Record v0.4.48 candidate Frame smoke

Repair official Music Control backend bound-method calls

.github/workflows/release.yml

@@ -10,7 +10,7 @@ on:
   push:
     tags: ["v*"]
   pull_request:
-    paths: ["app/**", "desktop/**", "mac/frame-mac-view/**", ".github/workflows/release.yml"]
+    paths: ["app/**", "desktop/**", "mac/frame-mac-view/**", "scripts/check-appimage-launch.py", ".github/workflows/release.yml"]
   workflow_dispatch:
 
 # A newer push to the same pull request supersedes a build still in progress.
@@ -70,6 +70,9 @@ jobs:
           - os: macos-latest
             script: dist
             files: app/dist/*.dmg app/dist/*.zip
+          - os: macos-15-intel
+            script: dist:mac:x64
+            files: app/dist/*.dmg app/dist/*.zip
           - os: windows-latest
             script: dist:win
             files: app/dist/*.exe app/dist/*.zip
@@ -110,6 +113,20 @@ jobs:
         run: npm ci && npm run ${{ matrix.script }}
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
+      - name: Check the Mac bundle matches its runner
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          bundle=$(find app/dist -maxdepth 2 -name 'Frame Control.app' -type d -print -quit)
+          test -n "$bundle"
+          resources="$bundle/Contents/Resources"
+          for binary in "$bundle/Contents/MacOS/Frame Control" "$resources/python/bin/python3" "$resources/tools/adb" "$resources/mac/bin/frame-mac-view"; do
+            lipo "$binary" -verify_arch "$(uname -m)"
+          done
+          "$resources/python/bin/python3" -I -B -c 'import http.server, ssl, sqlite3; print(ssl.OPENSSL_VERSION)'
+      - name: Launch the built Linux AppImage
+        if: matrix.os == 'ubuntu-latest'
+        run: python3 scripts/check-appimage-launch.py app/dist/Frame-Control-linux-x86_64.AppImage
       # The installer, not just the unpacked build: its 7-Zip payload once dropped
       # the OpenXR layer's arm64 library without any error. Install it silently
       # and compare every installed file with the unpacked build.

README.md

@@ -128,6 +128,7 @@ Choose the operating system and processor of the computer you will use.
 | | Download | Needs |
 |---|---|---|
 | **macOS** (Apple Silicon) | [Frame-Control-mac-arm64.dmg](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-mac-arm64.dmg) | Nothing extra |
+| **macOS** (Intel, v0.4.39+) | [Frame-Control-mac-x64.dmg](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-mac-x64.dmg) | Nothing extra |
 | **Windows** 10 / 11 (x64) | [Frame-Control-Setup-x64.exe](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-Setup-x64.exe) · [portable .zip](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-win-x64.zip) | OpenSSH Client (normally installed) |
 | **Linux** (x64) | [AppImage](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-x86_64.AppImage) · [.deb](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-amd64.deb) | `ssh` (most desktops have it) |
 | **Linux** (arm64) | [AppImage](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.AppImage) · [.deb](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.deb) | `ssh`, and `adb` for Android apps (`sudo apt install adb`) |
@@ -150,8 +151,8 @@ The [source](https://github.com/saphid/frame-control) and [release build workflo
 
 日本語: [5 ステップの接続ガイド](docs/connection-faq.md#日本語-5-ステップで接続)を参照してください。v0.4.26 以降は公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。
 
-**Which build?** On a Mac, check Apple menu → About This Mac: the download is
-for Apple Silicon (M-series); no Intel Mac build is published. On Windows,
+**Which build?** On a Mac, check Apple menu → About This Mac: use `mac-arm64`
+for Apple Silicon (M-series), or `mac-x64` for Intel (available from v0.4.39). On Windows,
 check Settings → System → About → System type: the release is x64, not a native
 Windows ARM build. On Linux, `uname -m` reports `x86_64` (x64) or `aarch64`
 (arm64). Use `.deb` on Debian/Ubuntu, or AppImage on other distributions.
@@ -173,16 +174,44 @@ distribution's. If you already have `adb`, the app uses yours.
 <details>
 <summary><b>macOS: the app isn't notarized</b></summary>
 
-There's no paid Apple developer account behind it, so macOS says the app is
-damaged or can't be checked. Drag it to Applications, then clear the download
-quarantine once, only for a download you trust from the releases linked above:
+The app has an **ad hoc signature**, no Apple Developer ID signature, and no
+notarization. The DMG is unsigned. First verify the download against the
+`SHA256SUMS` from the same release, then open the DMG and drag **Frame Control**
+to **Applications**.
+
+Check your processor before opening: v0.4.38 and earlier publish only
+`mac-arm64` for Apple Silicon. On an Intel Mac, this build cannot run;
+removing quarantine or installing Rosetta does not make an ARM app run on Intel.
+On a real Intel MacBook Air with macOS 15.7.7, opening v0.4.35 and v0.4.36
+reported: **“The application cannot be opened because it has an incorrect
+executable format.”** This is an architecture failure, not an observed
+Gatekeeper warning. The official **v0.4.39 Intel DMG** was then verified,
+installed and launched on that Air. Both CLI and T3 browser downloads lacked
+quarantine metadata; no Gatekeeper dialog appeared, while `spctl` rejected the
+ad hoc signed app. This does not verify Safari/Chrome warnings or Open Anyway.
+See the [released Intel test](docs/evidence/mac-v0439-2026-10-26.md) and
+[earlier architecture failure](docs/evidence/mac-desktop-2026-10-26.md).
+
+On a compatible Mac, if macOS blocks an unverified developer, try opening the
+app once, then go to **System Settings → Privacy & Security → Open Anyway**
+and confirm **Open**. Only do this for a download you verified and trust.
+[Apple's opening instructions](https://support.apple.com/102445) describe the
+current security controls. The exact warning and this override flow have not
+yet been verified here on either Mac architecture.
+
+If a trusted, verified copy still reports “damaged” and offers no Open Anyway
+option, the Terminal fallback removes only this app's download quarantine
+(it does not sign or notarize the app):
 
 ```sh
 xattr -dr com.apple.quarantine "/Applications/Frame Control.app"
 ```
 
-The first time, macOS also asks to allow local network access (for SSH) and
-control of Terminal (for the password prompts).
+Then open it from Applications. Do not disable Gatekeeper globally. Depending
+on the features you use, macOS may also request Local Network access, permission
+to control Terminal, or Screen Recording; approve only the feature you intend
+to use. Those permission prompts were not verified in the release test above.
+
 </details>
 
 <details>

app/build/fetch-deps.js

@@ -4,7 +4,7 @@
 // copies into the app's resources. Also KDE Connect for the Frame (the same arm64
 // packages for every build), into ../frame/kdeconnect/packages as listed in
 // ../frame/kdeconnect/packages.json. Everything is pinned by version and SHA-256.
-//   node build/fetch-deps.js mac arm64 | win x64 | linux x64 arm64
+//   node build/fetch-deps.js mac arm64 x64 | win x64 | linux x64 arm64
 const crypto = require("crypto");
 const fs = require("fs");
 const https = require("https");
@@ -15,6 +15,7 @@ const PY = "3.12.14+20260924";
 const PY_URL = (triple) => "https://github.com/astral-sh/python-build-standalone/releases/download/"
   + `${PY.split("+")[1]}/cpython-${PY}-${triple}-install_only_stripped.tar.gz`;
 const PYTHON = {
+  "mac-x64": ["x86_64-apple-darwin", "7ea9761b9069c10b9a20531d568645849d604c59e9c7f11f6659f1e1790c968e"],
   "mac-arm64": ["aarch64-apple-darwin", "c2edb321cd32ec2b170df208db0446dccc4398db602ca27cf2079098fb1f7d9d"],
   "win-x64": ["x86_64-pc-windows-msvc", "c5bf8edfe858c1df9891be498b5bbc8761d383df5b9790658b088fea4870433a"],
   "linux-x64": ["x86_64-unknown-linux-gnu", "269b2c99e4db15b242bf01832f4fea1e8f1a664f273cff519393f296e9820b41"],

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.35",
+  "version": "0.4.48",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.35",
+      "version": "0.4.48",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.35",
+  "version": "0.4.48",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",
@@ -9,10 +9,11 @@
   "scripts": {
     "start": "env -u ELECTRON_RUN_AS_NODE electron .",
     "icon": "env -u ELECTRON_RUN_AS_NODE electron build/make-icon.js",
-    "dist": "sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --publish never",
-    "dist:dir": "sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --dir",
+    "dist": "FRAME_MAC_ARCH=arm64 sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --publish never",
+    "dist:dir": "FRAME_MAC_ARCH=arm64 sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac arm64 && electron-builder --mac --arm64 --dir",
     "dist:linux": "node build/fetch-deps.js linux x64 arm64 && electron-builder --linux --x64 --arm64 --publish never",
-    "dist:win": "node build/fetch-deps.js win x64 && electron-builder --win --x64 --publish never"
+    "dist:win": "node build/fetch-deps.js win x64 && electron-builder --win --x64 --publish never",
+    "dist:mac:x64": "FRAME_MAC_ARCH=x86_64 sh ../mac/frame-mac-view/build.sh && node build/fetch-deps.js mac x64 && electron-builder --mac --x64 --publish never"
   },
   "devDependencies": {
     "electron": "^44.4.5",
@@ -55,7 +56,8 @@
           "*.html",
           "*.js",
           "*.css",
-          "telemetry.json"
+          "telemetry.json",
+          "framey-compatibility.json"
         ]
       },
       {

docs/current-support-matrix.md

@@ -1,16 +1,17 @@
 # What we have tested
 
-Current for Frame Control **v0.4.35**, 25 October 2026. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.
+Release baseline: Frame Control **v0.4.41**, 26 October 2026. Rows also identify verified post-release main changes explicitly. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.
 
 | Feature | Real Frame + physical PC tested | VM only | Untested or limited | Last check and proof |
 |---|---|---|---|---|
-| Core title smoke test | Linux lxso2 installed, launched and removed reserved native/Proton titles on the real Frame; all 13 steps passed | No | Unworn headset; visible rendering and controller input not checked. Other feature paths retain their separate limits below | 25 Oct, v0.4.31 candidate source `1255ef2`, Frame OS 0.5.6 build `20261022.6153909`: [sanitized results](evidence/round2-smoke-2026-10-25.json) |
+| Mac desktop release — tested on a real Mac | Physical MacBook Air (MacBookAir9,1), Intel Core i3, macOS 15.7.7 (24G720): official v0.4.39 x64 DMG and ZIP hashes/architectures verified; clean DMG app installed and launched. Native UI, preferences across restart, update discovery of 0.4.40, offline OBS Start/Stop and 116-entry Decky store checked. Actual Open at Login menu toggled on, persisted across Quit/relaunch, then restored off. A 54-byte relay upload/readback/delete passed under coordinator/headset locks | No | Ordinary browser quarantine, right-click Open and Open Anyway remain unverified; the synthetic quarantine probe was inconclusive. Actual login startup untested. Direct frame.local had no route and app SSH trust failed; relay transfer is not native Mac transfer acceptance. Real OBS/Framey VR unverified. Earlier shutdown race fix #284 shipped in v0.4.40, whose Intel installer was not tested here | 26 Oct, official v0.4.39 tag `fd0b0a9`: [repeat Intel acceptance evidence](evidence/intel-mac-v0.4.39-2026-10-26.md); [earlier release test](evidence/mac-v0439-2026-10-26.md) |
+| Core title smoke test | Linux lxso2 ran the exact v0.4.41 tagged source against the real Frame; 13/13 reserved title steps passed and cleanup completed | No | The headset was unworn; visible rendering and controller input were not checked. Optional Steam Linux Runtime 4 was absent, so the x86_64 test executable did not actually launch. Other feature paths retain their separate limits below | 26 Oct, exact v0.4.41 tag `b5d50a8`, Frame OS 0.5.6 build `20261022.6153909`: [tagged release evidence](evidence/v0441-release-2026-10-26.md); [earlier candidate smoke](evidence/v0441-candidate-frame-2026-10-26.md) |
 | Windows desktop in the headset | No physical Windows PC test | Windows 11 VM sent a whole desktop to a real Frame; this used an intermediate fix, not the final native DLL | Physical GPU, capture and controller input; individual windows unavailable in bundled DXGI build | 24 Oct, v0.4.10 installer + candidate fix: [VM log](evidence/windows-vm-2026-10-24.md), [PC guide](pc-in-headset.md) |
 | Linux desktop in the headset | No | No | Native Linux PC capture is disabled; lxso2 lacked a desktop portal and PipeWire session. The separate Steam `-pipewire` helper is not Frame Control's PC capture | 24 Oct, v0.4.17: [host audit](evidence/linux-pc-host-lxso2-2026-10-24.md), [Steam helper PR #163](https://github.com/saphid/frame-control/pull/163) |
 | Mac desktop in the headset | A physical Mac sent its screen/window to a real Frame | No | Current v0.4.26 Mac installer and worn-headset controller input have not been repeated | 28 Sep, pre-v0.4 / Frame OS 0.4.1: [Mac guide and measurement](streaming.md#b-show-the-macs-desktop-inside-the-frame) |
 | OBS headset source on Linux | Real Frame to OBS 30.0.2 on a Linux host: 187.367 s, 720p30 H.264/AAC stereo, 5,621 frames, no encoder skips; room passthrough appeared in the recording | No | Synthetic tone was measured, not real game audio or audible listening. Default audio led by about 0.43 s in this setup; a measured +480 ms OBS offset removed residual skew at test resolution. Source-image latency was 1.431 s in one trial; other hosts and long sessions are unverified | 25 Oct, v0.4.30 package plus PR #219 runtime: [validation](evidence/obs-validation-2026-10-25.md) |
 | OBS headset source on Windows | No physical Windows PC test | Windows 11 VM helper fixture passed, but a native bridge to the real Frame sent no packets | In-app OBS controls remain hidden; native Windows OBS and firewall path are unverified | 25 Oct, PR #219: [validation](evidence/obs-validation-2026-10-25.md), [OBS guide](obs-headset-source.md) |
-| OBS headset source on macOS | No | No | Helper and OBS Media Source not tested on a Mac with a Frame | 25 Oct, v0.4.22: [OBS PR #174](https://github.com/saphid/frame-control/pull/174), [OBS guide](obs-headset-source.md) |
+| OBS headset source on macOS | Physical Intel Air: official v0.4.39 native Start/Stop returned to idle offline | No | Real headset stream, OBS receiver and audio/video remain unverified; the app rejected its stale SSH identity | 26 Oct, v0.4.39: [Mac evidence](evidence/mac-v0439-2026-10-26.md), [OBS guide](obs-headset-source.md) |
 | OBS headset source on a SteamOS / Steam Machine PC | No SteamOS PC or Flatpak OBS runtime test | No SteamOS host VM test | v0.4.27 AppImage launched on Ubuntu x86_64 under Xvfb; the helper sent H.264/AAC from a real Frame to a local UDP receiver. SteamOS read-only root, desktop UI and Flatpak OBS remain unverified | 25 Oct, v0.4.27: [host test](evidence/obs-steamos-host-2026-10-25.md), [OBS guide](obs-headset-source.md#steamos--steam-machine-pc-host) |
 | Wired connection doctor | No physical PC/Frame cable test of the doctor | No | Synthetic route/SSH tests; a separate Mac USB-C address observation does not test the doctor or game stream | 25 Oct, v0.4.23: [PR #178](https://github.com/saphid/frame-control/pull/178), [wired guide](wired-connection.md) |
 | Windows Wireless Adapter doctor | No physical Steam Wireless Adapter/dropout test | Windows 11 VM ran read-only checks without the adapter or WLAN | Adapter identification, dropouts and recovery on hardware | 24–25 Oct, v0.4.20–0.4.25: [VM log](evidence/windows-wireless-2026-10-24.md), [doctor guide](windows-wireless-doctor.md), [comparison PR #184](https://github.com/saphid/frame-control/pull/184) |
@@ -20,10 +21,10 @@ Current for Frame Control **v0.4.35**, 25 October 2026. “Real Frame + physical
 | Backup and restore after reset | Same-headset backup, no-op save restore and Return to Game Mode checks | No | Restore **after a factory reset**, replacement restore and Android data restore have not been tested on a headset. No headset reset was done | 24 Oct, v0.4.17: [backup guide](backup-and-recovery.md), [Return to Game Mode log](evidence/return-game-mode-packaged-2026-10-24.json) |
 | Android game backup import | F-Droid Basic APK with synthetic main and patch OBBs installed, transferred and read back on a real Frame | No | v0.4.30 restricted split-APK backup route has generated-fixture and existing merger tests only; no real split game or RE4 gameplay test | 20 Oct OBB headset check; 25 Oct, v0.4.30 split fixtures: [OBB device evidence](evidence/android-import/device.json), [split PR #206](https://github.com/saphid/frame-control/pull/206), [guide](android-backups.md) |
 | Passthrough in recordings | Real room pixels in OBS and a production MP4 after safe SteamVR wake | No | **Yes** for the checked 0.5.6 mirror. Raw cameras are not opened. Other games/modes and Steam clips may differ | 25 Oct: [validation](evidence/obs-validation-2026-10-25.md), [recording guide](recording.md#does-record-include-passthrough) |
-| Open at login | No Frame needed; Linux autostart file toggled on a physical Linux host with an isolated config directory | No | A full login session and physical Windows/macOS host login have not been checked; OS API calls were unit tested | 25 Oct, v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
+| Open at login | No Frame needed; official v0.4.39 on the physical Intel Air toggled the actual native menu on, retained its checkmark after Quit/relaunch and restored it off. Linux autostart file previously toggled on a physical Linux host with an isolated config directory | No | A full OS login session and physical Windows host login remain untested | 26 Oct, v0.4.39: [native Intel toggle evidence](evidence/intel-mac-v0.4.39-2026-10-26.md); Linux v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
 | Local Frame Control extensions | Example panel displayed live Frame status in a browser preview; the real Frame served a read-only example in the experimental headset panel | No | No wearer-visible extension view; third-party extensions and physical Windows/macOS extension folders untested | 25 Oct, v0.4.29: [PR #194](https://github.com/saphid/frame-control/pull/194), [PR #201](https://github.com/saphid/frame-control/pull/201), [extension guide](extensions.md) |
-| Experimental Frame Control SteamVR panel | Real Frame OS 0.5.6 installed its user service, registered an overlay, served authenticated live status and a read-only extension, saved a screenshot and short MP4, and removed owned resources | No | Headset was unworn in standby: overlay reported `not_visible`, stereo capture was dark; wearer-visible pixels and controller input are unverified. The new large read-only status screen has browser layout and packaging checks only | 25 Oct, v0.4.29 device check and v0.4.31 status screen: [PR #198](https://github.com/saphid/frame-control/pull/198), [PR #201](https://github.com/saphid/frame-control/pull/201), [PR #220](https://github.com/saphid/frame-control/pull/220), [panel guide](headset-app.md) |
-| Experimental Decky Loader manager | Real Frame OS 0.5.6 ARM64 user-service install, status, update and remove completed; seven official-store plugin backends loaded, and ProtonDB Badges completed managed store install/update/remove | No | v0.4.33 shared transaction lock and stopped-loader plugin removal have Linux and CI tests, but no live recovery test on the Frame. v0.4.35 treats `_root` store tags as root-required and hides duplicate IDs; this has test coverage, not a live store check. Plugin pages, settings, routes, toasts and controller input in VR remain unverified; some plugins need root, x86_64 binaries or Deck-specific hardware | 25 Oct, v0.4.31 hardware and v0.4.35 tests: [PR #208](https://github.com/saphid/frame-control/pull/208), [PR #230](https://github.com/saphid/frame-control/pull/230), [PR #234](https://github.com/saphid/frame-control/pull/234), [PR #246](https://github.com/saphid/frame-control/pull/246), [compatibility table](decky-frame.md) |
-| Experimental Framey VR plugin panels and store | No live real-Frame panel test | No | ProtonDB Badges settings rendered and sent a setting call in local Chromium. Official Steam Status rendered in local Chromium; a session-only cache avoided its earlier storage errors. A later local browser check restored a bounded per-plugin cache after panel reopen; live Decky and offline behavior were not tested. Fake Frame tests cover setting read/write through update and reinstall and install/remove two pinned official API v2 archives plus the modern API v1 Storage Cleaner archive. Page tests cover the official JSX runtime, disabled controls, text fields, sliders, grouped dropdowns and an author sample bundle with a settings tab and read-only backend quick action. The sample is not published in the store. The 11-archive manifest audit found only ProtonDB Badges API v2 in that set. Storage Cleaner 1.4.0 showed an empty-data panel and four disabled cleanup buttons in local Chromium with a stub backend; no cleanup action was tested. A hash match, local panel and fake Frame install do not prove VR use. Wearer-visible pixels, controller input and live settings persistence remain unverified | 25 Oct, v0.4.32–0.4.35: [#223](https://github.com/saphid/frame-control/pull/223), [#224](https://github.com/saphid/frame-control/pull/224), [#225](https://github.com/saphid/frame-control/pull/225), [#226](https://github.com/saphid/frame-control/pull/226), [#227](https://github.com/saphid/frame-control/pull/227), [#229](https://github.com/saphid/frame-control/pull/229), [#231](https://github.com/saphid/frame-control/pull/231), [#232](https://github.com/saphid/frame-control/pull/232), [#233](https://github.com/saphid/frame-control/pull/233), [#236](https://github.com/saphid/frame-control/pull/236), [#237](https://github.com/saphid/frame-control/pull/237), [#238](https://github.com/saphid/frame-control/pull/238), [#239](https://github.com/saphid/frame-control/pull/239), [#240](https://github.com/saphid/frame-control/pull/240), [#241](https://github.com/saphid/frame-control/pull/241), [#243](https://github.com/saphid/frame-control/pull/243), [#244](https://github.com/saphid/frame-control/pull/244), [#245](https://github.com/saphid/frame-control/pull/245), [#247](https://github.com/saphid/frame-control/pull/247), [#248](https://github.com/saphid/frame-control/pull/248), [browser/fake Frame evidence](evidence/framey-browser-2026-10-25.md), [guide](framey-loader.md) |
+| Experimental Frame Control SteamVR panel | Frame OS 0.5.6 registered and served the opt-in overlay. A later unattended check safely woke SteamVR and found the panel in stereo compositor and mirror captures; it removed its temporary service and restored power settings | No | No person wore the headset for that check. Physical controller input, scrolling, VR keyboard, comfort and legibility remain unverified. The large status view has browser and packaging checks, not a wearer review | 26 Oct, v0.4.29–0.4.40: [panel PR #201](https://github.com/saphid/frame-control/pull/201), [unattended evidence](evidence/framey-vr-2026-10-25/README.md), [post-#292 unworn sample exercise](evidence/v0440-release-2026-10-26.md#post-tag-292-panel-regression), [earlier standby-gated exercise](evidence/framey-vr-standby-gate-2026-10-26.md), [worn checklist](framey-vr-check.md) |
+| Experimental Decky Loader manager | Frame OS 0.5.6 ARM64 user-service install/status/update/remove and managed ProtonDB install/update/remove passed earlier. A private Decky 3.3.0 service returned read-only ProtonDB and Steam Status setting RPCs; a later locked check verified the official Notebook default drawing/save/reopen flow and Simple Timer backend events in local Chromium | No | The loader remains opt-in. Installs/updates reject an archive whose Decky name collides with another installed plugin before download and under the headset transaction lock; this safety path has host/fake Frame tests, not a new real-headset collision test. v0.4.41 classifies the 116 exact-version plugins as 3 works, 48 partial, 54 broken and 11 not applicable. Notebook works for its default flow; Volume Mixer and Mixer work for tested per-app silent-stream volume control only. TabMaster is partial. Deck Shelves moved to partial after its exact chunked frontend rendered settings in local Chromium; its backend and Steam Home shelves remain unverified. Steamback, PlayTime and Deck Settings became partial after detached read-only library/user snapshots and isolated amd64 backend checks; their official ARM64 backends, automatic behavior and VR panels remain unverified. A read-only Steam bridge returned the Frame country, install folders and system information; IsThereAnyDeal selected that country in local Chromium, but its deployed HTTP endpoint and deal lookup remain unverified. An isolated ARM64 LocalSend core answered its info endpoint, but the official x86-only plugin archive and file transfers remain blocked. Volume Mixer and Mixer controlled a named silent stream through real ARM64 Decky with independent Pulse readbacks; Volume Boost default-sink reads matched, but real writes were denied. Audible output, Bluetooth playback, internal-node controls and worn VR remain unverified. Most official backends and VR controls remain unverified. Physical controller use and wearer-visible official panels remain unverified | 26 Oct, v0.4.31–0.4.41: [managed store PR #208](https://github.com/saphid/frame-control/pull/208), [name-collision PR #269](https://github.com/saphid/frame-control/pull/269), [catalog PR #266](https://github.com/saphid/frame-control/pull/266), [backend event evidence](evidence/framey-events-backend-2026-10-26.json), [Steam read PR #274](https://github.com/saphid/frame-control/pull/274), [LocalSend evidence PR #275](https://github.com/saphid/frame-control/pull/275), [local audio evidence](evidence/framey-audio-backends-2026-10-26.md), [ARM64 audio evidence](evidence/framey-audio-arm64-2026-10-26.md), [post-release library evidence](evidence/framey-library-context-2026-10-26.md), [compatibility table](framey-compatibility.md) |
+| Experimental Framey VR plugin panels and store | Unattended Frame OS 0.5.6 runs showed the Framey sample panel in stereo compositor and mirror captures. The latest standby-gated exercise restored the original power settings and released its shared lock. Synthetic OpenVR clicks changed a live sample setting, read its Decky backend file and confirmed it after a fresh iframe reopen | No | This was the repository sample, not an official store plugin. Physical controllers, native scrolling, VR keyboard, wearer comfort and legibility remain unverified. CSS Loader and SteamGridDB exact archives passed fake Frame install/remove and panel packing; this does not establish theme or artwork controls in VR. Panel-local backend events and React toasts have local/real-backend checks, but no wearer review. Pause Games and Tailscale Control settings render in local Chromium; their live actions are unverified. The 116-plugin catalog had 60 fake installs/removals and 56 expected blocks; v0.4.40 recorded 101 local Chromium initializers ready and 15 failed, up from 98/18 in v0.4.39. Notebook is marked works only for its default drawing/save/reopen flow | 26 Oct, v0.4.38–0.4.40: [post-#294 unworn sample and scroll evidence](evidence/framey-scroll-probe-2026-10-26.md#post-294-exact-main-sample-check), [backend event PR #270](https://github.com/saphid/frame-control/pull/270), [settings/cache PR #271](https://github.com/saphid/frame-control/pull/271), [post-release sample exercise](evidence/v0439-release-2026-10-26.md#post-release-framey-library-change-282), [worn checklist](framey-vr-check.md) |
 
 Release notes must preserve these limits until a newer recorded check changes them. When a feature is retested, add its date, exact app/Frame version, host type and proof here. The older [v0.3.1 matrix](support-matrix.html) is a historical snapshot and does not describe current coverage.

docs/decky-frame.md

@@ -44,25 +44,37 @@ For a new plugin, follow the [Frame plugin and extension guide](frame-plugin-aut
 
 ### Which of these plugins can open a Framey panel?
 
-The separate Framey panel accepts a Frame Control store install only when its
-`plugin.json` declares `api_version: 2` and it has `dist/index.js`. A backend
-load does not bypass this frontend check. We downloaded the 11 versions above
+The separate Framey panel accepts a Frame Control store install with a supported
+API v1/v2 frontend or a legacy Decky IIFE frontend in `dist/index.js`.
+A backend load does not bypass this frontend check. We downloaded the 11 versions above
 again on 25 October 2026 and matched every ZIP's SHA-256 to the official store
 catalogue. All 11 had a frontend bundle, but their manifests differed:
 
 | Manifest in the checked archive | Plugins | Framey panel result |
 | --- | --- | --- |
 | API v2 | ProtonDB Badges 1.3.4 | Eligible; settings rendered in local Chromium. No worn VR check. |
-| API v1 | Bluetooth 3.1.1, HLTB for Deck 2.0.12, SteamGridDB 1.8.1, Storage Cleaner 1.4.0, Wine Cellar 0.2.1, MagicPods 2.0.21 | Framey refuses these frontends. Wine Cellar and MagicPods also fail the ARM64 archive check. |
-| No `api_version` field | CSS Loader 2.1.3, Animation Changer 1.3.2, Audio Loader 1.6.1, PowerTools 2.0.3 | Framey refuses these frontends. Audio Loader and PowerTools also request root. |
+| API v1 | Bluetooth 3.1.1, HLTB for Deck 2.0.12, SteamGridDB 1.8.1, Storage Cleaner 1.4.0, Wine Cellar 0.2.1, MagicPods 2.0.21 | Storage Cleaner rendered its empty-data panel in local Chromium. HLTB started and built a settings view in a local host test; its Steam game page patches have no target. Other panels remain untested. Wine Cellar and MagicPods fail the ARM64 archive check. None has a worn VR result. |
+| No `api_version` field | CSS Loader 2.1.3, Animation Changer 1.3.2, Audio Loader 1.6.1, PowerTools 2.0.3 | CSS Loader's legacy IIFE passes the Framey panel packaging check; its theme UI remains untested. Animation Changer's panel remains untested. Audio Loader and PowerTools request root and are blocked. |
 
 The [archive audit record](evidence/framey-official-archive-audit-2026-10-25.json)
 has each store ID, exact version, SHA-256, manifest field, and bundle check.
-This is a static PC inspection. It does not show that any plugin is visible or
-usable in the headset. The earlier real Frame backend checks in the table above
+The archive audit itself is static PC inspection. Later local host and fake
+Frame tests cover the Storage Cleaner, HLTB, CSS Loader and SteamGridDB cases noted above; none shows
+that a plugin is visible or usable in the headset. The earlier real Frame backend checks in the table above
 remain the only device evidence for these versions. A new store version needs a
 new check because its manifest and binaries can change.
 
+Pinned CSS Loader 2.1.3 and SteamGridDB 1.8.1 archives now pass the fake Frame
+managed install/remove flow. CSS Loader's `plugin.json` has no `api_version` and
+its older IIFE bundle passes the Framey packaging check added in
+[#261](https://github.com/saphid/frame-control/pull/261). The fixture does not
+render its theme controls. SteamGridDB declares API v1 and its bundle passes Framey's packaging
+check, but it looks up Steam library modules while loading and patches game
+context menus. Those modules and menus do not exist in Framey's isolated
+iframe, so its artwork picker cannot be called a usable VR panel. Framey does
+not apply its Steam library changes. These checks did not run CSS themes or
+modify game artwork on the real Frame.
+
 The new store transaction was also exercised on the same real Frame:
 **managed loader install → ProtonDB Badges 1.3.4 store install → status →
 store update → store remove → managed loader remove**. Status reported the
@@ -76,14 +88,22 @@ entries. Install, update, and remove need an explicit confirmation. They only
 change Frame Control owned plugin folders under
 `~/.local/share/frame-control/decky/plugins`. The installer checks the store
 hash and archive paths, blocks root plugins and non-ARM64 binaries, and rolls
-back an update if the service restart fails. The current VR shell does not
-provide Decky's Steam Deck Quick Access Menu. Frame Control's headset panel
+back an update if the service restart fails. An update is also refused if its
+new plugin name is already used by another installed plugin, because Decky
+routes backend calls by name. This collision check has local tests only.
+For a managed plugin with a valid recorded SHA-256, Update and Remove recheck
+that installed receipt under the headset transaction lock. If another store
+action changed it after the list was read, refresh the installed list and
+review the action again. This race check has local transaction tests; older
+receipts without a valid hash still use the existing ownership check.
+The current VR shell does not provide Decky's Steam Deck Quick Access Menu.
+Frame Control's headset panel
 shows installed plugins and store actions. Its separate Framey iframe hosts
 API v2 pages and API v1 bundles that use Decky's modern frontend initializer,
 with settings, local routes, and panel toasts where supported.
 Steam route patches and system notifications remain unavailable. The panel
 still needs a worn-headset visual and controller check. See the
-[current compatibility table](frame-plugin-author.md#framey-api-v2-compatibility).
+[current compatibility table](frame-plugin-author.md#framey-decky-api-compatibility).
 
 ## What was checked on the real headset
 

docs/evidence/fakeframe-package-retry-2026-10-26.md

@@ -0,0 +1,22 @@
+# Fake Frame package download retry, 26 October 2026
+
+The ARM64 fake Frame container sometimes fails before project tests start.
+Valve's `holo-packages.steamos.cloud` returned package responses with **164
+bytes missing** during the `pacman -Syu` layer in
+`tests/fakeframe/Containerfile`:
+
+| Run | Package and outcome |
+| --- | --- |
+| [v0.4.44 candidate checks](https://github.com/saphid/frame-control/actions/runs/40296431563) | `iptables` download truncated; a failed-only rerun passed on the unchanged PR head. |
+| [PR #316 checks](https://github.com/saphid/frame-control/actions/runs/40298316496) | `c-ares` download truncated before e2e tests. |
+| [PR #318 checks](https://github.com/saphid/frame-control/actions/runs/40301478955) | First attempt truncated `iptables`; failed-only rerun on the unchanged documentation head truncated `rsync`. The six other jobs passed. |
+
+The fake Frame image now retries that package transaction at most five times,
+with a two-second delay after each failed attempt except the last. A fifth
+failure still fails the build. The end-to-end tests and their assertions are
+unchanged. This retry affects only the fake Frame test image; it does not
+change a real headset or the released application.
+
+Exact-head hosted CI must pass before this change is merged. A successful
+container build would show that at least one package attempt completed; it
+would not establish that Valve's package service is permanently healthy.

docs/evidence/frame-smoke-runtime-skip-2026-10-26.md

@@ -0,0 +1,9 @@
+# Headset smoke: unavailable x86 runtime is a skip
+
+The v0.4.41 tagged smoke result recorded 13/13 passed even though its x86_64 launch outcome was `runtime missing`: Steam had acknowledged the title but had not started it. This follow-up separates an unavailable optional runtime from a verified launch. It keeps the smoke usable on a Frame without Steam Linux Runtime 4 while making the missing coverage explicit in its console summary and saved JSON.
+
+Focused local `test_smoke_cleanup.py` ran **22 tests successfully**. The new regression starts an x86_64 title cycle with a fresh missing-runtime Steam log, verifies `skipped=true` and `outcome=runtime missing`, and verifies that the title is still removed. A result test checks separate passed/skipped/failed counts and a zero exit code when an optional runtime is absent but nothing fails.
+
+The revised `scripts/frame-smoke.sh` then ran on the real Frame from this branch. It acquired its unique owner in `/tmp/frame-test.lock` before any headset read. Locked preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. On Frame OS 0.5.6 build `20261022.6153909`, the result was **12 passed / 1 skipped / 0 failed**. ARM64 and Proton test executables ran; x86_64 was explicitly skipped because Steam Linux Runtime 4 was not installed. Both title cleanup steps passed. The command exited 0, including release of its owned shared lock. The detailed result remains private at `tests/smoke/results/2026-10-26T050711Z-20261022.6153909.json` in the test checkout.
+
+The headset was in standby and nobody wore it for this test. Title smoke does not prove wearer-visible pixels, physical controller input, official Decky panels, audio output or comfort. It also does not prove x86_64 runtime execution on this Frame; that path needs the optional runtime present. The hourly worn check remains enabled.

