backend restart. Simple Timer's start/cancel controls,
-countdown, completion toast and persisted recents/subtle mode worked. Simple
-Timer remains partial: its own expired-timer startup raises a missing
-`timer_task` error, sound/suspend are unsupported, and worn VR was not checked.
+countdown, completion toast and persisted recents/subtle mode worked. The
+[Simple Timer lifecycle repair](evidence/framey-simple-timer-2026-10-26.md) now
+fixes cancellation, replacement and active/canceled/expired backend restarts,
+verified through actual Decky 3.3.0 on amd64 and the ARM64 Frame. Managed
+update/reinstall is required. Silent in-panel session timers qualify as works;
+sound/suspend are unsupported, alerts require an open panel, and worn VR remains
+unverified.

 DFL module and class lookup searches a finite registry of Framey's own controls,
 CSS maps and an explicitly unsupported optional UI-audio player. It follows DFL's
@@ -204,10 +208,6 @@ browser session, so **Check result** can resume polling after a navigation or
 temporary connection error. After a polling error, Install, Update, and Remove
 stay disabled while the saved job's result is unknown; use **Check result**
 before starting another change.
-If Chromium denies session storage, the open panel keeps the accepted job ID in
-memory and **Check result** still works after a connection error. A page reload
-loses that memory fallback; wait for the old job to finish and refresh installed
-status before starting another change.
 Refresh the installed list before starting another
 operation after an error. The headset panel and desktop app send the hash of
 the version you saw; if the official store changes that version before the job
@@ -34,13 +34,27 @@ count. So a build reaches people only when you publish it, after testing it.

 4. Publish:

+   Confirm the exact tag commit's main CI and e2e, the locked real Frame smoke,
+   release verification, independent package checks, and all four tagged
+   installer builds have passed. Hold the release if any gate is failed,
+   cancelled, skipped, still running, or unverified. The publisher also reads
+   the exact commit's GitHub CI, native Decky runtime gate, and tagged build
+   job records and refuses to
+   publish unless every required job succeeded; it cannot prove physical
+   headset or installer behavior on its own.
+
   ```sh
   scripts/publish-release.sh --dry-run v0.4.0   # checks and shows update.json, changes nothing
   scripts/publish-release.sh v0.4.0
   ```

-   The script checks that the tag is on GitHub and that all ten installers
+   The script checks that the tag is on GitHub, that exact-commit main CI
+   (including e2e), native amd64/ARM64 Decky runtime checks, and the tagged
+   release workflow are green with no failed,
+   cancelled, skipped or running jobs, and that all ten installers
   are attached, each with the SHA-256 digest GitHub records. It also checks
+   that the draft does not begin with a `WITHDRAWN` notice, so the preserved
+   v0.4.48 draft cannot accidentally be offered again. It checks
   that the uploaded `SHA256SUMS` digest matches a fresh list of those ten
   installer digests. It attaches
   `update.json` (the version, the notes, the release page and each
@@ -50,7 +50,7 @@ def render(data):
        'record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) '
        'verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, '
        'countdown/completion events, a visible toast and persisted recents/subtle mode. '
-        'Only private test settings were written. Simple Timer remains partial because its own expired-timer startup '
+        'Only private test settings were written. That initial pass left Simple Timer partial because its own expired-timer startup '
        'raises a missing `timer_task` error; sound/suspend are unsupported. '
        'A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer '
        'through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, '
@@ -85,7 +85,14 @@ def render(data):
        'Exact managed installs also restore the system library path for D-Bus subprocesses, repairing a real Frame OS libtinfo/glibc failure in MusicControl 1.1.6. '
        'Both official entries pass transport/seek/volume, Info and reopen in local Chromium with actual Decky 3.3.0 amd64 and a private silent MPRIS service. '
        'Actual ARM64 Decky on the Frame passes read-only empty-player discovery for both. Existing copies need remove/reinstall or an explicit managed update. '
-        'Actual media playback on ARM64, artwork and worn VR remain unverified; both stay partial.', '',
+        'Actual media playback on ARM64, artwork and worn VR remain unverified; both stay partial. '
+        'A [Simple Timer lifecycle follow-up](evidence/framey-simple-timer-2026-10-26.md) repairs fresh/expired startup cancellation, '
+        'canceled deadlines that resumed and replaced tasks that still notified. Exact managed installs retain the API1 instance convention. '
+        'Published Decky 3.3.0 discovery/RPC/events verify cancel, replacement, completion and active/canceled/expired restarts in isolation; '
+        'the real ARM64 Frame repeats those lifecycle checks under the shared lock. Local Chromium with that live backend verifies '
+        'Begin/Cancel, countdown and a silent completion toast. Simple Timer qualifies as works for silent in-panel session timers. '
+        'Update/reinstall is required; old receipts stay partial. Sound/suspend are unsupported, closed-panel alerts and worn VR unverified. '
+        'The private service, files, test listeners and processes were removed; independent cleanup audit passed and battery stayed 99 → 99.', '',
        '## Every current plugin', '',
        'The API column shows manifest / actual bundled frontend API. Many manifests say v1 while their bundle connects API2. '
        'Missing manifest API is labelled legacy; an unrecognized bundle is unknown. Globals and hardware are static signals, not exhaustive dependencies.', '',
@@ -82,7 +82,8 @@ def main():
            loader = Path(temp)/'PluginLoader'
            loader.write_bytes(data)
            loader.chmod(0o644)  # Private container user copies/chmods its own executable.
-            probes = [(case['id'], False) for case in cases] + [(111, True)]
+            probes = [(case['id'], None) for case in cases] + [
+                (111, '--reproduce-bound-method-regression'), (96, '--reproduce-timer-regression')]
            for plugin_id, negative in probes:
                name = 'framey-decky-'+uuid.uuid4().hex[:12]
                command = ['docker', 'run', '--rm', '--name', name, '--network', 'none', '--read-only',
@@ -94,7 +95,7 @@ def main():
                    '--mount', f'type=bind,source={loader},target=/input/PluginLoader,readonly',
                    tag, str(plugin_id)]
                if negative:
-                    command.append('--reproduce-bound-method-regression')
+                    command.append(negative)
                try:
                    result = subprocess.run(command, capture_output=True, text=True, timeout=120)
                    if result.returncode:
@@ -31,6 +31,11 @@ trap 'rm -rf "$tmp"' EXIT
 gh api "repos/$repo/git/ref/tags/$tag" >/dev/null 2>&1 \
  || { echo "tag $tag isn't on GitHub; push it first (git push origin $tag)" >&2; exit 1; }