docs/evidence/framey-audio-arm64-2026-10-26.json

@@ -0,0 +1,384 @@
+{
+  "schemaVersion": 1,
+  "timeUtc": "2026-10-26T04:05:15.145624+00:00",
+  "baseCommit": "56bde24",
+  "frameOS": "0.5.6",
+  "decky": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+  },
+  "scope": "Local Chromium opaque Framey panels, production SSH/CDP bridge and actual unmodified official backends in ARM64 Decky; real user audio session, silent test stream only; no worn VR",
+  "plugins": [
+    {
+      "id": 38,
+      "name": "Volume Mixer",
+      "version": "1.2.1-1",
+      "sha256": "11b259ad234d0e97cfef4e6a2af3f1edfb0908d5482765af56b86b0a4601c5f3"
+    },
+    {
+      "id": 58,
+      "name": "Volume Boost",
+      "version": "0.0.7",
+      "sha256": "2cc576a7f60751306d690268e227df626e59d3733680ced753de4c116629a9cc"
+    },
+    {
+      "id": 144,
+      "name": "Mixer",
+      "version": "0.1.0",
+      "sha256": "4b3546170e5fbd5f9afad3b24555498ee51caac7cec9e4c86321b18cdd4b5106"
+    }
+  ],
+  "readOnlySession": {
+    "timeUtc": "2026-10-26T04:03:54.509107+00:00",
+    "before": {
+      "battery": [
+        100
+      ],
+      "uid": 1000,
+      "arch": "aarch64",
+      "decky": "failed",
+      "panel": "inactive",
+      "volumeMixerLogExists": false,
+      "defaultSinkVolume": {
+        "code": 0,
+        "stdout": "Volume: front-left: 0 /   0% / -inf dB,   front-right: 0 /   0% / -inf dB\n        balance 0.00\n",
+        "stderr": ""
+      },
+      "pactlInfoExit": 0,
+      "pwDumpExit": 0
+    },
+    "after": {
+      "battery": [
+        100
+      ],
+      "uid": 1000,
+      "arch": "aarch64",
+      "decky": "failed",
+      "panel": "inactive",
+      "volumeMixerLogExists": false,
+      "defaultSinkVolume": {
+        "code": 0,
+        "stdout": "Volume: front-left: 0 /   0% / -inf dB,   front-right: 0 /   0% / -inf dB\n        balance 0.00\n",
+        "stderr": ""
+      },
+      "pactlInfoExit": 0,
+      "pwDumpExit": 0
+    },
+    "calls": [
+      {
+        "id": 38,
+        "method": "get_sink_inputs",
+        "args": [
+          {}
+        ],
+        "legacy": true,
+        "version": "1.2.1-1",
+        "sha256": "11b259ad234d0e97cfef4e6a2af3f1edfb0908d5482765af56b86b0a4601c5f3",
+        "result": {
+          "success": true,
+          "streamCount": 1,
+          "volumes": [
+            1
+          ]
+        }
+      },
+      {
+        "id": 58,
+        "method": "get_volume_state",
+        "args": [
+          {
+            "channel": "left"
+          }
+        ],
+        "legacy": true,
+        "version": "0.0.7",
+        "sha256": "2cc576a7f60751306d690268e227df626e59d3733680ced753de4c116629a9cc",
+        "result": {
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        }
+      },
+      {
+        "id": 58,
+        "method": "get_volume_state",
+        "args": [
+          {
+            "channel": "right"
+          }
+        ],
+        "legacy": true,
+        "version": "0.0.7",
+        "sha256": "2cc576a7f60751306d690268e227df626e59d3733680ced753de4c116629a9cc",
+        "result": {
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        }
+      },
+      {
+        "id": 144,
+        "method": "get_settings",
+        "args": [],
+        "legacy": false,
+        "version": "0.1.0",
+        "sha256": "4b3546170e5fbd5f9afad3b24555498ee51caac7cec9e4c86321b18cdd4b5106",
+        "result": {
+          "result": {
+            "filters": [],
+            "boostLimit": 0
+          }
+        }
+      },
+      {
+        "id": 144,
+        "method": "get_playbacks",
+        "args": [],
+        "legacy": false,
+        "version": "0.1.0",
+        "sha256": "4b3546170e5fbd5f9afad3b24555498ee51caac7cec9e4c86321b18cdd4b5106",
+        "result": {
+          "count": 6,
+          "internalAudioNodeCount": 5,
+          "steamStreamCount": 1
+        }
+      }
+    ],
+    "cleanup": {
+      "baseAbsent": true,
+      "unitAbsent": true,
+      "fixedLogAbsent": true
+    },
+    "lockReleased": true
+  },
+  "liveSilentStream": {
+    "before": {
+      "battery": [
+        100
+      ],
+      "uid": 1000,
+      "arch": "aarch64",
+      "decky": "failed",
+      "panel": "inactive",
+      "volumeMixerLogExists": false,
+      "defaultSinkVolume": {
+        "code": 0,
+        "stdout": "Volume: front-left: 0 /   0% / -inf dB,   front-right: 0 /   0% / -inf dB\n        balance 0.00\n",
+        "stderr": ""
+      },
+      "pactlInfoExit": 0,
+      "pwDumpExit": 0
+    },
+    "after": {
+      "battery": [
+        100
+      ],
+      "uid": 1000,
+      "arch": "aarch64",
+      "decky": "failed",
+      "panel": "inactive",
+      "volumeMixerLogExists": false,
+      "defaultSinkVolume": {
+        "code": 0,
+        "stdout": "Volume: front-left: 0 /   0% / -inf dB,   front-right: 0 /   0% / -inf dB\n        balance 0.00\n",
+        "stderr": ""
+      },
+      "pactlInfoExit": 0,
+      "pwDumpExit": 0
+    },
+    "source": "paplay --raw --format=s16le --rate=48000 --channels=2 --client-name=FrameySilentARM64 --stream-name=\"Framey ARM64 silent verification\" /dev/zero",
+    "writes": [
+      {
+        "id": 38,
+        "method": "set_input_volume",
+        "args": [
+          {
+            "index": 31400,
+            "volume": 0.5
+          }
+        ],
+        "result": {
+          "result": true,
+          "success": true
+        },
+        "independentReadback": [
+          {
+            "index": 31400,
+            "name": "FrameySilentARM64",
+            "volume": {
+              "front-left": {
+                "value": 32768,
+                "value_percent": "50%",
+                "db": "-18.06 dB"
+              },
+              "front-right": {
+                "value": 32768,
+                "value_percent": "50%",
+                "db": "-18.06 dB"
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": 38,
+        "method": "set_input_volume",
+        "args": [
+          {
+            "index": 31400,
+            "volume": 0.45
+          }
+        ],
+        "result": {
+          "result": true,
+          "success": true
+        },
+        "independentReadback": [
+          {
+            "index": 31400,
+            "name": "FrameySilentARM64",
+            "volume": {
+              "front-left": {
+                "value": 29491,
+                "value_percent": "45%",
+                "db": "-20.81 dB"
+              },
+              "front-right": {
+                "value": 29491,
+                "value_percent": "45%",
+                "db": "-20.81 dB"
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": 144,
+        "method": "set_volume",
+        "args": [
+          199,
+          37
+        ],
+        "result": true,
+        "independentReadback": [
+          {
+            "index": 31400,
+            "name": "FrameySilentARM64",
+            "volume": {
+              "front-left": {
+                "value": 24248,
+                "value_percent": "37%",
+                "db": "-25.91 dB"
+              },
+              "front-right": {
+                "value": 24248,
+                "value_percent": "37%",
+                "db": "-25.91 dB"
+              }
+            }
+          }
+        ]
+      },
+      {
+        "id": 144,
+        "method": "set_volume",
+        "args": [
+          199,
+          38
+        ],
+        "result": true,
+        "independentReadback": [
+          {
+            "index": 31400,
+            "name": "FrameySilentARM64",
+            "volume": {
+              "front-left": {
+                "value": 24904,
+                "value_percent": "38%",
+                "db": "-25.21 dB"
+              },
+              "front-right": {
+                "value": 24904,
+                "value_percent": "38%",
+                "db": "-25.21 dB"
+              }
+            }
+          }
+        ]
+      }
+    ],
+    "volumeMixerReopen": {
+      "id": 38,
+      "method": "get_sink_inputs",
+      "args": [
+        {}
+      ],
+      "result": {
+        "result": [
+          {
+            "name": "FrameySilentARM64",
+            "index": 31400,
+            "volume": 0.3800048828125
+          }
+        ],
+        "success": true
+      }
+    },
+    "mixerReadAfterChange": {
+      "id": 144,
+      "method": "get_playbacks",
+      "args": [],
+      "result": [
+        {
+          "id": 199,
+          "name": "FrameySilentARM64",
+          "mediaName": "Framey ARM64 silent verification",
+          "volume": 38
+        }
+      ]
+    },
+    "volumeBoostReads": [
+      {
+        "id": 58,
+        "method": "get_volume_state",
+        "args": [
+          {
+            "channel": "left"
+          }
+        ],
+        "result": {
+          "result": 0,
+          "success": true
+        }
+      }
+    ],
+    "cleanup": {
+      "baseAbsent": true,
+      "unitAbsent": true,
+      "fixedLogAbsent": true
+    },
+    "lockReleased": true
+  },
+  "independentCleanupAudit": {
+    "testPathsAbsent": true,
+    "units": {
+      "framey-audio-kp0z857q58-32363fd7": "MainPID=0\nLoadState=not-found\nActiveState=inactive",
+      "framey-audio-kp0z857q58-c08f3f5d": "MainPID=0\nLoadState=not-found\nActiveState=inactive",
+      "framey-audio-kp0z857q58-c08f3f5d-silence": "MainPID=0\nLoadState=not-found\nActiveState=inactive"
+    },
+    "silentStreamsAbsent": true
+  },
+  "limitations": [
+    "Physical audible output, default-sink writes, boost above 100%, Bluetooth playback controls and worn VR unverified.",
+    "Mixer also exposes internal Frame PipeWire nodes and Reset; neither was changed or invoked.",
+    "Private Decky/installed-plugin outer status fixture; real RPC used production framey_panel.call_method over SSH and live Steam CEF, not a deployed headset HTTP endpoint test.",
+    "Mixer filter save/restart was verified on amd64 in the earlier evidence, not repeated on ARM64."
+  ],
+  "catalogRefresh": {
+    "timeUtc": "2026-10-26T04:11:59.449535+00:00",
+    "visibleCount": 116,
+    "idsVersionsDigestsUnchanged": true
+  }
+}

docs/evidence/framey-audio-arm64-2026-10-26.md

@@ -0,0 +1,111 @@
+# Official audio plugins on the ARM64 Frame
+
+Volume Mixer 1.2.1-1 (38) and Mixer 0.1.0 (144) now qualify as **works for
+per-app volume control**. Their exact official, unmodified Python backends ran
+in published Decky 3.3.0 ARM64 on Frame OS 0.5.6. Local Chromium rendered the
+actual Framey panels and changed only a deliberately created silent playback
+stream in the Frame's real user audio session. Independent Pulse readbacks
+confirmed the changes. This is useful backend behavior, not initializer-only
+or fake-backend evidence.
+
+Volume Boost 0.0.7 (58) remains **partial**. Its real ARM64 default-sink reads
+matched independent `pactl` reads, and its controls rendered. Default-sink writes
+were denied throughout the real-Frame run. Its earlier slider/numeric write
+checks used an isolated amd64 virtual sink.
+
+[Digest-pinned observations and cleanup](framey-audio-arm64-2026-10-26.json)
+record both runs. No physical audible output or worn-VR result is claimed.
+
+| Plugin | Real Frame result | Remaining limits |
+| --- | --- | --- |
+| Volume Mixer | `pulsectl`/`ravel` import; real Pulse session discovery; silent-stream slider click 100 → 50%, ArrowDown → 45%; reopen reads back the 38% subsequently set by Mixer | Bluetooth discovery/playback commands, audible output and worn-VR input unverified. The range input rounds the reopened 0.38000488 backend value to its configured step; no extra write occurred. |
+| Volume Boost | `pactl` default sink and stereo channel parsing; both backend reads return 0 and agree with independent 0% / 0% sink reads; local panel shows 0 | No real default-sink writes or boosts; no audible output or worn-VR result. Zero alone is not proof: upstream returns 0 when its command fails. |
+| Mixer | `pw-dump`/`wpctl` available; real playbacks/settings reads; exact silent-stream numeric input 37%, ArrowUp → 38%, independently read back | Exposes internal Frame PipeWire nodes as well as apps. Internal-node controls and Reset were not exercised. Filter persistence passed on amd64 earlier, not ARM64. Audible output and worn-VR input unverified. |
+
+## Runtime and transport
+
+The normal atomic `/tmp/frame-test.lock` was acquired separately for each run.
+An existing owner would abort testing; the lock was never stolen. The headset
+was not woken, and no power setting was changed.
+
+The actual Frame UID is 1000. The legacy plugins' hard-coded
+`XDG_RUNTIME_DIR=/run/user/1000` therefore reaches this Frame's existing audio
+session. Volume Mixer's bundled pure Python wrappers successfully loaded the
+system ARM64 Pulse and D-Bus libraries. No native rebuild was needed. It also
+sets `HOME=/home/deck` inside its own plugin process; this test does not establish
+that arbitrary Deck paths work on the Frame.
+
+The upstream `PluginLoader-arm64` release was verified against GitHub's
+published SHA-256 and ELF machine 183 before transfer. Two private, bounded,
+removable user-service installs used their own Decky plugins/settings bases.
+Neither service was enabled. The normal managed Decky service was already
+failed, and the normal headset-panel service inactive; both states remained
+unchanged. A pre-existing `/tmp/VolumeMixer-decky.log` would have aborted the
+run because the upstream plugin truncates that fixed path during import.
+
+The local relay served actual `ui/headset.html`, vendored React, `framey-host.js`
+and digest-checked official frontend bytes in an opaque `allow-scripts` iframe.
+Only outer status/install responses were fixtures. Plugin RPC used production
+`framey_panel.call_method`, SSH through lxso2, `frame_steam.Page`, the live Steam
+CEF `DeckyBackend.call`, and actual Decky plugin subprocesses. Private install
+paths were redirected to the temporary base. No second Decky websocket client
+was attached. This does not verify the deployed headset HTTP endpoint or a VR
+compositor interaction.
+
+## Safe control check
+
+The first run was read-only. Independent `pactl info`, default-sink volume and
+`pw-dump` commands exited successfully, so empty/zero fallback values were not
+accepted on their own. Volume Mixer saw a live Steam stream; Mixer also saw
+Frame spatialization, echo-cancellation and ALSA internal nodes.
+
+For the second run, a separate task-owned transient user service ran:
+
+```sh
+paplay --raw --format=s16le --rate=48000 --channels=2 \
+  --client-name=FrameySilentARM64 \
+  --stream-name='Framey ARM64 silent verification' /dev/zero
+```
+
+This sends zero-valued samples to the existing user server. It is an explicit
+silent client, not the earlier private null-server fixture. No server, device,
+default-route or physical-sink configuration was changed. The relay resolved
+its live stream IDs before every write and allowed only this exact application
+name, bounded to 80% volume. The spatialization node with a similar prefix was
+excluded. All Volume Boost writes, Mixer Reset/settings writes and Bluetooth
+commands were denied. Existing streams and internal nodes were never write
+targets. This broader real-session check supersedes the earlier suggested
+null-server-only ARM64 follow-up; that older fixture could not prove access to
+the Frame's real session.
+
+Every browser-triggered volume RPC was followed by independent
+`pactl --format=json list sink-inputs` channel readback. Only the named silent
+stream's rows are published. Background streams can appear/disappear naturally;
+no whole-session stability claim is made.
+
+## Cleanup and catalog interpretation
+
+Both runs removed their private Decky units/bases and the test-created fixed
+plugin log. The live run also stopped its transient silent client. Decky's main
+process exited during shutdown but left children waiting; those remaining
+processes were killed only within the test service's systemd cgroup before
+cleanup completed. Both locks were released after cleanup. An independent
+fresh-lock audit confirmed all three test units unloaded/inactive with PID 0,
+private paths absent, and no named silent stream. Battery was 100 → 100 and
+independent default-sink reads stayed 0% / 0% in both runs.
+
+The canonical store data and generated compatibility table now report
+**3 works / 48 partial / 54 broken / 11 N/A**. “Works” describes the tested
+per-app control behavior; read each row's remaining limits. Historical
+[fake-Frame archive checks](framey-module-lookup-2026-10-26.md) cover transport
+with plugin execution stubbed, and the
+[earlier local audio checks](framey-audio-backends-2026-10-26.md) cover isolated
+amd64 controls/filter persistence. Neither is relabelled as a real ARM64 test.
+
+## Repository checks
+
+The full Python suite passed 1,621 tests (16 skips), and the focused Framey
+suite passed all 43 tests. `scripts/framey-compatibility-doc.py --check` and
+`git diff --check` passed. A fresh official-store fetch at 04:11:59 UTC found
+all 116 IDs, versions and digests unchanged. This PR changes catalog/evidence
+and generated documentation; it adds no backend shim or plugin patch.

docs/evidence/framey-audio-backends-2026-10-26.json

@@ -0,0 +1,677 @@
+{
+  "schemaVersion": 1,
+  "timeUtc": "2026-10-26T01:30:56.939937+00:00",
+  "baseCommit": "442b5ec",
+  "hostChange": "SliderField editableValue numeric input",
+  "verification": "local Chromium + real Decky 3.3.0 amd64 container; no real Frame/worn VR",
+  "decky": {
+    "tag": "v3.3.0",
+    "name": "PluginLoader",
+    "digest": "sha256:e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181"
+  },
+  "audioVersions": {
+    "pipewire": "1.4.2",
+    "wireplumber": "0.5.8",
+    "pactl": "17.0"
+  },
+  "plugins": [
+    {
+      "id": 38,
+      "name": "Volume Mixer",
+      "version": "1.2.1-1",
+      "sha256": "11b259ad234d0e97cfef4e6a2af3f1edfb0908d5482765af56b86b0a4601c5f3",
+      "folder": "VolumeMixer-decky"
+    },
+    {
+      "id": 58,
+      "name": "Volume Boost",
+      "version": "0.0.7",
+      "sha256": "2cc576a7f60751306d690268e227df626e59d3733680ced753de4c116629a9cc",
+      "folder": "volume-boost"
+    },
+    {
+      "id": 144,
+      "name": "Mixer",
+      "version": "0.1.0",
+      "sha256": "4b3546170e5fbd5f9afad3b24555498ee51caac7cec9e4c86321b18cdd4b5106",
+      "folder": "decky-volume-mixer"
+    }
+  ],
+  "isolation": {
+    "network": "none",
+    "devices": "none",
+    "hostAudioSockets": "none",
+    "audio": "private PipeWire/Pulse null sink; two silent streams; WirePlumber policy-only"
+  },
+  "fixtureBoundaries": [
+    "Outer headset status/installed-plugin responses were fixture-shaped. Actual ui/headset.html, React 18.3.1, opaque allow-scripts iframe and unmodified official bundles ran in Chromium.",
+    "The relay used Decky 3.3.0 official websocket RPC routes directly inside the isolated container; Steam CEF and the production SSH/CDP method transport were not part of this audio run.",
+    "Actual published amd64 Decky binary and official unmodified Python backends executed. No ARM64 or real Frame audio claim.",
+    "Previous full-catalog fake-Frame evidence tests archive/install/remove transport only; its backends remain stubbed."
+  ],
+  "sharedHeadsetLock": {
+    "acquired": false,
+    "owner": "delightvr-r4-a56d43b4c0",
+    "headsetReadsOrChanges": false
+  },
+  "audioBefore": {
+    "sinks": [
+      {
+        "index": 24,
+        "name": "framey-silent-test",
+        "channels": {
+          "front-left": "45%",
+          "front-right": "50%"
+        }
+      }
+    ],
+    "streams": [
+      {
+        "index": 45,
+        "name": "FrameySilent0",
+        "channels": {
+          "front-left": "100%",
+          "front-right": "100%"
+        }
+      },
+      {
+        "index": 46,
+        "name": "FrameySilent1",
+        "channels": {
+          "front-left": "100%",
+          "front-right": "100%"
+        }
+      }
+    ]
+  },
+  "mutatingCalls": [
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 75,
+          "channel": "both"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "75%",
+              "front-right": "75%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 74,
+          "channel": "both"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "74%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 73,
+          "channel": "both"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "73%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 75,
+          "channel": "right"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "75%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 74,
+          "channel": "right"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 38,
+      "method": "set_input_volume",
+      "args": [
+        {
+          "index": 46,
+          "volume": 0.5
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "50%",
+              "front-right": "50%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 38,
+      "method": "set_input_volume",
+      "args": [
+        {
+          "index": 46,
+          "volume": 0.45
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "45%",
+              "front-right": "45%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 144,
+      "method": "set_volume",
+      "args": [
+        41,
+        37
+      ],
+      "result": true,
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "37%",
+              "front-right": "37%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 144,
+      "method": "set_volume",
+      "args": [
+        41,
+        38
+      ],
+      "result": true,
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "73%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "38%",
+              "front-right": "38%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 42,
+          "channel": "left"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "42%",
+              "front-right": "74%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "38%",
+              "front-right": "38%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 58,
+      "method": "set_volume_state",
+      "args": [
+        {
+          "value": 42,
+          "channel": "right"
+        }
+      ],
+      "result": {
+        "result": true,
+        "success": true
+      },
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "42%",
+              "front-right": "42%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "38%",
+              "front-right": "38%"
+            }
+          }
+        ]
+      }
+    },
+    {
+      "id": 144,
+      "method": "save_settings",
+      "args": [
+        {
+          "filters": [
+            "FrameySilent0"
+          ],
+          "boostLimit": 0
+        }
+      ],
+      "result": true
+    },
+    {
+      "id": 144,
+      "method": "set_volume",
+      "args": [
+        41,
+        39
+      ],
+      "result": true,
+      "independentAudioReadback": {
+        "sinks": [
+          {
+            "index": 24,
+            "name": "framey-silent-test",
+            "channels": {
+              "front-left": "42%",
+              "front-right": "42%"
+            }
+          }
+        ],
+        "streams": [
+          {
+            "index": 45,
+            "name": "FrameySilent0",
+            "channels": {
+              "front-left": "100%",
+              "front-right": "100%"
+            }
+          },
+          {
+            "index": 46,
+            "name": "FrameySilent1",
+            "channels": {
+              "front-left": "39%",
+              "front-right": "39%"
+            }
+          }
+        ]
+      }
+    }
+  ],
+  "checks": {
+    "volumeMixer38": "Discovery, slider click and ArrowDown: only FrameySilent1 changed 100\u219250\u219245%; FrameySilent0 stayed100%.",
+    "volumeBoost58": "Sync both channels 75\u219274\u219273%; unsynced right 75\u219274% preserved left73%; reopen restored unchecked sync and73/74. Numeric left42 preserved right74; re-sync set right42 and disabled both right inputs.",
+    "mixer144": "Numeric37\u219238\u219239 changed FrameySilent1 only; server readbacks37/38/39%. Invalid101 and off-step37.5 produced no set_volume RPC. Filter FrameySilent0 saved with boostLimit0, survived actual Decky shutdown/restart and reopened showing only FrameySilent1 at38%.",
+    "invalidNumericBrowserMessages": {
+      "inputs": [
+        "101",
+        "37.5",
+        "39"
+      ],
+      "setVolumeMessages": [
+        {
+          "method": "set_volume",
+          "args": [
+            41,
+            39
+          ]
+        }
+      ]
+    },
+    "notRun": [
+      "boost above100%",
+      "Bluetooth playback commands",
+      "reset_volumes",
+      "physical headset audio",
+      "worn VR",
+      "VR keyboard/controller input"
+    ]
+  },
+  "pipewireConfig": "context.properties = { core.daemon = true core.name = framey-audio }\ncontext.spa-libs = { audio.convert.* = audioconvert/libspa-audioconvert support.* = support/libspa-support }\ncontext.modules = [\n { name = libpipewire-module-protocol-native }\n { name = libpipewire-module-access }\n { name = libpipewire-module-spa-node-factory }\n { name = libpipewire-module-client-node }\n { name = libpipewire-module-client-device }\n { name = libpipewire-module-adapter }\n { name = libpipewire-module-metadata }\n { name = libpipewire-module-link-factory }\n { name = libpipewire-module-session-manager }\n]\ncontext.objects = [\n\n { factory = spa-node-factory args = { factory.name = support.node.driver node.name = Dummy-Driver node.group = pipewire.dummy priority.driver = 20000 } }\n { factory = adapter args = { factory.name = support.null-audio-sink node.name = framey-silent-test node.description = \"Framey Silent Test\" media.class = Audio/Sink audio.position = [ FL FR ] } }\n]",
+  "remaining": "All three remain partial until real ARM64 Frame dependencies and audio-session mapping are verified under the shared lock.",
+  "cleanup": {
+    "testContainerRemoved": true,
+    "browserRelayStopped": true,
+    "headsetUntouched": true,
+    "testServicesOnHeadset": false
+  },
+  "catalogRefresh": {
+    "checkedAtUtc": "2026-10-26T01:34:07.257386+00:00",
+    "plugins": 116,
+    "idsVersionsDigestsUnchanged": true
+  },
+  "regression": {
+    "serverTests": {
+      "count": 1612,
+      "skipped": 16,
+      "result": "OK"
+    },
+    "siteTests": {
+      "passed": 2,
+      "failed": 0
+    },
+    "focusedFrameyTests": 38,
+    "officialFrontendAudit": {
+      "attempted": 116,
+      "ready": 98,
+      "failed": 18,
+      "readyStateChanges": [],
+      "initializerOnly": true,
+      "backendAndNetworkDenied": true
+    }
+  }
+}

docs/evidence/framey-audio-backends-2026-10-26.md

@@ -0,0 +1,110 @@
+# Official audio plugins: local real-backend checks
+
+Historical amd64 run. The [later ARM64 Frame check](framey-audio-arm64-2026-10-26.md)
+supersedes the ARM64 gaps and follow-up plan below; it promotes the two per-app
+mixers to works for their verified scope. Volume Boost remains partial.
+
+Volume Mixer 1.2.1-1 (38), Volume Boost 0.0.7 (58) and Mixer 0.1.0 (144)
+passed useful audio controls in local Chromium with their **unmodified official
+Python backends running in actual Decky 3.3.0**. All three remain **partial**:
+this run used amd64 Linux, and Frame ARM64 dependencies/audio-session mapping
+are unverified. The shared headset lock was occupied; no headset reads or
+changes occurred. No worn-VR result is claimed.
+
+The private test container and browser relay were removed after verification.
+
+The [machine-readable observations](framey-audio-backends-2026-10-26.json)
+pin all three official archives and the published Decky binary digest, and
+record each browser-triggered write with independent `pactl` channel readbacks.
+
+| Plugin | Useful behavior checked | Still unverified on Frame |
+| --- | --- | --- |
+| Volume Mixer | Discover two playback streams; slider click and ArrowDown change only the selected stream, 100 → 50 → 45%; other stream remains 100% | ARM64 libpulse/libdbus, actual user audio session, Bluetooth playback controls |
+| Volume Boost | Both-channel slider; separate right-channel change preserves left; reopen restores sync preference and actual values; exact numeric left entry; syncing disables both right controls | `pactl`, default sink, hard-coded runtime UID, physical output, boost above 100% |
+| Mixer | Exact stream volume 37 → 38%, independently read back; invalid 101 and off-step 37.5 produce no write; playback filter saved, survives actual Decky restart, hides the intended stream on reopen | `pw-dump`/`wpctl`, actual Frame session, physical output, worn VR |
+
+## Reproduced host gap
+
+Both Volume Boost and Mixer request `SliderField.editableValue`. Framey
+previously ignored that prop and rendered only a range slider. It now supplies
+an accessible numeric input with the same minimum, maximum, step and disabled
+state, and emits numeric `onChange` values. Empty, non-finite, out-of-range and
+browser-invalid drafts do not reach a backend. No official archive was patched.
+This also makes the control available to other plugins requesting that prop;
+it does not establish their compatibility.
+
+## Runtime and isolation
+
+The disposable Debian 13 container ran PipeWire 1.4.2, WirePlumber 0.5.8 and
+PulseAudio client tools 17.0. Docker used `--network none --cap-drop ALL
+--security-opt no-new-privileges`, no host audio sockets and no sound devices.
+Only the archive cache and test inputs were mounted, read-only. Debian 12 was
+insufficient for the published Decky binary's GLIBC requirement; that initial
+runtime did not start.
+
+Private environment:
+
+```text
+XDG_RUNTIME_DIR=/tmp/framey-audio-runtime
+PIPEWIRE_REMOTE=framey-audio
+PULSE_SERVER=unix:/tmp/framey-audio-runtime/pulse-native
+DBUS_SYSTEM_BUS_ADDRESS=unix:path=/tmp/framey-audio-runtime/bus
+DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/framey-audio-runtime/bus
+```
+
+XDG config/data/state and both Decky paths were below the private test base.
+Decky ran unprivileged with `CHOWN_PLUGIN_PATH=0`, `LIVE_RELOAD=0`,
+`USE_CEF_CLOSE_WORKAROUND=0` and `KEEP_SYSTEMD_SERVICE=1`. A private D-Bus
+session satisfied Volume Mixer's import; there was no real BlueZ service.
+Its fixed `/tmp/VolumeMixer-decky.log` existed only inside the container.
+
+The JSON includes the complete PipeWire server configuration: only a dummy
+driver and null stereo sink, no hardware factories. A second PipeWire process
+loaded protocol-native, client-node, adapter, metadata and protocol-pulse with
+the private absolute socket. `wireplumber --profile policy` managed this server;
+that installed profile contains no hardware monitors. Only private default-sink
+metadata was selected. Two `paplay --raw --format=s16le --rate=48000 --channels=2
+/dev/zero` clients supplied silence named `FrameySilent0` and `FrameySilent1`.
+Without policy, successful volume RPCs initially left readbacks unchanged; those
+fixture attempts are excluded from the passing observations.
+
+The browser relay served actual `ui/headset.html`, vendored React 18.3.1,
+`ui/framey-host.js` and the exact archived frontends in an opaque `allow-scripts`
+iframe. Outer headset/installed-plugin responses were fixture-shaped. Backend
+RPC used the official Decky websocket protocol inside the isolated container:
+`loader/call_legacy_plugin_method` with keyword objects for 38/58 and
+`loader/call_plugin_method` with positional arguments for 144. This bypassed
+Steam CEF and the production SSH/CDP transport; neither is an audio verification
+claim from this run.
+
+The relay allowed discovery/settings reads, bounded volume writes only to
+identified `FrameySilent` streams/the private default sink, and Mixer filters
+`[]` or `["FrameySilent0"]` with boost limit 0. It denied Bluetooth commands,
+`reset_volumes` and boosts. Every volume write was followed by a separate
+`pactl -f json list sinks` / `list sink-inputs` read. A clean Decky shutdown and
+restart retained Mixer's actual settings file and filter behavior.
+
+Earlier full-catalog fake-Frame evidence for these exact digests covers
+install/receipt/frontend/removal transport, with plugin execution stubbed.
+The new evidence adds actual local backend execution; it does not turn that
+older fake-Frame result into an ARM64 backend test.
+
+## Regression checks
+
+The required server suite passed 1,612 tests (16 skips); all 38 focused Framey
+tests and both website tests passed. The 116-plugin browser audit retained
+98 initializer-ready / 18 failed, with no change to any ready state. That audit
+keeps backend/network actions denied. A fresh official catalog fetch confirmed
+all 116 IDs, versions and digests unchanged.
+
+## Next device check
+
+Acquire the normal atomic `/tmp/frame-test.lock`; refuse an existing owner.
+First inspect available tools/libraries and audio runtime UID. If supported,
+repeat with a private ARM64 Decky user service, isolated audio socket, dummy
+sink/streams and hardware discovery disabled. Check Volume Mixer's fixed log
+path for collisions before loading it. Never attach the fixture to the normal
+headset output/default server. Remove only test-owned services/processes/files,
+read back original service/battery state and release only the matching lock.
+Keep all three partial until that check passes; physical output, Bluetooth and
+worn-VR controls need separate evidence.

docs/evidence/framey-audit-chunk-route-2026-10-26.md

@@ -0,0 +1,32 @@
+# Chunked Framey frontend audit route, 26 October 2026
+
+The local 116-plugin Chromium audit served chunked modules at a route that
+omitted the store receipt, while the production panel requested
+`/framey/module/<id>/<receipt>/<file>`. The audit parsed that receipt as part
+of the file path and returned 404. This made its result for chunked frontends
+weaker than the separate targeted panel checks.
+
+The audit now accepts the production URL shape only when the plugin ID,
+receipt and JavaScript path are valid, the receipt equals the catalog SHA-256,
+and the cached archive bytes match that SHA-256. Invalid IDs, receipts, paths
+and changed archive bytes fail before the module is served. The production
+Framey panel and installer are unchanged.
+
+## Exact archived browser check
+
+Pinned official Deck Shelves 2.0.0 (store ID 135, SHA-256
+`b566280ad38fd3ecd584b5b46a855f301539eb9a86063834c64b7045f7063f91`)
+ran through the repaired audit in an opaque Chromium iframe. Its entry module
+and all eight JavaScript chunks returned HTTP 200 at receipt-bound URLs. The
+frontend reported ready and called `get_settings`; the audit denied that
+backend call and a Steam library read. Plugin network access remained blocked
+by the audit policy. The previous
+catalog browser observation had failed to resolve `./chunks/...` from a blob
+URL. This check verifies the current audit route and frontend initializer,
+not the official backend or a live shelf.
+
+The focused route regression covers entry and chunk reads plus wrong receipt,
+path traversal, malformed ID and changed archive bytes. The catalog's
+**4 works / 50 partial / 51 broken / 11 N/A** statuses are unchanged. Deck
+Shelves remains partial; installed settings, home-shelf behavior, worn VR and
+physical controller input remain unverified.

docs/evidence/framey-bluetooth-fixture-2026-10-25.md

@@ -0,0 +1,16 @@
+# Bluetooth 3.1.1 compatibility fixture, 25 October 2026
+
+The unmodified official Decky store archive for Bluetooth 3.1.1 (store ID 18,
+SHA-256 `f07f7b74f31da15b5e3a8234a3f00faa01365b56b8f496aca7bb79120be7b8a5`)
+passes Frame Control's archive rules. The fake Frame e2e harness installed it
+through the store API, verified the managed receipt and frontend bytes, then
+removed it. An earlier real Frame check recorded the backend's `Bluetooth
+plugin loaded` line while SteamVR was in standby.
+
+In a local Node host test, its official frontend starts and builds an initial
+panel tree. Framey supplies empty Steam token maps and readable English
+fallbacks for the three Bluetooth labels that lack plugin-owned fallbacks.
+The test leaves React effects and click
+handlers inert and sends no backend calls. It does not inspect paired devices,
+change Bluetooth state, exercise a controller, or prove the panel is visible in
+VR. No worn-headset check has passed for this plugin.

docs/evidence/framey-deck-shelves-browser-2026-10-26.json

@@ -0,0 +1,56 @@
+{
+  "dateUtc": "2026-10-26",
+  "plugin": {
+    "storeId": 135,
+    "name": "Deck Shelves",
+    "version": "2.0.0",
+    "sha256": "b566280ad38fd3ecd584b5b46a855f301539eb9a86063834c64b7045f7063f91"
+  },
+  "mode": "opaque allow-scripts iframe in local Chromium, exact archived frontend, backend and network denied",
+  "baselineError": "relative JavaScript chunk imports cannot resolve from a blob URL",
+  "result": {
+    "initializerReady": true,
+    "error": null,
+    "moduleResponses200": 9,
+    "settingsVisible": [
+      "Enable shelves on Home",
+      "Create default shelves",
+      "Behavior",
+      "Shelves"
+    ],
+    "attemptedBackendMethods": [
+      "get_settings"
+    ],
+    "backendMethodsExecuted": [],
+    "steamLibraryRead": "denied by audit",
+    "pluginNetwork": "denied by audit"
+  },
+  "limits": [
+    "No Steam Home shelf injection or settings write was verified",
+    "No official backend executed",
+    "No official Deck Shelves interaction occurred on the real Frame or in worn VR",
+    "Settings visibility alone does not prove the plugin works"
+  ],
+  "realFrameGate": {
+    "sourceCommit": "b0c4647b856035c970ae27ea4e2ddbf6e51f6963",
+    "headsetOsBuild": "20261022.6153909",
+    "preflightActivity": 3,
+    "preflightBatteryPercent": 100,
+    "postBatteryPercent": 99,
+    "sampleExercisePassed": true,
+    "sampleSettingPersistedAfterFreshIframe": true,
+    "syntheticOpenVrPointerTrusted": true,
+    "stereoPixelsChanged": true,
+    "mirrorCapturePresent": true,
+    "nativeScrollMoved": false,
+    "powerValuesRestored": true,
+    "recoveryTimerRemoved": true,
+    "lockReleased": true,
+    "cleanupErrors": [],
+    "genericFrameSmokePassed": 13,
+    "genericFrameSmokeFailed": 0,
+    "officialDeckShelvesBackendOrVrTested": false,
+    "physicalControllerVerified": false,
+    "wornVisualComfortVerified": false
+  }
+}

docs/evidence/framey-deck-shelves-browser-2026-10-26.md

@@ -0,0 +1,23 @@
+# Deck Shelves chunked frontend, 26 October 2026
+
+The exact official Deck Shelves 2.0.0 archive (store ID 135, SHA-256 `b566280ad38fd3ecd584b5b46a855f301539eb9a86063834c64b7045f7063f91`) contains `dist/index.js` and eight JavaScript chunks. Its API v1 `connect(1, "Deck Shelves")` bridge sits in `chunks/decky-api-WgbNuFYS.js`, not in the entry file; the original static scanner therefore reported its frontend API as unknown. Framey's prior blob import failed before initialization because a blob URL has no directory in which to resolve `./chunks/...`. The [numeric observation](framey-deck-shelves-browser-2026-10-26.json) and [local Chromium capture](framey-deck-shelves-browser-2026-10-26.png) record a targeted follow-up using the unchanged official frontend.
+
+Framey now serves JavaScript files from the managed plugin's `dist` directory using hierarchical module URLs. Its opaque `allow-scripts` iframe still has no Frame UI key. Local Chromium received HTTP 200 for the entry and eight chunks, reported the initializer ready, and rendered the settings panel with “Enable shelves on Home,” “Create default shelves,” “Behavior,” and “Shelves.” The browser audit denied the attempted `get_settings` backend call, Steam library read and plugin network access. No backend method executed.
+
+The catalog moves this exact version from broken to **partial** for visible local settings. The plugin's main feature injects shelves into Steam Home; Framey has no verified Steam Home patch target. Actual Decky RPC, real Frame settings, wearer-visible VR, and physical controller input remain unverified. The [compatibility table](../framey-compatibility.md) and store views retain these limits.
+
+## Isolated official backend settings check
+
+I verified the same archive digest before loading its unchanged `Deck-Shelves/main.py` in local Python. A stub `decky` module supplied only a logger; `DECKY_PLUGIN_SETTINGS_DIR` and `DECKY_HOME` pointed inside a temporary directory. No Decky service, headset, Steam API, or network call was involved. Calling `_main`, `get_settings`, and `set_settings` returned the default disabled state, saved one shelf named `Local Test`, and returned that shelf from a fresh `Plugin` instance. The temporary directory was removed after the check.
+
+```json
+{"archiveSha256":"b566280ad38fd3ecd584b5b46a855f301539eb9a86063834c64b7045f7063f91","defaultEnabled":false,"defaultShelves":0,"saveResult":true,"reopenedEnabled":true,"reopenedShelfTitle":"Local Test","settingsFileExists":true}
+```
+
+This proves only the archive's Python settings logic under those local conditions. It does not prove that Decky 3.3.0 can dispatch these methods on the ARM64 Frame, that the opaque panel can save settings through the production bridge, or that a shelf appears on Steam Home or in VR.
+
+## Exact source real Frame gates
+
+The exact source commit `b0c4647b856035c970ae27ea4e2ddbf6e51f6963` ran the unattended `scripts/framey-vr-check.py --exercise` on SteamOS build `20261022.6153909` under its unique shared-lock owner. Preflight found SteamVR activity 3 (standby), battery 100%, and proximity 6.25. The repository sample panel appeared, stereo compositor pixels changed, and `/dev/video99` supplied a mirror frame. Synthetic OpenVR pointer input changed the sample setting through actual Decky; the value survived a fresh iframe reopen. Native scroll did not move. The runner removed its temporary services and recovery timer, read back the original `false`/`5` power values, found battery 99%, reported no cleanup errors, and released its lock.
+
+The same source then passed `scripts/frame-smoke.sh` **13/13** on the real Frame, starting from standby at battery 99%. Its final cleanup step passed. The [sanitized result fields](framey-deck-shelves-browser-2026-10-26.json) omit room pixels, raw overlays, identifiers, and settings contents; private captures were not committed. These gates exercise the Framey repository sample and generic install/launch/remove paths. They do **not** exercise Deck Shelves' official ARM64 backend or prove its settings or shelves in VR. No person wore the headset and no physical controller was checked.

docs/evidence/framey-dialog-controls-2026-10-26.json

@@ -0,0 +1,311 @@
+{
+  "checkedAtUtc": "2026-10-26T09:28:48.295443+00:00",
+  "plugin": {
+    "id": 124,
+    "name": "AlarMe",
+    "version": "1.6.3",
+    "sha256": "17d4166a9e98979df5fdb07c7eae42317acd54a453d3b82757508f971193c0fe"
+  },
+  "status": "partial",
+  "sharedControls": {
+    "ConfirmModalOfficialImporters": 43,
+    "FocusableOfficialImporters": 65,
+    "claim": "Import counts show shared surface, not successful behavior in every plugin. Only AlarMe received a real-backend follow-up."
+  },
+  "realFrame": {
+    "os": "Frame OS 0.5.6",
+    "arch": "aarch64",
+    "decky": {
+      "version": "v3.3.0",
+      "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+    },
+    "transport": "trusted SSH through coordinator host; receipt-bound real CEF Decky RPC/events",
+    "isolation": "Exact official archive installed by production APPLY into a random private path. Removable unprivileged user service, not enabled, RuntimeMaxSec=900 and TimeoutStopSec=5.",
+    "settings": {
+      "timer_subtle_mode": true,
+      "timer_volume": 0,
+      "timer_auto_suspend": false,
+      "timer_prevent_sleep": false,
+      "pomodoro_subtle_mode": true,
+      "pomodoro_volume": 0,
+      "pomodoro_prevent_sleep": false,
+      "overlay_enabled": false
+    },
+    "safeRpcResults": [
+      {
+        "method": "create_timer",
+        "args": [
+          300,
+          "Framey silent private timer",
+          true,
+          false,
+          false
+        ],
+        "result": "91c1f87d"
+      },
+      {
+        "method": "pause_timer",
+        "args": [
+          "91c1f87d"
+        ],
+        "result": true
+      },
+      {
+        "method": "save_preset_from_timer",
+        "args": [
+          "91c1f87d"
+        ],
+        "result": {
+          "id": "47c046cd",
+          "seconds": 300,
+          "label": "Framey silent private timer",
+          "subtle_mode": true,
+          "auto_suspend": false,
+          "prevent_sleep": false
+        }
+      },
+      {
+        "method": "remove_preset",
+        "args": [
+          "47c046cd"
+        ],
+        "result": true
+      },
+      {
+        "method": "cancel_timer",
+        "args": [
+          "91c1f87d"
+        ],
+        "result": true
+      },
+      {
+        "method": "stopwatch_start",
+        "args": [],
+        "result": {
+          "status": "running",
+          "start_time": 1793006404.791917,
+          "elapsed_ms": 0,
+          "laps": [],
+          "prevent_sleep": false,
+          "current_elapsed_ms": 1.0344982147216797
+        }
+      },
+      {
+        "method": "stopwatch_lap",
+        "args": [],
+        "result": {
+          "status": "running",
+          "start_time": 1793006404.791917,
+          "elapsed_ms": 0,
+          "laps": [
+            {
+              "label": "Lap 1",
+              "absolute_ms": 31747.3783493042,
+              "split_ms": 31747.3783493042
+            }
+          ],
+          "prevent_sleep": false,
+          "current_elapsed_ms": 31750.77533721924,
+          "total_lap_count": 1,
+          "lap_limit_reached": false
+        }
+      },
+      {
+        "method": "stopwatch_pause",
+        "args": [],
+        "result": {
+          "status": "paused",
+          "start_time": null,
+          "elapsed_ms": 34339.426040649414,
+          "laps": [
+            {
+              "label": "Lap 1",
+              "absolute_ms": 31747.3783493042,
+              "split_ms": 31747.3783493042
+            }
+          ],
+          "prevent_sleep": false,
+          "current_elapsed_ms": 34339.426040649414,
+          "total_lap_count": 1,
+          "lap_limit_reached": false
+        }
+      },
+      {
+        "method": "stopwatch_reset",
+        "args": [],
+        "result": {
+          "status": "idle",
+          "start_time": null,
+          "elapsed_ms": 0,
+          "laps": [],
+          "current_elapsed_ms": 0
+        }
+      }
+    ],
+    "eventCounts": {
+      "alarme_timers_updated": 3,
+      "alarme_sleep_inhibitor_updated": 6,
+      "alarme_timer_tick": 124,
+      "alarme_presets_updated": 2,
+      "alarme_stopwatch_updated": 3
+    },
+    "finalReadback": {
+      "timers": [],
+      "stopwatch": {
+        "status": "idle",
+        "start_time": null,
+        "elapsed_ms": 0,
+        "laps": [],
+        "current_elapsed_ms": 0
+      },
+      "sleep": {
+        "active": false,
+        "items": []
+      },
+      "presets": [
+        {
+          "id": "preset-5",
+          "seconds": 300,
+          "label": "5 minutes",
+          "subtle_mode": false,
+          "auto_suspend": false
+        },
+        {
+          "id": "preset-10",
+          "seconds": 600,
+          "label": "10 minutes",
+          "subtle_mode": false,
+          "auto_suspend": false
+        },
+        {
+          "id": "preset-15",
+          "seconds": 900,
+          "label": "15 minutes",
+          "subtle_mode": false,
+          "auto_suspend": false
+        },
+        {
+          "id": "preset-30",
+          "seconds": 1800,
+          "label": "30 minutes",
+          "subtle_mode": false,
+          "auto_suspend": false
+        }
+      ]
+    },
+    "before": {
+      "decky": "failed",
+      "panel": "inactive",
+      "battery": [
+        97
+      ]
+    },
+    "after": {
+      "decky": "failed",
+      "panel": "inactive",
+      "battery": [
+        96
+      ]
+    },
+    "cleanup": {
+      "baseAbsent": true,
+      "unitAbsent": true
+    },
+    "lockReleased": true
+  },
+  "browser": {
+    "host": "Repository headset.html and opaque allow-scripts iframe with bundled React 18.3.1; loopback RPC/event relay to the real ARM64 backend",
+    "verified": [
+      "labeled silent timer creation and live tick display",
+      "timer pause through onActivate and backend readback",
+      "save paused timer as preset through onActivate",
+      "delete confirmation shows preset name and description",
+      "Cancel closes dialog without dispatching remove_preset; backend readback retains preset",
+      "Delete invokes remove_preset once and readback removes the private preset",
+      "timer cancellation",
+      "Watch tab activation; stopwatch start/lap/pause",
+      "fresh panel reopen retains paused 34.339-second stopwatch and one lap",
+      "stopwatch reset; no active timers or sleep inhibitors in final backend readback"
+    ],
+    "domFixture": {
+      "type": "fixture:result",
+      "checks": [
+        "description visible",
+        "underlying panel inert",
+        "dialog fixed",
+        "Tab wraps in top dialog",
+        "Cancel callback once",
+        "parent draft preserved",
+        "disabled actions",
+        "old Close retains child",
+        "programmatic Close skips callback",
+        "OK does not close newly opened dialog",
+        "Update changes body",
+        "Escape cancels top dialog",
+        "panel reactivated",
+        "pointer Enter Space activate once each"
+      ]
+    },
+    "limits": "Local Chromium with real backend, not the deployed headset HTTP host or worn VR. Synthetic DOM checks use programmatic DOM events, not physical controllers."
+  },
+  "fixtureCorrection": {
+    "issue": "Initial seed used settings/<display-name>; actual Decky uses settings/<folder>. Safety assertion failed on readback before any timer action.",
+    "resolution": "First private service/data removed and lock released. Correct folder seed read back before second run exposed actions."
+  },
+  "cleanupAudit": {
+    "servicesAudited": 2,
+    "allBaseUnitArchiveAbsent": true,
+    "allLoadStateNotFound": true,
+    "allActiveStateInactive": true,
+    "allMainPidZero": true,
+    "sharedLock": "Fresh atomic lock acquired and released for cleanup audit"
+  },
+  "unverified": [
+    "audio playback and sound imports",
+    "alarms and reminders",
+    "auto-suspend and /dev/uinput sleep inhibition",
+    "in-game/global Steam overlay: no injection target in isolated panel",
+    "background notifications after panel closes",
+    "worn VR and physical controller/keyboard input"
+  ],
+  "validation": {
+    "fullPython": {
+      "ran": 1628,
+      "skipped": 16,
+      "result": "pass"
+    },
+    "nodeContracts": [
+      "tests/page/framey_actions.mjs",
+      "tests/page/framey_running.mjs"
+    ],
+    "siteTestFiles": 2,
+    "currentStoreRefresh": {
+      "plugins": 116,
+      "exactIdsVersionsAndDigestsUnchanged": true
+    },
+    "fakeFrame": {
+      "blocked": 56,
+      "installed-removed": 60
+    },
+    "noContextBrowser": {
+      "plugins": 116,
+      "ready": 101,
+      "failed": 15,
+      "noRegressionsAgainstCatalogBaseline": true,
+      "scope": "Initialization only, all backend/network denied; library-dependent plugins lack Steam context"
+    },
+    "contextReplayBrowser": {
+      "plugins": 116,
+      "ready": 104,
+      "failed": 12,
+      "initializationRegressionsAgainstPriorContextReplay": [],
+      "scope": "Synthetic library/running replay; backend and network denied, initialization only"
+    }
+  },
+  "reviewFollowUp": {
+    "checkedAtUtc": "2026-10-26T10:10:05.650676+00:00",
+    "change": "Update reinjects the scoped close callback into replacement React dialogs and uses the replacement close callback.",
+    "verification": "Node regression: updated ConfirmModal OK and Cancel, with and without custom close callbacks; ClosedPromise resolves; original callback not retained; repeated Close/Update inert. Regression reproduced before the fix.",
+    "limits": "No additional local Chromium or real Frame check for this small follow-up; prior runtime evidence applies to initial dialog and workflow paths."
+  }
+}

docs/evidence/framey-dialog-controls-2026-10-26.md

@@ -0,0 +1,107 @@
+# Framey activation and dialog follow-up — 2026-10-26
+
+AlarMe 1.6.3 now has usable timer, preset and stopwatch controls in the local
+Framey host with its official backend running on the ARM64 Frame. It remains
+**partial**. This check does not establish audio, alarm/reminder, sleep-control,
+background-notification or worn-VR compatibility.
+
+The exact archive is store ID 124, SHA-256
+`17d4166a9e98979df5fdb07c7eae42317acd54a453d3b82757508f971193c0fe`.
+See the [structured results](framey-dialog-controls-2026-10-26.json).
+
+## Reproduced blockers and repairs
+
+AlarMe uses DFL `Focusable.onActivate` for timer pause, save-as-preset, cancel,
+preset deletion, tabs and stopwatch controls. Framey's previous `div`
+passthrough ignored that callback: clicks on the save/pause controls did not
+dispatch backend calls. Focusable now maps pointer activation and Enter/Space
+to plugin callbacks, exposes a keyboard focus target and respects disabled
+controls. A click does not invoke both `onClick` and `onActivate` when a plugin
+supplies both; nested activation stops bubbling to the parent action.
+
+The previous ConfirmModal omitted `strDescription`, Cancel, middle actions and
+disabled flags. showModal did not inject a `closeModal` callback into custom
+dialog components, and every Close handle cleared the same root. A confirmation
+opened by another dialog could therefore disappear when the earlier action
+closed. Dialogs also appeared below the panel's long page content.
+
+Dialogs now occupy a scrollable overlay inside the opaque iframe. They preserve
+the underlying dialog's mounted state, receive scoped close callbacks, support
+Close/ClosedPromise/Update, show confirmation descriptions and cancel/middle
+actions, and respect disabled flags. The underlying plugin surface becomes
+inert while a dialog is open; Tab stays in the top dialog, Escape cancels it and
+closing restores focus. Steam popouts and controller navigation are not emulated.
+
+43 official archives import ConfirmModal and 65 import Focusable in this
+snapshot. These are shared API surfaces, **not** verification or status
+promotions for every importing plugin.
+
+## Real backend and local browser verification
+
+Held the normal atomic shared headset lock. Installed the exact official archive
+through the production archive validation/extraction path into a random private
+directory. Used published Decky 3.3.0 ARM64, an unprivileged user service that was
+never enabled, with a 900-second runtime bound and five-second stop timeout.
+RPCs and events used Framey's production receipt-bound bridge through real Steam
+CEF. The Chromium host served repository headset.html, React and framey-host.js;
+its status endpoints were fixture-shaped, while AlarMe RPCs/events were live.
+
+The initial private settings seed used the plugin display name instead of the
+archive folder. A safety assertion failed on readback of the defaults before any
+timer action. That service/data was removed and the lock released. The corrected
+run read back subtle mode, zero volume, no auto-suspend, no sleep inhibition and
+no overlay before exposing actions. Its relay allowed only the documented safe
+methods; sound, suspend, sleep-inhibitor and arbitrary plugin actions were denied.
+
+Verified with actual browser clicks and real backend readback:
+
+1. Add Label opened a custom timer dialog. Created a silent five-minute timer
+   named `Framey silent private timer`; live backend ticks changed its display.
+2. Pause and save-as-preset activated after the Focusable repair. Backend
+   readback reported a paused timer and its saved preset.
+3. Delete Preset showed the preset's name in its confirmation description.
+   Cancel closed the dialog without dispatching `remove_preset`; readback kept
+   the preset. Reopening and choosing Delete dispatched it once and removed it.
+4. Cancel removed the private timer. Watch opened the stopwatch; Start, Lap and
+   Pause produced real backend state and events.
+5. Closing and reopening the panel retained the paused stopwatch at 34.339
+   seconds and one lap. Reset cleared it. Final readback showed no active timers,
+   no laps and no active sleep inhibitor.
+
+A separate local Chromium DOM fixture passed 14 checks for nested-dialog state,
+scoped handles, descriptions, disabled buttons, Cancel, Escape, Tab wrapping,
+Close/ClosedPromise/Update and pointer/Enter/Space activation. These programmatic
+DOM checks do not verify physical input devices.
+
+Review follow-up: Update also injects the scoped close callback into replacement
+dialogs. Node regression contracts update to ConfirmModal and exercise both OK
+and Cancel, with and without a plugin close callback, then await ClosedPromise.
+They verify that the replacement's callback runs once and the original callback
+is not retained. This extends the local host's Update behavior so replacements
+remain dismissible; this follow-up was not rerun in Chromium or on the headset.
+
+## Cleanup and remaining limits
+
+Removed both private service units, bases and uploaded archives; reloaded the
+user service manager and released the matching shared lock. A fresh locked audit
+confirmed both units were not found, inactive and PID zero, with all test paths
+absent. Managed Decky remained failed and the headset panel inactive, matching
+the initial state. Battery was 97% before and 96% after. No power settings changed.
+
+AlarMe stays partial. Audio, sound imports, alarms/reminders, auto-suspend and
+`/dev/uinput` sleep inhibition were not exercised. Steam's global/in-game overlay
+has no injection target inside Framey's isolated panel. Notifications require
+the plugin panel to remain open. The deployed headset HTTP host, worn VR and
+physical controller/keyboard input were not tested in this pass.
+
+The store and documentation use the same exact-digest catalog reason. Aggregate
+counts remain **4 works / 49 partial / 52 broken / 11 N/A**.
+
+Validation: all 116 official IDs/versions/digests unchanged on store refresh;
+fake-Frame 60 installed/removed and 56 blocked; full Python suite 1,628 tests,
+16 skipped; Framey action/running Node contracts and both site test files pass.
+The no-Steam-context Chromium pass attempted all 116 frontends (101 initialized,
+15 failed); backend and network access were denied throughout that pass.
+The repeat with synthetic library/running context initialized 104 of 116, with no
+initialization regressions against the prior context-replay pass. Neither
+initialization pass is a useful-functionality check.

docs/evidence/framey-emuchievements-arm-2026-10-26.md

@@ -0,0 +1,40 @@
+# Emuchievements ARM64 hash helper feasibility, 26 October 2026
+
+The exact official Emuchievements 2.0.5 archive (store ID 28, SHA-256
+`98dcb443e81b9f9011cfe77c69eb659869c8e2df2df8b0a443df66cbfc2f5a89`)
+contains an x86_64 `Emuchievements/bin/hash`. Frame Control still blocks
+that archive on ARM64; this experiment did not install the plugin.
+
+The upstream source commit
+[`8567e94befffc943434b2adb842487274815f8bb`](https://github.com/EmuDeck/Emuchievements/commit/8567e94befffc943434b2adb842487274815f8bb)
+declares version 2.0.5. Its `src/py/main.py` matches the published ZIP's
+`Emuchievements/main.py` byte for byte (SHA-256
+`d4e72f136c94e48919575937ec4190f28864cc259eb111ef47f0df99f5912645`).
+The pinned build dependencies at that commit are libarchive
+`b3be94ba4f36943745e64a6a0a3c21c2d1281d3c`, libchdr
+`a20e04c12c0c20048bf771da6df7aa2e51f5e0cb`, and rcheevos
+`85a3209398e576d79170f569fcddf277640f3f06`.
+
+On a separate Linux host, the version-matched source and submodules built an
+x86_64 `hash` with CMake. It and the official x86_64 binary both returned
+`ff78ca6c21ac11504dbddbd5d4e7524a` for one synthetic `.rom` file. An
+isolated Debian cross-build using `gcc-aarch64-linux-gnu` and
+`g++-aarch64-linux-gnu` produced an AArch64 binary with SHA-256
+`9c7aedb80bdd64941aa5dd9b41f9bb8471411c812e04c7ee7d60486779d99997`.
+It links to `liblzma.so.5`, `libstdc++.so.6`, `libgcc_s.so.1`, and `libc.so.6`.
+
+A real Frame test acquired `/tmp/frame-test.lock` atomically with a unique
+owner before reading the device. SteamVR activity was **3** (standby),
+proximity raw **3.0625**, and battery **100%**. The ARM64 helper ran against
+the same synthetic ROM in a private `/tmp` directory, exited 0, and returned
+the same hash. The owned directory and lock were removed. No normal service,
+power setting, Steam library, real ROM, or installed plugin was changed.
+The separate host's source/build directory was also removed after the test.
+
+This proves only a single-file helper path. The official ZIP remains blocked
+because it still bundles x86_64 bytes. A release-ready port needs a packaged
+ARM64 helper with GPL-3.0 source and license compliance, format-specific hash
+coverage (including archives and CHD), a managed plugin transaction, actual
+Decky backend and frontend checks, and cleanup. RetroAchievements login,
+real ROM scanning, wearer-visible VR, and physical controller use remain
+unverified.

docs/evidence/framey-events-backend-2026-10-26.json

@@ -0,0 +1,418 @@
+{
+  "checkedAtUtc": "2026-10-26T00:12:47.296778+00:00",
+  "method": "Local Chromium actual Framey headset page and opaque official plugin iframe; production method/event bridge relayed by SSH to real ARM64 Decky 3.3.0 in a private removable user service. Test relay restricts RPC methods and timer durations. Backend code is unmodified, no fake plugin replies. Only file paths to private install and outer status/data APIs differ. Not worn VR.",
+  "decky": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+  },
+  "hostSourceSha256": {
+    "framey-host.js": "3bad52546c0b78c20e6479c91899f1f3864b74687c6fce37e776abededfb5f1c",
+    "framey-events.js": "89046f4c89bdab0f578b910170a044d5ada540db0f7b71d6a370c68b4b008c3f",
+    "framey_panel.py": "8ca4b3ba5f0d51c51bb3601f9ccd24c4af397fbf8f63c383a3042e1ae3f7b39b",
+    "headset.html": "ebaf1711639a929ec7287c01dbbbe8eb08f000b852fdc877f31c9d99e5fe69fc"
+  },
+  "before": {
+    "battery": [
+      100
+    ],
+    "decky": "inactive",
+    "panel": "inactive"
+  },
+  "after": {
+    "battery": [
+      100
+    ],
+    "decky": "inactive",
+    "panel": "inactive"
+  },
+  "powerSettingsChanged": false,
+  "plugins": [
+    {
+      "id": 19,
+      "name": "Notebook",
+      "version": "0.1.5",
+      "sha256": "c35b09de4bba4b4157fbe84cb7b0d20fc3924f78fa3c48ae17686b4314c1cc0c",
+      "calls": [
+        {
+          "id": 19,
+          "method": "listPages",
+          "args": [
+            {
+              "appid": 0
+            }
+          ],
+          "result": {
+            "result": {
+              "result": [],
+              "success": true
+            }
+          }
+        },
+        {
+          "id": 19,
+          "method": "loadLastSelectedPage",
+          "args": [
+            {
+              "appid": 0
+            }
+          ],
+          "result": {
+            "result": {
+              "result": 0,
+              "success": true
+            }
+          }
+        },
+        {
+          "id": 19,
+          "method": "loadPage",
+          "args": [
+            {
+              "appid": 0,
+              "page": 0
+            }
+          ],
+          "result": {
+            "result": {
+              "result": {
+                "page": 0,
+                "timestamp": 0,
+                "empty": true,
+                "data": ""
+              },
+              "success": true
+            }
+          }
+        },
+        {
+          "id": 19,
+          "method": "savePage",
+          "args": [
+            {
+              "appid": 0,
+              "page": 0,
+              "data": "[{\"drawMode\":true,\"strokeColor\":\"white\",\"strokeWidth\":4,\"paths\":[{\"x\":583.3984375,\"y\":155.997802734375}]}]"
+            }
+          ],
+          "result": {
+            "result": {
+              "result": {
+                "timestamp": 1792973680303
+              },
+              "success": true
+            }
+          }
+        },
+        {
+          "id": 19,
+          "method": "listPages",
+          "args": [
+            {
+              "appid": 0
+            }
+          ],
+          "result": {
+            "result": {
+              "result": [
+                {
+                  "page": 0,
+                  "timestamp": 1792973680303,
+                  "empty": false
+                }
+              ],
+              "success": true
+            }
+          }
+        },
+        {
+          "id": 19,
+          "method": "loadLastSelectedPage",
+          "args": [
+            {
+              "appid": 0
+            }
+          ],
+          "result": {
+            "result": {
+              "result": 0,
+              "success": true
+            }
+          }
+        },
+        {
+          "id": 19,
+          "method": "loadPage",
+          "args": [
+            {
+              "appid": 0,
+              "page": 0
+            }
+          ],
+          "result": {
+            "result": {
+              "result": {
+                "page": 0,
+                "timestamp": 1792973680303,
+                "empty": false,
+                "data": "[{\"drawMode\":true,\"strokeColor\":\"white\",\"strokeWidth\":4,\"paths\":[{\"x\":583.3984375,\"y\":155.997802734375}]}]"
+              },
+              "success": true
+            }
+          }
+        }
+      ],
+      "events": [],
+      "checks": {
+        "pointerStrokeSaved": true,
+        "sameStrokeLoadedAfterBackendRestart": true,
+        "defaultAppId": 0,
+        "existingNotesTouched": false
+      }
+    },
+    {
+      "id": 96,
+      "name": "Simple Timer",
+      "version": "1.0.0",
+      "sha256": "973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312",
+      "calls": [
+        {
+          "id": 96,
+          "method": "load_remaining_seconds",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "load_subtle_mode",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "load_recents",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "start_timer",
+          "args": [
+            300
+          ],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "cancel_timer",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "start_timer",
+          "args": [
+            5
+          ],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "load_remaining_seconds",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "load_recents",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        },
+        {
+          "id": 96,
+          "method": "load_subtle_mode",
+          "args": [],
+          "result": {
+            "result": null
+          }
+        }
+      ],
+      "events": [
+        {
+          "sequence": 1,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            0
+          ]
+        },
+        {
+          "sequence": 2,
+          "event": "simple_timer_subtle",
+          "args": [
+            true
+          ]
+        },
+        {
+          "sequence": 3,
+          "event": "simple_timer_refresh_recents",
+          "args": [
+            []
+          ]
+        },
+        {
+          "sequence": 4,
+          "event": "simple_timer_refresh_recents",
+          "args": [
+            [
+              300
+            ]
+          ]
+        },
+        {
+          "sequence": 5,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            300
+          ]
+        },
+        {
+          "sequence": 6,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            294.9945251941681
+          ]
+        },
+        {
+          "sequence": 7,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            289.99201130867004
+          ]
+        },
+        {
+          "sequence": 8,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            284.9877219200134
+          ]
+        },
+        {
+          "sequence": 9,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            0
+          ]
+        },
+        {
+          "sequence": 10,
+          "event": "simple_timer_refresh_recents",
+          "args": [
+            [
+              5,
+              300
+            ]
+          ]
+        },
+        {
+          "sequence": 11,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            5
+          ]
+        },
+        {
+          "sequence": 12,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            -0.005679607391357422
+          ]
+        },
+        {
+          "sequence": 13,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            0
+          ]
+        },
+        {
+          "sequence": 14,
+          "event": "simple_timer_event",
+          "args": [
+            "Your session has ended!",
+            true
+          ]
+        },
+        {
+          "sequence": 1,
+          "event": "simple_timer_seconds_updated",
+          "args": [
+            0
+          ]
+        },
+        {
+          "sequence": 2,
+          "event": "simple_timer_refresh_recents",
+          "args": [
+            [
+              5,
+              300
+            ]
+          ]
+        },
+        {
+          "sequence": 3,
+          "event": "simple_timer_subtle",
+          "args": [
+            true
+          ]
+        }
+      ],
+      "checks": {
+        "uiStart300Seconds": true,
+        "uiCancel": true,
+        "shortTimer5Seconds": true,
+        "completionToastVisible": true,
+        "recentTimersAndSubtleModeSurvivedRestart": true,
+        "subscriptionsAfterPanelClose": 0
+      },
+      "upstreamError": "Simple Timer 1.0.0 _main after restarting with an expired timer raises AttributeError: 'Plugin' object has no attribute 'timer_task' (main.py:94,129). Frontend read requests still load recent timers and subtle mode."
+    }
+  ],
+  "cleanup": {
+    "baseAbsent": true,
+    "unitAbsent": true,
+    "serviceActive": false,
+    "independentlyRechecked": true,
+    "lockReleased": true
+  },
+  "regressions": {
+    "unitTests": 1606,
+    "unitSkips": 16,
+    "browserPlugins": 116,
+    "browserReady": 96,
+    "browserFailed": 20,
+    "fakeFrameInstalled": 60,
+    "fakeFrameRejected": 56
+  },
+  "limitations": [
+    "Timer sound asset and suspend action unsupported; no suspend/power action run.",
+    "Closing a Framey panel removes its event channel; it is not a global background notification service.",
+    "Notebook default notebook only (appid 0): no per-game auto-selection or background artwork.",
+    "No worn VR, physical controller, keyboard, or optical check."
+  ]
+}

docs/evidence/framey-free-loader-duplicates-2026-10-26.md

@@ -0,0 +1,49 @@
+# Free Loader duplicate archive entries, 26 October 2026
+
+The exact official Free Loader 1.6.0 archive is store ID 63, SHA-256
+`05208aee6f6ba824391d8ddc81b1168b2599a9711e7528cdaa789f6cc710b42a`.
+It has 23 ZIP entries. Seven names under `free-loader/py_modules/` occur
+twice. Each duplicate pair has identical uncompressed bytes and file type;
+five Python files and `.keep` differ only between mode `0644` and `0755`.
+The directory entry is identical. No path escape, symlink or alternate content
+was accepted.
+
+The installer now accepts an exact duplicate name only when its bytes match
+and its mode differs at most in execute bits. Both desktop validation and the
+headset transaction enforce that rule before extraction. The existing member
+count, unpacked-size, per-member-size, root, path and ARM64 checks still run.
+Synthetic tests reject changed duplicate payloads and non-execute mode changes.
+
+## Scoped verification
+
+- The exact archive passed the revised validator. A private local transaction
+  installed and removed its `free-loader` folder and receipt; cleanup left no
+  plugin folder. The focused store suite passed 21/21 tests, including a
+  duplicate-member install/remove and permission readback.
+- After merging current main, the full local Python suite passed **1,637
+  tests, 16 skipped**. The generated compatibility document check and
+  whitespace check passed.
+- The pinned official fake-Frame HTTP/SSH install/remove test passed with this
+  archive alongside the other pinned fixtures. It ran in a uniquely named
+  disposable Compose project; its containers, network and volumes were removed.
+  The fake does not execute the plugin's Python backend.
+- The current Framey opaque Chromium host on main `d963305` initialized the
+  exact frontend. Its **Free Games** view rendered, then displayed “Failed to
+  load games!” because the audit intentionally denied all backend/network
+  calls. It attempted `settings_read`, `read_deals` and logger methods.
+  The browser audit's former `local_bundle` stub had returned HTTP 404 after
+  receipt-bound panel lookup was introduced; the audit now supplies the
+  digest-checked bundle and receipt to the shipped panel renderer.
+- Exact official Python backend code ran in a disposable Python 3.12 container
+  with network disabled, read-only root, no capabilities, a private data mount
+  and a minimal `decky` API stub. `_main`, `settings_read` and `read_deals`
+  succeeded: 14 default settings, a 12-hour update frequency, an empty deals
+  map, and only private `settings.json`/`deal_db.json` files. The container
+  and its private files were removed. No feed refresh or notification ran.
+
+This makes **partial** the accurate digest-scoped status. The earlier full
+116-plugin fake-Frame catalog audit blocked this archive before the validator
+change; the focused pinned flow now passes. Actual Decky 3.3.0 backend load,
+live giveaway feeds, notification delivery, headset install, worn UI and
+physical controller input remain unverified. No real Frame session or service
+was touched for this change.

docs/evidence/framey-game-theme-music-2026-10-26.md

@@ -0,0 +1,7 @@
+# Game Theme Music local panel check, 26 October 2026
+
+The exact official Game Theme Music 1.7.1-1 archive (store ID 52, SHA-256 `9ce293ab4db212c03c6b96dfbc5e4d92e874d33387463f53223773921f75a80e`) passed the existing fake Frame install/remove audit. Its prior local Chromium run stopped before initialization with `Cannot read properties of null (reading 'type')`: the frontend dereferenced the result of `DFL.fakeRenderComponent` while looking for Steam's Library Context Menu.
+
+Framey's isolated host now returns an inert local component type from that lookup. The patch API remains a no-op and does not expose or modify a Steam React tree. In the repository's opaque Chromium audit, the unchanged archive reported initializer ready and rendered a Settings view containing Music Volume, Default Muted, Use yt-dlp, Invidious Instance, Download Music, Overrides and Extras. The audit observed a `get_setting` request, but denied the backend call. It also denied plugin network requests; a YouTube/Invidious fetch failed as expected. The bounded root-text observation came from the test iframe and contained only these public UI labels.
+
+The catalog therefore moves this digest from **broken** to **partial** for the visible local settings panel. No theme was played or injected into a Steam game page. Music search, playback, downloads, settings persistence, live ARM64 backend behavior, wearer-visible VR and physical controller input remain unverified. The earlier failed browser observation remains in the canonical JSON alongside this follow-up so the change in evidence is explicit.

docs/evidence/framey-installed-context-2026-10-26.json

@@ -0,0 +1,140 @@
+{
+  "checkedAtUtc": "2026-10-26T08:14:37.777131+00:00",
+  "plugin": {
+    "id": 84,
+    "name": "Junk-Store",
+    "version": "1.1.13",
+    "sha256": "f7ad2a0103c85bf308929b2e96ec9aeeb0d76bcc6ae97eb1e4b5f31ffba0cbb1"
+  },
+  "projection": {
+    "field": "local_per_client_data.installed",
+    "wire": "optional ninth scalar: boolean or null",
+    "unknown": "null creates an empty detached metadata object; installed stays undefined",
+    "privateFieldsCopied": false,
+    "oldEightScalarRows": "accepted; running updates preserve existing library metadata",
+    "liveObservation": false
+  },
+  "realFrame": {
+    "os": "Frame OS 0.5.6",
+    "arch": "aarch64",
+    "uid": 1000,
+    "decky": {
+      "version": "v3.3.0",
+      "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+    },
+    "transport": "trusted SSH through lxso2",
+    "sharedLock": true,
+    "runtime": "private bounded removable user service; not enabled",
+    "library": {
+      "apps": 1106,
+      "games": 895,
+      "installedTrue": 41,
+      "installedFalse": 0,
+      "installedUnknown": 1065
+    },
+    "protonRuntimeInstalledFields": "undefined for both EasyAntiCheat and BattlEye; no false value invented",
+    "legendaryInstalled": false,
+    "allowedMethods": [
+      "execute_action",
+      "get_websocket_port"
+    ],
+    "staticActions": [
+      "MainMenu/GetContent",
+      "init/InitActions"
+    ],
+    "noMutationActions": true
+  },
+  "localBrowser": {
+    "host": "actual headset.html/framey-host.js, vendored React, opaque iframe",
+    "backend": "exact official ARM64 plugin through production receipt-bound bridge",
+    "library": "production receipt-bound snapshot from real Frame CEF",
+    "outerStatusInstallCheck": "fixture responses",
+    "passed": [
+      "main menu",
+      "About content and tab list",
+      "Dependencies tab controls render; no buttons invoked",
+      "Back to main menu",
+      "close/reopen and About again"
+    ],
+    "limits": [
+      "optional localhost websocket blocked by test relay CSP",
+      "RSS calls denied",
+      "running-context relay returns fixture/unavailable data; no lifetime claims",
+      "outer extension/status fixture is incomplete; unrelated outer status/extension errors excluded from plugin claim",
+      "deployed headset HTTP endpoint unverified",
+      "worn VR unverified"
+    ]
+  },
+  "cleanup": {
+    "initialSshStop": "timed out while test unit deactivating",
+    "recovery": "SIGKILL to exact owned unit only after matching lock owner; private files removed",
+    "result": {
+      "baseAbsent": true,
+      "unitAbsent": true,
+      "archiveAbsent": true,
+      "state": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n",
+      "normal": {
+        "frame-control-decky.service": "inactive",
+        "frame-control-headset.service": "inactive"
+      },
+      "battery": [
+        99
+      ]
+    },
+    "freshLockedAudit": {
+      "services": 1,
+      "allArtifactsAbsent": true,
+      "allUnloadedInactivePidZero": true
+    },
+    "lockReleased": true,
+    "batteryBeforeAfter": [
+      [
+        99
+      ],
+      [
+        99
+      ]
+    ],
+    "powerSettingChanged": false,
+    "localRelayAndBrowserClosed": true
+  },
+  "verification": {
+    "python": {
+      "run": 1628,
+      "skipped": 16,
+      "failures": 0
+    },
+    "panelFocused": {
+      "run": 22,
+      "failures": 0
+    },
+    "nodeContracts": [
+      "framey_actions.mjs",
+      "framey_running.mjs"
+    ],
+    "siteTestFiles": {
+      "passed": 2,
+      "failures": 0
+    },
+    "fakeFrame": {
+      "blocked": 56,
+      "installed-removed": 60
+    },
+    "officialStore": {
+      "plugins": 116,
+      "errors": 0,
+      "identitySetUnchanged": true,
+      "checkedAtUtc": "2026-10-26T08:21:01.653768+00:00"
+    }
+  },
+  "status": "partial",
+  "unverified": [
+    "dependency/runtime installation",
+    "login",
+    "game listing/download/launch",
+    "RSS",
+    "optional websocket operations",
+    "Steam shortcut mutation",
+    "worn VR"
+  ]
+}

docs/evidence/framey-installed-context-2026-10-26.md

@@ -0,0 +1,62 @@
+# Junk-Store About and read-only installed metadata
+
+Junk-Store 1.1.13 (official ID 84) now renders its About and Dependencies tabs
+without the `local_per_client_data.installed` crash recorded in the
+[script-entrypoint audit](framey-script-entrypoints-2026-10-26.md). It remains
+**partial**. The catalog and both store views use the same updated reason.
+
+The library snapshot omitted the entire `local_per_client_data` object. The
+official frontend dereferences it to display its dependency controls. Under the
+shared headset lock, a read-only probe confirmed that the real Frame exposes
+this object for the two Proton runtimes, but neither has an `installed` boolean.
+Across 1,106 app overviews, 41 had `installed: true`, none had `false`, and 1,065
+had no installed boolean. Those absent values must not be relabelled as false.
+
+The snapshot adds one bounded scalar per app: a Steam-supplied boolean or null.
+Framey's detached overview creates a minimal metadata object, copying `installed`
+only for a boolean. Null leaves that property undefined. No client IDs, paths,
+other metadata, live Steam objects or methods cross the iframe boundary. Eight
+scalar rows remain accepted, and running-app updates preserve library metadata.
+The snapshot still refreshes at panel open; it is not a live installation feed.
+
+## Actual ARM64 backend and local Chromium
+
+The unmodified, hash-verified official archive ran in published Decky 3.3.0 ARM64
+on Frame OS 0.5.6 using a private, bounded, removable user service. Legendary was
+absent; no dependency installer, runtime install, login, game operation or custom
+backend download was invoked. The exact plugin and loader digests are in the
+[redacted results](framey-installed-context-2026-10-26.json).
+
+Local Chromium ran the actual Framey host and official frontend in an opaque
+iframe. The production receipt-bound bridges read the real Steam library and
+called the official ARM64 backend's static menu actions. About content and its
+tab list, Dependencies controls, Back, close/reopen, and About again passed.
+No dependency buttons were pressed. The real library counts matched the probe.
+
+The optional localhost websocket was blocked by the test relay CSP; RSS was
+deliberately denied. Outer status/install/check replies were fixtures; incomplete
+outer extension/status and running-context replies are excluded from the plugin
+claim. The screenshot still used the catalog reason from before this follow-up.
+Dependency installation, login, game operations, RSS, websocket operations,
+shortcut changes, deployed headset HTTP and worn VR remain unverified.
+
+## Cleanup and regression checks
+
+The initial cleanup SSH timed out while the private Decky unit was deactivating.
+Recovery checked the matching lock owner, killed only that exact test unit, and
+removed its private base, unit file and archive. A fresh locked audit independently
+confirmed unloaded/inactive/PID 0 and no artifacts, then released its lock. Normal
+managed Decky/panel services stayed inactive; battery was 99 → 99. No power-setting
+action ran. Local relay and owned browser tab are closed.
+
+- Full Python suite: 1,628 tests, 16 skipped, no failures; focused panel: 22 passed.
+- Framey action/running Node contracts passed, including true/false/unknown,
+  malformed metadata, detached values, old rows and running-update preservation.
+- Both site test files passed. Generated docs and diff checks passed.
+- All 116 exact official archives passed the fake-Frame audit: 60 installed/removed,
+  56 expected blocks; disposable project removed. Backend execution is stubbed in
+  that harness. The fresh official store has 116 entries, no audit errors, and an
+  unchanged ID/version/digest set.
+
+No new works claim is made. Catalog totals remain **4 works / 49 partial / 52 broken
+/ 11 N/A**; only Junk-Store's verified scope and remaining limits change.

docs/evidence/framey-legacy-2026-10-25.md

@@ -0,0 +1,25 @@
+# Legacy Decky frontend bridge
+
+The exact official MusicControl 1.1.6 archive (`12.zip` in the test fixtures)
+has no `api_version` field and returns its initializer from a Decky IIFE.
+Framey now wraps that expression in an ES module inside the existing
+opaque-origin iframe. It passes a legacy `serverAPI` to the initializer.
+
+Local Chromium ran the unchanged official frontend, including React effects,
+with all backend calls rejected and network access blocked. It emitted
+`framey:ready` without a JavaScript startup error during the observation window.
+This proves initialization, not playback, MPRIS access, or a useful populated UI.
+
+The fake Frame installed, packed, checked the frontend bytes and removed this
+exact archive. Its synthetic Sample Panel also read a legacy keyword argument,
+wrote a setting, and read that setting through the modern API. This exercised
+the real HTTP → SSH → CDP path with a fake Decky backend. The RPC contract was
+checked against Decky's `handle_plugin_method_call_legacy`: it calls with a
+keyword object and returns `{success, result}`. Invalid argument shapes and
+unmanaged plugin IDs are rejected.
+
+Verification: `python3 -m unittest discover -s tests -p 'test_framey*.py'`
+(21 passed), `node tests/page/framey_actions.mjs`, and
+`scripts/e2e.sh test_framey` (2 passed). No official Python backend code or
+headset state was changed by these checks. Real Frame backend behavior,
+controller input, playback and worn VR use remain unverified.