+# A complete asset list is insufficient: a cancelled installer build can leave
+# old uploaded bytes behind. Check the exact tagged commit's main/e2e jobs and
+# the latest exact-tag release attempt before any release mutation.
+python3 "$(dirname "$0")/verify-release-gates.py" "$tag"
+
 # Every release, drafts included, one JSON object per line.
 gh api --paginate "repos/$repo/releases?per_page=100" --jq '.[]' > "$tmp/releases"
 # The release whose tag_name is the tag; failing that, the one untagged-... draft
@@ -56,6 +61,12 @@ json.dump(r, sys.stdout)
 EOF
 id=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["id"])' "$tmp/release.json")
 echo "release  $id ($(python3 -c 'import json,sys; r=json.load(open(sys.argv[1])); print(("draft" if r["draft"] else "published") + ", tag_name " + str(r["tag_name"]))' "$tmp/release.json"))"
+python3 - "$tmp/release.json" <<'EOF'
+import json, sys
+release = json.load(open(sys.argv[1]))
+if (release.get("body") or "").lstrip().startswith("> **WITHDRAWN"):
+    sys.exit("not publishing: this release is marked WITHDRAWN")
+EOF

 missing=""
 for name in $expected; do
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""Refuse publication unless the exact tag commit and tagged installers passed CI.
+
+This checks GitHub's current run and job records, not a prior PR's check marks.
+The real Frame smoke and independent package checks remain release-procedure
+gates documented in docs/releasing.md.
+"""
+import json
+import subprocess
+import sys
+from urllib.parse import quote
+
+
+REPO = "saphid/frame-control"
+MAIN_JOBS = {
+    "checks", "e2e", "ios", "wireless-windows",
+    "server-tests (ubuntu-latest, 3.13)",
+    "server-tests (macos-latest, 3.12)",
+    "server-tests (windows-latest, 3.12)",
+}
+RELEASE_JOBS = {
+    "draft", "checksums",
+    "build (windows-latest, dist:win, app/dist/*.exe app/dist/*.zip)",
+    "build (ubuntu-latest, dist:linux, app/dist/*.AppImage app/dist/*.deb)",
+    "build (macos-15-intel, dist:mac:x64, app/dist/*.dmg app/dist/*.zip)",
+    "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)",
+}
+DECKY_JOBS = {"decky-runtime (ubuntu-latest)", "decky-runtime (ubuntu-24.04-arm)"}
+
+
+class GateError(Exception):
+    pass
+
+
+def api(path):
+    # publish-release.sh already requires sh. Resolve gh through that same
+    # shell: on Git Bash, Python's Windows CreateProcess skips an extensionless
+    # test gh shim in PATH and accidentally launches the real gh.exe instead.
+    command = ["sh", "-c", 'gh api "$1"', "sh", f"repos/{REPO}/{path}"]
+    result = subprocess.run(command, text=True, capture_output=True, check=False)
+    if result.returncode:
+        raise GateError(f"GitHub gate read failed for {path}: {result.stderr.strip()}")
+    try:
+        return json.loads(result.stdout)
+    except json.JSONDecodeError as error:
+        raise GateError(f"invalid GitHub gate response for {path}: {error}") from error
+
+
+def tag_commit(tag):
+    target = api(f"git/ref/tags/{quote(tag, safe='')}").get("object") or {}
+    for _ in range(5):
+        kind, sha = target.get("type"), target.get("sha")
+        if not isinstance(sha, str) or len(sha) != 40:
+            raise GateError(f"{tag} has no valid tag target")
+        if kind == "commit":
+            return sha
+        if kind != "tag":
+            raise GateError(f"{tag} points to unsupported Git object {kind!r}")
+        target = api(f"git/tags/{sha}").get("object") or {}
+    raise GateError(f"{tag} has too many nested tag objects")
+
+
+def exact_run(workflow, branch, sha, event):
+    query = f"actions/workflows/{workflow}/runs?branch={quote(branch, safe='')}&head_sha={sha}&per_page=100"
+    runs = api(query).get("workflow_runs") or []
+    matching = [run for run in runs if run.get("head_sha") == sha
+                and run.get("head_branch") == branch and run.get("event") == event]
+    if not matching:
+        raise GateError(f"no exact {workflow} {event} run for {branch} at {sha}")
+    run = max(matching, key=lambda item: item["id"])
+    if run.get("status") != "completed" or run.get("conclusion") != "success":
+        raise GateError(f"{workflow} run {run['id']} is {run.get('status')}/{run.get('conclusion')}")
+    return run
+
+
+def successful_jobs(run, required):
+    attempt = run.get("run_attempt")
+    if not isinstance(attempt, int) or attempt < 1:
+        raise GateError(f"run {run['id']} has no valid attempt number")
+    data = api(f"actions/runs/{run['id']}/attempts/{attempt}/jobs?per_page=100")
+    jobs = data.get("jobs") or []
+    if data.get("total_count") != len(jobs):
+        raise GateError(f"run {run['id']} has more jobs than the gate inspected")
+    names = [job.get("name") for job in jobs]
+    if len(names) != len(set(names)) or not required.issubset(names):
+        missing = sorted(required.difference(names))
+        raise GateError(f"run {run['id']} has missing or duplicate jobs: {missing}")
+    bad = [f"{job.get('name')}: {job.get('status')}/{job.get('conclusion')}"
+           for job in jobs if job.get("status") != "completed" or job.get("conclusion") != "success"]
+    if bad:
+        raise GateError(f"run {run['id']} has unfinished, failed, cancelled, or skipped jobs: {bad}")
+    print(f"gate passed: {run.get('html_url')} ({len(jobs)} jobs)")
+
+
+def main(tag):
+    if not tag.startswith("v") or not tag[1:]:
+        raise GateError("expected a version tag beginning with v")
+    sha = tag_commit(tag)
+    successful_jobs(exact_run("checks.yml", "main", sha, "push"), MAIN_JOBS)
+    successful_jobs(exact_run("decky-runtime.yml", "main", sha, "push"), DECKY_JOBS)
+    successful_jobs(exact_run("release.yml", tag, sha, "push"), RELEASE_JOBS)
+    print(f"exact release commit: {sha}")
+
+
+if __name__ == "__main__":
+    try:
+        main(sys.argv[1])
+    except (IndexError, GateError) as error:
+        sys.exit(f"release gate failed: {error}")
@@ -1,5 +1,22 @@
 [
-  {"id": 12, "shim": "music-control-system-dbus-env", "probe": "mpris"},
-  {"id": 111, "shim": "music-control-system-dbus-env", "probe": "mpris"},
-  {"id": 53, "shim": "shotty-click-app-dir", "probe": "screenshots"}
+  {
+    "id": 12,
+    "shim": "music-control-system-dbus-env",
+    "probe": "mpris"
+  },
+  {
+    "id": 111,
+    "shim": "music-control-system-dbus-env",
+    "probe": "mpris"
+  },
+  {
+    "id": 53,
+    "shim": "shotty-click-app-dir",
+    "probe": "screenshots"
+  },
+  {
+    "id": 96,
+    "shim": "simple-timer-lifecycle",
+    "probe": "timer-lifecycle"
+  }
 ]
@@ -11,6 +11,8 @@ import subprocess
 import sys
 import time
 import urllib.request
+import zipfile
+import io