docs/evidence/framey-library-context-2026-10-26.json

@@ -0,0 +1,326 @@
+{
+  "timeUtc": "2026-10-26T02:23:08.939647+00:00",
+  "theme": "Detached read-only Steam library and current-user context",
+  "baselineMain": "3921e59",
+  "hostFileSha256": "3f70e9769c6c95d39cfa329ccf3f822df85d411e9295bdf888508b4738679e9d",
+  "realFrame": {
+    "platform": "Frame OS 0.5.6 ARM64",
+    "path": "SSH via lxso2; Steam SharedJSContext CDP",
+    "lock": "/tmp/frame-test.lock atomic mkdir; matching owner released in finally after every probe",
+    "apps": 1106,
+    "games": 895,
+    "compactBytesWithoutUser": 88451,
+    "invalidRows": 0,
+    "missingGameOverviews": 0,
+    "currentUser": "17-digit string verified; value withheld",
+    "mutations": "none; no wake, service, setting, screenshot or library changes; no device artifacts created",
+    "limits": "read-only CEF projection, not an official backend or worn-VR test"
+  },
+  "browser": {
+    "mode": "opaque iframe Chromium; detached real Frame snapshot replay; all backend/network actions denied",
+    "attempted": 116,
+    "initializerReady": 101,
+    "failed": 15,
+    "initializerGains": [
+      46,
+      53,
+      66
+    ],
+    "regressions": [],
+    "focused": [
+      {
+        "id": 37,
+        "name": "Discord Status",
+        "ready": true,
+        "error": null,
+        "logs": [],
+        "methods": [],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 46,
+        "name": "Steamback",
+        "ready": true,
+        "error": null,
+        "logs": [
+          {
+            "kind": "error",
+            "message": "TypeError: saveInfos.map is not a function"
+          }
+        ],
+        "methods": [
+          "set_account_id",
+          "get_saveinfos"
+        ],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 53,
+        "name": "Shotty",
+        "ready": true,
+        "error": null,
+        "logs": [],
+        "methods": [
+          "set_id_map_fronend"
+        ],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 66,
+        "name": "PlayTime",
+        "ready": true,
+        "error": null,
+        "logs": [
+          {
+            "kind": "error",
+            "message": "%c PlayTime %c ERROR  background: #16a085; color: black; background: #FF000040; Impossible to get \"RunningApps\" observe. Events will not be attached."
+          },
+          {
+            "kind": "error",
+            "message": "%c PlayTime %c ERROR  background: #16a085; color: black; background: #FF000040; Unable to get settings, saving defaults Error: Not found"
+          },
+          {
+            "kind": "error",
+            "message": "%c PlayTime %c ERROR  background: #16a085; color: black; background: #FF000040; Failed to set current user: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "%c PlayTime %c ERROR  background: #16a085; color: black; background: #FF000040; Error: Read-only compatibility audit: backend method blocked"
+          }
+        ],
+        "methods": [
+          "set_current_user",
+          "fetch_playtime_information",
+          "statistics_for_last_two_weeks",
+          "daily_statistics_for_period"
+        ],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 93,
+        "name": "Deck Settings",
+        "ready": true,
+        "error": null,
+        "logs": [
+          {
+            "kind": "error",
+            "message": "[decky-game-settings:AuthorFooter] Error fetching avatar image: Error: Decky proxy fetch is unavailable in Framey"
+          },
+          {
+            "kind": "error",
+            "message": "[decky-game-settings:GameSelectView] Error fetching installed games: Error: Read-only compatibility audit: live Steam API blocked"
+          }
+        ],
+        "methods": [],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 132,
+        "name": "SuggestMe",
+        "ready": true,
+        "error": null,
+        "logs": [
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load config: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load library status: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load play next list: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load excluded games: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load filter presets: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load history: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load non-steam info: Error: Read-only compatibility audit: backend method blocked"
+          },
+          {
+            "kind": "error",
+            "message": "[SuggestMe] Failed to load collections: Error: Read-only compatibility audit: backend method blocked"
+          }
+        ],
+        "methods": [
+          "log_message",
+          "get_config",
+          "get_library_status",
+          "get_play_next_list",
+          "get_excluded_games",
+          "get_filter_presets",
+          "get_suggestion_history",
+          "get_non_steam_games",
+          "get_collections",
+          "get_available_genres",
+          "get_available_tags",
+          "get_available_community_tags"
+        ],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 134,
+        "name": "Deck Progress Tracker",
+        "ready": true,
+        "error": null,
+        "logs": [],
+        "methods": [
+          "get_settings",
+          "get_tag_statistics"
+        ],
+        "library": "snapshot replay"
+      },
+      {
+        "id": 135,
+        "name": "Deck Shelves",
+        "ready": false,
+        "error": "Failed to resolve module specifier \"./chunks/pluginApi-B8sV7970.js\". Invalid relative url or base scheme isn't hierarchical.",
+        "logs": [],
+        "methods": [],
+        "library": "snapshot replay"
+      }
+    ]
+  },
+  "fakeFrame": {
+    "attempted": 116,
+    "installedRemoved": 60,
+    "expectedBlockers": 56,
+    "backendExecution": "stubbed",
+    "cleanup": "private Compose containers/network/volumes removed"
+  },
+  "localBackends": {
+    "timeUtc": "2026-10-26T02:18:51.848256+00:00",
+    "verification": "local Chromium + actual Decky 3.3.0 amd64, detached real Frame SSH snapshot; no worn VR",
+    "calls": [
+      {
+        "id": 46,
+        "method": "set_account_id",
+        "resultType": "dict",
+        "resultCount": 2
+      },
+      {
+        "id": 46,
+        "method": "get_saveinfos",
+        "resultType": "dict",
+        "resultCount": 2
+      },
+      {
+        "id": 66,
+        "method": "set_current_user",
+        "resultType": "NoneType"
+      },
+      {
+        "id": 66,
+        "method": "statistics_for_last_two_weeks",
+        "resultType": "list",
+        "resultCount": 0
+      },
+      {
+        "id": 66,
+        "method": "fetch_playtime_information",
+        "resultType": "list",
+        "resultCount": 0
+      },
+      {
+        "id": 66,
+        "method": "daily_statistics_for_period",
+        "resultType": "dict",
+        "resultCount": 3
+      },
+      {
+        "id": 66,
+        "method": "fetch_playtime_information",
+        "resultType": "list",
+        "resultCount": 0
+      },
+      {
+        "id": 66,
+        "method": "statistics_for_last_two_weeks",
+        "resultType": "list",
+        "resultCount": 0
+      }
+    ],
+    "runtime": {
+      "tag": "v3.3.0",
+      "name": "PluginLoader",
+      "digest": "sha256:e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181"
+    },
+    "legacyReadback": {
+      "plugin": 46,
+      "method": "get_saveinfos",
+      "replyType": 1,
+      "success": true,
+      "saveInfoCount": 0
+    }
+  },
+  "uiChecks": {
+    "Steamback": "Supported games panel, actual private backend set_account_id and get_saveinfos returned successfully; empty isolated Steam save data",
+    "PlayTime": "Statistics panel (empty database) and routed General settings/tabs rendered; actual private backend selected user and returned statistics",
+    "Deck Settings": "Installed game picker rendered real Frame install-folder/name snapshot; search modal rendered",
+    "Shotty": "Initializer repaired; actual Decky 3.3.0 backend fails importing unused click.get_app_dir: ModuleNotFoundError; no screenshot methods invoked"
+  },
+  "notVerified": [
+    "Real ARM64 official backends in this theme",
+    "Worn VR/controllers/keyboard",
+    "Live MobX or running-game observations",
+    "Steamback backups/restores and automatic notifications",
+    "PlayTime automatic recording, existing databases or account switches while panel remains open",
+    "Deck Settings remote reports/proxy fetch and settings changes",
+    "Shotty screenshot aggregation/rescue"
+  ],
+  "cleanup": {
+    "localContainer": "stopped/removed; docker ps -a matching name empty",
+    "headsetLockReleased": true,
+    "httpHelpers": "three task-local HTTP servers stopped"
+  },
+  "plugins": [
+    {
+      "id": 37,
+      "name": "Discord Status",
+      "version": "1.5.0",
+      "sha256": "00a45dd919abb6e050685e1e408ce8023b9c4a09d6e91ba528d50aed2a63bf45"
+    },
+    {
+      "id": 46,
+      "name": "Steamback",
+      "version": "1.0.0-1",
+      "sha256": "ed5f2fbb47cdfc3aa9a4349a139ab20c29976117a3be0de7e8a588bb265ee7f3"
+    },
+    {
+      "id": 53,
+      "name": "Shotty",
+      "version": "0.1.0",
+      "sha256": "ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe"
+    },
+    {
+      "id": 66,
+      "name": "PlayTime",
+      "version": "3.2.5",
+      "sha256": "10fc3beea48991c77cb02867e919b618d4cd6d5e9c6a6d0ccd5266c13214039f"
+    },
+    {
+      "id": 93,
+      "name": "Deck Settings",
+      "version": "1.2.6",
+      "sha256": "23c2a933a6883e2622f0184c33a76ce4a4e88c0a7dcd730f9bab71b8c3702132"
+    }
+  ],
+  "validation": {
+    "serverTests": 1617,
+    "serverSkips": 16,
+    "siteTests": 18,
+    "fakeFramePanel": "2 targeted panel/store flows passed; private Compose resources removed",
+    "focusedFrameyTests": 40
+  }
+}

docs/evidence/framey-library-context-2026-10-26.md

@@ -0,0 +1,72 @@
+# Framey detached Steam library context — 2026-10-26
+
+Framey now reads a bounded library snapshot before importing official frontends
+that reference `appStore`, `collectionStore` or `m_CurrentUser`. It supplies app
+IDs/names/types/game IDs, sorting/playtime scalars, the actual all-games
+collection and the current public Steam ID. It does not copy credentials,
+balances, account names, filesystem paths or executable Steam objects.
+
+The projection is a fixed, parameterless `GetLibrarySnapshot` read through the
+existing installed-store-plugin boundary. The parent checks the iframe source,
+session, method and empty argument list. The host validates rows before exposing
+detached Maps and lookup methods. Plugin patches remain local to that iframe.
+Missing or invalid data leaves the globals unavailable and logs a clear warning;
+there is no invented account or empty-library fallback. Reopening the panel
+refreshes the snapshot. Live MobX observations, account-switch notifications and
+running-game events are outside this change.
+
+Library-sized backend arguments now have a 256 KiB UTF-8 JSON budget. The old
+8 KiB ceiling rejected normal app-name maps. Payloads travel as quoted literals
+on SSH stdin, avoiding operating-system limits on a single command argument.
+Store receipt ownership, method validation and legacy keyword envelopes still
+apply. The library read has a separate 2 MiB / 10,000-app limit; other Steam
+reads retain their 256 KiB response limit.
+
+## Observations
+
+| Plugin | Verified behavior | Remaining limit |
+| --- | --- | --- |
+| Steamback 1.0.0-1 | Panel opens; account setup and empty save-list reads succeed through actual Decky 3.3.0 amd64 | Private container had no Steam saves. ARM64 backend, backup/restore and automatic hooks unverified. Partial. |
+| PlayTime 3.2.5 | Actual backend selects the user, returns empty statistics; statistics panel and routed settings/tabs render | No sessions were created. ARM64 backend, existing databases, live observations and automatic recording unverified. Partial. |
+| Deck Settings 1.2.6 | Installed game picker renders the real Frame folder/name snapshot; search modal opens | Remote reports/proxy fetch, settings changes and ARM64 backend unverified. Partial. |
+| Shotty 0.1.0 | Library-based initializer now completes | Exact backend fails importing `click.get_app_dir`: `ModuleNotFoundError: No module named 'click'`. Archive does not bundle it. Broken. |
+| Discord Status 1.5.0 | Detached overview lookups available | Live running-app observations and artwork helpers remain absent; Discord activity unverified. Broken. |
+
+Exact plugin versions/digests, runtime digest, scoped calls and counts are in the
+[redacted observations](framey-library-context-2026-10-26.json). The canonical
+table/store labels use the same digest-scoped JSON. None of these plugins is
+promoted to **works** by this pass.
+
+## Verification boundaries
+
+- **Real Frame SSH:** atomic `/tmp/frame-test.lock` acquisition for every probe,
+  matching-owner release in `finally`. Frame OS 0.5.6 ARM64 Steam CEF returned
+  1,106 apps and 895 game IDs; no missing collection members or invalid rows.
+  The compact library-only response was 88,451 bytes. Current-user field shape
+  was separately inspected. Values remain private; only aggregate counts are
+  published. No wake, power/service changes or device artifacts were needed.
+- **Local Chromium:** production `headset.html`, current host, opaque iframe and
+  unmodified digest-checked official frontends. Library/user and install-folder
+  data were detached snapshots read from the Frame, replayed locally. This is
+  not a deployed headset HTTP or worn-VR test.
+- **Actual local backends:** published Decky 3.3.0 amd64 executable, private
+  unprivileged container, network disabled, capabilities dropped, no devices,
+  host home, saves or Steam files mounted. Only account setup within private
+  plugin data and read methods were allowed. Backup, restore, aggregation,
+  screenshot rescue and game actions were denied. Shotty's import failure was
+  observed from the runtime log before invoking screenshot methods.
+- **Catalog regression:** 116 exact frontends attempted, 101 initializer-ready
+  and 15 failed, compared with 98 ready before this theme. Steamback, Shotty and
+  PlayTime gained initializer readiness; no previous ready state regressed.
+  Backend/network calls stayed denied in this sweep. Readiness alone does not
+  establish useful operation.
+- **Fake Frame:** 116 archive/transport cases; 60 install/remove cycles and 56
+  expected blockers. Official backend execution was stubbed. Its private
+  Compose containers, network and volumes were removed.
+
+The browser audit accepts `--library-snapshot /private/library.json` to reproduce
+the detached replay. This flag does not convert the audit into live Steam or
+backend evidence. Never commit personal library snapshots or account values.
+
+No worn-VR, physical controller, keyboard, automatic recording or backup claim
+is made. Further device backend checks still require the shared hardware lock.

docs/evidence/framey-localsend-arm64-2026-10-26.json

@@ -0,0 +1,97 @@
+{
+  "checkedAtUtc": "2026-10-26",
+  "plugin": {
+    "id": 125,
+    "name": "Decky Localsend",
+    "officialArchiveStatus": "x86_64; blocked; no substitutions or safeguard changes"
+  },
+  "source": {
+    "url": "https://github.com/MoYoez/LocalSend-Go",
+    "revision": "66edc509a28b9f877e7374504892dcbc653a4da4",
+    "license": "MIT",
+    "licenseUrl": "https://github.com/MoYoez/LocalSend-Go/blob/66edc509a28b9f877e7374504892dcbc653a4da4/LICENSE",
+    "pluginLicense": "BSD-3-Clause; distinct from the MIT helper",
+    "officialElfBuildInfo": "Go 1.25.7, CGO_ENABLED=0, GOARCH=amd64; no embedded VCS revision. Exact source correspondence unproven."
+  },
+  "build": {
+    "toolchain": "go1.25.7",
+    "environment": {
+      "GOTOOLCHAIN": "go1.25.7",
+      "CGO_ENABLED": "0",
+      "GOOS": "linux",
+      "GOARCH": "arm64"
+    },
+    "command": "go build -trimpath -o localsend-core .",
+    "elfMachine": 183,
+    "architecture": "aarch64",
+    "staticallyLinked": true,
+    "sha256": "e79238f6051ce34f172f765ae918d3d902b819e27377989a55e5b1eba10e46f9",
+    "rebuildSha256Matches": true
+  },
+  "realFrame": {
+    "os": "Frame OS 0.5.6 ARM64",
+    "sharedLockOwner": "kp0z857q58-live-steam-reads-20261026",
+    "helpExitCode": 0,
+    "officialBackendFlagsAllRecognized": true,
+    "helpFlags": [
+      "-doNotMakeSessionFolder",
+      "-log",
+      "-scanTimeout",
+      "-skipNotify",
+      "-useAlias",
+      "-useAutoSave",
+      "-useAutoSaveFromFavorites",
+      "-useConfigPath",
+      "-useDefaultUploadFolder",
+      "-useDownload",
+      "-useHttp",
+      "-useMultcastAddress",
+      "-useMultcastPort",
+      "-usePin",
+      "-useReferNetworkInterface",
+      "-useWebOutPath"
+    ],
+    "runtimeExitCode": 0,
+    "isolation": "unshare -Urn; loopback and private veth pair only; no external interface/default route",
+    "receiving": "-useAutoSave=false and -useAutoSaveFromFavorites=false; no upload/transfer requests",
+    "notifications": "-skipNotify",
+    "readOnlyRequest": "GET http://127.0.0.1:53317/api/localsend/v2/info",
+    "result": {
+      "ok": true,
+      "protocolVersion": "2.0",
+      "deviceType": "headless",
+      "responseKeys": [
+        "alias",
+        "deviceModel",
+        "deviceType",
+        "download",
+        "fingerprint",
+        "version"
+      ],
+      "aliasMatches": true
+    },
+    "cleanup": {
+      "helperExited": true,
+      "filesCreated": [
+        "config.yaml",
+        "helper.log"
+      ]
+    },
+    "privateDirectoryAbsent": true,
+    "servicesInstalledOrStarted": false,
+    "powerChanges": false,
+    "sharedLockReleasedAfterTests": true,
+    "independentReacquireAudit": "Deferred: another job had acquired the shared lock; it was left untouched. The helper process exited and TemporaryDirectory removal completed within the original locked probe."
+  },
+  "failedProbe": {
+    "interface": "loopback only",
+    "result": "Upstream rejects lo as a discovery interface and exits. Repeated with a veth pair wholly inside the private namespace; no source changes."
+  },
+  "unverified": [
+    "Exact source correspondence to shipped official ELF",
+    "Unmodified official Python backend invoking this ARM64 artifact",
+    "HTTPS, discovery on real network, pairing and file transfers",
+    "Framey frontend/proxy protocol integration",
+    "Worn VR/controller/keyboard"
+  ]
+}

docs/evidence/framey-localsend-arm64-2026-10-26.md

@@ -0,0 +1,57 @@
+# LocalSend ARM64 build and isolated Frame probe
+
+The official Decky Localsend archive remains **broken/blocked**: its helper is
+x86_64. A source rebuild is now proven to execute on the ARM64 Frame and answer
+the LocalSend 2.0 info endpoint. This is a core runtime result, not a working
+official-plugin or file-transfer claim. [Machine-readable evidence](framey-localsend-arm64-2026-10-26.json)
+records the exact scope and cleanup.
+
+## Reproduce the build
+
+The helper is MIT-licensed; the separate official Python plugin is BSD-3-Clause.
+Use the pinned helper source and retain its license for any redistribution.
+No binary is redistributed in Frame Control, and no installer digest or
+architecture safeguard was changed.
+
+```sh
+framey_build_dir=$(mktemp -d)
+git clone https://github.com/MoYoez/LocalSend-Go "$framey_build_dir/source"
+git -C "$framey_build_dir/source" checkout --detach 66edc509a28b9f877e7374504892dcbc653a4da4
+cd "$framey_build_dir/source"
+env GOTOOLCHAIN=go1.25.7 CGO_ENABLED=0 GOOS=linux GOARCH=arm64 \
+  go build -trimpath -o "$framey_build_dir/localsend-core" .
+sha256sum "$framey_build_dir/localsend-core"
+```
+
+Two builds produced the same static aarch64 ELF SHA-256:
+`e79238f6051ce34f172f765ae918d3d902b819e27377989a55e5b1eba10e46f9`.
+The official ELF uses Go 1.25.7 too, but embeds no VCS revision, so the exact
+source correspondence is still unproven. The rebuilt helper recognizes every
+CLI flag supplied by the official Python backend.
+
+## Real Frame scope
+
+Tests ran under the normal atomic `/tmp/frame-test.lock` with a private temporary
+directory. `-h` exited before configuration or networking. For the health probe,
+`unshare -Urn` created a private user/network namespace with loopback and a veth
+pair entirely inside it: no external interface or default route. The veth used
+the documentation-only `192.0.2.1/24` address. Upstream rejects a loopback-only
+discovery interface, which is why the second isolated attempt used a veth.
+
+The helper used a private config/upload path, `-skipNotify`,
+`-useAutoSave=false`, `-useAutoSaveFromFavorites=false`, `-useHttp=true`,
+`-useReferNetworkInterface probe0` and `-scanTimeout 1`. The test client sent only
+`GET /api/localsend/v2/info` over loopback; it returned version `2.0`, device type
+`headless` and the private test alias. No upload, transfer, pairing or external
+discovery request ran. The helper exited; its private config/log and executable
+directory were removed; no service or power setting changed. The lock was
+released. An independent cleanup reacquisition found another job's lock and
+left it alone; cleanup success comes from the original probe's process wait and
+temporary-directory exit, not that deferred audit.
+
+Before enabling an ARM64 official package, verify the unmodified Python backend
+and frontend/proxy protocol with this source revision, then HTTPS, discovery and
+an explicitly safe private transfer. The official store must publish a matching
+ARM64 archive or Frame Control must gain a separately reviewed, digest-scoped
+build/package path. Compiling the core does not justify accepting the current
+x86 archive or marking the full plugin works.

docs/evidence/framey-module-lookup-2026-10-26.json

@@ -0,0 +1,222 @@
+{
+  "schemaVersion": 1,
+  "timeUtc": "2026-10-26T03:29:05.328492+00:00",
+  "baseCommit": "c89ddff",
+  "scope": "Finite Framey-local DFL component/CSS registry and explicit unsupported optional UI-audio export",
+  "upstreamReferences": [
+    "https://github.com/SteamDeckHomebrew/decky-frontend-lib/blob/main/src/webpack.ts",
+    "https://github.com/SteamDeckHomebrew/decky-frontend-lib/blob/main/src/class-mapper.ts"
+  ],
+  "plugins": [
+    {
+      "id": 16,
+      "name": "Audio Loader",
+      "version": "1.6.1",
+      "sha256": "fd5a090c2e2cd4da6723d7bd08937ab31b9f8d4663510431713da531343e303f",
+      "status": "broken",
+      "reason": "This plugin needs root and is not supported by the Frame user service. Steam UI sound lookup is present as explicitly unsupported; the frontend still requires Steam m_GamepadUIAudioStore.m_AudioPlaybackManager, which is unavailable in the isolated panel.",
+      "browser": {
+        "id": 16,
+        "name": "Audio Loader",
+        "ready": false,
+        "error": "Cannot read properties of undefined (reading 'm_AudioPlaybackManager')",
+        "logs": [
+          {
+            "kind": "warn",
+            "message": "Resolve failed: [object Object] promise [object Promise]"
+          }
+        ],
+        "methods": [
+          "store_read"
+        ]
+      }
+    },
+    {
+      "id": 36,
+      "name": "SteamGridDB",
+      "version": "1.8.1",
+      "sha256": "e84f5b1f111af8862b06218479491fbf61036e1bfd9f16f93f9901e9b9ebc5e0",
+      "status": "broken",
+      "reason": "Local module mapping is available; frontend still requires the Steam LibraryContextMenu implementation, which has no target in the isolated Framey panel.",
+      "browser": {
+        "id": 36,
+        "name": "SteamGridDB",
+        "ready": false,
+        "error": "Cannot convert undefined or null to object",
+        "logs": [],
+        "methods": []
+      }
+    },
+    {
+      "id": 61,
+      "name": "TabMaster",
+      "version": "2.15.1",
+      "sha256": "e08333859a32b0c177b8e9a7959c5eeeafe38f946578f7f1d161c721f0e05da5",
+      "status": "partial",
+      "reason": "Local Chromium rendered the QAM and navigable Overview/Filters documentation with an actual Decky 3.3.0 amd64 backend. Library-tab editing remains unavailable: Steam login/library patches and MobX reactions have no target. ARM64 and worn VR unverified.",
+      "browser": {
+        "id": 61,
+        "name": "TabMaster",
+        "ready": true,
+        "error": null,
+        "logs": [
+          {
+            "kind": "error",
+            "message": "%c TabMaster %c ERROR %c background: #ff6d05; color: black; background: #c70808; color: black; background: transparent; Could not find mobx.reaction"
+          }
+        ],
+        "methods": [
+          "log_message"
+        ]
+      }
+    },
+    {
+      "id": 84,
+      "name": "Junk-Store",
+      "version": "1.1.13",
+      "sha256": "f7ad2a0103c85bf308929b2e96ec9aeeb0d76bcc6ae97eb1e4b5f31ffba0cbb1",
+      "status": "broken",
+      "reason": "Local CSS lookup fixes the loading view crash. Actual Decky 3.3.0 amd64 startup/static InitActions return a script execution/JSON error; the published scripts are not executable after extraction. Store install/login/game launch and ARM64 remain unverified.",
+      "browser": {
+        "id": 84,
+        "name": "Junk-Store",
+        "ready": true,
+        "error": null,
+        "logs": [],
+        "methods": [
+          "fetch_rss_feed",
+          "execute_action"
+        ]
+      }
+    },
+    {
+      "id": 102,
+      "name": "DeckSP",
+      "version": "1.1.3",
+      "sha256": "d6cbedcd64430e1f94a2b12caf936ba270f1ceafe77c6252808ff39c88640b40",
+      "status": "broken",
+      "reason": "Optional UI-audio lookup succeeds, but the published frontend raises \"Cannot access PluginManager before initialization\" when Steam MobX reaction lookup is unavailable. JamesDSP installation/audio routing and ARM64 remain unverified.",
+      "browser": {
+        "id": 102,
+        "name": "DeckSP",
+        "ready": false,
+        "error": "Cannot access 'PluginManager' before initialization",
+        "logs": [],
+        "methods": []
+      }
+    }
+  ],
+  "fullCatalogFrontend": {
+    "attempted": 116,
+    "ready": 102,
+    "failed": 14,
+    "previousReady": 101,
+    "newlyReady": [
+      61
+    ],
+    "regressions": [],
+    "backendAndNetworkDenied": true,
+    "library": "Private detached real Frame snapshot replay, not live Steam or backend verification"
+  },
+  "focusedBrowser": {
+    "host": "Actual ui/headset.html, React 18.3.1, opaque allow-scripts iframe, exact official bundles",
+    "installedPluginAndStatusResponses": "Fixture-shaped; no headset HTTP endpoint exercised",
+    "backend": "Actual official Decky 3.3.0 amd64 in unprivileged network-none container; no host audio/device/data mounts",
+    "deckySha256": "e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181",
+    "allowedMethods": {
+      "TabMaster": [
+        "log_message",
+        "get_setting",
+        "get_users_dict",
+        "get_tags"
+      ],
+      "Junk-Store": [
+        "execute_action only init/InitActions"
+      ]
+    },
+    "checks": [
+      "TabMaster QAM renders; library editing controls remain disabled",
+      "TabMaster Open Docs -> Overview renders",
+      "TabMaster Filters tab renders",
+      "Back to plugin returns to QAM",
+      "Junk-Store static InitActions via real backend returns Type Error; not promoted"
+    ],
+    "denied": [
+      "External RSS/network",
+      "Other execute_action arguments",
+      "Login, installation, game launch, library patching, audio playback"
+    ],
+    "directBackendReads": {
+      "TabMaster.get_setting": "default string returned",
+      "TabMaster.get_users_dict": {},
+      "TabMaster.get_tags": [],
+      "Junk-Store.scriptMode": "0644, Python shebang present"
+    }
+  },
+  "headset": {
+    "newPluginDeviceExecution": false,
+    "lockProbe": "Normal atomic lock acquired/released for read-only dependency availability probe; no service or power changes",
+    "ARM64OfficialBackend": "Not exercised in this theme",
+    "wornVR": false
+  },
+  "verification": {
+    "frameyTests": 42,
+    "fullServerTests": {
+      "count": 1620,
+      "skipped": 16,
+      "result": "OK"
+    },
+    "siteTestFilesPassed": 2,
+    "fakeFrame": {
+      "attempted": 116,
+      "installedRemoved": 60,
+      "expectedBlockers": 56,
+      "backendExecuted": false,
+      "privateProject": "framey-catalog-6456d3d939",
+      "projectRemoved": true,
+      "baseCommit": "c89ddff"
+    }
+  },
+  "storeRefresh": {
+    "timeUtc": "2026-10-26T03:29:46.606326+00:00",
+    "currentCount": 116,
+    "pinnedCount": 116,
+    "unchanged": true,
+    "changedIds": []
+  },
+  "postMainMerge": {
+    "mainCommit": "38c388f",
+    "mergedPRs": [
+      286,
+      287,
+      288
+    ],
+    "frameyTests": 43,
+    "fullCatalogFrontend": {
+      "attempted": 116,
+      "ready": 103,
+      "failed": 13,
+      "additionalReadyFromUpstream": [
+        135
+      ],
+      "regressionsComparedWithPreMergeAudit": []
+    },
+    "catalog": {
+      "works": 1,
+      "partial": 50,
+      "broken": 54,
+      "na": 11
+    },
+    "fullServerTests": {
+      "count": 1621,
+      "skipped": 16,
+      "result": "OK"
+    }
+  },
+  "cleanup": {
+    "focusedBackendContainerAbsent": true,
+    "loopback18770Closed": true,
+    "loopback18771Closed": true,
+    "fakeProjectAndVolumesRemoved": true
+  }
+}

docs/evidence/framey-module-lookup-2026-10-26.md

@@ -0,0 +1,64 @@
+# Framey-local module lookup: official plugin checks
+
+TabMaster 2.15.1 now renders its QAM and bundled documentation in local Chromium.
+Opening its docs, selecting Overview and Filters, and returning to the panel
+passed. Its status moves from **broken to partial**: library editing controls
+remain disabled because Steam login, live MobX reactions and library-page
+patches are unavailable. This is not working library-tab customization.
+
+The [observations](framey-module-lookup-2026-10-26.json) pin each tested official
+archive and the actual Decky 3.3.0 amd64 binary. The complete current official
+store was refreshed: all 116 IDs, versions and digests match the catalog.
+
+| Plugin | Result | Remaining limitation |
+| --- | --- | --- |
+| TabMaster 61 | Partial: QAM and documentation navigation render | Steam library editing unavailable; ARM64 and worn VR unverified |
+| Junk-Store 84 | Loading and backend-error views render without the CSS lookup crash | Actual startup/static InitActions return an execution/JSON error; extracted scripts lack executable permission; remains broken |
+| SteamGridDB 36 | Module mapping is callable | Still needs Steam's LibraryContextMenu implementation; remains broken |
+| DeckSP 102 | Optional UI-audio lookup succeeds | Published bundle accesses PluginManager before initialization when MobX reaction is absent; remains broken |
+| Audio Loader 16 | Optional UI-audio lookup succeeds | Still requires Steam's mutable audio playback store; remains broken |
+
+## What ran
+
+The host exposes a finite registry of its own components and styled CSS maps,
+with DFL module/export/class lookup and mapping semantics. Unknown matches return
+undefined or an empty mapping. An optional audio export explicitly reports
+unavailable; invoking playback throws. No Steam webpack cache, function-source
+signature, audio store or library patch was manufactured.
+
+The full exact-bundle browser pass ran with backend and network calls denied.
+It completed 102 initializers and failed 14, versus 101/15 before this theme.
+Initializer readiness alone does not establish rendered or useful behavior.
+After integrating main’s #286/#287/#288, all 116 were retried: 103 initializers
+completed and 13 failed. The additional completion is Deck Shelves from #286;
+no previously completed initializer regressed.
+
+Focused checks used actual `ui/headset.html`, React 18.3.1 and opaque
+`allow-scripts` iframes. Status/installed-plugin responses were fixture-shaped,
+and the private detached library snapshot from the earlier Frame SSH check was
+replayed. The relay allowed only TabMaster log/settings reads and Junk-Store's
+static `init/InitActions` action. TabMaster's official backend returned the
+default setting, empty users dictionary and empty tags. Junk-Store returned a
+structured Type Error, which its panel displayed. RSS/network, login, installs,
+launch actions and other backend methods were denied.
+
+The unmodified Python backends ran in actual Decky 3.3.0 inside a disposable
+unprivileged amd64 container with no network, host audio, devices or user-data
+mounts. This bypasses Steam CEF and is not a headset HTTP/RPC check. The normal
+headset lock was briefly acquired and released for read-only dependency/service
+availability; no official plugin ran there in this theme. No ARM64 or worn-VR
+result is claimed.
+
+## Regression checks
+
+- 1,621 server tests passed, 16 skipped; all 43 focused Framey tests passed
+  after integrating the latest main.
+- Both site test files passed.
+- All 116 exact archives passed the fake-Frame audit: 60 install/remove flows
+  and 56 expected blockers. Official backend execution remained stubbed.
+- The unique fake-Frame project and its volumes were removed. The focused
+  backend container and both loopback helpers were removed after the checks.
+
+The catalog and generated compatibility table use the same status/reasons as
+both store views. The result is **1 works / 50 partial / 54 broken / 11 N/A** (including main’s independent Deck Shelves improvement);
+the majority goal remains open.

docs/evidence/framey-music-control-bound-methods-2026-10-26.md

@@ -0,0 +1,34 @@
+# Music Control 1.1.7 bound-method compatibility, 26 October 2026
+
+The official Decky store archive for ID 111, version 1.1.7, is
+`3f56a3f56034b277ea74a2c37cc84133b69e382aa6bcb0b43876776aac737ed9`
+(SHA-256). The pinned `tests/fixtures/framey-official/111.zip` matches that
+digest and includes the upstream license.
+
+The unchanged backend fails before it reaches D-Bus: `sp_list_media_players`
+raises `TypeError: Plugin._get_dbus_env() takes 1 positional argument but 2
+were given`, and `sp_play` raises the corresponding `_sp_player_dbus` argument
+error. The source passes `self` explicitly to methods already bound by Python.
+
+For this exact store ID, archive digest and folder, a managed install removes
+the redundant argument at the five affected call sites. It checks the number
+of occurrences before writing `main.py` and records
+`music-control-bound-methods` in the managed receipt. The original ZIP remains
+the verified download; the older ID 12 archive is installed without this
+change.
+
+`test_exact_music_control_backend_calls_work_after_managed_install` installs
+the official ZIP through the production transaction script into a disposable
+home. It imports the patched backend and exercises player enumeration,
+selection, play/pause, next/previous, volume and playback-status calls against
+a private fake `dbus-send` executable that records the actual command
+arguments. It then removes the plugin through the receipt-bound transaction.
+The same test confirms ID 12 retains its original backend source. The focused
+store suite passed **23/23** tests locally. The pinned frontend/fake-Frame
+install/remove tests are part of the hosted gate.
+
+This proves that the Python argument mismatch no longer prevents backend
+command dispatch in the isolated fixture. The fixture is not an MPRIS player.
+Actual Decky 3.3.0 ARM64 execution, live player discovery, media transport,
+volume effects, album-art routing, and wearer-visible VR controls have not
+been verified. Music Control remains **partial**.

docs/evidence/framey-official-backend-2026-10-25.json

@@ -0,0 +1,66 @@
+{
+  "timeUtc": "2026-10-25T23:35:22.022586+00:00",
+  "method": "Real Frame ARM64 Decky 3.3.0, isolated removable user service; explicit read-only plugin methods only",
+  "plugins": [
+    {
+      "id": 14,
+      "version": "1.3.4",
+      "sha256": "90a3453ac02709cad64096e7539fd8141fa56f99ae3441fc24a4990dc9684358",
+      "method": "get_setting",
+      "result": {
+        "result": "default"
+      },
+      "errors": [
+        "Transient CEF reconnect during Decky frontend injection; succeeded on retry."
+      ]
+    },
+    {
+      "id": 123,
+      "version": "1.2.3",
+      "sha256": "9053308e04a74f44745b45b9f4f50af3673348d367e7b14bacc5677de707ac4e",
+      "method": "get_settings",
+      "result": {
+        "keys": [
+          "enable_notification_antiflood",
+          "enable_notifications",
+          "gateway_api_key",
+          "gateway_url",
+          "refresh_interval_seconds",
+          "show_history",
+          "show_regions",
+          "show_trending_games"
+        ],
+        "defaultRefreshInterval": 120
+      },
+      "errors": []
+    }
+  ],
+  "before": {
+    "battery": [
+      100
+    ],
+    "deckyService": "inactive",
+    "panelService": "inactive"
+  },
+  "service": {
+    "created": true
+  },
+  "decky": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+  },
+  "passed": true,
+  "cleanup": {
+    "baseAbsent": true,
+    "unitAbsent": true
+  },
+  "after": {
+    "battery": [
+      99
+    ],
+    "deckyService": "inactive",
+    "panelService": "inactive"
+  },
+  "lockReleased": true,
+  "cleanupErrors": []
+}

docs/evidence/framey-receipt-live-2026-10-26.md

@@ -0,0 +1,11 @@
+# Framey receipt guard, unworn Frame exercise (26 October 2026)
+
+The bounded `scripts/framey-vr-check.py --exercise` runner acquired `/tmp/frame-test.lock` with its own random owner before reading the real Frame. Its 05:26 UTC run used source commit `c2f94c242dac670e18259193311a7375f5a87942`. Preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. No wearer was confirmed.
+
+The temporary Frame Control dashboard overlay became visible to OpenVR. The stereo compositor image changed, and the `/dev/video99` mirror produced a frame. The sample settings panel displayed its stored off value, accepted a trusted synthetic OpenVR pointer event, saved on through the real Decky Python backend, read the setting from disk, and showed on after a fresh iframe reopen. The quick action read on. A native slider reached 50. Text entry used CDP after OpenVR focus. The runner exited 0 with `input.passed=true` and `compositorChanged=true`.
+
+The private capture files remain outside the repository at `/tmp/frame-pr301-unworn-vr-fixed/`. The before/after stereo SHA-256 values were `1683bf1dab70c1a0a1e8f313c8317dc04f992070b5b0de232de9008700130711` and `684a27eecf7bcbbc5308092ddbb1517c4596fb283e061e73dd6bb7f025954e8b`; the mirror frame SHA-256 was `5939149ea9c85fd2d86d3f8879c348f006c421a386bd66a93fe`. Room pixels are not committed.
+
+An earlier locked run at 05:24 UTC exposed a missing SHA-256 in the runner's temporary sample receipt: the new guard correctly asked to reopen the panel. Commit `c2f94c2` gives that sample a content digest; the second run passed. Both runs reported no cleanup errors, restored `power.pauseCompositorOnStandby=false` and `power.turnOffScreensTimeout=5`, removed their power recovery timers, and released only their own locks. Battery remained 99%.
+
+This is an **unworn sample-plugin result**. It does not prove wearer-visible pixels, physical controller input, native scrolling (the attempted scroll offset stayed 0), VR keyboard behavior, comfort, or any official Decky plugin's VR panel or backend. The hourly worn check remains enabled.