 import websockets
 from websockets.exceptions import WebSocketException
@@ -57,6 +59,7 @@ def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('id', type=int)
    parser.add_argument('--reproduce-bound-method-regression', action='store_true')
+    parser.add_argument('--reproduce-timer-regression', action='store_true')
    args = parser.parse_args()
    assert os.getuid() == 1100 and ROOT.is_dir(), 'Run through framey-test-decky-runtime.py'
    record = next(p for p in PLUGINS if p['id'] == args.id)
@@ -83,10 +86,15 @@ def main():
    assert install.returncode == 0, install.stderr
    plugin = base/'plugins'/record['folder']
    receipt = json.loads((plugin/'.frame-control-store.json').read_text())
-    assert receipt['compatShims'] == [case['shim']], receipt
+    if not args.reproduce_timer_regression:
+        assert receipt['compatShims'] == [case['shim']], receipt
+    else:
+        assert record['id'] == 96
+        with zipfile.ZipFile(io.BytesIO(data)) as original:
+            (plugin/'main.py').write_bytes(original.read(record['folder']+'/main.py'))
    # Exercise the production manifest's API convention, never import Plugin ourselves.
    manifest = json.loads((plugin/'plugin.json').read_text())
-    assert 'api_version' not in manifest, manifest
+    assert manifest.get('api_version', 'legacy') == record['api_version'], manifest
    if args.reproduce_bound_method_regression:
        assert record['id'] == 111
        source = (plugin/'main.py').read_text()
@@ -131,7 +139,29 @@ def main():
                report['calls'].append({'method': method, 'result': response['result']})
                return response['result']

-            if args.reproduce_bound_method_regression:
+            if case['probe'] == 'timer-lifecycle':
+                from timer_lifecycle import probe
+
+                def restart(settings=None):
+                    nonlocal backend
+                    os.killpg(backend.pid, signal.SIGTERM)
+                    backend.wait(timeout=8)
+                    if settings is not None:
+                        path = base/'settings'/record['folder']/'settings.json'
+                        assert path.exists(), path
+                        path.write_text(json.dumps(settings))
+                    backend = subprocess.Popen([str(loader)], env=env, stdout=log, stderr=log,
+                                               start_new_session=True)
+                    processes.append(backend)
+                    until_ready(lambda: rpc('loader/get_plugins'), 'restarted Decky discovery')
+                    until_ready(lambda: rpc('loader/call_plugin_method', record['name'],
+                        'settings_getSetting', 'subtle_mode', False), 'restarted instance RPC')
+
+                report['lifecycle'] = probe(record['name'], restart, home/'runtime.log',
+                                            args.reproduce_timer_regression)
+                report['result'] = ('upstream timer lifecycle regressions reproduced' if args.reproduce_timer_regression
+                    else 'discovery, cancel, replace, completion and persistent restart passed')
+            elif args.reproduce_bound_method_regression:
                response = rpc('loader/call_legacy_plugin_method', record['name'], 'sp_list_media_players', {})
                assert response['success'] is False and 'self' in response['result'], response
                report['expectedRegression'] = response
@@ -0,0 +1,148 @@
+"""Simple Timer lifecycle through actual Decky instance dispatch, never Plugin()."""
+import asyncio
+import json
+import time
+import urllib.request
+
+import websockets
+
+
+class Client:
+    def __init__(self, name):
+        self.name = name
+        self.sequence = 0
+        self.events = []
+
+    async def __aenter__(self):
+        token = urllib.request.urlopen('http://127.0.0.1:1337/auth/token', timeout=2).read().decode()
+        self.ws = await websockets.connect('ws://127.0.0.1:1337/ws?auth='+token)
+        return self
+
+    async def __aexit__(self, *_):
+        await self.ws.close()
+
+    async def receive(self, timeout=8):
+        response = json.loads(await asyncio.wait_for(self.ws.recv(), timeout))
+        if response.get('type') == 5 and response.get('event') == 'loader/plugin_event':
+            event = response['args'][0]
+            if event['plugin'] == self.name:
+                self.events.append(event)
+        return response
+
+    async def call(self, method, *args, success=True):
+        self.sequence += 1
+        await self.ws.send(json.dumps({'type': 0, 'id': self.sequence,
+            'route': 'loader/call_plugin_method', 'args': [self.name, method, *args]}))
+        while True:
+            response = await self.receive()
+            if response.get('id') != self.sequence:
+                continue
+            await self.ws.send(json.dumps({'type': 3, 'id': self.sequence}))
+            if success:
+                assert response['type'] == 1, response
+                return response['result']
+            return response
+
+    async def seconds(self):
+        offset = len(self.events)
+        await self.call('load_remaining_seconds')
+        while not any(e['event'] == 'simple_timer_seconds_updated' for e in self.events[offset:]):
+            await self.receive()
+        return next(e['args'][0] for e in reversed(self.events)
+                    if e['event'] == 'simple_timer_seconds_updated')
+
+    async def drain(self, seconds):
+        deadline = time.monotonic()+seconds
+        while time.monotonic() < deadline:
+            try:
+                await self.receive(max(.01, deadline-time.monotonic()))
+            except TimeoutError:
+                break
+
+
+async def initial(name, negative):
+    async with Client(name) as client:
+        await client.call('set_subtle_mode', True)  # No sound or physical actions.
+        response = await client.call('cancel_timer', success=False)
+        if negative:
+            assert response['type'] == -1 and 'timer_task' in str(response), response
+        else:
+            assert response['type'] == 1, response
+        await client.call('start_timer', 60)
+        end = await client.call('settings_getSetting', 'timer_end', None)
+        assert end > time.time()
+        await client.call('cancel_timer')
+        saved = await client.call('settings_getSetting', 'timer_end', None)
+        assert (saved is not None) if negative else (saved is None), saved
+        await client.call('start_timer', 1)
+        await client.call('start_timer', 60)
+        await client.drain(6.5)  # Past upstream's 5-second tick and first timer's expiry.
+        completed = [e for e in client.events if e['event'] == 'simple_timer_event']
+        if negative:
+            assert completed, client.events
+        else:
+            assert not completed, completed
+            assert await client.seconds() > 45
+        await client.call('cancel_timer')
+        if negative:
+            return {'freshCancelError': response, 'cancelRetainsEnd': True,
+                    'replacedTimerStillFires': True}
+        await client.call('start_timer', 1)
+        client.events.clear()
+        await client.drain(5.5)
+        completed = [e for e in client.events if e['event'] == 'simple_timer_event']
+        assert len(completed) == 1 and completed[0]['args'] == ['Your session has ended!', True], completed
+        assert await client.seconds() == 0
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+        client.events.clear()
+        await client.call('start_timer', -20)  # An already expired, private silent deadline.
+        await client.drain(.3)
+        expired = [e for e in client.events if e['event'] == 'simple_timer_event']
+        assert len(expired) == 1 and expired[0]['args'] == ['Your timer has expired!', True], expired
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+        await client.call('start_timer', 60)
+        return {'end': await client.call('settings_getSetting', 'timer_end', None),
+                'recents': await client.call('settings_getSetting', 'recent_timers_seconds', [])}
+
+
+async def resumed(name, saved):
+    async with Client(name) as client:
+        assert 0 < await client.seconds() < 60
+        assert await client.call('settings_getSetting', 'timer_end', None) == saved['end']
+        assert await client.call('settings_getSetting', 'recent_timers_seconds', []) == saved['recents']
+        await client.call('cancel_timer')
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+
+
+async def idle(name):
+    async with Client(name) as client:
+        assert await client.seconds() == 0
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+        await client.call('cancel_timer')  # Idempotent before any new timer.
+        assert await client.call('settings_getSetting', 'subtle_mode', False) is True
+
+
+def probe(name, restart, log, negative=False):
+    saved = asyncio.run(initial(name, negative))
+    if negative:
+        restart({'timer_end': time.time()-60, 'subtle_mode': True})
+        asyncio.run(read_after_startup(name))
+        assert "has no attribute 'timer_task'" in log.read_text(), log.read_text()[-6000:]
+        return saved | {'expiredRestartError': True}
+    restart()
+    asyncio.run(resumed(name, saved))
+    restart()
+    asyncio.run(idle(name))
+    restart({'timer_end': time.time()-60, 'subtle_mode': True})
+    asyncio.run(idle(name))
+    return {'freshCancel': True, 'replacementSuppressesOldCompletion': True,
+            'completionClearsEnd': True, 'lateExpiryEmitsWithoutSelfCancel': True,
+            'activeRestartPreservesDeadlineAndRecents': True,
+            'canceledRestartIdle': True, 'expiredRestartIdle': True}
+
+
+async def read_after_startup(name):
+    async with Client(name) as client:
+        # _main is scheduled independently; allow it to finish before reading its journal.
+        await client.call('settings_getSetting', 'subtle_mode', False)
+        await client.drain(.3)
@@ -185,6 +185,9 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                    expected = hashlib.sha256(bundle.read(plugin['folder']+'/dist/index.js')).hexdigest()
                self.assertEqual(ssh(f'sha256sum {installed}/dist/index.js').split()[0], expected)
                self.assertEqual(json.loads(ssh(f'cat {installed}/plugin.json')).get('api_version', 'legacy'), plugin['api_version'])
+                if plugin['id'] == 96:
+                    self.assertEqual(found[0]['compatShims'], ['simple-timer-lifecycle'])
+                    self.assertEqual(found[0]['compatibility']['status'], 'works')
                if plugin['id'] == 135:
                    chunk = 'chunks/pluginApi-B8sV7970.js'
                    with zipfile.ZipFile(io.BytesIO(official_archive(plugin))) as bundle:
@@ -13,6 +13,7 @@ import os
 import shutil
 import subprocess
 import sys
+from urllib.parse import parse_qs