docs/evidence/framey-running-context-2026-10-26.md

@@ -0,0 +1,101 @@
+# Running-game context and Discord Status, 2026-10-26
+
+Framey now projects running apps and the selected main app from Steam CEF into
+detached `SteamUIStore` / `DFL.Router` getters. It relays actual Steam lifetime
+callbacks while the panel is open. Public Steam CDN capsule URLs are projected
+for running apps; local artwork paths and URL query data never cross the bridge.
+The [machine-readable evidence](framey-running-context-2026-10-26.json) records
+the exact archives, fixtures, browser observations and cleanup results.
+
+| Plugin / scope | Result | Verification |
+| --- | --- | --- |
+| Discord Status 1.5.0 | **Broken → partial.** Disconnected panel renders; activity construction accepts the synthetic running game without the previous missing-store/artwork errors. | Exact unmodified official frontend in opaque Chromium iframe; backend/network denied. Actual official `is_connected` returns false in real Decky 3.3.0 ARM64, with no Discord IPC present. |
+| Pause Games | **Partial.** Running-list initialization reaches `pid_from_appid` for the synthetic game. | Local Chromium fixture; all backend calls, including settings writes and process actions, denied. |
+| Notebook | **Works for its previously verified default notebook scope.** Per-game context is now supplied, but real per-game selection remains unverified. | Synthetic game causes the official frontend to request `loadPage`; backend calls denied in this pass. Earlier default save/reopen ARM64 evidence remains separate. |
+| PlayTime | **Partial.** Running snapshots do not satisfy its private MobX observation. | Local Chromium explicitly logs that its running-app observer is unavailable. No automatic tracking claim. |
+| 14 other focused panels | Labels retained. Initialization alone does not establish backend functionality. | Exact frontends with synthetic nonempty running/library snapshots and backend/network denied; Game Sync still stops on the denied `get_config` read. |
+
+The bridge addresses a shared dependency detected in 34 official frontend
+bundles, including hardware-inapplicable plugins whose installation remains
+blocked. This is infrastructure coverage, not 34 working plugins. Catalog after
+this pass: **3 works / 49 partial / 53 broken / 11 N/A**.
+
+## Real Frame checks and cleanup
+
+Every device probe acquired the atomic `/tmp/frame-test.lock` and released only
+its matching owner. Read-only probes verified the actual RunningApps and
+MainRunningApp getter implementations, the lifetime API's object with an
+`unregister()` method, and a public `https://shared.steamstatic.com` capsule URL.
+
+A private removable user service ran the published Decky 3.3.0 ARM64 executable
+and the exact unmodified Discord Status 1.5.0 store archive. Production
+`framey_panel.call_method` returned false from `is_connected`. Production
+`poll_running` verified two empty running-list reads, an actual lifetime
+subscription and explicit close. The device had no running apps: **nonempty
+reads and launch/exit callbacks were not observed on hardware**. Decky startup
+reinjected its frontend/restarted Steam CEF. No plugin game, power, audio or process-control
+action was invoked, and no Discord connection/activity mutation was allowed.
+
+After close, CEF reported zero sessions and a null timer. The test service,
+unit and private base were removed. A fresh independently locked audit read
+`LoadState=not-found`, `ActiveState=inactive`, `MainPID=0`, absent paths and zero
+CEF sessions/timers. Battery stayed **99 → 99**; normal Decky stayed failed and
+the normal panel service stayed inactive. No headset wipe or system service
+installation was used.
+
+## Local verification and limits
+
+- Full current official store fetch: 116 IDs/versions/digests unchanged at
+  2026-10-26 05:18:22 UTC.
+- Fake Frame: 116 transport cases, 60 install/remove cycles and 56 expected
+  blockers; private Compose project and volumes removed. Plugin execution was
+  stubbed.
+- Full local Chromium sweep: 103 of 116 initializer-ready with explicitly
+  synthetic library/running data. No backend/network request was allowed.
+  The focused Discord Status observation lasted eight seconds and constructed
+  `Test Running Game` activity; the visible UI correctly remained disconnected.
+- Node contract tests cover actual-event queue projection, retry/deduplication,
+  bounds, expiry, unregister, reconnect, update-before-callback ordering,
+  invalid data, public-artwork filtering, stale sessions, overlapping reads,
+  failure clearing stale state and late replies after close. Nonempty app rows
+  and launch/exit notifications in these tests are explicit synthetic fixtures.
+
+The queue retains at most 64 real notifications per session; overflow can lose
+old callbacks. Polling runs about every two seconds with no overlap. At most four
+CEF sessions survive; unreachable cleanup expires after 15 seconds, checked
+every five seconds. The bridge does not implement private MobX internals,
+suspend/input events, game actions or closed-panel automation.
+
+Discord shortcut detection, real IPC connection/activity, local custom artwork,
+actual running-game transitions, worn VR and physical controller/keyboard use
+remain unverified. None of the new fixture checks promotes a plugin to works.
+
+After #301 merged, running polls and both close paths adopted its pinned SHA-256
+receipt guard. Local Python/Node tests verify the parent carries that receipt,
+missing/stale receipts are rejected before CEF after plugin replacement, and a
+reopened panel can poll and close with the new receipt. Rejected stale closes
+retain the tested finite-lease cleanup. This authorization-only follow-up did
+not repeat the device checks above; their recorded hardware scope is unchanged.
+
+## Post-merge unworn panel exercise
+
+On merged main `daee952873255b86018cce1d2a4d3bd070ec4341`,
+`scripts/framey-vr-check.py --exercise --output /tmp/framey-post304-exercise`
+acquired its own `/tmp/frame-test.lock` before any headset read. At 05:54 UTC,
+preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%.
+The temporary sample panel passed the real Decky setting save and fresh-iframe
+reopen, a trusted synthetic OpenVR pointer, quick action, slider value 50 and
+CDP text entry after OpenVR focus. Stereo compositor SHA-256 changed from
+`50fcab1ee25e6d9398106cc0c24ec6616e07bcf4573b52be1774c715b756060b`
+to `98241806fb1f775e7f4c5ef0b0564bfd3c552ee896ff225b4d0cb5b7b53f70d1`;
+the `/dev/video99` mirror capture hash was
+`c284c05f86b60362168c1d1f58fe775974b70ac54bbfd57834802b892eb4509e`.
+The command exited 0 with `passed=true`. The original power values (`false` and
+`5.000000`) were read back, battery remained 99%, the recovery timer was removed,
+cleanup errors were empty and the run released only its own lock. The private
+full report is `/tmp/framey-post304-exercise/result.json` on the test host.
+
+This exercise covered the sample panel path after the running-context merge. It
+did not observe a nonempty running-game list, a game lifetime callback, Discord
+activity, a worn display or physical controller input. Synthetic native scroll
+again did not move (`scrollTop=0`, no wheel event).

docs/evidence/framey-script-entrypoints-2026-10-26.json

@@ -0,0 +1,184 @@
+{
+  "checkedAtUtc": "2026-10-26T07:22:08.822239+00:00",
+  "plugin": {
+    "id": 84,
+    "name": "Junk-Store",
+    "version": "1.1.13",
+    "sha256": "f7ad2a0103c85bf308929b2e96ec9aeeb0d76bcc6ae97eb1e4b5f31ffba0cbb1",
+    "license": "BSD-3-Clause",
+    "sourceModified": false
+  },
+  "installer": {
+    "beforeScriptMode": "0644",
+    "afterScriptMode": "0744",
+    "policy": "Add owner execute for a shebang or ZIP-declared executable; do not restore archive privilege/write bits. Existing installs require update or reinstall."
+  },
+  "isolatedBackend": {
+    "runtime": "published Decky 3.3.0 amd64",
+    "loaderSha256": "e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181",
+    "isolation": [
+      "unprivileged",
+      "no network",
+      "no devices",
+      "no capabilities",
+      "read-only root",
+      "private tmpfs home and tmp"
+    ],
+    "beforeInit": {
+      "result": {
+        "Type": "Error",
+        "Content": {
+          "Message": "Error parsing json result Expecting value: line 1 column 1 (char 0)",
+          "Data": "",
+          "ActionName": "init",
+          "ActionSet": "init"
+        }
+      },
+      "success": true
+    },
+    "afterInit": {
+      "result": {
+        "Type": "Success",
+        "Content": {
+          "Message": "Initialized"
+        }
+      },
+      "success": true
+    },
+    "beforeInitActions": {
+      "result": {
+        "Type": "Error",
+        "Content": {
+          "Message": "Error parsing json result Expecting value: line 1 column 1 (char 0)",
+          "Data": "",
+          "ActionName": "InitActions",
+          "ActionSet": "init"
+        }
+      },
+      "success": true
+    },
+    "afterInitActions": {
+      "outerSuccess": true,
+      "innerType": "ActionSet",
+      "setName": "MainMenu",
+      "actionCount": 4
+    }
+  },
+  "realFrame": {
+    "os": "Frame OS 0.5.6",
+    "arch": "aarch64",
+    "uid": 1000,
+    "decky": {
+      "version": "v3.3.0",
+      "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+    },
+    "transport": "existing trusted SSH via lxso2",
+    "sharedLock": true,
+    "service": "private removable user service; not enabled; RuntimeMaxSec=600",
+    "installedWithProductionApply": true,
+    "scriptMode": "0o744",
+    "legendaryInstalled": false,
+    "backendMethods": [
+      "execute_action",
+      "get_websocket_port"
+    ],
+    "staticActions": [
+      "JunkStoreActions/GetContent",
+      "JunkStoreActions/GetEpicActions",
+      "MainMenu/GetContent",
+      "MainMenu/JunkStoreInit",
+      "init/InitActions"
+    ],
+    "websocketPort": 8765,
+    "websocketCommandsSent": false,
+    "librarySnapshotCounts": {
+      "apps": 1106,
+      "games": 895
+    },
+    "explicitInitActionInvoked": false,
+    "normalDeckyBeforeAfter": [
+      "inactive",
+      "inactive"
+    ],
+    "normalPanelBeforeAfter": [
+      "inactive",
+      "inactive"
+    ],
+    "batteryBeforeAfter": [
+      [
+        99
+      ],
+      [
+        100
+      ]
+    ],
+    "powerSettingChanged": false,
+    "cleanup": {
+      "baseAbsent": true,
+      "unitAbsent": true
+    },
+    "lockReleased": true
+  },
+  "localBrowser": {
+    "runtime": "local Chromium, real headset.html/framey-host.js, vendored React, official frontend in opaque iframe",
+    "backend": "production receipt-bound bridge to actual ARM64 backend",
+    "steamLibrary": "production receipt-bound GetLibrarySnapshot; only counts retained",
+    "outerStatusInstallResponses": "fixtures",
+    "passed": [
+      "Custom Stores main menu and Games/News/About navigation items render",
+      "Games route opens static Epic tab",
+      "Back returns to main menu",
+      "close/reopen returns to main menu"
+    ],
+    "remainingFailure": "About: Cannot read properties of undefined (reading 'installed'); detached app overview lacks local_per_client_data.installed",
+    "deniedActions": [
+      "fetch_rss_feed",
+      "EpicActions/GetContent"
+    ],
+    "denialIsNotBackendFailure": true
+  },
+  "cleanupAudit": {
+    "attempts": 3,
+    "allPrivateBasesAbsent": true,
+    "allPrivateUnitsAbsent": true,
+    "allArchivesAbsent": true,
+    "allServicesInactive": true,
+    "freshAuditLockReleased": true
+  },
+  "verification": {
+    "python": {
+      "run": 1628,
+      "skipped": 16,
+      "failures": 0
+    },
+    "site": {
+      "passed": 18
+    },
+    "focusedStore": {
+      "passed": 19
+    },
+    "fakeFrame": {
+      "blocked": 56,
+      "installed-removed": 60
+    },
+    "officialStore": {
+      "plugins": 116,
+      "errors": 0,
+      "identitySetUnchanged": true,
+      "checkedAtUtc": "2026-10-26T07:22:17.371046+00:00"
+    },
+    "staticEntrypointArchives": 28
+  },
+  "unverified": [
+    "Legendary dependency installation",
+    "Epic login",
+    "game listing",
+    "game downloads or launch",
+    "RSS feed",
+    "Steam shortcut mutation",
+    "optional websocket operations",
+    "deployed headset HTTP endpoint",
+    "worn VR"
+  ],
+  "status": "partial"
+}

docs/evidence/framey-script-entrypoints-2026-10-26.md

@@ -0,0 +1,76 @@
+# Executable script entrypoints: Junk-Store
+
+Junk-Store 1.1.13 (official ID 84) moves **broken → partial**. The exact unmodified
+BSD-3-Clause archive is pinned in the [redacted results](framey-script-entrypoints-2026-10-26.json).
+No ARM64 rebuild or upstream plugin source patch was needed.
+
+Python ZIP extraction drops execute permissions. This archive also publishes its
+shebang scripts as 0644, relying on upstream Decky's recursive permission setup.
+Framey's user service disables that setup. Direct script calls therefore fail.
+The installer now adds **owner execute only** to shebang scripts or ZIP-declared
+executables. It does not restore archive privilege/write bits, grant group/other
+execute, or change unmarked data permissions. Archive validation and installation
+blocks remain in place. Existing installations need update/reinstall for repair.
+
+The upstream comparison is Decky 3.3.0's
+[permission setup](https://github.com/SteamDeckHomebrew/decky-loader/blob/v3.3.0/backend/decky_loader/browser.py)
+and [Linux implementation](https://github.com/SteamDeckHomebrew/decky-loader/blob/v3.3.0/backend/decky_loader/localplatform/localplatformlinux.py).
+Static inspection found 28 accepted official archives with shebang or declared
+executable members. This is shared installer coverage, not 28 functional claims.
+
+## Before and after in an isolated real backend
+
+Both runs used the exact official plugin and published Decky 3.3.0 amd64, with no
+network/devices/capabilities, a read-only root and private temporary home/tmp.
+The only difference was the production installer before/after this change.
+
+| Check | Before | After |
+| --- | --- | --- |
+| `scripts/get-json.py` | 0644 | 0744 |
+| `execute_action(init, init)` | inner `Type:Error`, empty output / JSON parse error | `Type:Success`, `Initialized` |
+| `execute_action(init, InitActions)` | inner `Type:Error` | `Type:ActionSet`, `MainMenu`, four actions |
+
+The legacy wrapper reports `success:true` even for the failing inner error.
+Startup log text alone is also insufficient: the baseline emits initialized/started
+messages despite those errors. Both private containers were removed.
+
+## Real ARM64 Frame and local Chromium
+
+Under the shared headset lock, the patched production installer installed the
+official archive into a private, bounded, removable Decky 3.3.0 ARM64 user service
+on Frame OS 0.5.6. The service was not enabled. Legendary was absent before and
+after; no dependency installer, login, download, launch or websocket command ran.
+
+The production receipt-bound bridge called the actual backend through live Steam
+CEF. Static action sets, main-menu content and the Epic action set returned real
+results. `get_websocket_port` returned 8765. Explicit `init/init` success was tested
+in the isolated amd64 backend; it was not explicitly invoked in the final Frame run.
+
+Local Chromium ran the actual Framey host and official frontend in an opaque
+iframe, relaying only allowed static calls to that ARM64 backend. Main menu,
+Games → static Epic tab, Back and fresh close/reopen passed. Steam library reads
+used the production receipt-bound bridge; only counts were retained. Outer
+status/install responses were fixtures, and the deployed headset HTTP endpoint
+was not tested.
+
+The About route still crashes on missing `local_per_client_data.installed` in
+the detached app overview. Epic game-list and RSS calls were deliberately denied;
+their loading/error views do not demonstrate backend failure. Dependency
+installation, login, game operations, RSS, Steam shortcut mutation and worn VR
+remain unverified. This supports **partial**, not works.
+
+Three temporary attempts were cleaned, including an initial Steam reinjection
+readiness failure and a test-relay omission of the library endpoint. A fresh
+shared-lock audit found all three services inactive/unloaded (PID 0), with their
+private bases, unit files and archives absent. Normal managed Decky/panel services
+stayed inactive; final battery was 99 → 100 while charging. No power-setting action
+ran. The audit lock was released, and local relays/browser tabs were closed.
+
+## Verification
+
+- Python suite: 1,628 tests, 16 skipped, no failures; store suite: 19 passed.
+- Site suite: 18 passed. Two new regression tests failed before the fix.
+- All 116 official plugins: fake-Frame 60 installed/removed, 56 expected blocks;
+  no actual plugin backends run by this harness. Disposable project cleaned.
+- Fresh official-store audit: 116 plugins, zero errors; ID/version/digest set
+  matches the catalog. Other plugin statuses are unchanged.

docs/evidence/framey-scroll-probe-2026-10-26.md

@@ -0,0 +1,23 @@
+# Unworn Framey scroll transport probe, 26 October 2026
+
+The previous `scripts/framey-vr-check.py --exercise` runs reported `scrollY=0` before and after one injected smooth-scroll event. That was inconclusive because the repository sample may fit inside the iframe. This probe changed only the **test script**: it created a temporary 160-pixel-high scroll region with 716 pixels of content, moved the native OpenVR pointer over it, and measured its own `scrollTop` and captured wheel events. No production Framey panel code changed.
+
+Two local diagnostic versions ran on the real Frame from base main `784118b` after PR #292. The final version in this PR tried OpenVR `VREvent_ScrollSmooth` (309) and `VREvent_ScrollDiscrete` (305), using Valve's documented `VREvent_Scroll_t` ABI. The overlay listing showed the temporary Frame Control dashboard visible with `+smoothscroll`; a trusted native pointer move reached the iframe. Neither scroll event reached Chromium's capture listener and the region stayed at `scrollTop=0`. This establishes only that `IVROverlayView_003.PostOverlayEvent` did not deliver these synthetic scroll events in this run. A physical controller may follow a different path.
+
+| Check | First probe | Final probe |
+| --- | --- | --- |
+| Unique shared lock and standby gate | Acquired; activity 3, battery 99% | Acquired; activity 3, battery 100% |
+| Scroll region | 160 px viewport, 716 px content | 160 px viewport, 716 px content |
+| Native pointer | Moved over region | Trusted pointer move reached iframe |
+| Injected scroll | Smooth 309 | Smooth 309, then discrete 305 |
+| Wheel events / offset | 0 / 0 → 0 | 0 / 0 → 0 |
+| Other sample checks | Passed | Passed |
+| Cleanup | Power restored to `false/5`, recovery timer removed, owned lock released; battery 99% | Same cleanup; battery 99% |
+
+Both runs captured changed stereo compositor frames and a `/dev/video99` mirror frame, saved only in private folders `/tmp/framey-native-scroll-probe/` and `/tmp/framey-native-scroll-events/`. No room pixels are committed. The final run's `result.json` reported `passed=true`, `cleanupErrors=[]`, `powerRecoveryRemoved=true` and `lockReleased=true`. Here `passed` covers the sample setting, quick action, slider, text and cleanup checks; **native scroll did not pass**. The final immediate SteamVR activity was 0 after the temporary wake; original power settings were restored and read back. No person wore the headset, and physical controller scrolling, rays, haptics, keyboard, optical readability and comfort remain unverified. The hourly worn-check schedule remains enabled.
+
+## Post-#294 exact-main sample check
+
+After PR #294 merged, the **unmodified** `scripts/framey-vr-check.py --exercise` from exact main `c38e7e8da459e44a9a717d15e6a07ab8a8e8ef8d` exited 0 on the real Frame. Locked preflight found activity 3 standby, proximity 6.3125 and battery 99%. The sample saved `{"enabled": true}` through trusted synthetic OpenVR input and the live Decky backend, read the file independently, then reopened a fresh iframe with the value retained. Quick action, slider value 50 and text entry completed; compositor frames changed and the mirror capture returned a frame. The old scroll diagnostic still reported no offset movement.
+
+The run removed its temporary services and recovery timer, restored/read back power `false/5`, reported no cleanup errors, and released only its owned lock. Its immediate activity was 0 after the temporary wake. Private captures/result are under `/tmp/framey-post294/` outside Git. This was one setting activation, so it does not prove the new rapid-double-input guard on physical controllers. No person wore the headset.

docs/evidence/framey-shotty-python-2026-10-26.md

@@ -0,0 +1,9 @@
+# Shotty Python compatibility, 26 October 2026
+
+The exact official Shotty 0.1.0 archive (store ID 53, SHA-256 `ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe`) imports `click.get_app_dir` at startup but never calls it. The archive includes an empty `py_modules` directory and no `click` package. A prior actual Decky 3.3.0 amd64 backend check stopped at `ModuleNotFoundError: click`; its local frontend separately starts with Framey's read-only Steam library snapshot.
+
+Frame Control now writes a small Linux `click.get_app_dir` compatibility module into **only this exact digest's** managed `Shotty/py_modules` folder during staging. Decky Loader adds each plugin's `py_modules` folder to that plugin's Python search path. The staging transaction records `shotty-click-app-dir` in the receipt and removes the whole staged folder on failure. A different Shotty digest receives no module. The official ZIP bytes and their verified hash remain unchanged.
+
+An isolated transaction test installed the pinned archive, imported its unchanged `main.py` using the staged module, and called its `aggregate_all` method with a synthetic Steam screenshot under a temporary `HOME`. It copied one fixture image into that temporary home's `Pictures/Screenshots/Local Test Game` folder; reopening the copied bytes matched the source. Removal deleted the managed folder. A second synthetic Shotty archive with another digest installed without the module. The test neither started the plugin's continuous screenshot rescuer nor touched a person's Steam library or screenshots.
+
+This supports **partial** compatibility for the local frontend and a narrow backend copy path. Actual Decky 3.3.0 ARM64 plugin startup, gamescope screenshot rescue, real screenshot aggregation, VR panel visibility, and physical controller use remain unverified. No headset lock was acquired or headset state changed for this check.

docs/evidence/framey-steam-reads-2026-10-26.json

@@ -0,0 +1,99 @@
+{
+  "checkedAtUtc": "2026-10-26T00:40:00Z",
+  "scope": "Actual SteamClient parameterless reads through Steam CEF on ARM64 Frame. Official frontends ran in local Chromium with plugin backend/network calls denied. Private loopback relay used the production read bridge with fixture installed-plugin status and the real frame_steam module supplied in memory because the optional headset service was not deployed. This does not verify a deployed real-Frame HTTP endpoint.",
+  "allowlist": [
+    "User.GetIPCountry",
+    "InstallFolder.GetInstallFolders",
+    "System.GetSystemInfo"
+  ],
+  "probeResults": {
+    "GetIPCountry": {
+      "ok": true,
+      "type": "string",
+      "length": 2,
+      "value": "redacted"
+    },
+    "GetInstallFolders": {
+      "ok": true,
+      "folders": 1,
+      "apps": 29,
+      "pathsAndTitles": "redacted"
+    },
+    "GetSystemInfo": {
+      "ok": true,
+      "fields": 27,
+      "identifiers": "redacted"
+    }
+  },
+  "officialPanels": {
+    "IsThereAnyDeal for Deck": {
+      "observation": {
+        "id": 81,
+        "name": "IsThereAnyDeal for Deck",
+        "ready": true,
+        "error": null,
+        "logs": [],
+        "methods": [
+          "settings_load",
+          "settings_save"
+        ]
+      },
+      "countryDropdownMatchesLiveFrameValue": true,
+      "backendSettingsSave": "attempted by official frontend; denied; no setting written",
+      "dealLookups": "not run"
+    },
+    "Deck Settings": {
+      "observation": {
+        "id": 93,
+        "name": "Deck Settings",
+        "ready": true,
+        "error": null,
+        "logs": [
+          {
+            "kind": "error",
+            "message": "[decky-game-settings:AuthorFooter] Error fetching avatar image: Error: Decky proxy fetch is unavailable in Framey"
+          },
+          {
+            "kind": "error",
+            "message": "[decky-game-settings:GameSelectView] Error fetching installed games: TypeError: Cannot read properties of undefined (reading 'allGamesCollection')"
+          }
+        ],
+        "methods": []
+      },
+      "remainingBlocker": "collectionStore.allGamesCollection"
+    }
+  },
+  "boundariesTested": [
+    "Only three explicit zero-argument APIs",
+    "Installed store plugin required",
+    "Headset-service gate",
+    "Iframe source and current session required",
+    "Late replies dropped after reopen",
+    "256 KiB UTF-8 response cap and socket cleanup"
+  ],
+  "deviceState": {
+    "sharedLock": "owned normally; released after testing",
+    "servicesInstalledOrStarted": false,
+    "powerChanges": false,
+    "deviceFilesForSteamProbe": false
+  },
+  "unverified": [
+    "Deployed headset HTTP endpoint",
+    "Plugin backend settings/deal lookups",
+    "Steam page patches and live library context",
+    "Worn VR/controller/keyboard"
+  ],
+  "catalogRefresh": {
+    "source": "https://plugins.deckbrew.xyz/plugins",
+    "checkedAtUtc": "2026-10-26T00:44:00Z",
+    "visiblePlugins": 116,
+    "idVersionDigestChanges": 0
+  },
+  "localRegressionAudit": {
+    "exactArchivedFrontends": 116,
+    "ready": 98,
+    "failed": 18,
+    "initializationRegressions": 0,
+    "pluginBackendAndNetworkActions": "denied, including live Steam read APIs"
+  }
+}

docs/evidence/framey-tailscale-path-2026-10-26.md

@@ -0,0 +1,33 @@
+# Tailscale Control read-only backend and Decky PATH, 26 October 2026
+
+The audited archive was official Tailscale Control 0.1.3, store ID 43,
+SHA-256 `06411711b27101d438339000da3d91202d682862710b02ef3ddf2462e642448a`.
+Earlier local Chromium evidence showed its settings panel. This check focused
+on the Frame's CLI lookup; it did not run a live Framey panel RPC.
+
+Each real Frame check acquired `/tmp/frame-test.lock` atomically with its own
+random owner, read SteamVR activity and proximity, and released only that
+owner's lock. The headset was in standby. The installed Tailscale CLI wrapper
+resides in `~/.local/bin`, which the systemd user manager did not put in the
+Decky service's inherited `PATH`.
+
+| Check | Result |
+| --- | --- |
+| Exact official backend with the current service PATH | Three read-only status methods returned `None`; `tailscale` was not found. |
+| Same backend in a disposable process with `~/.local/bin` prepended | The read-only methods returned active state, two exit-node entries and 16 device entries. |
+| Bounded transient systemd user unit with the proposed service PATH | Found `tailscale` and completed `tailscale status`. The unit ended inactive, PID 0, `LoadState=not-found`. |
+
+The Frame Control managed Decky unit now sets `PATH` to `~/.local/bin` plus
+standard system directories when installed or updated. The install transaction
+rolls its prior unit back on failure. No Tailscale `up`, `down`, routing or
+exit-node change was run. No persistent test service, headset wake, controller
+input or settings write was used.
+
+This supports CLI discovery and read-only backend data on the real Frame. It
+does not prove the production Framey-to-Decky RPC, connection controls, QR
+asset, worn panel visibility or physical controller usability. Tailscale
+Control remains **partial** in the digest-scoped catalog.
+
+A later independent hourly read-only check found SteamVR activity 3
+(standby), proximity raw 3.0625 and battery 93%. It released its owned lock;
+no worn test was possible and the hourly schedule remains enabled.

docs/evidence/framey-ui-fallbacks-2026-10-26.json

@@ -0,0 +1,107 @@
+{
+  "checkedAtUtc": "2026-10-26T00:29:00Z",
+  "scope": "Exact archived frontends only. Production Framey host with bounded SteamClient JSON cache, image fallback and inert Steam subscriptions/context. Opaque iframe; all backend calls and network denied. No headset or plugin backends used in this follow-up.",
+  "baseHostCommit": "52a0974",
+  "before": {
+    "ready": 96,
+    "failed": 20
+  },
+  "after": {
+    "ready": 98,
+    "failed": 18
+  },
+  "regressions": [],
+  "observations": [
+    {
+      "id": 13,
+      "name": "Pause Games",
+      "ready": true,
+      "error": null,
+      "logs": [],
+      "methods": [
+        "load_settings"
+      ]
+    },
+    {
+      "id": 43,
+      "name": "Tailscale Control",
+      "ready": true,
+      "error": null,
+      "logs": [],
+      "methods": [
+        "get_tailscale_state"
+      ]
+    },
+    {
+      "id": 46,
+      "name": "Steamback",
+      "ready": false,
+      "error": "Cannot read properties of undefined (reading 'm_CurrentUser')",
+      "logs": [],
+      "methods": []
+    },
+    {
+      "id": 66,
+      "name": "PlayTime",
+      "ready": false,
+      "error": "Cannot read properties of undefined (reading 'm_mapApps')",
+      "logs": [
+        {
+          "kind": "error",
+          "message": "%c PlayTime %c ERROR  background: #16a085; color: black; background: #FF000040; Impossible to get \"RunningApps\" observe. Events will not be attached."
+        },
+        {
+          "kind": "error",
+          "message": "%c PlayTime %c ERROR  background: #16a085; color: black; background: #FF000040; Unable to get settings, saving defaults Error: Not found"
+        }
+      ],
+      "methods": [
+        "fetch_playtime_information",
+        "statistics_for_last_two_weeks"
+      ]
+    },
+    {
+      "id": 120,
+      "name": "Reroll",
+      "ready": true,
+      "error": null,
+      "logs": [],
+      "methods": [
+        "get_setting",
+        "version"
+      ]
+    }
+  ],
+  "tailscaleFocusedCheck": {
+    "rendered": [
+      "Settings",
+      "Toggle Tailscale",
+      "Exit Node IP",
+      "Toggle LAN Access",
+      "Advanced Settings",
+      "Device Status",
+      "Tailscale Setup"
+    ],
+    "assetError": "Hardcoded localhost:1337 QR SVG blocked by image CSP",
+    "actions": "Inspected only; no toggles, exit nodes, installs or connection actions"
+  },
+  "pauseGamesFocusedCheck": {
+    "rendered": [
+      "Pause before Suspend",
+      "Pause on focus loss"
+    ],
+    "actions": "Inspected only; no process signaling or suspend actions"
+  },
+  "storageChecks": [
+    "Per-plugin cache survives panel reopen",
+    "Missing key rejects Not found",
+    "JSON serialization and cache quota enforced",
+    "Malformed and stale-session cache updates rejected"
+  ],
+  "unverified": [
+    "Real backends for these plugins",
+    "Tailscale network state/actions",
+    "Live games and pause/resume",
+    "Worn VR/controller/keyboard"
+  ]
+}

docs/evidence/framey-volume-boost-arm64-2026-10-26.json

@@ -0,0 +1,405 @@
+{
+  "baseCommit": "daee952873255b86018cce1d2a4d3bd070ec4341",
+  "plugin": {
+    "id": 58,
+    "name": "Volume Boost",
+    "version": "0.0.7",
+    "sha256": "2cc576a7f60751306d690268e227df626e59d3733680ced753de4c116629a9cc"
+  },
+  "runtime": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6",
+    "os": "Frame OS 0.5.6",
+    "arch": "aarch64"
+  },
+  "verificationLimits": {
+    "fakeFrame": "Prior exact archive HTTP/SSH install/receipt/removal; plugin execution stubbed, not repeated",
+    "localBrowser": "Actual headset.html, React and Framey host, exact unmodified official frontend in opaque iframe; direct RPC relay to actual ARM64 backend",
+    "realFrameSSH": "Production receipt-bound framey_panel.call_method over SSH and live Steam CEF DeckyBackend.call into actual Decky 3.3.0 ARM64 plugin; default speaker sink remained muted throughout",
+    "wornVR": "Not tested",
+    "audibleOutput": "Not tested; gain writes and readbacks only",
+    "deployedHTTP": "Not tested; outer status/install/check responses were fixtures, methods used production call_method with exact current receipt"
+  },
+  "catalogRefresh": {
+    "checkedAtUtc": "2026-10-26T06:10:58.537029+00:00",
+    "plugins": 116,
+    "changedIdsVersionsDigests": 0
+  },
+  "runs": [
+    {
+      "timeUtc": "2026-10-26T06:07:19.370988+00:00",
+      "locale": "LC_ALL=C for the private Decky service",
+      "originalSink": {
+        "mute": true,
+        "volumes": {
+          "front-left": 0,
+          "front-right": 0
+        }
+      },
+      "writes": [
+        {
+          "request": {
+            "value": 125,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 81920,
+              "front-right": 81920
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 125,
+              "success": true
+            },
+            "right": {
+              "result": 125,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 75,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 49152,
+              "front-right": 49152
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 75,
+              "success": true
+            },
+            "right": {
+              "result": 75,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 74,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 48496,
+              "front-right": 48496
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 74,
+              "success": true
+            },
+            "right": {
+              "result": 74,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 33,
+            "channel": "left"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 21626,
+              "front-right": 0
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 33,
+              "success": true
+            },
+            "right": {
+              "result": 0,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 67,
+            "channel": "right"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 0,
+              "front-right": 43909
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 0,
+              "success": true
+            },
+            "right": {
+              "result": 67,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 33,
+            "channel": "right"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 0,
+              "front-right": 21626
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 0,
+              "success": true
+            },
+            "right": {
+              "result": 33,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        }
+      ],
+      "reads": [
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        },
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        }
+      ],
+      "reopen": "Fresh query/session, ready; UI returned to actual restored zero; no write on mount",
+      "before": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "after": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "cleanup": {
+        "baseAbsent": true,
+        "unitAbsent": true
+      },
+      "exactSinkRestored": true,
+      "lockReleased": true
+    },
+    {
+      "timeUtc": "2026-10-26T06:12:04.889613+00:00",
+      "locale": "Inherited user-service environment, matching production unit; no LANG or LC_ALL override",
+      "originalSink": {
+        "mute": true,
+        "volumes": {
+          "front-left": 0,
+          "front-right": 0
+        }
+      },
+      "writes": [
+        {
+          "request": {
+            "value": 150,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 98304,
+              "front-right": 98304
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 150,
+              "success": true
+            },
+            "right": {
+              "result": 150,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        }
+      ],
+      "reads": [
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        },
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        }
+      ],
+      "reopen": "Fresh query/session, ready; UI returned to actual restored zero; no write on mount",
+      "before": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "after": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "cleanup": {
+        "baseAbsent": true,
+        "unitAbsent": true
+      },
+      "exactSinkRestored": true,
+      "lockReleased": true
+    }
+  ],
+  "guard": {
+    "scope": "Private test helper only; not a shipped feature or plugin patch",
+    "timeoutSeconds": 60,
+    "runtimeMaxSec": 120,
+    "sequence": [
+      "Capture exact default sink identity, native per-channel volume integers and original mute",
+      "Persist recovery state; start bounded device-side systemd watchdog before mute/write",
+      "Require stereo front-left/front-right and mute readback before plugin call",
+      "Only official get_volume_state/set_volume_state; value 0..150, known channels",
+      "Read native Pulse volume and mute independently; read both channels through actual plugin",
+      "Restore exact native volume while muted, verify, then restore original mute and verify exact snapshot",
+      "Remove recovery state, stop only own watchdog; cleanup own service/base and release matching lock"
+    ],
+    "automaticTimeoutExercised": false,
+    "explicitRestoreExercised": true
+  },
+  "freshCleanupAudit": {
+    "exactSinkRestored": true,
+    "baseAbsent": true,
+    "unitAbsent": true,
+    "services": {
+      "framey-boost-kp0z857q58-b4126054.service": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n",
+      "framey-boost-kp0z857q58-b4126054-guard.service": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n"
+    },
+    "battery": [
+      100
+    ]
+  },
+  "remaining": [
+    "Audible sound/quality, perceived loudness and physical speaker gain are unverified",
+    "Worn VR, headset controller input and Bluetooth sinks are unverified",
+    "No default route change, playback or power-setting action was invoked",
+    "Decky startup reinjects its frontend and can restart Steam CEF; normal managed services stayed inactive"
+  ],
+  "repositoryChecks": {
+    "python": "1,626 tests, 16 skips, no failures",
+    "site": "18 passed",
+    "catalogDocCheck": "passed",
+    "diffCheck": "passed"
+  }
+}

docs/evidence/framey-volume-boost-arm64-2026-10-26.md

@@ -0,0 +1,96 @@
+# Volume Boost sink controls on the ARM64 Frame
+
+Volume Boost 0.0.7 (official store ID 58) now qualifies as **works for sink
+controls**. The exact official, unmodified Python backend ran in Decky 3.3.0
+ARM64 on Frame OS 0.5.6. Local Chromium rendered its official frontend through
+Framey's existing legacy bridge. Actual control changes reached the Frame's
+default speaker sink, including above-100% gain, with independent Pulse
+readbacks. The sink stayed muted; no audible-output or worn-VR claim is made.
+
+[Digest-pinned observations and cleanup](framey-volume-boost-arm64-2026-10-26.json)
+record both runs. This supersedes the Volume Boost read-only limitation in the
+[previous ARM64 audio check](framey-audio-arm64-2026-10-26.md). No plugin patch,
+native rebuild or new compatibility shim was necessary. Volume Boost's backend
+uses Python and the Frame's existing ARM64 `pactl`; its hard-coded UID 1000
+matches the actual Frame user.
+
+| Local Chromium action | Actual ARM64 result, independently read back |
+| --- | --- |
+| Linked numeric input 125% | Native Pulse channel values 81920 / 81920; plugin reads 125 / 125 |
+| Linked slider click, then ArrowDown | 75% then 74%; native values 49152 / 49152 then 48496 / 48496 |
+| Unlink, set left to 33% | Native values 21626 / 0; plugin reads 33 / 0 |
+| Set right to 67% | Native values 0 / 43909; plugin reads 0 / 67 |
+| Re-link | Official frontend issues a right-only 33% write; native values 0 / 21626 |
+| Close and reopen | New document/session, ready; backend reads and displayed linked value return to the restored 0%; no mount write |
+| Repeat linked numeric 150% with inherited service locale | Native values 98304 / 98304; plugin reads 150 / 150; reopen again reads restored zero |
+
+The test restores the original sink state after **each** write. Therefore the
+separate-channel checks intentionally begin from 0% / 0%, rather than from the
+previous UI value. A right-only re-link request is the published plugin's
+behavior. These checks verify channel selection and preservation of the other
+channel; they do not claim a continuous unmuted listening session. Pulse's
+integer conversion truncates fractional native values; the evidence retains
+those integers rather than replacing them with rounded percentages.
+
+## Runtime and transport
+
+Each run separately acquired the atomic `/tmp/frame-test.lock`; neither stole
+an existing lock. A unique private Decky user service used its own plugin,
+settings and runtime directories, was never enabled, and had an eight-minute
+runtime limit. The upstream ARM64 loader matched GitHub's published SHA-256
+and ELF machine 183. The plugin ZIP matched the official digest.
+
+The local relay served actual `ui/headset.html`, vendored React and
+`framey-host.js`, with exact official frontend bytes in an opaque
+`allow-scripts` iframe. Outer status/install/check responses were fixtures.
+Plugin calls used production `framey_panel.call_method`, including the current
+store receipt, SSH through lxso2, live Steam CEF and `DeckyBackend.call` into the
+actual plugin subprocess. Only the temporary install paths were redirected.
+This does not verify the deployed headset HTTP endpoint or a VR compositor.
+
+The first private service explicitly used `LC_ALL=C`. The second inherited the
+user-service locale without a `LANG` or `LC_ALL` override, matching the
+production service configuration, and repeated actual reads, a 150% write and
+reopen. Zero alone was not accepted as success: upstream returns zero on
+command failure. Every write returned true, both backend channel reads agreed,
+and independent native Pulse readbacks confirmed nonzero changes.
+
+## Bounded muted writes and restoration
+
+The default sink was already muted at native channel values 0 / 0. Before each
+plugin write, a private device-side helper captured the exact sink identity,
+channel values and mute state; persisted recovery state; and started a bounded
+60-second systemd watchdog. It then required a successful mute readback before
+allowing the plugin call. The relay allowed only `get_volume_state` and
+`set_volume_state`, known channels and values from 0 through 150.
+
+After the call, independent `pactl --format=json list sinks` and both plugin
+reads checked the result. In `finally`, the helper restored exact native
+channel values while muted, checked them, restored the original mute state,
+and verified the entire snapshot before removing recovery state and stopping
+its watchdog. No default route, playback, existing stream or power setting was
+changed. Automatic watchdog expiry was armed but not deliberately exercised;
+explicit restoration passed after all seven writes.
+
+Both private Decky services/bases were removed and their locks released.
+Fresh-lock cleanup audits found their Decky and guard units unloaded/inactive
+with PID 0, paths absent, and the exact original sink/mute restored. Battery
+stayed 100 → 100; normal managed Decky and headset-panel services stayed
+inactive. Decky startup reinjects its frontend and can restart Steam CEF.
+
+## Catalog and verification limits
+
+The canonical store catalog and generated table report **4 works / 48 partial /
+53 broken / 11 N/A**. A fresh full official-store fetch at 06:10:58 UTC found
+all 116 IDs, versions and digests unchanged. Historical fake-Frame checks cover
+this exact archive's install/receipt/removal with backend execution stubbed;
+that test was not repeated or relabelled as real-backend evidence.
+
+Audible gain, sound quality, physical speaker output, Bluetooth sinks,
+headset-controller input and worn VR remain unverified. The store row includes
+these limits. This change records new real-backend evidence and updates its
+compatibility classification; it changes no shipped audio implementation.
+
+The full server suite completed 1,626 tests with no failures (16 skips); all
+18 site tests passed. Generated-document consistency and `git diff --check`
+also passed. No implementation change followed those tests.

docs/evidence/framey-vr-2026-10-25/README.md

@@ -0,0 +1,119 @@
+# Framey unattended VR evidence, 25 October 2026 UTC
+
+The committed runner exited **0** on the real Frame, using the existing
+`ssh lxso2 'ssh frame …'` route from lxso1. No person wore the headset.
+Frame OS **0.5.6**, build **20261022.6153909**, ARM64, SteamVR **2.18.2**,
+Decky **3.3.0**. The run began at **23:27:34 UTC**; the Frame's own clock/logs
+use UTC+11 and therefore show 26 October.
+
+```sh
+python3 scripts/framey-vr-check.py --via lxso2 --exercise --output /tmp/framey-vr-verified
+```
+
+[Full machine result](result.json) records source commit
+`cb9ad1b6cb7302008783d5f7fe42fa77a4dd43af`, bundle digest, before/after
+SteamVR listings, power settings, input observations, and private image hashes.
+The checked app code includes the sample settings-path and iframe-reopen fixes
+and main through `d77e2bd`. This is source-bundle testing, not a newly published
+release/AppImage test. The sample has a random test name and store-shaped local
+receipt; it is not presented as an official catalogue listing.
+
+| Check | Observed | Scope |
+| --- | --- | --- |
+| Overlay registration and visibility | `IVROverlay_027.IsOverlayVisible=true` | Actual Frame Control gamescope overlay, not a browser fixture |
+| Transform | type **5**, DashboardTab; absolute getter returns **18**, WrongTransformType | Dashboard owns placement; no transform/dock setters used |
+| Texture queries | main size 0×0; image read **24**, InvalidTexture | Direct texture refresh not established; compositor capture used instead |
+| Stereo compositor | Before/after SHA-256 differ; final image visibly contains Framey tabs, quick action and saved result | Actual `IVRScreenshots_001` production screenshot path |
+| OBS mirror | Current run's random name and “Saved setting is on” appear after draining 60 frames | `/dev/video99` pixels; OBS app itself was not launched in this task |
+| OpenVR click | Move/down/up reaches intended control; iframe pointer event is trusted | `IVROverlayView_003.PostOverlayEvent`, no DOM `.click()` |
+| Live setting | off → on; real backend file `{"enabled":true}`; fresh iframe reads on | Actual Framey HTTP → Steam CEF → Decky websocket → Python backend; no stubs |
+| Tabs/quick action | Settings/Panel clicked; “Saved setting is on” returned | Actual shipped host controls and sample action |
+| Slider | 10 → **50** | Native OpenVR click on actual DFL slider, diagnostic UI-only value |
+| Text | **framey-ci** | OpenVR pointer focus, then CDP `Input.insertText`; not SteamVR keyboard proof |
+| Smooth scroll attempt | `scrollBefore=0`, `scrollAfter=0` | No scrolling established by this attempt; do not count it as a pass |
+| Battery | **99% → 99%** | Probed only under the owned lock |
+| Power restoration | original pause **false**, timeout **5.000000**, exact values read back | Temporary values false/120; no idle-suspend timer or proximity changes |
+| Cleanup | `cleanupErrors=[]`, `powerRecoveryRemoved=true`, `lockReleased=true` | Temporary managed services, sample/settings/profile, timer and restore script removed |
+
+`IsDashboardVisible` and `IsActiveDashboardOverlay` are false while the panel is
+visible in these captures: this is an existing placed/docked panel. They cannot
+be used alone as a Framey visibility verdict. Activity changes from standby 3
+to active 0 without wearing the headset, so activity alone is not worn proof.
+Native OpenVR events also produce trusted pointers, so `event.isTrusted` alone
+is not physical-controller proof. The worn script now requires explicit
+`--worn-confirmed` and reports trusted pointer input with that narrower name.
+
+![Actual compositor panel, room masked](stereo-left-panel-redacted.png)
+
+![Actual mirror panel, room masked](mirror-panel-redacted.png)
+
+These are inset panel crops from the raw captures, with all other pixels
+replaced by solid black. No UI content was synthesized. [Image provenance](images.json)
+contains source hashes, mask polygons, crops and published hashes. Raw images
+remain private under `/tmp/framey-vr-verified` on lxso1. They are not committed.
+
+## Bugs found and fixed
+
+1. The author sample used `decky.decky_SETTINGS_DIR`, absent from real Decky
+   3.3.0. The actual iframe displayed its backend `AttributeError`. Decky's
+   [pinned module](https://github.com/SteamDeckHomebrew/decky-loader/blob/v3.3.0/backend/decky_loader/plugin/imports/decky.py)
+   exports `DECKY_PLUGIN_SETTINGS_DIR`. The sample, docs and Python test fixture
+   now use that name. The old fixture invented the same wrong attribute and
+   masked the failure. The live fixed backend save/reopen is in `result.json`.
+2. Reopening the same plugin changed only `#session`, so Chromium retained the
+   old document/host/cache session. It could retain an error and eventually
+   show a false “No compatible panel loaded” message. A fresh query parameter
+   forces a new document while keeping the fragment session. The cache
+   regression now checks document URLs, rather than manually assuming a new
+   iframe. The real reopen with the saved setting passed.
+
+## Methods tried and limits
+
+Read-only `vrcmd` stats/overlay listings, the shipped OpenVR ABI, compositor
+logs and actual CEF/Chromium targets were inspected first. A simple
+`--handlewakeup` initially produced the Frame Control status panel in a stereo
+screenshot. The full test uses a bounded screen timeout so it stays active.
+Decky's service startup reloads Steam's web helper. During exploratory service
+recreation, SteamVR logged `UpdateInputFocus: Failed to give focus to panel`
+and returned a hidden, zero-sized main overlay despite a successful focus
+request. Retagging only the test browser's `STEAM_GAME` property recovered it;
+no Steam, SteamVR, gamescope or headset restart was needed. The final run did
+not need this recovery. The runner records it when used.
+
+The first mirror image was demonstrably stale: it contained a previous test's
+random plugin name while the contemporaneous stereo image contained the current
+one. Reading 60 frames before selecting the mirror image fixed that observation;
+the final two published images contain the same current run name.
+
+The diagnostic itself initially failed its cleanup check because an idle
+systemd watchdog service was already unloaded. It restored power and removed
+the test services, retained the lock, then the exact owned remainder was cleaned
+up. Cleanup now checks `LoadState` and tolerates an already-unloaded transient
+unit. Subsequent full runs, including the committed run here, exited 0 with no
+cleanup errors. A four-minute power-recovery timer was created and cancelled;
+forced host death or network loss was not fault injected.
+
+A null driver or virtual tracked controller was not needed for pointer delivery
+and was not installed. No root/system files, tracking/proximity configuration,
+Steam global binaries, or spatial transforms were edited. PR #113 was untouched.
+This check does not establish every official plugin, sustained frame rate,
+backend persistence across Steam/Decky reboot, physical controller tracking or
+haptics, a functioning virtual keyboard, native scrolling, comfort or legibility
+through the optics. Follow the [three-minute worn checklist](../../framey-vr-check.md#three-minute-worn-checklist).
+
+## Local checks
+
+- Full Python suite after integrating current main and worn-confirmation gate:
+  **1,595 tests, 16 skipped, OK**. The final added scroll/mirror helpers also
+  passed the **24 focused Framey tests** and the real-device run above.
+- App and website test commands passed under **Node 24.22.1**, matching CI's
+  Node major. System Node 22 cancelled unrelated Meta sign-in timer tests;
+  those files were not changed. Node 24 was used for final app verification.
+- `git diff --check` and Python compilation passed. Hosted CI status belongs to
+  the PR; local checks do not substitute for its macOS/Windows/ARM64 jobs.
+
+A separate [locked cleanup audit](cleanup-verification.json) confirms both test
+services inactive, no panel bundle or Decky binary, no test plugins/profiles or
+remaining timers, power restored to false/5, battery 99→99, and its own lock
+released. It also removed the stale DevTools discovery file created during the
+earlier exploratory use of the original browser profile.

docs/evidence/framey-vr-2026-10-25/cleanup-verification.json

@@ -0,0 +1,2 @@
+{"batteryBefore": [99], "headsetService": {"code": 4, "out": "inactive", "err": ""}, "deckyService": {"code": 4, "out": "inactive", "err": ""}, "panelBundleExists": false, "deckyBinaryExists": false, "testPluginFolders": [], "testProfiles": [], "timers": {"code": 0, "out": "", "err": ""}, "pause": {"code": 0, "out": "power.pauseCompositorOnStandby=false", "err": ""}, "timeout": {"code": 0, "out": "power.turnOffScreensTimeout=5.000000", "err": ""}, "removedOwnedStaleDevToolsDiscovery": true, "batteryAfter": [99], "lockReleased": true}
+

docs/evidence/framey-vr-2026-10-25/images.json

@@ -0,0 +1,80 @@
+[
+  {
+    "source": "stereo-private.png",
+    "sourceSha256": "25944a3f3ffe0c217ef25cbc3f5e08a104f9d8901075b755c928ec5049a4cb3c",
+    "published": "stereo-left-panel-redacted.png",
+    "publishedSha256": "0de6fbf0f31d0587c8ba91817406acf455b8adb10d343bd56daa605f9a3051c7",
+    "maskPolygon": [
+      [
+        50,
+        435
+      ],
+      [
+        910,
+        365
+      ],
+      [
+        940,
+        920
+      ],
+      [
+        700,
+        910
+      ],
+      [
+        350,
+        945
+      ],
+      [
+        90,
+        1000
+      ]
+    ],
+    "crop": [
+      50,
+      365,
+      941,
+      1001
+    ],
+    "background": "solid black; only inset panel pixels retained"
+  },
+  {
+    "source": "mirror-private.png",
+    "sourceSha256": "44d193943ca3164269feeea38f5cbfb0d58cefb79d6c0e8231eab4a5069985b8",
+    "published": "mirror-panel-redacted.png",
+    "publishedSha256": "86fa296a36171efca6a9aa627ec3589496df73f3c03f8f9428454c411a904a77",
+    "maskPolygon": [
+      [
+        455,
+        445
+      ],
+      [
+        1420,
+        390
+      ],
+      [
+        1470,
+        940
+      ],
+      [
+        1150,
+        910
+      ],
+      [
+        850,
+        940
+      ],
+      [
+        495,
+        1020
+      ]
+    ],
+    "crop": [
+      455,
+      390,
+      1471,
+      1021
+    ],
+    "background": "solid black; only inset panel pixels retained"
+  }
+]

docs/evidence/framey-vr-2026-10-25/result.json

@@ -0,0 +1,189 @@
+{
+  "schema": 1,
+  "time": "2026-10-25T23:27:34.130334+00:00",
+  "controllerHardwareVerified": false,
+  "wornVisualComfortVerified": false,
+  "sourceCommit": "cb9ad1b6cb7302008783d5f7fe42fa77a4dd43af",
+  "before": {
+    "battery": [
+      99
+    ],
+    "dashboardVisible": false,
+    "stats": [
+      {
+        "activity_level": 3,
+        "operation": "status",
+        "version": "2.18.2",
+        "version_timestamp": 1791331621
+      }
+    ],
+    "overlays": "---- OVERLAYS ---- \n'system.HeadsetView' -- 'Headset View', 2048x1280 not_visible VROverlayType_Basic \n'system.toast' -- 'Toast', not_visible VROverlayType_Basic \n'system.cursor.ibeam' -- 'system.cursor.ibeam', 64x64 not_visible VROverlayType_Basic \n     flags=0x00200000 +premult  overlayhandle=0x0000000d00000002\n'system.pointer' -- 'system.pointer', 64x64 not_visible VROverlayType_Basic \n     flags=0x00200000 +premult  overlayhandle=0x0000000e00000003\n'system.pointer.secondary' -- 'system.pointer.secondary', 64x64 not_visible VROverlayType_Basic \n     flags=0x00200000 +premult  overlayhandle=0x0000000f00000004\n'system.standalone' -- 'Standalone Overlay Manager', not_visible VROverlayType_Basic \n'valve.steam.desktopgame.0' -- 'Gamescope', not_visible VROverlayType_Dashboard_Main \n     flags=0x29A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x0000001100000006\n'valve.steam.desktopgame.0.thumb' -- 'Gamescope (Thumb)', 256x256 not_visible VROverlayType_Dashboard_Thumbnail \n     flags=0x20200000 +premult  overlayhandle=0x0000001200000007\n'valve.steam.desktopgame.0.layer1' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x0000001300000008\n'valve.steam.desktopgame.0.layer2' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x0000001400000009\n'valve.steam.desktopgame.0.layer3' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000150000000a\n'valve.steam.desktopgame.0.layer4' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000160000000b\n'valve.steam.desktopgame.0.layer5' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000170000000c\n'valve.steam.desktopgame.0.layer6' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000180000000d\n'valve.steam.desktopgame.0.layer7' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000190000000e\n'valve.steam.desktopgame.0.layer8' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x0000001a0000000f\n'gamescope.gamescope-0.cursor.0' -- 'Mouse Cursor', not_visible VROverlayType_Basic \n     flags=0x60000000   overlayhandle=0x0000001b00000010\n'system.systemui' -- 'systemui', 1860x2048 not_visible VROverlayType_Basic \n     flags=0x08230008 -dash, +interactive, +smoothscroll, +premult, +clickstab  overlayhandle=0x0000001c00000011\n'system.vrwebhelper.controllerbinding' -- 'controllerbinding', 2400x1350 not_visible VROverlayType_Dashboard_Main \n     flags=0x09228108 -dash, +scrollwheel, +dash, +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x0000003800000012\n'system.vrwebhelper.controllerbinding.thumb' -- 'controllerbinding (Thumb)', 16x16 not_visible VROverlayType_Dashboard_Thumbnail \n'valve.steam.gamepadui.main' -- 'SteamVR', 0x0 not_visible VROverlayType_Dashboard_Main \n     flags=0x69A28000 +dash, +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001a400000014\n'valve.steam.gamepadui.main.thumb' -- 'Webhelper (Thumb)', 300x300 not_visible VROverlayType_Dashboard_Thumbnail \n     flags=0x20200000 +premult  overlayhandle=0x000001a500000015\n'valve.steam.browserview_MainBrowser_2' -- 'data:text/html,<body><%2Fbody>', 0x0 not_visible VROverlayType_Subview \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001a600000016\n'valve.steam.gamepadui.keyboard' -- 'SteamVR - Keyboard', 0x0 not_visible VROverlayType_Basic \n     flags=0x31A30000 +interactive, +smoothscroll, +premult, +keyboard, +2cursor  overlayhandle=0x000001a700000017\n'valve.steam.gamepadui.bar' -- 'SteamVR - valve.steam.gamepadui.bar (85370000)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001a800000018\n'valve.steam.gamepadui.barpopup.85370001' -- 'SteamVR - valve.steam.gamepadui.barpopup.85370001 (85370001)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001a900000019\n'valve.steam.gamepadui.tooltip.85370002' -- 'SteamVR - valve.steam.gamepadui.tooltip.85370002 (85370002)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001aa0000001a\n'valve.steam.gamepadui.volumelevel' -- 'SteamVR - valve.steam.gamepadui.volumelevel (85370003)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001ab0000001b\n'valve.steam.gamepadui.floatingfooterLine truncated
+    "pause": "power.pauseCompositorOnStandby=false",
+    "timeout": "power.turnOffScreensTimeout=5.000000"
+  },
+  "powerRecovery": {
+    "timer": "framey-vr-5e068da08ef73637-restore.timer",
+    "script": "/tmp/framey-vr-5e068da08ef73637-restore.py",
+    "originalPause": "false",
+    "originalTimeout": "5.000000"
+  },
+  "deckyInstall": {
+    "message": "Decky Loader v3.3.0 is running as a user service. The VR menu is experimental."
+  },
+  "panelInstall": {
+    "message": "Installed Frame Control on the headset. Asked SteamVR to show Frame Control. Select its panel in the dashboard if it is hidden.",
+    "version": "4968ad070054d005",
+    "overlay": "valve.steam.desktopgame.2001947813"
+  },
+  "overlay": {
+    "state": {
+      "interface": "IVROverlay_027",
+      "visible": true,
+      "dashboardVisible": false,
+      "activeDashboard": false,
+      "texture": {
+        "error": 0,
+        "width": 0,
+        "height": 0
+      },
+      "transform": {
+        "error": 18,
+        "typeError": 0,
+        "type": 5,
+        "origin": 0,
+        "matrix": [
+          [
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ],
+          [
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ],
+          [
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ]
+        ]
+      },
+      "input": {
+        "error": 0,
+        "method": 1,
+        "scaleError": 0,
+        "scale": [
+          1920.0,
+          1080.0
+        ]
+      }
+    },
+    "imageRead": {
+      "error": 24,
+      "width": 0,
+      "height": 0
+    }
+  },
+  "beforeStereoSha256": "5d0635d02e44d7cf2d5c249e72ea01c5cd161996427c1012cfd1c42fa5aa5751",
+  "input": {
+    "clickTransport": "IVROverlayView_003.PostOverlayEvent",
+    "textTransport": "CDP Input.insertText after OpenVR focus",
+    "controllerHardwareVerified": false,
+    "initialText": "PanelSettings\nQuick actions\nRead saved setting\nFramey settings sample\nExample setting\nStored by the Decky Python backend\nReload saved setting\nAbout this setting\n\nSaved setting: off",
+    "savedText": "Framey sample\n\nSetting saved\n\nDismiss\nPanelSettings\nQuick actions\nRead saved setting\nFramey settings sample\nExample setting\nStored by the Decky Python backend\nReload saved setting\nAbout this setting\n\nSaved setting: on",
+    "pointerEvents": [
+      {
+        "trusted": true,
+        "x": 594.6666870117188,
+        "y": 280.0625
+      }
+    ],
+    "trustedOverlayPointer": true,
+    "diskSetting": {
+      "enabled": true
+    },
+    "reopenedText": "PanelSettings\nQuick actions\nRead saved setting\nFramey settings sample\nExample setting\nStored by the Decky Python backend\nReload saved setting\nAbout this setting\n\nSaved setting: on",
+    "reopenedChecked": true,
+    "quickActionText": "PanelSettings\nQuick actions\nRead saved setting\n\nSaved setting is on\n\nFramey settings sample\nExample setting\nStored by the Decky Python backend\nReload saved setting\nAbout this setting\n\nSaved setting: on",
+    "sliderValue": "50",
+    "textValue": "framey-ci",
+    "scrollBefore": 0,
+    "scrollAfter": 0,
+    "nativeScrollMoved": false,
+    "finalOverlay": {
+      "interface": "IVROverlay_027",
+      "visible": true,
+      "dashboardVisible": false,
+      "activeDashboard": false,
+      "texture": {
+        "error": 0,
+        "width": 0,
+        "height": 0
+      },
+      "transform": {
+        "error": 18,
+        "typeError": 0,
+        "type": 5,
+        "origin": 0,
+        "matrix": [
+          [
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ],
+          [
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ],
+          [
+            0.0,
+            0.0,
+            0.0,
+            0.0
+          ]
+        ]
+      },
+      "input": {
+        "error": 0,
+        "method": 1,
+        "scaleError": 0,
+        "scale": [
+          1920.0,
+          1080.0
+        ]
+      }
+    },
+    "passed": true
+  },
+  "stereoSha256": "25944a3f3ffe0c217ef25cbc3f5e08a104f9d8901075b755c928ec5049a4cb3c",
+  "compositorChanged": true,
+  "mirrorSha256": "44d193943ca3164269feeea38f5cbfb0d58cefb79d6c0e8231eab4a5069985b8",
+  "passed": true,
+  "after": {
+    "battery": [
+      99
+    ],
+    "dashboardVisible": false,
+    "stats": [
+      {
+        "activity_level": 0,
+        "operation": "status",
+        "version": "2.18.2",
+        "version_timestamp": 1791331621
+      }
+    ],
+    "overlays": "---- OVERLAYS ---- \n'system.HeadsetView' -- 'Headset View', 2048x1280 not_visible VROverlayType_Basic \n'system.toast' -- 'Toast', not_visible VROverlayType_Basic \n'system.cursor.ibeam' -- 'system.cursor.ibeam', 64x64 not_visible VROverlayType_Basic \n     flags=0x00200000 +premult  overlayhandle=0x0000000d00000002\n'system.pointer' -- 'system.pointer', 64x64 not_visible VROverlayType_Basic \n     flags=0x00200000 +premult  overlayhandle=0x0000000e00000003\n'system.pointer.secondary' -- 'system.pointer.secondary', 64x64 not_visible VROverlayType_Basic \n     flags=0x00200000 +premult  overlayhandle=0x0000000f00000004\n'system.standalone' -- 'Standalone Overlay Manager', not_visible VROverlayType_Basic \n'valve.steam.desktopgame.0' -- 'Gamescope', not_visible VROverlayType_Dashboard_Main \n     flags=0x29A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x0000001100000006\n'valve.steam.desktopgame.0.thumb' -- 'Gamescope (Thumb)', 256x256 not_visible VROverlayType_Dashboard_Thumbnail \n     flags=0x20200000 +premult  overlayhandle=0x0000001200000007\n'valve.steam.desktopgame.0.layer1' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x0000001300000008\n'valve.steam.desktopgame.0.layer2' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x0000001400000009\n'valve.steam.desktopgame.0.layer3' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000150000000a\n'valve.steam.desktopgame.0.layer4' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000160000000b\n'valve.steam.desktopgame.0.layer5' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000170000000c\n'valve.steam.desktopgame.0.layer6' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000180000000d\n'valve.steam.desktopgame.0.layer7' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x000000190000000e\n'valve.steam.desktopgame.0.layer8' -- 'Gamescope Layer', not_visible VROverlayType_Subview \n     flags=0x28200000 +premult, +clickstab  overlayhandle=0x0000001a0000000f\n'gamescope.gamescope-0.cursor.0' -- 'Mouse Cursor', not_visible VROverlayType_Basic \n     flags=0x60000000   overlayhandle=0x0000001b00000010\n'system.systemui' -- 'systemui', 1860x2048 not_visible VROverlayType_Basic \n     flags=0x08230008 -dash, +interactive, +smoothscroll, +premult, +clickstab  overlayhandle=0x0000001c00000011\n'system.vrwebhelper.controllerbinding' -- 'controllerbinding', 2400x1350 not_visible VROverlayType_Dashboard_Main \n     flags=0x09228108 -dash, +scrollwheel, +dash, +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x0000003800000012\n'system.vrwebhelper.controllerbinding.thumb' -- 'controllerbinding (Thumb)', 16x16 not_visible VROverlayType_Dashboard_Thumbnail \n'valve.steam.gamepadui.main' -- 'SteamVR', 0x0 not_visible VROverlayType_Dashboard_Main \n     flags=0x69A28000 +dash, +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001c600000014\n'valve.steam.gamepadui.main.thumb' -- 'Webhelper (Thumb)', 300x300 not_visible VROverlayType_Dashboard_Thumbnail \n     flags=0x20200000 +premult  overlayhandle=0x000001c700000015\n'valve.steam.browserview_MainBrowser_2' -- 'data:text/html,<body><%2Fbody>', 0x0 not_visible VROverlayType_Subview \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001c800000016\n'valve.steam.gamepadui.keyboard' -- 'SteamVR - Keyboard', 0x0 not_visible VROverlayType_Basic \n     flags=0x31A30000 +interactive, +smoothscroll, +premult, +keyboard, +2cursor  overlayhandle=0x000001c900000017\n'valve.steam.gamepadui.bar' -- 'SteamVR - valve.steam.gamepadui.bar (85430000)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001ca00000018\n'valve.steam.gamepadui.barpopup.85430001' -- 'SteamVR - valve.steam.gamepadui.barpopup.85430001 (85430001)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001cb00000019\n'valve.steam.gamepadui.tooltip.85430002' -- 'SteamVR - valve.steam.gamepadui.tooltip.85430002 (85430002)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001cc0000001a\n'valve.steam.gamepadui.volumelevel' -- 'SteamVR - valve.steam.gamepadui.volumelevel (85430003)', 0x0 not_visible VROverlayType_Basic \n     flags=0x69A20000 +smoothscroll, +premult, +keyboard, +clickstab  overlayhandle=0x000001cd0000001b\n'valve.steam.gamepadui.floatingfooterLine truncated
+    "pause": "power.pauseCompositorOnStandby=false",
+    "timeout": "power.turnOffScreensTimeout=5.000000"
+  },
+  "powerRecoveryRemoved": true,
+  "lockReleased": true,
+  "cleanupErrors": []
+}

docs/evidence/framey-vr-activity-row-2026-10-26.md

@@ -0,0 +1,28 @@
+# Read-only Framey activity gate, 26 October 2026
+
+At 11:12 UTC, a read-only probe acquired `/tmp/frame-test.lock` by atomic
+`mkdir` with a random owner token before reading the Frame. SteamVR
+returned two `vrcmd --stats` rows: performance metrics first and the status
+row second. The status row reported activity level **1**. The original
+`framey-worn-check.py` looked only at row zero and reported unknown activity;
+`framey-vr-check.py` used the same row-zero assumption for its wake gate. The
+fixed gates select the unique status row and fail closed if it is missing,
+duplicated or malformed.
+
+The first locked read found 90% battery, proximity raw 222.25, no active
+managed headset panel service and no managed Decky plugin. A subsequent locked
+read found activity 1 and proximity raw 223.625. No reliable wearer
+confirmation was available. No wake, service install, settings write or input
+was attempted.
+
+While activity was 1, a separate owned-lock read captured four seconds from
+`/dev/video99` into a private 640×360 H.264 MP4. It decoded successfully and
+contained active video imagery. The inspected sample did **not** establish
+room passthrough, Frame Control panel visibility, ProtonDB Badges UI or
+controller interaction. The private recording and decoded frame were removed
+after inspection; no room or media images are committed. Each read released
+only its owner-token lock. The hourly worn-check schedule remains enabled.
+
+The local focused safety suite covers a metrics row before the status row,
+awake activity, ambiguous/missing status and foreign-lock refusal. A genuine
+worn visual and physical-controller check remains outstanding.

docs/evidence/framey-vr-standby-gate-2026-10-26.json

@@ -0,0 +1,120 @@
+{
+  "timeUtc": "2026-10-26T01:52:44.513151+00:00",
+  "testedMainCommit": "c62bffc8efe88e107a82e2f2ef481228021acc88",
+  "change": "uncommitted standby/proximity preflight in this PR",
+  "preflight": {
+    "activity": 3,
+    "proximityRaw": [
+      6.3125
+    ],
+    "batteryPercent": [
+      99
+    ],
+    "pause": "power.pauseCompositorOnStandby=false",
+    "screenTimeout": "power.turnOffScreensTimeout=5.000000"
+  },
+  "result": {
+    "passed": true,
+    "overlayVisible": true,
+    "stereoChanged": true,
+    "mirrorCaptured": true,
+    "trustedSyntheticOpenVRPointer": true,
+    "liveDeckySavedSetting": {
+      "enabled": true
+    },
+    "settingPersistedAfterReopen": true,
+    "quickActionObserved": true,
+    "sliderValue": "50",
+    "textValue": "framey-ci",
+    "nativeScrollMoved": false
+  },
+  "cleanup": {
+    "batteryPercent": [
+      99
+    ],
+    "proximityRaw": [
+      6.1875
+    ],
+    "pause": "power.pauseCompositorOnStandby=false",
+    "screenTimeout": "power.turnOffScreensTimeout=5.000000",
+    "powerRecoveryRemoved": true,
+    "lockReleased": true,
+    "errors": []
+  },
+  "limits": {
+    "controllerHardwareVerified": false,
+    "wornVisualComfortVerified": false,
+    "vrKeyboardVerified": false
+  },
+  "combinedHeadChecks": [
+    {
+      "timeUtc": "2026-10-26T02:01:05.938830+00:00",
+      "head": "bc72c41be5aa4bc80192145afefb1c6fe31a47fc",
+      "passed": false,
+      "overlayVisible": false,
+      "inputPassed": false,
+      "reason": "Timed out waiting for live UI: 0",
+      "retaggedTestWindow": true,
+      "batteryBefore": [
+        100
+      ],
+      "batteryAfter": [
+        99
+      ],
+      "powerRestored": true,
+      "lockReleased": true
+    },
+    {
+      "timeUtc": "2026-10-26T02:02:44.600755+00:00",
+      "head": "bc72c41be5aa4bc80192145afefb1c6fe31a47fc",
+      "passed": false,
+      "overlayVisible": false,
+      "inputPassed": false,
+      "reason": "Timed out waiting for live UI: 0",
+      "retaggedTestWindow": true,
+      "batteryBefore": [
+        99
+      ],
+      "batteryAfter": [
+        99
+      ],
+      "powerRestored": true,
+      "lockReleased": true
+    },
+    {
+      "timeUtc": "2026-10-26T02:05:00.560460+00:00",
+      "head": "bc72c41be5aa4bc80192145afefb1c6fe31a47fc",
+      "passed": true,
+      "overlayVisible": true,
+      "inputPassed": true,
+      "reason": null,
+      "retaggedTestWindow": false,
+      "batteryBefore": [
+        99
+      ],
+      "batteryAfter": [
+        99
+      ],
+      "powerRestored": true,
+      "lockReleased": true
+    },
+    {
+      "timeUtc": "2026-10-26T02:07:28.654641+00:00",
+      "head": "db079eec9f64a865fca8a1a51b5304e071596383",
+      "localChange": "bounded overlay wait on this PR branch",
+      "passed": true,
+      "overlayVisible": true,
+      "inputPassed": true,
+      "reason": null,
+      "retaggedTestWindow": false,
+      "batteryBefore": [
+        100
+      ],
+      "batteryAfter": [
+        99
+      ],
+      "powerRestored": true,
+      "lockReleased": true
+    }
+  ]
+}

docs/evidence/framey-vr-standby-gate-2026-10-26.md

@@ -0,0 +1,50 @@
+# Framey unworn exercise with standby gate
+
+At 2026-10-26 01:52 UTC, this PR's `scripts/framey-vr-check.py --exercise`
+acquired the shared lock on a real Frame running the `c62bffc8` main bundle.
+The new read-only preflight found SteamVR activity 3 (standby), proximity raw
+6.3125 and battery 99% before allowing temporary installation or power changes.
+The lock owner was unique to this run.
+
+The documented unworn exercise passed: the Frame Control overlay was visible,
+stereo compositor pixels changed, `/dev/video99` was captured, a synthetic
+trusted OpenVR pointer reached the sample, a live Decky setting was saved and
+persisted after a fresh panel reopen, and the quick action, slider and text
+field produced their expected values. Native scroll did not move. The test
+retagged only its temporary panel window once to recover focus. Public numeric
+results are in [framey-vr-standby-gate-2026-10-26.json](framey-vr-standby-gate-2026-10-26.json).
+Room-containing stereo and mirror captures remain private in `/tmp`.
+
+Cleanup returned battery 99%, `power.pauseCompositorOnStandby=false` and
+`power.turnOffScreensTimeout=5.000000`, matching the preflight. The temporary
+power recovery unit was removed, no cleanup errors were reported, and only
+this run's lock was released. Local tests also checked that activity 1, 2 or
+unknown refuses both `--wake` and `--exercise` before any installation or
+power change.
+
+Synthetic pointer events and captures do not prove physical controller use,
+wearer-visible readability, optical comfort or VR keyboard behavior. Those
+remain unverified.
+
+## Combined v0.4.39 candidate reruns
+
+After #278 and #279 joined main, the combined `bc72c41` branch ran the same
+locked exercise three times. The first two runs (02:01 and 02:02 UTC) loaded
+the sample UI in Chromium, but SteamVR kept its overlay hidden even after the
+existing test-window focus retry. Synthetic input reached no panel control;
+both runs failed. The third run (02:05 UTC) showed the overlay without that
+retry and passed the sample setting, input, stereo and mirror checks. Every run
+restored the original power settings, removed its recovery timer and released
+its own lock with no cleanup errors. The [numeric summary](framey-vr-standby-gate-2026-10-26.json)
+records all three outcomes.
+
+The intermittent hidden-overlay condition remains a reliability limit. The
+runner now records a small read-only diagnostic and refuses to send synthetic
+input if the overlay stays hidden after its focus retry. A successful Chromium
+panel alone is not treated as VR visibility.
+
+At 02:07 UTC, a fourth combined-head run with a bounded overlay wait passed
+without a focus retry. The sample setting/input and stereo checks passed; power
+settings were restored, the recovery timer was removed, and the owned lock was
+released. This single pass does not prove that the wait eliminates intermittent
+hidden overlays. Battery changed from 100% to 99% during the run.

docs/evidence/framey-web-browser-2026-10-26.md

@@ -0,0 +1,48 @@
+# Official Web Browser 1.4.3 frontend follow-up
+
+The exact official Decky store archive for ID 59 is 91,859 bytes and matched
+SHA-256 `1192864fddc5d72550346b8dff02c21d71f0c40a06ac41c4e67bb6220d267f9d`.
+Its legacy bundle calls `deckyFrontendLib.getReactRoot` when attempting to patch
+Steam's main menu and search bar. The prior full-catalog audit recorded
+`getReactRoot is not a function` and initializer failure.
+
+Framey's isolated iframe has no Steam React root. The host now exposes
+`getReactRoot()` with a **null** result, consistent with its existing inert
+`findInReactTree()` lookup. It never returns a fabricated Steam tree or permits
+patching the user's Steam UI. The focused Node host test checks this contract.
+
+A focused local Chromium run used the verified archive through
+`scripts/framey-audit-browser.py`, with every backend method, fetch and
+WebSocket denied. The exact frontend reported `ready=true` with no initializer
+error after 2.5 seconds, and again during a longer ten-second observation.
+It attempted `set_main_tab` and `load`; the audit denied both. Console output
+reported that no Steam window or main-menu root was available. The panel did
+not show a usable browser view in the audited state.
+
+Static inspection of this archive's published Python backend shows
+`set_main_tab()` requesting a Steam GamepadUI CDP tab, then returning a key and
+port for its own WebSocket server. That Steam tab and browser injection path
+are outside Framey's isolated panel. No real plugin backend was executed, no
+browser tab or navigation was verified, and no real Frame or worn-VR check was
+performed for this change. The catalog retains **broken** for this digest; its
+reason and focused observation now distinguish successful initialization from
+the unresolved core browser dependency. The full 116-plugin browser baseline
+still refers to its earlier host commit; this is a one-plugin follow-up.
+
+## Unworn Framey regression gate
+
+The exact code commit `d5e62f643d462b7070f27c2c47b11b4aa9982094` ran
+`scripts/framey-vr-check.py --exercise` under its own shared-lock owner at
+07:26 UTC. Preflight found SteamVR activity 3 (standby), proximity 6.25 and
+battery 100%. The real Decky sample setting saved `enabled=true`, survived a
+fresh iframe, and the quick action read the saved value. A trusted synthetic
+OpenVR pointer, slider value 50, CDP text entry after focus and changed stereo
+compositor hashes passed. The mirror capture SHA-256 was
+`4f0d977fab7c144a3490b12ebefddacf3126db585057eb022006ffdf844a7498`.
+The command exited 0 with `passed=true`; original power settings (`false` and
+`5.000000`) were read back, battery ended at 99%, the recovery timer was
+removed, cleanup errors were empty and only its own lock was released. The
+private full report is `/tmp/framey-web-browser-vr-d5e62f6/result.json` on the
+test host. This verifies the sample-panel regression path, not the official
+Web Browser plugin or a worn headset. Synthetic native scroll still did not
+move.