 args = sys.argv[1:]
 with open(os.environ["FAKEGH_LOG"], "a") as f:
@@ -49,6 +50,18 @@ while i < len(args):

 releases = json.load(open(os.environ["FAKEGH_RELEASES"]))
 repo = "repos/saphid/frame-control/"
+gate = json.load(open(os.environ["FAKEGH_GATES"])) if os.environ.get("FAKEGH_GATES") else {}
+commit = gate.get("tag_commit", "a" * 40)
+tag_object = "b" * 40
+main_jobs = ("checks", "e2e", "ios", "wireless-windows",
+             "server-tests (ubuntu-latest, 3.13)", "server-tests (macos-latest, 3.12)",
+             "server-tests (windows-latest, 3.12)")
+release_jobs = ("draft", "checksums",
+                "build (windows-latest, dist:win, app/dist/*.exe app/dist/*.zip)",
+                "build (ubuntu-latest, dist:linux, app/dist/*.AppImage app/dist/*.deb)",
+                "build (macos-15-intel, dist:mac:x64, app/dist/*.dmg app/dist/*.zip)",
+                "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)")
+decky_jobs = ("decky-runtime (ubuntu-latest)", "decky-runtime (ubuntu-24.04-arm)")


 def answer(response, fallback):
@@ -67,7 +80,30 @@ if method == "GET" and endpoint.startswith(repo + "git/ref/tags/"):
    tag = endpoint.rsplit("/", 1)[1]
    if tag not in os.environ.get("FAKEGH_TAGS", "").split():
        sys.exit("gh: Not Found (HTTP 404)")
-    print(json.dumps({"ref": "refs/tags/" + tag}))
+    print(json.dumps({"ref": "refs/tags/" + tag,
+                      "object": {"type": "tag", "sha": tag_object}}))
+elif method == "GET" and endpoint == repo + "git/tags/" + tag_object:
+    print(json.dumps({"object": {"type": "commit", "sha": commit}}))
+elif method == "GET" and endpoint.startswith(repo + "actions/workflows/"):
+    path, _, query = endpoint.partition("?")
+    workflow = path.split("/")[5]
+    branch = parse_qs(query).get("branch", [""])[0]
+    is_main = workflow != "release.yml"
+    run_id = {"checks.yml": 501, "release.yml": 502, "decky-runtime.yml": 503}[workflow]
+    run = {"id": run_id, "head_sha": gate.get("main_sha" if is_main else "release_sha", commit),
+           "head_branch": branch, "event": "push", "run_attempt": 1,
+           "status": gate.get("decky_status" if run_id == 503 else ("main_status" if is_main else "release_status"), "completed"),
+           "conclusion": gate.get("decky_conclusion" if run_id == 503 else ("main_conclusion" if is_main else "release_conclusion"), "success"),
+           "html_url": "https://github.com/saphid/frame-control/actions/runs/%s" % run_id}
+    print(json.dumps({"workflow_runs": [run]}))
+elif method == "GET" and endpoint.startswith(repo + "actions/runs/"):
+    run_id = endpoint[len(repo + "actions/runs/"):].split("/")[0]
+    names = {"501": main_jobs, "502": release_jobs, "503": decky_jobs}[run_id]
+    names = [name for name in names if name != gate.get("omit_job")]
+    jobs = [{"name": name, "status": "completed",
+             "conclusion": gate.get("bad_job_conclusion", "success") if name == gate.get("bad_job") else "success"}
+            for name in names]
+    print(json.dumps({"total_count": len(jobs), "jobs": jobs}))
 elif method == "GET" and endpoint.startswith(repo + "releases?"):
    # The fallback is what --jq '.[]' prints.
    answer(releases, "\n".join(json.dumps(r) for r in releases))
@@ -1,13 +1,14 @@
 # Pinned Decky store test archives

 These are unmodified ZIPs downloaded from the official Decky store CDN on
-2026-10-25, except `111.zip` downloaded on 2026-10-26. Each ZIP includes its
+2026-10-25, except `96.zip` and `111.zip` downloaded on 2026-10-26. Each ZIP includes its
 upstream `LICENSE`. They are test data, not plugins shipped or installed by
 Frame Control. The fake Frame tests serve them
 from a local fixture so CI does not depend on the store being online.

 | File | Official plugin | Version | Store SHA-256 |
 | --- | --- | --- | --- |
+| `96.zip` | Simple Timer | 1.0.0 | `973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312` |
 | `7.zip` | CSS Loader | 2.1.3 | `99beaf1374af82408e6d056e0b0147e5fca544e1035fa7ab88419231697bc231` |
 | `12.zip` | MusicControl | 1.1.6 | `246b89fd653c60a735b1cc401d1b0937d5cb969eea9024561661ff741f081d62` |
 | `111.zip` | Music Control | 1.1.7 | `3f56a3f56034b277ea74a2c37cc84133b69e382aa6bcb0b43876776aac737ed9` |
@@ -19,7 +20,7 @@ from a local fixture so CI does not depend on the store being online.
 | `36.zip` | SteamGridDB | 1.8.1 | `e84f5b1f111af8862b06218479491fbf61036e1bfd9f16f93f9901e9b9ebc5e0` |
 | `135.zip` | Deck Shelves | 2.0.0 | `b566280ad38fd3ecd584b5b46a855f301539eb9a86063834c64b7045f7063f91` |

-The matching source projects are
+The matching source projects include [Simple Timer](https://github.com/decktools-xyz/simple-timer) and
 [CSS Loader](https://github.com/suchmememanyskill/SDH-CssLoader),
 [MusicControl](https://github.com/nikurasu/MusicControl),
 [Music Control](https://github.com/martinpl/music-control),
@@ -41,3 +42,9 @@ Bluetooth result and limits are in
 Deck Shelves' chunked frontend renders its settings in local Chromium with
 backend/network calls denied. Its Steam Home shelves cannot be verified in the
 isolated VR panel; no worn-headset test is claimed.
+
+Simple Timer also runs through actual published Decky 3.3.0 discovery, instance
+RPC and events in the native isolated runtime gate. Cancel/replace/completion and
+active/canceled/expired backend restarts are regression checks; the unmodified
+archive must reproduce its historical lifecycle errors. Only private silent
+timers/settings are used. The upstream BSD license stays unchanged.
@@ -4,6 +4,8 @@ from pathlib import Path

 ROOT = Path(__file__).parent / 'fixtures/framey-official'
 PLUGINS = (
+    {'id': 96, 'name': 'Simple Timer', 'version': '1.0.0', 'api_version': 1,
+     'folder': 'simple-timer', 'sha256': '973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312'},
    {'id': 12, 'name': 'MusicControl', 'version': '1.1.6', 'api_version': 'legacy', 'folder': 'MusicControl', 'sha256': '246b89fd653c60a735b1cc401d1b0937d5cb969eea9024561661ff741f081d62'},
    {'id': 111, 'name': 'Music Control', 'version': '1.1.7', 'api_version': 'legacy',
     'folder': 'MusicControl', 'sha256': '3f56a3f56034b277ea74a2c37cc84133b69e382aa6bcb0b43876776aac737ed9'},
@@ -244,46 +244,3 @@ vm.runInContext('api=mockApi',ctx);
 await vm.runInContext('refreshDecky()',ctx);
 assert.equal(el('frameyPanel').hidden,true);
 assert.match(el('deckyState').textContent,/panel was closed until status can be refreshed/);
-
-// A denied sessionStorage must not lose an accepted job in the current panel.
-// Keep Update/Remove disabled after a polling outage and allow Check result.
-for(const method of ['getItem','setItem','removeItem'])
-  ctx.sessionStorage[method]=()=>{throw Error('storage denied');};
-let accepted=0;
-ctx.mockApi=async path => {
-  if(path==='/api/decky/plugin'){accepted++;return {job:'memory-job'};}
-  if(path.startsWith('/api/job'))throw Error('connection lost');
-  if(path==='/api/decky')return {managed:true,running:true,
-    plugins:[{storeId:2,name:'Plugin 2',version:'1.0'}]};
-  throw Error(`unexpected ${path}`);
-};
-vm.runInContext('api=mockApi;deckyState={managed:true,running:true,plugins:[]};' +
-  'deckyStore=[{id:2,name:"Plugin 2",version:"1.0",description:"A panel",root:false}];showDeckyStore()',ctx);
-await vm.runInContext('deckyChange("install",{id:2,name:"Plugin 2",sha256:"a".repeat(64)})',ctx);
-assert.equal(accepted,1);
-assert.equal(vm.runInContext('deckyJobPending()',ctx),true);
-assert.equal(el('deckyJobCheck').hidden,false);
-assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,true);
-await vm.runInContext('deckyChange("remove",{id:2,name:"Plugin 2"})',ctx);
-assert.equal(accepted,1);
-ctx.mockApi=async path => {
-  if(path.startsWith('/api/job'))return {done:true,message:'Installed Plugin 2'};
-  if(path==='/api/decky')return {managed:true,running:true,
-    plugins:[{storeId:2,name:'Plugin 2',version:'1.0'}]};
-  throw Error(`unexpected ${path}`);
-};
-vm.runInContext('api=mockApi',ctx);
-await vm.runInContext('checkDeckyJob()',ctx);
-assert.equal(vm.runInContext('deckyJobPending()',ctx),false);
-assert.equal(el('deckyJobCheck').hidden,true);
-assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,false);
-
-// Opening the headset panel with a key in its URL must survive denied storage.
-const deniedDocument={getElementById:id=>new Element(id),createElement:()=>new Element()};
-const deniedBoot=vm.createContext({document:deniedDocument,
-  location:{hash:'#private-key',pathname:'/'},history:{replaceState(){}},
-  sessionStorage:{getItem(){throw Error('storage denied');},setItem(){throw Error('storage denied');}},
-  window:{addEventListener(){}},setInterval(){},setTimeout(){},confirm:()=>true,console,
-  fetch(){throw Error('No network expected');}});
-vm.runInContext(script,deniedBoot);
-assert.equal(vm.runInContext('key',deniedBoot),'private-key');
@@ -161,6 +161,37 @@ class StoreTransaction(unittest.TestCase):
        self.assertNotEqual(result.returncode, 0)
        self.assertTrue(external.exists())

+    def test_exact_simple_timer_gets_lifecycle_repair_and_keeps_api1_and_license(self):
+        from framey_official import PLUGINS, archive as official_archive
+        plugin = next(p for p in PLUGINS if p['id'] == 96)
+        result = self.apply('install', official_archive(plugin), plugin_id=96,
+                            folder=plugin['folder'], version=plugin['version'])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        folder = self.folder.parent / plugin['folder']
+        self.assertEqual(json.loads((folder / '.frame-control-store.json').read_text())['compatShims'],
+                         ['simple-timer-lifecycle'])
+        self.assertEqual(json.loads((folder / 'plugin.json').read_text())['api_version'], 1)
+        with zipfile.ZipFile(io.BytesIO(official_archive(plugin))) as original:
+            self.assertEqual((folder / 'LICENSE').read_bytes(), original.read('simple-timer/LICENSE'))
+        # Backend behavior is verified separately by the real Decky lifecycle gate.
+        result = self.apply('remove', plugin_id=96, folder=plugin['folder'])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse(folder.exists())
+
+    def test_changed_simple_timer_digest_does_not_get_pinned_repair(self):
+        from framey_official import PLUGINS, archive as official_archive
+        plugin = next(p for p in PLUGINS if p['id'] == 96)
+        data = io.BytesIO(official_archive(plugin))
+        with zipfile.ZipFile(data, 'a') as changed:
+            original_main = changed.read('simple-timer/main.py')
+            changed.writestr('simple-timer/new-version.txt', 'unrecognized new payload')
+        result = self.apply('install', data.getvalue(), plugin_id=96,
+                            folder=plugin['folder'], version=plugin['version'])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        folder = self.folder.parent / plugin['folder']
+        self.assertEqual((folder / 'main.py').read_bytes(), original_main)
+        self.assertEqual(json.loads((folder / '.frame-control-store.json').read_text()).get('compatShims', []), [])
+
    def test_exact_shotty_archive_gets_isolated_click_import(self):
        from framey_official import PLUGINS, archive as official_archive
        plugin = next(p for p in PLUGINS if p['id'] == 53)
@@ -59,6 +59,16 @@ class Compatibility(unittest.TestCase):
                frame_decky_store.change(no_ssh, 'install', 42)
            download.assert_not_called()