docs/evidence/framey-worn-proximity-gate-2026-10-26.md

@@ -0,0 +1,20 @@
+# Interactive Framey worn-check proximity gate, 26 October 2026
+
+The interactive `scripts/framey-worn-check.py` already required an explicit
+operator wear confirmation and a unique `/tmp/frame-test.lock` owner before
+reading SteamVR activity. It did not read proximity. This change makes its
+locked preflight read the raw proximity sensor and stop before its interaction
+window when the reading is missing or invalid. It checks activity, proximity
+and battery again before input. The same owned-lock cleanup applies on failure.
+
+The focused local gate suite passes 9/9 tests, including missing and nonfinite
+proximity, proximity disappearing between reads, metrics preceding the SteamVR status row,
+standby, low battery, no operator confirmation and a foreign lock. No headset
+input was sent for this change. A separate owner-locked read-only Frame check
+found SteamVR activity 3 (standby), proximity raw 3.0625 and battery 93%; it
+released its lock without a worn test.
+
+The raw proximity value is not calibrated as proof of wear. The operator's
+in-person confirmation remains required; awake activity, proximity and trusted
+synthetic input alone do not prove wearer-visible pixels or physical controller
+usability. The hourly worn-check schedule remains enabled.

docs/evidence/intel-mac-v0.4.39-2026-10-26.json

@@ -0,0 +1,288 @@
+{
+  "release": "v0.4.39",
+  "tagCommit": "fd0b0a946f11d92fd1cc480cd9d1a83be795bf71",
+  "job": "1vbt29ptkw",
+  "date": "2026-10-26",
+  "host": {
+    "model": "MacBookAir9,1",
+    "cpu": "Intel Core i3-1000NG4",
+    "arch": "x86_64",
+    "macOS": "15.7.7",
+    "build": "24G720"
+  },
+  "artifacts": {
+    "Frame-Control-mac-x64.dmg": {
+      "bytes": 169230398,
+      "sha256": "f47b5a188b5090f97a72467394d4fa65ccc73fe3169a6276e2a32cab5c8019d8",
+      "matchesSHA256SUMS": true
+    },
+    "Frame-Control-mac-x64.zip": {
+      "bytes": 169141014,
+      "sha256": "bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7",
+      "matchesSHA256SUMS": true
+    }
+  },
+  "native": {
+    "title": "Apps \u00b7 Frame Control",
+    "bridge": true,
+    "preferencesBefore": {},
+    "views": [
+      {
+        "view": "apps",
+        "title": "Apps \u00b7 Frame Control",
+        "heading": [
+          "Apps"
+        ]
+      },
+      {
+        "view": "games",
+        "title": "Games \u00b7 Frame Control",
+        "heading": [
+          "Games"
+        ]
+      },
+      {
+        "view": "tools",
+        "title": "Tools \u00b7 Frame Control",
+        "heading": [
+          "Tools"
+        ]
+      },
+      {
+        "view": "settings",
+        "title": "Settings \u00b7 Frame Control",
+        "heading": [
+          "Settings"
+        ]
+      },
+      {
+        "view": "privacy",
+        "title": "Privacy & updates \u00b7 Frame Control",
+        "heading": [
+          "Privacy & updates"
+        ]
+      },
+      {
+        "view": "capture",
+        "title": "Capture \u00b7 Frame Control",
+        "heading": [
+          "Capture & Live"
+        ]
+      },
+      {
+        "view": "decky",
+        "title": "Decky Loader \u00b7 Frame Control",
+        "heading": [
+          "Decky Loader"
+        ]
+      }
+    ],
+    "decky": {
+      "state": "116 plugins in the official store. Select a plugin to install it.",
+      "rows": 40,
+      "search": "ProtonDB Badges \u00b7 1.3.4 Display tappable ProtonDB badges on your game pages\n\npartial: Settings render locally and read-only get_setting RPC returned the default through real Decky 3.3.0 on ARM64 Frame. Steam game-page badges have no patch target; live writes and VR controls unverified. Verified: static archive, local browser, fake-Frame, real Frame SSH.\n\nInstall",
+      "installDisabled": [
+        {
+          "text": "Install",
+          "disabled": true
+        }
+      ]
+    },
+    "preferenceWritten": "0",
+    "preferencesAfter": {
+      "mvSeparate": "0"
+    },
+    "update": {
+      "status": "available",
+      "current": "0.4.39",
+      "error": null,
+      "canInstall": true,
+      "latest": "0.4.40"
+    },
+    "obs": {
+      "before": {
+        "state": "idle",
+        "alias": "",
+        "port": 15099,
+        "error": "",
+        "supported": true
+      },
+      "start": {
+        "state": "starting",
+        "alias": "frame",
+        "port": 15139,
+        "error": "",
+        "supported": true
+      },
+      "stop": {
+        "state": "stopping",
+        "alias": "frame",
+        "port": 15139,
+        "error": "",
+        "supported": true
+      },
+      "after": {
+        "state": "idle",
+        "alias": "frame",
+        "port": 15139,
+        "error": "",
+        "supported": true
+      }
+    },
+    "preferencesAfterRestart": {
+      "mvSeparate": "0"
+    }
+  },
+  "loginItem": {
+    "enabledBeforeQuit": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "nativeQuit": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\nPRESS 0\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "restartPid": 50393,
+    "enabledAfterRestart": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "beforeRestore": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "restoreOff": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\nPRESS 0\n",
+    "finalMenu": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "restoredOriginalOff": true
+  },
+  "macHelper": {
+    "permissions": {
+      "accessibility": false,
+      "screen": false
+    },
+    "displays": {
+      "displays": [
+        {
+          "h": 900,
+          "id": 69734464,
+          "main": true,
+          "name": "Built-in Retina Display",
+          "src": "display:69734464",
+          "w": 1440
+        }
+      ]
+    },
+    "windows": {
+      "screen": false,
+      "count": 3,
+      "frameControlCount": 2
+    }
+  },
+  "headset": {
+    "timestamp": "2026-10-26T04:56:52.808203+00:00",
+    "route": "Mac SSH -> pinned lxso2 -> trusted frame SSH",
+    "owner": "intel-v0439-1vbt29ptkw-20261026",
+    "payloadBytes": 54,
+    "coordinatorLock": "locked\n",
+    "headset": {
+      "os": {
+        "VERSION_ID": "0.5.6",
+        "BUILD_ID": "20261022.6153909",
+        "VARIANT_ID": "vr"
+      },
+      "battery": [
+        {
+          "percent": 99,
+          "status": "Not charging"
+        }
+      ],
+      "homeStorage": {
+        "total": 996984774656,
+        "free": 769012412416
+      },
+      "screenshotJpegs": 7,
+      "transfer": {
+        "path": "/tmp/intel-v0439-1vbt29ptkw-20261026-vtynzyky/intel-mac-check.txt",
+        "bytes": 54,
+        "sha256": "82029b7e8b519bac65e43a6e90386a06da9988b23330aa7c48fea0abdfac0a8b",
+        "deleted": true
+      }
+    },
+    "headsetLockReleased": true,
+    "coordinatorLockRelease": "released\n"
+  },
+  "gatekeeper": {
+    "downloadMethod": "gh release download",
+    "downloadQuarantinePresent": false,
+    "controlledSyntheticQuarantine": "inconclusive",
+    "cleanQuarantinedOpen": "NSPOSIXErrorDomain Code=16 Resource busy",
+    "cleanSpctl": "timeout after 15 seconds",
+    "rightClickOpenVerified": false,
+    "openAnywayVerified": false,
+    "appSpecificXattrFallbackUsed": true,
+    "globalGatekeeperChanged": false
+  },
+  "headsetCleanupReadback": {
+    "headset": {
+      "testFoldersAbsent": true,
+      "lockAbsent": false,
+      "subsequentLockOwner": "frame-smoke-92bb2294f1d9cd4b7084",
+      "subsequentLockLeftUntouched": true
+    },
+    "coordinatorLockAbsent": true
+  },
+  "cleanup": {
+    "debugPortClosed": true,
+    "originalPreferencesRestored": true,
+    "ownedAppRemaining": [],
+    "desk": {
+      "foreground_apps": [
+        "Finder",
+        "Messages",
+        "cmux"
+      ],
+      "display_on": false,
+      "notifications_found": 0,
+      "attention": []
+    },
+    "dmgejected": true,
+    "installedSignatureValidAfterRuntime": true,
+    "finalInstalledSignature": {
+      "removedOnlyGeneratedBytecodeFiles": 36,
+      "finalSignatureExit": 0,
+      "finalSignatureStderr": ""
+    }
+  },
+  "validation": {
+    "sourceBase": "741735aa98e615fb51bb1a5adb665c9d12e3fd2a",
+    "initialMacFullSuite": {
+      "python": "system 3.9",
+      "tests": 1621,
+      "failures": 6,
+      "skipped": 20,
+      "seconds": 818.353
+    },
+    "affectedMacModulesAfterFix": {
+      "python": "official bundled 3.12",
+      "tests": 87,
+      "skipped": 2,
+      "seconds": 37.605,
+      "result": "OK"
+    },
+    "focusedAppTests": {
+      "tests": 14,
+      "passed": 14
+    },
+    "websiteTests": {
+      "tests": 18,
+      "passed": 18
+    },
+    "testFixes": [
+      "Skip local Frame recording shell fixtures on Bash 3.2, whose read timeout status differs from Frame Bash 5",
+      "Require actual XCTest.framework for standalone XCTest contracts",
+      "Separate OBS fixture interpreter startup from stream-stall deadlines and synchronize signal-handler readiness",
+      "Leave margin between panel fixture delays and individual X tool timeouts"
+    ],
+    "linuxFullSuiteAfterFix": {
+      "tests": 1621,
+      "skipped": 16,
+      "seconds": 170.313,
+      "result": "OK",
+      "isolation": "temporary archived checkout on lxso2"
+    },
+    "testedFileSHA256": {
+      "tests/test_clips.py": "00ba70866cda2b6cacaa0dd9bd19e9f2a9532a035cef66c9d8e2bd0021b1f489",
+      "tests/test_ios_contracts.py": "f1cc22e54873617e381025233c6b422245e6943ba7432331fc2d01e7a9ae4fc1",
+      "tests/test_obs_headset_source.py": "62462cbadbfcf67d4c200edf54ee45697b6f8d6547cd4c538f0344d71cf70241",
+      "tests/test_touch.py": "c34c646d134e57130c4fb43cd3d53e6c859369f774f9b7fd1dd8c3e718b72b6f"
+    }
+  }
+}

docs/evidence/intel-mac-v0.4.39-2026-10-26.md

@@ -0,0 +1,181 @@
+# Intel Mac acceptance test: official v0.4.39, 26 October 2026
+
+Tested on the physical **MacBookAir9,1, Intel Core i3-1000NG4 1.10 GHz,
+8 GB RAM, macOS 15.7.7 (24G720), x86_64**. Job `1vbt29ptkw` repeated the
+[earlier release test](mac-v0439-2026-10-26.md) and added ZIP verification,
+native menu actions and Open at Login persistence. The app under test was
+the official [v0.4.39 release](https://github.com/saphid/frame-control/releases/tag/v0.4.39),
+tag commit `fd0b0a946f11d92fd1cc480cd9d1a83be795bf71`.
+It was not rebuilt or patched. Current source validation is reported separately.
+
+## Download and clean DMG installation
+
+Downloaded both Intel assets and `SHA256SUMS` from that exact tag with
+`gh release download`. Independently calculated SHA-256 values matched the
+same-release manifest:
+
+| Asset | Bytes | SHA-256 |
+|---|---:|---|
+| `Frame-Control-mac-x64.dmg` | 169,230,398 | `f47b5a188b5090f97a72467394d4fa65ccc73fe3169a6276e2a32cab5c8019d8` |
+| `Frame-Control-mac-x64.zip` | 169,141,014 | `bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7` |
+
+Mounted the DMG read-only with `hdiutil attach -readonly -nobrowse` and
+unpacked the ZIP separately. For each app, `file` reported
+`Mach-O 64-bit executable x86_64` and `lipo -info` reported:
+
+```text
+Non-fat file: …/Contents/MacOS/Frame Control is architecture: x86_64
+```
+
+The DMG's bundled Python and `frame-mac-view` are also x86_64; `adb` is
+universal with x86_64 and arm64 slices. Both fresh bundles passed
+`codesign --verify --deep --strict --verbose=2`. Signing is ad hoc, with no
+TeamIdentifier. This verifies the resource seal, not Apple notarization.
+
+Preserved the existing `/Applications/Frame Control.app` in the task's
+temporary directory. An initial `ditto` overlay retained that installation's
+extra Python bytecode caches and failed signature verification. Moved that
+copy aside and copied the DMG app into an empty destination. The clean copy
+passed `codesign --verify --strict`; the release bundles themselves passed.
+The final installed app is the clean DMG copy.
+
+## Gatekeeper: tested fallback, incomplete first-open coverage
+
+The CLI downloads had **no `com.apple.quarantine` attribute**. This Air had
+already launched the same app in the earlier job, so it is not a pristine
+first-install trust environment. A controlled probe added only this app's
+quarantine attribute (`0083;<timestamp>;FrameControlIntelReleaseTest;`).
+That is synthetic metadata, not a Safari or Chrome download.
+
+The overlaid copy's first `open` returned 0 and later produced a translocated
+app process. After making the clean copy, a quarantined `open` returned:
+
+```text
+The application cannot be opened, error=Error Domain=NSPOSIXErrorDomain Code=16 "Resource busy"
+```
+
+Assessment of the clean copy with `spctl --assess --type execute -vv` did
+not finish within 15 seconds. No readable Gatekeeper warning was captured;
+the controlled probe is **inconclusive**. Do not interpret `open` returning
+0 as proof of passing Gatekeeper. Native screen capture was unavailable.
+
+The exact app-specific fallback used for the verified clean copy was:
+
+```sh
+xattr -dr com.apple.quarantine "/Applications/Frame Control.app"
+```
+
+The installed app then launched successfully. No global Gatekeeper setting
+was changed. For a normal user, verify the Intel download, mount the DMG,
+drag the app to Applications and open it. If macOS blocks it, Apple's
+documented route is **System Settings → Privacy & Security → Open Anyway →
+Open**, after the initial attempt. **Right-click Open and Open Anyway were
+not exercised in this run**; neither is certified here. The Terminal command
+above is the fallback actually exercised, limited to this trusted app.
+
+## Official native app checks
+
+Controlled runs disabled telemetry and used a task-local server data
+directory. A temporary loopback CDP port inspected the actual Electron
+renderer and its real `window.frameApp` bridge. This was not a web-only
+substitute. Native menu actions used Apple's Accessibility API through an
+existing authorized SSH session; no Accessibility grant was added. Direct
+System Events/AppleScript calls timed out. The API route is why this run can
+verify native menu actions that the earlier evidence left untested.
+
+| Check | Result |
+|---|---|
+| Launch | **Pass.** Native window, real IPC bridge and bundled Python server loaded. Version remained 0.4.39 |
+| Offline UI | **Pass.** Apps, Games, Tools, Settings, Privacy & updates, Capture & Live and Decky rendered their expected headings |
+| Decky store | **Pass.** Official store returned 116 plugins, with 40 initial rows. Search displayed ProtonDB Badges 1.3.4 and its compatibility text. Install stayed disabled; no loader or plugin was installed |
+| Settings save | **Pass.** Native preferences initially `{}`; `mvSeparate="0"` saved, read back and survived a real app restart. Restored the original absence of the preferences file afterward |
+| Update check | **Pass.** Native IPC returned `available`, current 0.4.39, latest 0.4.40, `error=null`, `canInstall=true`. The actual Check for Updates menu action also succeeded. No update installed |
+| OBS Start/Stop | **Partial.** Native status supported/idle → Start on port 15139 returned starting → Stop returned stopping → idle. This checks local helper lifecycle; no OBS receiver or headset stream was exercised |
+| Open at Login | **Pass for toggle and persistence.** Native menu began unchecked. AXPress returned success, then the checkmark appeared. Native Quit/relaunch preserved it. Toggled off and independently read the unchecked menu back. Actual logout/login execution remains untested |
+| Show Server Log | **Partial.** Native menu AXPress succeeded and launched Console. The log contains startup with the installed bundled Python/server paths. The viewer's displayed document was not independently read back |
+| Intel Mac helper | **Pass for read-only commands.** `permissions`, `displays` and `windows` returned JSON. One 1440×900 built-in display was listed; screen/accessibility permissions were false. No capture or permission request was initiated by these commands |
+
+[Native searched Decky store screenshot](intel-mac-v0.4.39-2026-10-26.png).
+[Structured observations](intel-mac-v0.4.39-2026-10-26.json).
+
+## Headset: read-only checks and one temporary transfer
+
+`frame.local` resolved, but its LAN port 22 returned **No route to host**.
+The Tailscale endpoint answered TCP 22, but direct SSH and the app refused
+the Air's stale/missing host trust. No pin was replaced to bypass that
+failure. Used the already-pinned `saphid@lxso2` coordinator relay and its
+trusted `frame` SSH connection instead.
+
+Atomically acquired `/tmp/frame-test.lock` on the coordinator and headset
+with owner `intel-v0439-1vbt29ptkw-20261026`. Under those locks:
+
+- Read SteamOS **0.5.6**, variant `vr`, build **20261022.6153909**.
+- Read battery **99%, Not charging**.
+- Read home storage: **996,984,774,656 bytes total**, **769,012,412,416 free**.
+- Listed **7** JPEGs matching Steam's
+  `userdata/*/760/remote/*/screenshots/*.jpg`; no screenshots were copied.
+- Sent a **54-byte** payload originating on this Mac through the relay into
+  an exclusively created `/tmp/intel-v0439-1vbt29ptkw-20261026-…/` folder.
+  Its readback SHA-256 matched
+  `82029b7e8b519bac65e43a6e90386a06da9988b23330aa7c48fea0abdfac0a8b`.
+  Deleted the exact file and its temporary folder.
+- Released only matching owned locks. Separate readback confirmed the
+  headset lock was absent immediately after release. A later independent check
+  found the transfer folder absent and coordinator lock absent, while the
+  headset lock had been acquired by another job (`frame-smoke-92bb2294f1d9cd4b7084`);
+  that different owner was left untouched.
+
+This verifies a relay transfer, **not the native app's direct file-transfer
+path**. No existing headset content, installs, services, settings, power
+state or SteamVR state was changed. No wipe or reboot was attempted.
+
+## Bugs, validation and remaining limits
+
+No new Intel-specific product bug was isolated in these runtime checks.
+The earlier v0.4.39 shutdown race already has a merged fix in
+[PR #284](https://github.com/saphid/frame-control/pull/284), shipped in
+v0.4.40. This run did not install or validate the v0.4.40 Intel app.
+
+The initial full source suite on system Python 3.9 ran **1,621 tests in
+818.353 seconds**, with **six failed assertions and 20 skips**. These were
+source-test issues, separate from the released native checks:
+
+- The recording fixture's time limit ended with `q`, because macOS Bash 3.2
+  reports read timeout as status 1, the same as EOF. Frame Bash 5 reports a
+  value above 128. Local recording-shell tests now explicitly require Bash 4+.
+- The Foundation XCTest test found `swiftc` but failed `import XCTest`:
+  the active Command Line Tools installation has no XCTest framework.
+  It now checks for the actual framework and skips when unavailable.
+- Two OBS tests (three assertions, including subtests) started 0.15/0.3-second
+  watchdog clocks before the fixture's Python interpreter and signal handler
+  were ready. Fixture startup is now synchronized or separately budgeted;
+  the short stream-stall checks remain. Production watchdog limits did not change.
+- The panel timeout fixture's 4.6-second sleeps were too close to each tool's
+  five-second timeout once process startup was included, causing the wrong
+  failure path. Three-second sleeps still exhaust the 12-second overall
+  deadline before a panel is complete, with margin for process startup.
+
+All four affected modules then passed on this physical Air with the official
+app's bundled Python 3.12: **87 tests, two explicit prerequisite skips,
+37.605 seconds**. Focused native app tests passed **14/14** and website tests
+**18/18**. An isolated Linux checkout of base `741735a` plus the exact four
+test-file changes passed the **full 1,621-test suite, 16 skips, 170.313 seconds**,
+including recording-shell fixtures under modern Bash. No full Mac suite pass
+after these corrections is claimed.
+
+Final native cleanup confirmed the app processes and loopback debug port were
+closed, original preferences restored, Open at Login off, the DMG ejected and
+its installed signature still valid. External test subprocesses had generated
+36 Python bytecode files inside the bundle; removed only those absent from
+the verified clean release before the final signature check. The native app
+uses `-B` itself. The installed desk cleanup tool reported
+only **Finder, Messages and cmux** in front, **zero notifications**, no items
+needing attention and the **display asleep**. The official app remains installed;
+previous copies and raw test logs are retained in `/tmp/frame-control-v0439-intel`.
+The desk hold is released at the end of the task.
+
+Actual login startup, ordinary browser quarantine/first-open override,
+direct app/headset transfer, real OBS audio/video, Mac screen capture,
+headset VR interaction, wearer comfort and controller input remain untested.
+No social post was made. PR #113 was left untouched; merging and releasing
+remain with the lxso2 coordinator.

docs/evidence/mac-desktop-2026-10-26.md

@@ -0,0 +1,116 @@
+# Physical Mac desktop check, 26 October 2026
+
+Host: **MacBook Air (MacBookAir9,1), Intel Core i3 1.1 GHz, macOS 15.7.7
+(24G720), x86_64**. This is physical hardware. The console is an unattended
+server with display/automation restrictions. No Apple Silicon runtime result
+is inferred from this test.
+
+**Follow-up:** the official v0.4.39 Intel installer later launched on this Air.
+See the [released-build test](mac-v0439-2026-10-26.md); the results below remain
+the earlier ARM64 failure and separate candidate test.
+
+## Released installers: verified, installed, cannot run on Intel
+
+GitHub's latest release was v0.4.35 at the start; v0.4.36 became latest during
+the check. Each DMG and its SHA256SUMS were downloaded from that exact release
+with `gh release download`. Both passed `shasum -a 256 -c SHA256SUMS
+--ignore-missing` (only the downloaded asset was checked):
+
+| Release | Asset | SHA-256 |
+|---|---|---|
+| v0.4.35 | Frame-Control-mac-arm64.dmg | `eda670748679ca02fcf242870cd53954b22cf8b93af47a193c9903bd08a8334f` |
+| v0.4.36 | Frame-Control-mac-arm64.dmg | `4d13068f0cfd3616823d63c82333afa7e368c1d57d375e9564f5f7ed4f0ebbd7` |
+
+Each read-only DMG was mounted with `hdiutil attach -readonly -nobrowse`.
+There was no existing `/Applications/Frame Control.app`; the app was copied
+there with `ditto`, the command-line equivalent of the DMG's drag to
+Applications. `open "/Applications/Frame Control.app"` returned exactly:
+
+> The application cannot be opened because it has an incorrect executable format.
+
+`file` identified the executable as `Mach-O 64-bit executable arm64`.
+`codesign -dv` identified an ad hoc signature with no TeamIdentifier. The
+v0.4.35 `spctl -a -vv` assessment returned `rejected`. The v0.4.36 assessment
+stalled and is not counted as a completed assessment.
+
+**No Gatekeeper warning dialog was observed.** LaunchServices rejected the
+architecture first. The CLI download had no `com.apple.quarantine` attribute,
+so this was not a browser-quarantine test. Neither right-click Open, Open
+Anyway nor removing quarantine was tested. On this Intel Mac there is no
+honest opening workaround for either released ARM64 app. Rosetta does not
+run ARM64 apps on Intel. The README now separates that fact from Apple's
+recommended Open Anyway flow for compatible Macs and labels the latter
+unverified here. No global Gatekeeper setting was changed.
+
+## Separate Intel candidate: partial native runtime pass
+
+[PR #262](https://github.com/saphid/frame-control/pull/262), commit `6ea9eb2`,
+adds native x64 DMG/ZIP builds, pinned x64 Python, an x86_64 Swift helper, and
+CI architecture checks. Swift 6.2.4 rejected an ambiguous
+`Data.withUnsafeMutableBytes` overload in the helper; an explicit
+`UnsafeMutableRawBufferPointer` annotation compiled successfully on this Air.
+
+`npm run dist:mac:x64` completed locally, producing an ad hoc signed app,
+ZIP and DMG. The unpacked candidate was copied to
+`/Applications/Frame Control Intel Test.app` and launched with telemetry off,
+a task-local server data directory and a temporary loopback debug port.
+This is **not** the published v0.4.36 binary.
+
+The first launch stalled for several minutes before app code ran. A process
+sample showed only `_dyld_start`, a 12 KiB footprint and no loaded image
+list, while `syspolicyd` used about 89% CPU. It later proceeded without any
+system-service restart; the app window and server loaded. The initial stall
+is a host observation, not proof of a Frame Control bug. Restarting that
+security daemon was rejected by automatic approval review, and was not done.
+
+| Check | Observed result and limit |
+|---|---|
+| Native window and IPC bridge | The Electron renderer displayed Apps and the offline identity warning; `window.frameApp` was present. Native renderer inspected through its temporary loopback CDP port; this does not prove every macOS permission dialog or physical click |
+| Settings | Native preference read returned `{}`. Writing `mvSeparate="0"` read back correctly. The original preference file was restored byte-for-byte (or removed when originally absent) in a finally block. Persistence across an app restart is not claimed |
+| Open at Login | Source is opt-in and focused login-item tests passed. Native menu read via System Events timed out; an OS login session and actual checkbox state remain unverified. No login item was enabled |
+| Logs | `~/Library/Logs/Frame Control/server.log` exists. Its startup line proves the candidate used `Contents/Resources/python/bin/python3` and its bundled `ui/server.py`; HTTP reads and offline failures were logged. Show Server Log menu interaction was not verified |
+| Update check | Actual `frameApp.update.check()` completed with `status="none"`, `current="0.4.36"`, latest `0.4.36`, and `error=null`. No update was installed; native dialog dismissal was not verified |
+| OBS setup and lifecycle | Native status reported supported/idle, Start on port 15123 reported starting, Stop reported stopping, then idle. The Frame's SSH identity rejection prevented a headset stream. This checks local lifecycle only: no OBS app, audio/video delivery or receiver tested |
+| Decky store | The exact released UI/server resources, separately served by this Mac's existing Python 3.9.6, loaded 116 official entries in local Chromium. Forty rows rendered; searching ProtonDB found ProtonDB Badges 1.3.4; all Install buttons stayed disabled while offline. No loader or plugin was installed. [Browser screenshot](mac-decky-browser-2026-10-26.png) |
+| Other UI | Released Apps, Settings, Privacy & updates, Tools, Capture & Live and Decky views rendered. The privacy page correctly reported telemetry blocked by `FRAME_CONTROL_TELEMETRY=0`; sharing/contact choices were left alone. The activity log displayed the offline failure. The browser path hides native OBS buttons as designed; it is not a substitute for the native lifecycle check above |
+| Framey preview | No standalone local preview control was found in the desktop UI. The Framey panel belongs to the headset runtime; no VR or plugin-backend result is claimed |
+
+The released server refused a stale SSH host identity rather than silently
+trusting it. That safety check was preserved; no host pin was replaced just
+to make the test pass. Capture, media, game launches, power controls, installs,
+sign-ins and notifications were not triggered without a working connection.
+
+## Headset: read-only relay checks, no changes
+
+`frame.local` resolved on the Air, but direct TCP/SSH did not connect. The
+coordinator host lxso2 could reach it. The app's read-only `frame_status.py`
+was piped through lxso2 to the Frame and returned:
+
+- SteamOS **0.5.6**, build **20261022.6153909**, variant `vr`.
+- Battery **99%, Charging**.
+- Home storage: 996,984,774,656 bytes total, 769,023,275,008 bytes free.
+- A read-only search counted **14** Steam screenshot JPEGs; none was copied.
+
+The shared `/tmp/frame-test.lock` was owned by another Framey test on each
+check. This job did not acquire, remove or replace it. File upload/delete,
+OBS on the device and every other headset mutation were skipped. These relay
+reads do not prove the native Mac app's direct SSH or file-transfer path.
+The headset was never wiped or rebooted.
+
+## Validation and follow-up
+
+A disposable Linux checkout of exact commit `6ea9eb2` on lxso2 passed:
+**1,590 server tests (16 skipped)** and **46 app tests**. On the physical Air,
+**14 focused login-item/preferences/OBS tests** and **18 website tests** passed.
+Full Mac server/release suites were attempted but spawned helper programs
+stalled and timed out during the policy-service problem; they are not a pass.
+Node 22's complete app run cancelled sign-in tests around an unreferenced
+timeout; the exact same app suite passed on lxso2. CI uses Node 24.
+
+Required next steps: pass exact-head Mac packaging/architecture CI, publish
+an Intel asset through coordinator job mppkd9qczt, then repeat a normal
+browser-download/quarantine installation of that release on this Air. Verify
+Open Anyway and Open at Login through an authorized interactive console.
+Acquire the shared headset lock before a temporary transfer or real OBS test.
+Preserve all unverified labels until those checks actually pass. PR #113 was
+not changed. No social post was made.

docs/evidence/mac-v0439-2026-10-26.md

@@ -0,0 +1,102 @@
+# Official Intel Mac release test, 26 October 2026
+
+Physical **MacBookAir9,1, Intel Core i3 1.1 GHz, macOS 15.7.7 (24G720)**.
+The earlier ARM64 failure led to [#262](https://github.com/saphid/frame-control/pull/262),
+now merged. This test uses the published **v0.4.39**, tag `fd0b0a9`, rather
+than the locally built candidate. [Earlier results](mac-desktop-2026-10-26.md)
+remain a separate historical record.
+
+## Download, installation and Gatekeeper observations
+
+Downloaded `Frame-Control-mac-x64.dmg` and its same-release `SHA256SUMS`
+with `gh release download`. `shasum -a 256 -c SHA256SUMS --ignore-missing`
+passed for the downloaded asset:
+
+```text
+f47b5a188b5090f97a72467394d4fa65ccc73fe3169a6276e2a32cab5c8019d8  Frame-Control-mac-x64.dmg
+```
+
+Also clicked that asset in T3's Chromium browser. Its 169,230,398-byte download
+had the same hash. **Neither download had `com.apple.quarantine`.** T3's
+browser is not evidence of Safari/Chrome download metadata.
+
+Mounted the verified CLI DMG read-only, preserved the task's earlier ARM64
+installation, and copied `Frame Control.app` into `/Applications` with `ditto`
+(the command-line equivalent of dragging it there). The executable is x86_64;
+`codesign -dv` reports ad hoc signing. `open "/Applications/Frame Control.app"`
+returned success and the app started its bundled Python server.
+
+**No Gatekeeper warning dialog was observed.** `spctl --assess --type execute
+-vv "/Applications/Frame Control.app"` returned exit 3 and exactly:
+
+```text
+/Applications/Frame Control.app: rejected
+```
+
+Opening this unquarantined copy needed no override. This does not establish
+the warning or opening steps for a quarantined browser download. The README
+keeps Apple's Open Anyway guidance, explicitly unverified here. No quarantine
+attribute was removed and no global security setting was changed. System
+Events inspection timed out; an AppleEvent quit request returned “User
+cancelled” (-128). Native console/menu automation remains unavailable.
+
+## Official native app results
+
+After the normal launch, a second run disabled telemetry, used a task-local
+server data directory and enabled a temporary loopback renderer debug port.
+The app bundle was not patched. The following checks used its real renderer
+and `window.frameApp` IPC bridge; they are not physical mouse/menu tests.
+
+| Check | Result and limit |
+|---|---|
+| UI | Apps, Games, Tools, Settings, Privacy & updates, Capture and Decky views rendered with the expected headings. The activity log showed the stale SSH identity warning. [Native Apps screenshot](mac-v0439-native-2026-10-26.png) |
+| Settings | Initial native preferences were `{}`. `mvSeparate="0"` saved and read back, including after a real app restart. The original preferences file was restored byte-for-byte in `finally` (or removed if originally absent) |
+| Open at Login | Still opt-in in source; no login item was enabled. Actual menu checkbox and OS login behavior remain unverified because native automation was unavailable |
+| Logs | `~/Library/Logs/Frame Control/server.log` recorded startup with the installed app's `Contents/Resources/python/bin/python3` and `ui/server.py`. Show Server Log menu interaction remains unverified |
+| Update check | Native check returned current/latest `0.4.39`, status `none`, error `null`. No update installed |
+| OBS | Native Start on port 15123 returned `starting`; Stop returned `stopping`, then `idle`. This was offline: no OBS receiver or real headset audio/video |
+| Decky store | Native Load store returned 116 entries; 40 initial rows rendered. Search found ProtonDB Badges 1.3.4 and its compatibility text. Install remained disabled; no plugin/loader installed |
+| Framey preview | No standalone local Framey preview control found. No VR runtime result claimed |
+
+Closing the app through `window.close()` stopped its processes and closed
+the debug port. **The final shutdown log exposed a bug:** stdin EOF and the
+app's SIGTERM can overlap, raising `KeyboardInterrupt` while cleanup is
+installing its ignore handler. Cleanup can then stop before releasing staging
+or SSH resources. [#284](https://github.com/saphid/frame-control/pull/284)
+changes SIGTERM to request HTTP shutdown without raising into cleanup.
+
+The regression test injects SIGTERM at that exact cleanup boundary. On this
+physical Mac with the official app's bundled Python 3.12, it failed before
+the fix with exit -2 and the observed traceback. After the fix, all **45
+server integration tests** passed, including owned staging-file cleanup.
+This validates source from the fix PR, not a fixed published app.
+
+## Headset relay and small transfer
+
+`frame.local` resolved but TCP 22 returned **No route to host**. The native
+app refused a stale SSH identity; no pin was replaced. The trusted lxso2
+coordinator relay could reach the Frame. Both shared locks were absent.
+
+The relay test atomically created `/tmp/frame-test.lock` on the coordinator
+and the headset, each with this job's owner marker. It then:
+
+- Read battery **99%, Not charging** before and after; storage total
+  **996,984,774,656 bytes**, free **769,077,035,008 bytes**.
+- Listed **7** Steam screenshot JPEGs matching
+  `userdata/*/760/remote/*/screenshots/*.jpg`; no image was copied. This narrower
+  layout-specific count differs from the earlier broad JPEG search.
+- Sent a **40-byte** test payload from this Mac through lxso2, created one
+  reserved file in the Frame user's home using exclusive creation, and read
+  it back. SHA-256 matched
+  `457485db13f80d819d5301d337502c3df050c6b3eb6202be7aac85d2af8e0b92`.
+- Deleted that exact test file and released only the matching owned locks.
+  A separate SSH read verified the file and both locks were absent.
+
+This proves a bounded relay transfer, not native Mac app file transfer or
+direct `frame.local` connectivity. No existing headset file, app, service,
+power setting or SteamVR state was changed. The headset was not wiped or
+rebooted. Real OBS and wearer/controller interaction remain unverified.
+
+The DMG was ejected; the native app, debug port and task browser tab were
+closed; the desk hold was released. The official app remains installed for
+reproduction. No social post was made; PR #113 was left alone.

docs/evidence/v0436-release-smoke-2026-10-25.md

@@ -0,0 +1,24 @@
+# v0.4.36 release smoke on a real Frame
+
+On 25 October 2026 at 22:59 UTC, the release branch ran
+`scripts/frame-smoke.sh` from a physical Linux host against a real Steam Frame.
+The script and its Python implementation were byte-identical to the
+`v0.4.36` tag `1701e622dc1f9888560412a058fe816b19ca7e79`.
+The headset reported Frame OS 0.5.6, build `20261022.6153909`.
+
+The test acquired `/tmp/frame-test.lock` with a unique owner marker before
+reading device status or changing test titles. Its first read showed SteamVR
+activity level 3 (standby), proximity raw 6.3125, and battery 99%. The test
+ran only while that lock was owned. It released only its own marker and lock
+after the final cleanup.
+
+All **13 of 13** smoke steps passed: cleanup of reserved leftovers, devkit
+service read, status read, install/launch/remove for reserved ARM64, x86_64
+and Windows test titles, and final cleanup. The test did not pair a key. The
+test output was saved locally under `/tmp/frame-v0436-smoke-results/`; this
+summary omits the headset identifier and private device status fields.
+
+The headset was in standby. This test does not show wearer-visible game or
+Framey pixels, controller input, live Decky settings, or plugin actions.
+See [release v0.4.36](https://github.com/saphid/frame-control/releases/tag/v0.4.36)
+for the tagged installer and checksum checks.

docs/evidence/v0437-release-smoke-2026-10-26.md

@@ -0,0 +1,24 @@
+# v0.4.37 release smoke on a real Frame
+
+On 26 October 2026 at 00:27 UTC, a physical Linux host ran the release
+`scripts/frame-smoke.sh` against a real Steam Frame. The smoke scripts were
+byte-identical to tag `v0.4.37` (`5239dae1a82c35635ef89f59eac9721c5014e2ed`).
+The headset reported Frame OS 0.5.6, build `20261022.6153909`.
+
+The test acquired `/tmp/frame-test.lock` with a unique owner marker before
+reading the headset. SteamVR activity stayed at 3 (standby); initial proximity
+raw was 6.3125 and battery was 99%. The test released only its own lock after
+cleanup. Battery read 100% afterward.
+
+All **13 of 13** smoke steps passed. ARM64 and Windows test titles installed,
+launched, and were removed. The x86_64 title installed and was removed; its
+launch reported that Steam Linux Runtime 4.0 was found but not installed, so
+this result does **not** establish x86_64 game execution. Devkit properties and
+status reads passed. No key was paired. The final cleanup removed the reserved
+test titles and processes. The private result remains under
+`/tmp/frame-v0437-smoke-results/`; this summary omits headset identifiers and
+device status details.
+
+Because the headset was in standby, this test did not verify wearer-visible
+pixels, physical controller input, a Framey panel, or official Decky plugin
+settings in VR. Those checks remain on the [worn checklist](../framey-vr-check.md).