+    def test_old_simple_timer_copy_requires_lifecycle_reinstall(self):
+        plugin = next(p for p in json.loads(compatibility.DATA.read_text())['plugins'] if p['id'] == 96)
+        installed = {'plugins': [dict(storeId=96, version=plugin['version'], sha256=plugin['sha256']),
+                                  dict(storeId=96, version=plugin['version'], sha256=plugin['sha256'],
+                                       compatShims=['simple-timer-lifecycle'])]}
+        result = frame_decky.status(lambda *a, **k: json.dumps(installed))['plugins']
+        self.assertEqual(result[0]['compatibility']['status'], 'partial')
+        self.assertIn('Update or reinstall', result[0]['compatibility']['reason'])
+        self.assertEqual(result[1]['compatibility']['status'], 'works')
+
    def test_missing_audit_data_is_unverified(self):
        with patch.object(compatibility, 'DATA', Path('/nonexistent/framey-audit.json')):
            self.assertEqual(compatibility.lookup(12, 'a'*64, '1.0')['status'], 'unverified')
@@ -19,7 +19,7 @@ class RuntimeCoverage(unittest.TestCase):
        self.assertEqual(len(cases), len({case['id'] for case in cases}))
        for case in cases:
            self.assertIn(case['id'], official)
-            self.assertIn(case['probe'], ('mpris', 'screenshots'))
+            self.assertIn(case['probe'], ('mpris', 'screenshots', 'timer-lifecycle'))

    def test_new_shim_without_runtime_case_fails_coverage(self):
        import frame_decky_store
@@ -37,12 +37,14 @@ def draft(tag_name="untagged-c6ddfed7f75d67db2e99", name="Frame Control 9.8.7",


 class PublishRelease(unittest.TestCase):
-    def run_script(self, releases, *args, tags="v9.8.7"):
+    def run_script(self, releases, *args, tags="v9.8.7", gates=None):
        d = Path(tempfile.mkdtemp())
        (d / "releases.json").write_text(json.dumps(releases))
+        (d / "gates.json").write_text(json.dumps(gates or {}))
        env = dict(os.environ, PATH="%s:%s" % (FAKEGH, os.environ["PATH"]),
                   FAKEGH_RELEASES=str(d / "releases.json"), FAKEGH_TAGS=tags,
-                   FAKEGH_LOG=str(d / "log"), FAKEGH_UPLOAD=str(d / "upload.json"))
+                   FAKEGH_LOG=str(d / "log"), FAKEGH_UPLOAD=str(d / "upload.json"),
+                   FAKEGH_GATES=str(d / "gates.json"))
        p = subprocess.run(["sh", str(SCRIPT), *args], env=env, capture_output=True, text=True, timeout=30)
        log = [json.loads(line) for line in (d / "log").read_text().splitlines()] if (d / "log").exists() else []
        upload = json.loads((d / "upload.json").read_text()) if (d / "upload.json").exists() else None
@@ -120,6 +122,36 @@ class PublishRelease(unittest.TestCase):
        self.assertIsNone(upload)
        self.assertTrue(all("-X" not in c for c in log))

+    def test_refuses_failed_e2e_or_cancelled_installer_before_mutation(self):
+        for gates in ({"bad_job": "e2e", "bad_job_conclusion": "failure"},
+                      {"bad_job": "decky-runtime (ubuntu-24.04-arm)",
+                       "bad_job_conclusion": "failure"},
+                      {"bad_job": "build (macos-latest, dist, app/dist/*.dmg app/dist/*.zip)",
+                       "bad_job_conclusion": "cancelled"}):
+            p, log, upload = self.run_script([draft()], "v9.8.7", gates=gates)
+            self.assertNotEqual(p.returncode, 0)
+            self.assertIn("release gate failed", p.stderr)
+            self.assertIsNone(upload)
+            self.assertFalse(any("-X" in call for call in log))
+
+    def test_refuses_missing_or_nonexact_gate_results(self):
+        for gates in ({"omit_job": "e2e"}, {"main_sha": "c" * 40},
+                      {"decky_conclusion": "failure"}, {"release_conclusion": "failure"},
+                      {"release_status": "in_progress"}):
+            p, log, upload = self.run_script([draft()], "v9.8.7", gates=gates)
+            self.assertNotEqual(p.returncode, 0)
+            self.assertIn("release gate failed", p.stderr)
+            self.assertIsNone(upload)
+            self.assertFalse(any("-X" in call for call in log))
+
+    def test_refuses_a_withdrawn_release_even_when_ci_is_green(self):
+        rel = dict(draft(), body="> **WITHDRAWN 26 October 2026.** Do not install.\n\n# Notes")
+        p, log, upload = self.run_script([rel], "v9.8.7")
+        self.assertNotEqual(p.returncode, 0)
+        self.assertIn("marked WITHDRAWN", p.stderr)
+        self.assertIsNone(upload)
+        self.assertFalse(any("-X" in call for call in log))
+

 if __name__ == "__main__":
    unittest.main()
@@ -40,7 +40,9 @@ def plugins(folder):
                              'author': str(data.get('author', ''))[:80],
                              'storeId': owned.get('storeId') if isinstance(owned.get('storeId'), int) else None,
                              'version': str(owned.get('version', ''))[:40],
-                              'sha256': str(owned.get('sha256', ''))[:64]})
+                              'sha256': str(owned.get('sha256', ''))[:64],
+                              'compatShims': [s[:100] for s in owned.get('compatShims', []) if isinstance(s, str)][:16]
+                                  if isinstance(owned.get('compatShims'), list) else []})
            except (ValueError, OSError, UnicodeError): pass
    return found
 os_release = {}
@@ -166,7 +168,8 @@ def status(ssh):
    result = json.loads(ssh('python3 -', stdin=PROBE, timeout=15))
    for plugin in result.get('plugins', []):
        plugin['compatibility'] = framey_compatibility.lookup(
-            plugin.get('storeId'), plugin.get('sha256'), plugin.get('version'))
+            plugin.get('storeId'), plugin.get('sha256'), plugin.get('version'),
+            installed_shims=plugin.get('compatShims', []))
    return result


@@ -209,6 +209,100 @@ try:
            unpacked=stage/folder
            if not unpacked.is_dir(): raise RuntimeError('Missing plugin folder')
            compat_shims=[]
+            # Simple Timer 1.0.0 has annotation-only task state, orphaned
+            # replacement tasks and canceled deadlines that resume on restart.
+            # Preserve its API1 instance convention and upstream license.
+            if int(plugin_id)==96 and digest=='973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312' and folder=='simple-timer':
+                main=unpacked/'main.py'
+                source=main.read_text(encoding='utf-8')
+                start='    async def start_timer('; end='    async def load_recents('
+                if source.count(start)!=1 or source.count(end)!=1: raise RuntimeError('Simple Timer compatibility source changed')
+                a=source.index(start); b=source.index(end,a)
+                source=source[:a]+"""    async def _stop_timer(self):
+        # Call only under timer_lock. Joining prevents a replaced task from
+        # updating the new timer or sending a stale completion notification.
+        task, self.timer_task = self.timer_task, None
+        if task is not None and task is not asyncio.current_task():
+            task.cancel()
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
+
+    async def start_timer(self, seconds: int):
+        async with self.timer_lock:
+            await self._stop_timer()
+            recent = await self.settings_getSetting(settings_key_recent_timers, [])
+            await self.settings_setSetting(settings_key_recent_timers, [seconds] + recent[:4])
+            deadline = time.time() + seconds
+            await self.settings_setSetting(settings_key_timer_end, deadline)
+            await self.settings_commit()
+            self.seconds_remaining = seconds
+            self.timer_task = self.loop.create_task(self.timer_handler(datetime.fromtimestamp(deadline)))
+            await self.load_recents()
+            await self.load_remaining_seconds()
+
+    async def timer_handler(self, timer_end: datetime):
+        while True:
+            remaining = timer_end.timestamp() - time.time()
+            if remaining <= 0:
+                break
+            await asyncio.sleep(min(5, remaining))
+            self.seconds_remaining = max(0, timer_end.timestamp() - time.time())
+            await self.load_remaining_seconds()
+        async with self.timer_lock:
+            if self.timer_task is not asyncio.current_task():
+                return
+            self.timer_task = None
+            self.seconds_remaining = 0
+            await self.settings_setSetting(settings_key_timer_end, None)
+            await self.settings_commit()
+            await self.load_remaining_seconds()
+            subtle = await self.settings_getSetting(settings_key_subtle_mode, False)
+            if remaining <= -10:
+                await decky.emit("simple_timer_event", "Your timer has expired!", True)
+            else:
+                await decky.emit("simple_timer_event", "Your session has ended!", subtle)
+
+    async def cancel_timer(self):
+        async with self.timer_lock:
+            await self._stop_timer()
+            self.seconds_remaining = 0
+            await self.settings_setSetting(settings_key_timer_end, None)
+            await self.settings_commit()
+            await self.load_remaining_seconds()
+
+"""+source[b:]
+                start='    async def _main('; end='    async def _uninstall('
+                if source.count(start)!=1 or source.count(end)!=1: raise RuntimeError('Simple Timer compatibility source changed')
+                a=source.index(start); b=source.index(end,a)
+                source=source[:a]+"""    async def _main(self):
+        self.loop = asyncio.get_running_loop()
+        self.timer_task = None
+        self.timer_lock = asyncio.Lock()
+        self.seconds_remaining = 0
+        await self.settings_read()
+        deadline = await self.settings_getSetting(settings_key_timer_end, None)
+        if deadline is not None:
+            self.seconds_remaining = max(0, deadline - time.time())
+            if self.seconds_remaining > 0:
+                # Resume the exact deadline without adding another recent timer.
+                self.timer_task = self.loop.create_task(self.timer_handler(datetime.fromtimestamp(deadline)))
+            else:
+                await self.cancel_timer()
+        await self.load_recents()
+        await self.load_subtle_mode()
+        decky.logger.info("Simple Timer has been initialised.")
+
+    async def _unload(self):
+        async with self.timer_lock:
+            # Backend unload is a pause; only explicit cancel clears the deadline.
+            await self._stop_timer()
+        decky.logger.info("Simple Timer has been unloaded.")
+
+"""+source[b:]
+                main.write_text(source,encoding='utf-8')
+                compat_shims.append('simple-timer-lifecycle')
            # Shotty 0.1.0 imports click.get_app_dir but never calls it. Its
            # official ZIP omits click and Decky's bundled Python lacks it.
            # Supply the Linux function only inside this exact plugin's
@@ -7612,8 +7612,8 @@
        "https://github.com/decktools-xyz/simple-timer",
        "https://github.com/decktools-xyz/simple-timer.git"
      ],
-      "status": "partial",
-      "reason": "Live start/cancel, countdown events, completion toast, persisted recents/subtle mode verified in Chromium with real ARM64 Decky. Upstream expired-timer restart raises missing timer_task. Audio/suspend unsupported; alerts require an open panel; worn VR unverified.",
+      "status": "works",
+      "reason": "Verified for silent in-panel session timers: Chromium Begin/Cancel/countdown/toast with real ARM64 Decky 3.3.0; repaired cancel, replace, completion and active/canceled/expired restarts pass actual loader RPC/events. Update/reinstall required. Sound and suspend unsupported; alerts require an open panel; worn VR unverified.",
      "blockInstall": false,
      "verification": [
        "static archive",
@@ -7661,6 +7661,22 @@
          "subscriptionsAfterPanelClose": 0
        },
        "method": "local Chromium + real Frame SSH; private actual Decky 3.3.0 ARM64 service"
+      },
+      "requiredShims": [
+        "simple-timer-lifecycle"
+      ],
+      "lifecycle": {
+        "evidence": "docs/evidence/framey-simple-timer-2026-10-26.md",
+        "actualDeckyVersion": "3.3.0",
+        "instanceApi": 1,
+        "backendRestarts": [
+          "active",
+          "canceled",
+          "expired"
+        ],
+        "realFrame": true,
+        "localBrowser": true,
+        "fakeFrame": true
      }
    },
    {
@@ -12,7 +12,7 @@ def _records(path):
    return json.loads(path.read_text())['plugins']


-def lookup(plugin_id, digest, version):
+def lookup(plugin_id, digest, version, installed_shims=None):
    unknown = {'status': 'unverified', 'reason': 'This exact store version has not been audited on Frame.',
               'verification': [], 'blockInstall': False}
    if type(plugin_id) is not int or not isinstance(digest, str) or not isinstance(version, str):
@@ -23,6 +23,14 @@ def lookup(plugin_id, digest, version):
        if len(matches) != 1:
            return unknown
        record = matches[0]
-        return {key: record[key] for key in ('status', 'reason', 'verification', 'blockInstall')}
+        result = {key: record[key] for key in ('status', 'reason', 'verification', 'blockInstall')}
+        required = record.get('requiredShims', [])
+        if result['status'] in ('works', 'partial') and required and installed_shims is not None and (
+                not isinstance(installed_shims, list) or
+                any(shim not in installed_shims for shim in required)):
+            result['status'] = 'partial'
+            result['reason'] = ('Update or reinstall this managed plugin to add its missing Frame compatibility fix. '
+                                + result['reason'])
+        return result
    except (OSError, ValueError, KeyError, TypeError):
        return unknown
@@ -64,8 +64,8 @@ iframe{display:block;width:100%;height:560px;background:#0d1925;border:1px solid
 <div id="extensionPanel" hidden><div class="row" style="margin-top:16px"><strong id="extensionTitle"></strong><button id="extensionClose" class="secondary">Close extension</button></div>
  <iframe id="extensionFrame" title="Frame Control extension" sandbox="allow-scripts" referrerpolicy="no-referrer"></iframe></div>
 <script>
-const key=location.hash.slice(1)||(()=>{try{return sessionStorage.getItem('frameHeadsetKey')||'';}catch(_){return '';}})();
-if(key)try{sessionStorage.setItem('frameHeadsetKey',key);}catch(_){}
+const key=location.hash.slice(1)||sessionStorage.getItem('frameHeadsetKey')||'';
+if(key)sessionStorage.setItem('frameHeadsetKey',key);
 history.replaceState(null,'',location.pathname);
 const byId=id=>document.getElementById(id);
 let latestStatus=null, activeExtension=null, recordBusy=false;
@@ -106,23 +106,7 @@ async function refreshGames(){const list=byId('games');try{const data=await api(
    row.append(name,quit);list.append(row);}if(!data.running.length)list.textContent='No games are running.';
  }catch(error){list.textContent=error.message;}}
 function compatibilityText(plugin){const c=plugin.compatibility;return c ? `${c.status === 'na' ? 'N/A' : c.status}: ${c.reason}${c.verification?.length ? ' Verified: '+c.verification.join(', ')+'.' : ''}` : 'Unverified on Frame';}
-// Some Chromium profiles deny sessionStorage. Keep the accepted job ID in
-// memory so this open panel can still reconnect instead of offering a second
-// install while the first one may be running.
-let deckyPendingJob=null;
-function savedDeckyJob(){
-  if(deckyPendingJob)return deckyPendingJob;
-  try{return JSON.parse(sessionStorage.getItem('frameyPluginJob')||'null');}catch(_){return null;}
-}
-function rememberDeckyJob(job){
-  deckyPendingJob=job;
-  try{sessionStorage.setItem('frameyPluginJob',JSON.stringify(job));}catch(_){}
-}
-function clearDeckyJob(){
-  deckyPendingJob=null;
-  try{sessionStorage.removeItem('frameyPluginJob');}catch(_){}
-}
-function deckyJobPending(){return !!savedDeckyJob();}
+function deckyJobPending(){return !!sessionStorage.getItem('frameyPluginJob');}
 let deckyState=null, deckyStore=[], deckyStoreIndex=0, deckyStoreRequest=0,
  deckyStatusRequest=0,
  activeFrameyId=null, activeFrameyReceipt=null, frameySession=null, deckyBusy=false;
@@ -190,7 +174,7 @@ function deckyJobView(title,message,percent,failed=false){
  byId('deckyJobPanel').hidden=false;byId('deckyJobTitle').textContent=title;
  byId('deckyJobStatus').textContent=message;
  const bar=byId('deckyJobProgress');if(Number.isFinite(percent))bar.value=percent;else bar.removeAttribute('value');
-  byId('deckyJobCheck').hidden=!failed||!deckyJobPending();
+  byId('deckyJobCheck').hidden=!failed||!sessionStorage.getItem('frameyPluginJob');
 }
 async function followDeckyJob(job,action,name){
  for(let n=0;n<180;n++){
@@ -198,12 +182,12 @@ async function followDeckyJob(job,action,name){
    try{progress=await api(`/api/job?id=${encodeURIComponent(job)}`);}
    catch(error){
      if(/no such job/i.test(error.message)){
-        clearDeckyJob();
+        sessionStorage.removeItem('frameyPluginJob');
        throw Error('The app restarted and lost this job result. Refresh installed plugins to see what changed.');
      }
      throw error;
    }
-    if(progress.done){if(progress.error){clearDeckyJob();throw Error(progress.error);}
+    if(progress.done){if(progress.error){sessionStorage.removeItem('frameyPluginJob');throw Error(progress.error);}
      deckyJobView(`${action} ${name}`,progress.message||`${action} complete`,100);return;}
    deckyJobView(`${action} ${name}`,progress.stage||'Waiting for Frame…',progress.percent);
    await new Promise(resolve=>setTimeout(resolve,1000));
@@ -226,18 +210,18 @@ async function deckyChange(action,plugin){if(deckyBusy)return;
  try{const started=await api('/api/decky/plugin',{action,id:plugin.id,
    sha256:action==='remove'?undefined:plugin.sha256,acknowledged:true});
    if(!started.job)throw Error('The server did not return a job ID');
-    rememberDeckyJob({job:started.job,action,name:plugin.name});
+    sessionStorage.setItem('frameyPluginJob',JSON.stringify({job:started.job,action,name:plugin.name}));
    await followDeckyJob(started.job,action,plugin.name);
-    clearDeckyJob();
+    sessionStorage.removeItem('frameyPluginJob');
    if(panelNote)byId('deckyJobStatus').textContent+=panelNote;
  }catch(error){deckyJobView(`${action} ${plugin.name}`,`Error: ${error.message}${panelNote}`,null,true);}
  finally{deckyBusy=false;await refreshDecky();}
 }
-async function checkDeckyJob(){const saved=savedDeckyJob();
+async function checkDeckyJob(){let saved;try{saved=JSON.parse(sessionStorage.getItem('frameyPluginJob')||'null');}catch(_){saved=null;}
  if(deckyBusy)return;
-  if(!saved||typeof saved.job!=='string'){clearDeckyJob();showDeckyStore();return;}
+  if(!saved||typeof saved.job!=='string'){sessionStorage.removeItem('frameyPluginJob');showDeckyStore();return;}
  deckyBusy=true;byId('deckyJobCheck').hidden=true;
-  try{await followDeckyJob(saved.job,saved.action,saved.name);clearDeckyJob();}
+  try{await followDeckyJob(saved.job,saved.action,saved.name);sessionStorage.removeItem('frameyPluginJob');}
  catch(error){deckyJobView(`${saved.action} ${saved.name}`,`Error: ${error.message}`,null,true);}
  finally{deckyBusy=false;await refreshDecky();}}
 byId('deckyJobCheck').onclick=checkDeckyJob;
Author	SHA1	Message	Date
SAPHID	b3de6ecf71	Fix Simple Timer cancellation and backend restarts	2026-10-26 23:33:18 +00:00
Alex Southwell	38db6a2846	Merge pull request #348 from saphid/release/v0.4.49 Prepare Frame Control v0.4.49 repair candidate	2026-10-26 23:05:19 +00:00
SAPHID	a17ebf96fe	Record locked v0.4.49 candidate smoke	2026-10-26 22:51:00 +00:00
SAPHID	6247dfbf89	Prepare Frame Control v0.4.49 candidate	2026-10-26 22:48:02 +00:00
Alex Southwell	7ed59a9b25	Merge pull request #344 from saphid/fix/release-publisher-gates Require exact CI and installer gates before publishing	2026-10-26 22:46:48 +00:00
SAPHID	14d677f527	Merge remote-tracking branch 'origin/main' into fix/release-publisher-gates	2026-10-26 22:36:58 +00:00
SAPHID	72f8152525	Resolve gh consistently through publisher shell	2026-10-26 22:35:21 +00:00
SAPHID	62e27a2450	Require native Decky regression gate for publication	2026-10-26 22:28:50 +00:00
SAPHID	1cd1c07b7a	Keep withdrawn releases out of the update channel	2026-10-26 22:25:05 +00:00
SAPHID	55fb9226ba	Fail closed on exact release CI and installer gates	2026-10-26 22:21:53 +00:00