docs/evidence/v0438-release-smoke-2026-10-26.json

@@ -0,0 +1,32 @@
+{
+  "tag": "v0.4.38",
+  "commit": "d87b863aa3c61c9833045b29ba79c7534a351ef4",
+  "startedUtc": "2026-10-26T01:47:23Z",
+  "frameOSVersion": "0.5.6",
+  "frameOSBuild": "20261022.6153909",
+  "preflight": {
+    "steamVRActivity": 3,
+    "proximityRaw": 6.3125,
+    "batteryPercent": 100
+  },
+  "postflight": {
+    "steamVRActivity": 3,
+    "proximityRaw": 6.25,
+    "batteryPercent": 100
+  },
+  "smoke": {
+    "passed": 13,
+    "failed": 0,
+    "arm64": "running",
+    "x86_64": "runtime missing",
+    "windowsExe": "running",
+    "finalCleanupPassed": true,
+    "ownedProcessesAfterCleanup": 0
+  },
+  "sharedLock": "unique owner released",
+  "limits": [
+    "No worn headset",
+    "No physical controller input",
+    "No official Decky panel tested in this smoke"
+  ]
+}

docs/evidence/v0438-release-smoke-2026-10-26.md

@@ -0,0 +1,27 @@
+# v0.4.38 real Frame release smoke
+
+On 2026-10-26 at 01:47 UTC, the exact `v0.4.38` tag
+`d87b863aa3c61c9833045b29ba79c7534a351ef4` passed `scripts/frame-smoke.sh`
+on a real Frame running SteamOS 0.5.6 build `20261022.6153909`. The wrapper
+atomically acquired `/tmp/frame-test.lock` with a unique owner, then read
+SteamVR activity 3 (standby), proximity raw 6.3125 and battery 100%. It ran
+the smoke only after that preflight.
+
+All 13 smoke steps passed. The ARM64 test title ran. The x86_64 title correctly
+reported its runtime missing. The Windows executable ran through the ARM64
+Proton path. The final cleanup found no test processes and removed the reserved
+smoke titles. The read-only postflight still found activity 3 and battery 100%;
+the wrapper released only its own lock. The public numeric summary is
+[v0438-release-smoke-2026-10-26.json](v0438-release-smoke-2026-10-26.json).
+Private raw logs and process paths remain in `/tmp` and were not published.
+
+The new built-in shared-lock preflight on this PR's branch separately passed
+the same 13/13 smoke steps at 01:46 UTC, with activity 3, proximity raw 6.3125
+and battery 100% before the run. The lock was released after cleanup. The local
+`tests.test_smoke_cleanup` suite passed 20 tests, including refusal on a busy
+lock and release after a failed preflight. The built-in preflight was **not**
+part of the v0.4.38 tag; that release used the external lock wrapper described
+above.
+
+These checks did not involve a worn headset or prove Framey panel visibility,
+physical controller interaction, or optical comfort.

docs/evidence/v0439-release-2026-10-26.json

@@ -0,0 +1,212 @@
+{
+  "tag": "v0.4.39",
+  "tagCommit": "fd0b0a946f11d92fd1cc480cd9d1a83be795bf71",
+  "releaseUrl": "https://github.com/saphid/frame-control/releases/tag/v0.4.39",
+  "releaseId": 423799494,
+  "releaseWorkflow": {
+    "runId": 40258561639,
+    "conclusion": "success",
+    "jobsPassed": 6
+  },
+  "publishedLatest": true,
+  "assets": [
+    {
+      "name": "Frame-Control-linux-amd64.deb",
+      "size": 131444552,
+      "digest": "sha256:9ca74551fe47ea244f500e1b4119c02307d185d1acea6287a02a5f6c055c674e"
+    },
+    {
+      "name": "Frame-Control-linux-arm64.AppImage",
+      "size": 156170292,
+      "digest": "sha256:66bd8f644f6a0b06f1e46ff635c5b50e53d3f2a9c6736f12b737ee0ad1667335"
+    },
+    {
+      "name": "Frame-Control-linux-arm64.deb",
+      "size": 118529048,
+      "digest": "sha256:f6b476a2f3163028d0862a13d0c8890760bdc8fe52c1006f106d9e540de32a6a"
+    },
+    {
+      "name": "Frame-Control-linux-x86_64.AppImage",
+      "size": 164587947,
+      "digest": "sha256:240023c89bea049f0864da75f83ec235c138375c4fd1c4612953a4c5863610ca"
+    },
+    {
+      "name": "Frame-Control-mac-arm64.dmg",
+      "size": 162169626,
+      "digest": "sha256:c0243317555975b1a5588640ec6fe71db5014788858ff00dd45914b77c1fe99a"
+    },
+    {
+      "name": "Frame-Control-mac-arm64.zip",
+      "size": 162054585,
+      "digest": "sha256:08191f80d6c78ac8576e2e2fe7937f5c1689ebed780528e63b6fb41b3c90d823"
+    },
+    {
+      "name": "Frame-Control-mac-x64.dmg",
+      "size": 169230398,
+      "digest": "sha256:f47b5a188b5090f97a72467394d4fa65ccc73fe3169a6276e2a32cab5c8019d8"
+    },
+    {
+      "name": "Frame-Control-mac-x64.zip",
+      "size": 169141014,
+      "digest": "sha256:bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7"
+    },
+    {
+      "name": "Frame-Control-Setup-x64.exe",
+      "size": 136500288,
+      "digest": "sha256:44a9f4c072b8c10ec81b060484764af10607763c69d55ecdad6bd0b103b7207e"
+    },
+    {
+      "name": "Frame-Control-win-x64.zip",
+      "size": 183446427,
+      "digest": "sha256:14f3dae327f054431ecb7ed204144dc529e04a03b35b646925bd9812dc54c504"
+    }
+  ],
+  "sha256sumsDigest": "sha256:59cff0ab59e2a681656c0b15b3445ca0baa0546d03196f8c4ae58eae8785db25",
+  "updateJsonDigest": "sha256:afef87fa3869be3acf06dfaa4831a97b29ce9c5d275940a2202bc958c62f4d67",
+  "publisherDryRun": {
+    "passed": true,
+    "installerDigests": 10,
+    "digestAndChecksumChecks": 11,
+    "completeNotesCharacters": 3837
+  },
+  "downloadedAppImage": {
+    "name": "Frame-Control-linux-x86_64.AppImage",
+    "sha256": "240023c89bea049f0864da75f83ec235c138375c4fd1c4612953a4c5863610ca",
+    "isolatedXvfbHttpStatus": 200,
+    "serverStopped": true,
+    "serverHeaderPrefix": "FrameControl/1"
+  },
+  "downloadedIntelMacZip": {
+    "name": "Frame-Control-mac-x64.zip",
+    "sha256": "bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7",
+    "machOCpu": "x86_64",
+    "inspected": [
+      "app executable",
+      "bundled Python 3.12",
+      "Electron helper"
+    ],
+    "physicalRuntime": "unverified"
+  },
+  "realFrameSmoke": {
+    "sourceTag": "v0.4.39",
+    "started": "2026-10-26T02:20:45Z",
+    "buildId": "20261022.6153909",
+    "preflight": {
+      "activity": 3,
+      "proximity": [
+        6.3125
+      ],
+      "battery": [
+        100
+      ]
+    },
+    "passed": 13,
+    "failed": 0,
+    "steps": [
+      {
+        "name": "cleanup: leftovers from earlier runs",
+        "passed": true,
+        "seconds": 8.2
+      },
+      {
+        "name": "devkit service: properties.json",
+        "passed": true,
+        "seconds": 0.0
+      },
+      {
+        "name": "status",
+        "passed": true,
+        "seconds": 0.6
+      },
+      {
+        "name": "arm64: install",
+        "passed": true,
+        "seconds": 8.0
+      },
+      {
+        "name": "arm64: launch",
+        "passed": true,
+        "seconds": 3.5
+      },
+      {
+        "name": "arm64: remove",
+        "passed": true,
+        "seconds": 6.8
+      },
+      {
+        "name": "x86_64: install",
+        "passed": true,
+        "seconds": 7.9
+      },
+      {
+        "name": "x86_64: launch",
+        "passed": true,
+        "seconds": 3.5
+      },
+      {
+        "name": "x86_64: remove",
+        "passed": true,
+        "seconds": 6.6
+      },
+      {
+        "name": "exe: install",
+        "passed": true,
+        "seconds": 8.0
+      },
+      {
+        "name": "exe: launch",
+        "passed": true,
+        "seconds": 3.4
+      },
+      {
+        "name": "exe: remove",
+        "passed": true,
+        "seconds": 6.5
+      },
+      {
+        "name": "cleanup: everything this run installed",
+        "passed": true,
+        "seconds": 8.1
+      }
+    ],
+    "ownedLockReleased": true
+  },
+  "postReleasePr282": {
+    "headCommit": "ce6e8f807f44b614e5bbd5c5a5a6a2093236d917",
+    "mergedCommit": "67b9151513bc9fb550f5dfb2d2eec925df390ab3",
+    "exactHeadCiPassed": 11,
+    "unwornVrExercise": {
+      "passed": true,
+      "beforeActivity": 3,
+      "beforeBattery": [
+        99
+      ],
+      "afterBattery": [
+        99
+      ],
+      "overlayVisible": true,
+      "compositorChanged": true,
+      "stereoCaptureSha256": "c7edc11877aca35dd3aebe480feee93253d04825fe9bd75d02136bb7e3510b97",
+      "mirrorCaptureSha256": "8e5932fb0046b218a1781a6b06cfaa6e3c13dc7874799e287066ed6e43640cd4",
+      "syntheticPointerInputPassed": true,
+      "liveSettingReopened": true,
+      "nativeScrollMoved": false,
+      "powerRecoveryRemoved": true,
+      "ownedLockReleased": true,
+      "cleanupErrors": [],
+      "physicalControllerVerified": false,
+      "wornVisualVerified": false,
+      "officialPluginsInVrVerified": false
+    },
+    "realFrameSmoke": {
+      "passed": 13,
+      "failed": 0,
+      "beforeActivity": 3,
+      "battery": [
+        99
+      ],
+      "buildId": "20261022.6153909",
+      "ownedLockReleased": true
+    }
+  }
+}

docs/evidence/v0439-release-2026-10-26.md

@@ -0,0 +1,25 @@
+# v0.4.39 release gate, 26 October 2026
+
+The [published release](https://github.com/saphid/frame-control/releases/tag/v0.4.39) is GitHub's latest release. Its tag resolves to main commit `fd0b0a946f11d92fd1cc480cd9d1a83be795bf71`, after PRs #280 and #281 merged. The [tagged workflow](https://github.com/saphid/frame-control/actions/runs/40258561639) passed all six jobs: draft, Apple Silicon Mac, Intel Mac, Windows, Linux and checksums. The release has ten installers, `SHA256SUMS` and `update.json`. [Sanitized numeric results](v0439-release-2026-10-26.json) contain the exact asset sizes and GitHub digests.
+
+| Gate | Result |
+|---|---|
+| `scripts/publish-release.sh --dry-run v0.4.39` from the exact tag | Passed: all ten installer digests, regenerated `SHA256SUMS` digest, complete update notes and ten-asset `update.json` |
+| Downloaded Linux x86_64 AppImage | SHA-256 matched `240023c89bea049f0864da75f83ec235c138375c4fd1c4612953a4c5863610ca`; the tagged isolated Xvfb check received HTTP 200 with a `FrameControl/1` server header prefix and confirmed the server stopped |
+| Downloaded Intel Mac ZIP | SHA-256 matched `bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7`; ZIP inspection found x86_64 Mach-O app executable, bundled Python 3.12 and Electron helper |
+| Exact tagged `scripts/frame-smoke.sh` on the real Frame | **13/13** steps passed on SteamOS build `20261022.6153909`; locked preflight found SteamVR activity 3, proximity raw 6.3125 and battery 100%. Reserved test titles were removed and the script released its owner-token lock. |
+| Published release readback | GitHub reports `draft=false`, `prerelease=false`, latest tag `v0.4.39`; downloaded `update.json` lists ten unique assets, the stable release URL and complete safety notes |
+
+The first local AppImage launch attempt stopped before app startup because the execution sandbox denied Electron's sandbox host (`Operation not permitted`). Repeating the same tagged check with host permissions passed. The bundled release CI also ran its own AppImage launch check.
+
+The unworn VR runner's candidate evidence is [documented separately](framey-vr-standby-gate-2026-10-26.md). Its successful stereo and `/dev/video99` panel captures and synthetic OpenVR input are not a worn or physical-controller test. Two other attempts found an intermittently hidden overlay and failed safely. No person wore the headset for this release check. Physical controller input, optical comfort, VR keyboard, native scroll and official-plugin wearer-visible behavior remain unverified.
+
+The physical Intel MacBook Air ran an earlier candidate, but was unreachable for this exact tagged installer. The architecture and hash checks above do not prove physical Mac runtime. Physical Windows PC and macOS OBS/headset capture also remain unverified. No private room pixels or raw Steam log lines are included here.
+
+## Post-release Framey library change (#282)
+
+After v0.4.39 publication, [PR #282](https://github.com/saphid/frame-control/pull/282) merged at `67b9151513bc9fb550f5dfb2d2eec925df390ab3`. All eleven exact-head checks passed on `ce6e8f807f44b614e5bbd5c5a5a6a2093236d917`. This commit is **not** in v0.4.39. The [library-context evidence](framey-library-context-2026-10-26.md) covers its three newly partial official plugins and separate backend limits.
+
+The exact #282 source ran `scripts/framey-vr-check.py --exercise` under the shared lock from standby (activity 3, battery 99%). The sample panel became visible; stereo compositor pixels changed and `/dev/video99` mirror bytes were captured. Trusted synthetic OpenVR pointer input reached the repository sample's live Decky setting and the saved value survived reopening. Native scroll did not move. The runner removed its recovery timer, restored original power values, reported no cleanup errors and released its owner-token lock. Private images and room pixels remain outside this repository. The source came from an exact commit archive, so the runner's `sourceCommit` field was empty; the archive object ID was verified before extraction.
+
+Once the Frame returned to standby, the exact #282 source passed `scripts/frame-smoke.sh` **13/13** on the real SteamOS build `20261022.6153909`, with battery 99% at preflight. Test titles were removed and the lock was released. These checks cover the Framey sample and generic Frame smoke, not Steamback, PlayTime or Deck Settings in VR. No wearer or physical controller was involved; those limits remain open.

docs/evidence/v0440-candidate-frame-2026-10-26.md

@@ -0,0 +1,9 @@
+# v0.4.40 candidate: locked real Frame gates, 26 October 2026
+
+Source commit `9aa26a8322f74144c13528b6fb41edc451ec7eea` contains merged PRs #286–#288 and the candidate 0.4.40 version bump. The Frame ran SteamOS 0.5.6 build `20261022.6153909`. These are source checks before tagged installers exist.
+
+The unworn `scripts/framey-vr-check.py --exercise` acquired its random-owner `/tmp/frame-test.lock` from lxso2. Its locked read-only preflight found SteamVR activity 3 (standby), proximity 6.25, battery 100%, and original power values `false` and `5`. The repository sample panel became visible, the stereo compositor image changed, and `/dev/video99` supplied a mirror frame. Synthetic OpenVR pointer input produced a trusted click, changed the sample's live Decky setting, and the saved value survived a fresh iframe reopen. The quick action and native slider/text control paths completed; native scrolling did not move. The run exited 0, removed its temporary Decky/panel services and recovery timer, restored and read back the original power values, reported no cleanup errors, found battery 99%, and released its own lock. Private room and UI captures remain outside the repository.
+
+After the Frame returned to standby, `scripts/frame-smoke.sh` acquired a separate random-owner lock. Its preflight found activity 3, proximity 6.25, and battery 100%. All **13/13** steps passed, including ARM64, x86-64 and Windows-executable install/launch/remove and final cleanup. The command exited 0, which includes successful release of its owned lock. Its private detailed result remains outside the repository.
+
+These checks exercise Frame Control's repository sample and generic title paths. They do not run the official Deck Shelves backend or prove its panel or Steam Home shelves in VR. The run did not include a wearer, physical controller, VR keyboard, native scrolling, or optical comfort check. A mirror capture and changed compositor pixels do not by themselves prove wearer-visible passthrough for this run. The [compatibility table](../framey-compatibility.md) retains those limits.

docs/evidence/v0440-release-2026-10-26.md

@@ -0,0 +1,45 @@
+# v0.4.40 tag and post-tag Frame checks, 26 October 2026
+
+The v0.4.40 annotated tag dereferences to main merge commit `a4d8073e3199671873d304b80a6acc8cdbd33866` from PR #291. The tag contains the 0.4.40 package and lockfile version. PR #291 passed all reported exact-head checks before merge, including Linux, Windows, macOS, iOS, fake Frame e2e and installer preview builds.
+
+## Real Frame, tagged source
+
+From an exact `v0.4.40` checkout, `scripts/frame-smoke.sh` acquired its unique `/tmp/frame-test.lock` owner before any headset read. Locked preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. On SteamOS 0.5.6 build `20261022.6153909`, all **13/13** reserved title steps passed: ARM64, x86_64 and Windows executable install, launch and remove, plus final cleanup. The command exited 0, which includes successful removal of its own lock. Its detailed result remains private under `tests/smoke/results/2026-10-26T035641Z-20261022.6153909.json` in the test checkout.
+
+## Real Frame, next main source
+
+After #289 and #290 merged, `scripts/framey-vr-check.py --exercise` ran from main commit `56bde24be1d38ac060e8ff287455182765e48564` under its own unique shared lock. The locked preflight found activity 3, proximity 6.25, battery 99%, dashboard already visible, and original SteamVR power values `false` and `5`.
+
+The repository sample panel appeared in the stereo compositor; before/after compositor hashes differed and `/dev/video99` returned a mirror frame. Synthetic OpenVR pointer events were trusted by the panel. A real Decky 3.3.0 backend saved the sample setting from off to on; an independent settings-file read returned `{"enabled": true}`, and a fresh iframe reopen showed on. The quick action, slider value 50 and text entry path completed. Native scroll was attempted but its measured offset stayed 0. This exercise did not run an official store plugin.
+
+The command exited 0. It removed test services and temporary profile/plugin paths, restored and read back the original power values, removed its recovery timer, reported no cleanup errors, found battery still 99%, and released its own lock. Its immediate final SteamVR activity was 0 after the temporary wake; the saved standby power behavior was restored. Private room and UI captures remain outside Git.
+
+No person wore the headset. A stereo screenshot, changed pixels, trusted synthetic input and mirror frame do **not** prove wearer-visible passthrough, physical controller usability, VR keyboard behavior, native scrolling, optical legibility or comfort. The [worn checklist](../framey-vr-check.md#three-minute-worn-checklist) and hourly check remain necessary. Official TabMaster, Deck Shelves, ProtonDB Badges and other store panels were not exercised in this run.
+
+## Downloaded tagged installers
+
+The draft release's GitHub digest for `Frame-Control-linux-x86_64.AppImage` is `sha256:cded3c660e41eb04e835e28057da81345075c4dbe9a009f397aea1da59655b3d`. A fresh download matched it. After setting the download's executable bit, `scripts/check-appimage-launch.py` launched that exact file under isolated Xvfb: its bundled server answered HTTP 200 with `FrameControl/1`, then stopped on shutdown.
+
+The draft release's GitHub digest for `Frame-Control-mac-arm64.zip` is `sha256:98f6d118d0db0cba10c3e4bfcd618953f10ba1c35246ce26041ecd39a1d3aff0`. Fresh local and physical-Mac copies matched. On a reachable physical arm64 Mac running macOS 26.5.2, a private temporary extraction reported bundle version 0.4.40; `lipo -verify_arch arm64` passed for the app executable, bundled Python, adb and Mac viewer. Its bundled Python imported `http.server`, `ssl` and `sqlite3` and reported OpenSSL 3.5.8. The temporary directory was removed and checked absent.
+
+That Mac already had a person's Frame Control app running, so no tagged GUI was launched, replaced or quit. The physical Intel Air was unreachable from this worker; the tagged Intel artifact's build check and bundle-architecture CI are separate from a physical Intel runtime test. No macOS Gatekeeper browser-download path was tested.
+
+## Tagged workflow and checksum gate
+
+The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40266393941) ran at `a4d8073e3199671873d304b80a6acc8cdbd33866` and passed all six jobs: draft, Apple Silicon Mac, Intel Mac, Windows, Linux and checksums. Its Linux job launched the built AppImage under Xvfb; its Mac jobs checked bundled binary architectures and Python imports; its Windows job installed the Setup executable, compared installed resources and ran the bundled Python PC-library tests.
+
+The draft has exactly ten installers and `SHA256SUMS`, each with a GitHub SHA-256 digest. Regenerating the checksum file from the ten asset digests produced bytes identical to the downloaded `SHA256SUMS`; its own digest matches `7457da8f292bc1b2b74cb989b4d179858055380721b26e23ccd595994701d1f8`.
+
+A fresh `Frame-Control-mac-x64.zip` download matched GitHub digest `52f257fc0dfc1b41e89ab0c7a551d667af4cc46f800e4f57e2689d47c856977c`. Independent ZIP inspection found x86_64 Mach-O app, bundled Python 3.12 and Mac viewer executables. This is packaging evidence, not a physical Intel Mac launch.
+
+## Publication and updater readback
+
+`scripts/publish-release.sh --dry-run v0.4.40` passed the exact tag, ten installer digests and regenerated `SHA256SUMS` gate. The release script then published [v0.4.40](https://github.com/saphid/frame-control/releases/tag/v0.4.40) at 2026-10-26 04:14:35 UTC. A direct GitHub latest-release read returned `draft=false`, `tag_name=v0.4.40`, ten installers, `SHA256SUMS` and `update.json`. A fresh download of the public `update.json` parsed as version 0.4.40, its stable tag page, ten assets with SHA-256 digests and the unworn-test limits in its notes. This release contains the tagged `a4d8073` commit, not later main changes.
+
+## Post-tag #292 panel regression
+
+PR #292 passed all 11 hosted checks on exact head `e0115f356d3b33369a61cfba034b080a7764559f` and merged as `784118b71e3463156574988121f47354d87358c7`. From that exact main commit, `python3 scripts/framey-vr-check.py --exercise --output /tmp/framey-v0440-post292` exited 0 on the real Frame. Its unique `/tmp/frame-test.lock` owner was acquired before any read and released on exit. Preflight: battery 99%, proximity 6.25, SteamVR activity 3 standby, dashboard already visible, saved power `false/5`.
+
+The temporary repository sample appeared in stereo compositor and mirror captures; compositor frame hashes changed. Trusted synthetic OpenVR pointer input saved a Decky setting to `{"enabled": true}`, independently read from the settings file and retained on a fresh iframe reopen. A quick action, slider value 50 and CDP text entry after OpenVR focus completed. Native scroll remained at offset 0. The test reported `passed=true`, no cleanup errors, removed its recovery timer, restored/read back power `false/5`, battery 99%, and released only its own lock. The private result and room captures remain under `/tmp/framey-v0440-post292/` outside Git.
+
+This exercises one quick-action activation. It does not prove the new rapid duplicate-tap guard with physical controllers. No person wore the headset; no official Decky plugin panel was tested. The hourly worn-headset schedule remains enabled for wearer-visible passthrough, controller, scrolling, keyboard and comfort checks.

docs/evidence/v0441-candidate-frame-2026-10-26.md

@@ -0,0 +1,7 @@
+# v0.4.41 candidate: real Frame title smoke, 26 October 2026
+
+Source commit `c87e5c6` bumps the app and lockfile to 0.4.41 on top of main after PRs #289, #290, #292–#295. It includes the exact official ARM64 audio evidence from #293. The release tag and installers do not exist at this candidate stage.
+
+`scripts/frame-smoke.sh` acquired its unique owner in `/tmp/frame-test.lock` before any headset read. Locked preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. On Frame OS 0.5.6 build `20261022.6153909`, all **13/13** steps passed: existing reserved-title cleanup, devkit identity/status, install/launch/remove for ARM64, x86_64 and Windows test executables, and final cleanup. The command exited 0, which includes successfully releasing only its own lock. Its detailed result remains private under `tests/smoke/results/2026-10-26T043229Z-20261022.6153909.json` in the candidate checkout.
+
+No person wore the headset. This checks title management and process cleanup, not wearer-visible rendering, physical controllers, official plugin VR panels, audio output or installed desktop packages. After PR #294, a separate exact-main unworn Framey sample exercise passed live setting persistence, synthetic OpenVR input, stereo compositor change and cleanup; it did not prove rapid physical controller taps or native scroll. The [v0.4.40 publication evidence](v0440-release-2026-10-26.md) records the previous tagged installer gates. New v0.4.41 tagged installers and checksums must be verified before publication.

docs/evidence/v0441-release-2026-10-26.md

@@ -0,0 +1,23 @@
+# v0.4.41 tagged release, 26 October 2026
+
+The annotated `v0.4.41` tag dereferences to main merge commit `b5d50a8d896f790a94baf4e937db914eab475ed9` from PR #297. The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40271174791) passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs. The platform jobs launched the built Linux AppImage, checked the Windows installation and bundled PC Python libraries, and checked Mac bundle architectures. These CI results do not establish a physical Windows or Mac launch.
+
+## Real Frame, exact tag
+
+From an exact tag checkout, `scripts/frame-smoke.sh` acquired its unique owner in `/tmp/frame-test.lock` before reading the headset. Preflight found SteamVR activity 3 (standby) and battery 99%. On Frame OS 0.5.6 build `20261022.6153909`, all **13/13 reserved title steps passed**; the command exited 0, including test title and process cleanup and release of its owned lock. ARM64 and Proton test executables launched. The x86_64 launch step recorded that optional Steam Linux Runtime 4 was **not installed**, so that executable did not actually launch. The private detailed result is `tests/smoke/results/2026-10-26T045140Z-20261022.6153909.json` in the exact-tag checkout.
+
+No person wore the headset. This title smoke does not verify active passthrough pixels, wearer-visible panels, physical controller input, official Decky plugin panels, audio output, comfort or VR keyboard use. The separate [unworn Framey sample exercise](framey-scroll-probe-2026-10-26.md) established live sample setting persistence, stereo compositor changes and trusted synthetic OpenVR input; it did not establish a worn result. The hourly worn check remains enabled.
+
+## Downloaded installer and checksum checks
+
+The draft held ten installers plus `SHA256SUMS`, each with a GitHub SHA-256 digest. `scripts/publish-release.sh --dry-run v0.4.41` checked the exact tag and all ten installer digests, regenerated `SHA256SUMS` from those digests and matched its own GitHub digest. A fresh downloaded checksum list independently matched `e7555956aeb9ec3a464081aaafe1ed6762f65a17c04edaa6ea45286f10927109`.
+
+A fresh Linux x86_64 AppImage download matched `5d1f50dc8527faf299f2058c7b5ed19057ec7c81c41449f6ccd44d68e6b4d212`. `scripts/check-appimage-launch.py` launched that exact file under isolated Xvfb: the bundled server answered HTTP 200 with `FrameControl/1`, then stopped. The first local attempt failed at Chromium sandbox startup inside the command sandbox; rerunning the same downloaded file with normal host permissions passed. The release workflow's independent Linux launch also passed.
+
+Fresh Mac ZIP downloads matched GitHub digests: arm64 `84615ec8a0c62481a9f33bae1815d55ec902db9aa9d4bd767fcf9380c3d44d7a`, x64 `2800b749cda98d15207950eca4a6bd205d35f30551f16efd7720b41347edc7ca`. Both contain bundle version 0.4.41; the app executable Mach-O CPU types are arm64 and x86_64 respectively. The physical Mac was unreachable over SSH, so neither tagged ZIP was launched there. The physical Intel Air was also not tested with this tag.
+
+## Publication and updater readback
+
+The final dry run passed with the release notes and hardware limits in the draft. `scripts/publish-release.sh v0.4.41` published [v0.4.41](https://github.com/saphid/frame-control/releases/tag/v0.4.41) at 2026-10-26 05:01:47 UTC. GitHub's latest-release API read back `draft=false`, tag `v0.4.41`, ten installers, `SHA256SUMS` and `update.json`. A fresh public latest-download of `update.json` parsed as version 0.4.41 with the stable release page, ten SHA-256 digests and the unworn-test limits in its notes. The release contains the tagged `b5d50a8` commit; no post-tag changes are implied.
+
+The exact-version official Decky catalog in this release is **3 works / 48 partial / 54 broken / 11 N/A**. Volume Mixer and Mixer are works only for the tested per-app silent-stream volume scope on real ARM64 Decky; [audio evidence](framey-audio-arm64-2026-10-26.md) describes the independent Pulse readbacks. Volume Boost remains partial. Audible playback, Bluetooth, other mixer controls and official-plugin worn VR remain unverified.

docs/evidence/v0442-candidate-2026-10-26.md

@@ -0,0 +1,9 @@
+# v0.4.42 candidate gate, 26 October 2026
+
+This branch bumps the app and lockfile to 0.4.42. It includes the [v0.4.41 release evidence](v0441-release-2026-10-26.md), the Framey panel lifecycle change in PR #299, the truthful optional-runtime smoke result in PR #300, the physical Intel Mac acceptance and host-test fixes in PR #303 (`fe1da43171883dc31161ff607c6b5a6ddf75f6ef`), and the receipt-bound API guard in PR #301 (`ad57662d40d3bbf6c850dd80ddc275280d389c86`). All 11 hosted checks passed on PR #301's exact head before its normal merge. The combined release candidate's own headset gates passed; exact-head CI and installer previews remain pending.
+
+The exact v0.4.42 candidate at `27af46dd20d7af30dde4c3f954d7b57b94843594` ran `scripts/frame-smoke.sh` under its unique shared lock at 05:40 UTC. Locked preflight found standby activity 3, proximity 6.25 and battery 99%. It recorded **12 passed / 1 skipped / 0 failed** on Frame OS 0.5.6 build `20261022.6153909`; ARM64 and Proton test executables launched. The x86_64 launch was skipped because Steam Linux Runtime 4 was not installed. Cleanup passed and the command exited 0. The private detailed result is `tests/smoke/results/2026-10-26T054014Z-20261022.6153909.json` in the candidate checkout. The prior PR #300 result is documented [separately](frame-smoke-runtime-skip-2026-10-26.md).
+
+The exact candidate then ran `scripts/framey-vr-check.py --exercise` under a fresh owned lock at 05:41 UTC. Preflight again found activity 3 and battery 99%. The real Decky sample setting saved `enabled=true` and survived a fresh iframe; the quick action read the same value. A trusted synthetic OpenVR pointer reached the panel; the sample slider reached 50 and CDP text entry after OpenVR focus reached `framey-ci`. Stereo compositor hashes changed from `38265343e13f5915869c9622ab1ceda7c31ab2e9b050f44564cfb9b6dc9f6e6d` to `64cc4c6f865bb8b2f756632c922d17dee12af40d480171586f2e9a51797b83e6`; the mirror capture hash was `165289dca9ad2bd895eb544f5be5d5fa2db7d2f635a927ac68a0c74267f69ee2`. The exercise exited 0 with `passed=true`, battery 99% afterward, original power values restored (`false` / `5.000000`), recovery timer removed, no cleanup errors and its own lock released. Its private full result is `/tmp/framey-v0442-exercise/result.json` on the test host. Synthetic scroll events left `scrollTop=0` and produced no wheel events. No person wore the Frame; physical controller interaction, official plugin VR panels, optical readability, VR keyboard and comfort remain unverified. The earlier [receipt-guard exercise](framey-receipt-live-2026-10-26.md) is separate evidence.
+
+The release tag and published installers do not exist at this candidate stage. Publication remains gated on this combined head's exact-head CI, then tagged installer checksums, package checks and public updater readback. The 116 exact-version Decky catalog remains **3 works / 48 partial / 54 broken / 11 N/A**; the two additional works claims are restricted to tested per-app silent-stream volume control. The official v0.4.39 Intel installer ran on a physical MacBook Air, but no tagged v0.4.42 Mac launch or real OBS audio/video check is claimed.

docs/evidence/v0442-release-2026-10-26.md

@@ -0,0 +1,62 @@
+# v0.4.42 tagged release, 26 October 2026
+
+The annotated `v0.4.42` tag dereferences to main merge commit
+`98909cb54374a7bd7ec1f665f50eda20fa196f32` from PR #302. The app and
+lockfile both report 0.4.42. The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40276685171)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs.
+The Linux job launched its built AppImage under isolated Xvfb. CI does not prove
+a physical Windows or Mac launch.
+
+## Real Frame, exact tag
+
+From an exact tag checkout, `scripts/frame-smoke.sh` acquired its own unique
+owner in `/tmp/frame-test.lock` before reading the headset. Preflight found
+SteamVR activity 3 (standby), proximity 6.25 and battery 100%. On Frame OS 0.5.6
+build `20261022.6153909`, it recorded **12 passed / 1 skipped / 0 failed** and
+exited 0. ARM64 and Proton test executables launched. The x86_64 title was
+installed and removed, but its launch was skipped because optional Steam Linux
+Runtime 4 was absent. Test title/process cleanup passed and only the run's lock
+was released. The private result is
+`tests/smoke/results/2026-10-26T055940Z-20261022.6153909.json` in the exact tag
+checkout.
+
+The separate [unworn Framey candidate exercise](v0442-candidate-2026-10-26.md)
+passed real sample setting save/reopen, synthetic OpenVR pointer delivery and
+stereo compositor change, with power restored and cleanup complete. It was run
+on the release branch's code before the evidence-only final commit. No person
+wore the Frame. Neither run verifies official plugin VR panels, physical
+controller usability, native scrolling, VR keyboard or optical comfort. The
+hourly worn check remains enabled.
+
+## Installer, checksum and updater checks
+
+The draft held ten installers plus `SHA256SUMS`, each with a GitHub SHA-256
+digest. `scripts/publish-release.sh --dry-run v0.4.42` checked the exact remote
+tag and every installer digest, regenerated the checksum list from those
+metadata digests, and matched the uploaded `SHA256SUMS` digest. A fresh
+checksum-list download independently matched
+`e5c85f5a46d789dccafae5259bd00b9b048dd10ca4f2a6cdc52d1f432a6db989`.
+
+A fresh Linux x86_64 AppImage download matched
+`16fc9fbe448bccbe59aa4206bc171c6bfc741973d2b4da0a79652a5c11d837b3`.
+`scripts/check-appimage-launch.py` launched those exact bytes under isolated
+Xvfb: the bundled server answered HTTP 200 with `FrameControl/1` and then
+stopped. Fresh Mac ZIP downloads matched GitHub digests: arm64
+`394d6088e732a19289b7b92366dd247f14f7293a345d57ed5c4e9c83a50abad3`
+and x64 `66d4606e38210d02af59dc87e4d1216282ad9e968056d7096f247fcc51e72395`.
+Both bundles report version 0.4.42; their main Mach-O CPU types are arm64 and
+x86_64 respectively. Neither tagged Mac ZIP was launched on a physical Mac.
+
+`scripts/publish-release.sh v0.4.42` published
+[v0.4.42](https://github.com/saphid/frame-control/releases/tag/v0.4.42) at
+2026-10-26 06:02:20 UTC. GitHub's latest-release API read back `draft=false`,
+`prerelease=false`, the expected tag, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` parsed as
+version 0.4.42 with the stable release page and ten SHA-256 installer digests.
+The tag contains #299, #300, #301 and #303 through #302's release merge.
+#304 merged after the tag and is not in this release.
+
+The exact-version official Decky table for v0.4.42 is **3 works / 48 partial /
+54 broken / 11 N/A**. The two additional works labels are restricted to tested
+per-app silent-stream volume control. Audible playback and official-plugin
+worn VR remain unverified.

docs/evidence/v0443-candidate-2026-10-26.md

@@ -0,0 +1,7 @@
+# v0.4.43 candidate Frame gate, 26 October 2026
+
+The combined code head `232b253e7a9400aa9829f9fea6a5d2011dd2a8f3` (PR #309 after merging main with PR #308) ran `scripts/frame-smoke.sh` under its own `/tmp/frame-test.lock` owner at 07:57 UTC. Its locked preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. On Frame OS 0.5.6 build `20261022.6153909`, it recorded **12 passed / 1 skipped / 0 failed**. The ARM64 and Proton executables launched; x86_64 launch was skipped because Steam Linux Runtime 4 is absent. It removed its test titles, exited 0 and released its lock. The private detailed result is `/tmp/frame-smoke-pr309/2026-10-26T075752Z-20261022.6153909.json` on the test host. A fresh, separately owned read-only lock then found activity 3 and battery 99%, and was released. PR #310 subsequently changed only the Windows wireless CI smoke test; the release branch merged that test change and bumped the app version, with no further headset runtime code change after this Frame smoke.
+
+PR #308's panel code commit `d5e62f643d462b7070f27c2c47b11b4aa9982094` previously passed the temporary Framey sample `scripts/framey-vr-check.py --exercise` machine check, with cleanup and power restoration; see [Web Browser follow-up](framey-web-browser-2026-10-26.md). That test used synthetic OpenVR input and a repository sample, not the official Web Browser plugin or a person wearing the headset. No wake or VR input exercise ran on this combined code head because wearer confirmation was absent. The current smoke made no worn visual, physical-controller, audible-output or official-plugin VR claim.
+
+This is candidate evidence, not a published-release result. Publication still needs all exact-head PR and release checks, ten tagged installers with matching `SHA256SUMS`, package validation, the publisher dry run, and public updater readback. The exact-version official Decky catalog in this candidate is **4 works / 49 partial / 52 broken / 11 N/A**. Volume Boost's works claim covers tested muted sink controls; Junk-Store remains partial, and Web Browser remains broken.

docs/evidence/v0443-release-2026-10-26.md

@@ -0,0 +1,79 @@
+# v0.4.43 tagged release, 26 October 2026
+
+The annotated `v0.4.43` tag dereferences to main merge commit
+`b4e632b218eed0761db488061e3fe6c503b06a0a` from PR #311. Both the app
+and lockfile report 0.4.43. The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40292211650)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs.
+The [tagged main checks](https://github.com/saphid/frame-control/actions/runs/40292128084)
+passed all seven jobs, including iOS and fake-Frame end-to-end tests. The Linux
+builder launched its AppImage under isolated Xvfb; that does not prove a physical
+display, FUSE mount or headset connection.
+
+## Frame and package gates
+
+The [combined-head candidate](v0443-candidate-2026-10-26.md) passed the real
+Frame smoke before tagging: 12 passed, one optional x86 launch skipped, zero
+failed. The only later changes before the tag were the Windows wireless CI
+test and version metadata. Its locked preflight found SteamVR activity 3
+(standby), proximity 6.25 and battery 99%.
+
+The draft had ten installers plus `SHA256SUMS`. Each installer had a GitHub
+SHA-256 digest. A fresh downloaded checksum list contained exactly those ten
+names and digests; its own downloaded bytes matched GitHub's digest
+`57f211d8bbf76db8aa96cc4a5ae31410ed7e3075ce2e8c0c17394feb9426d01c`.
+`scripts/publish-release.sh --dry-run v0.4.43` passed the exact remote tag,
+installer and checksum gates after the notes were attached.
+
+Freshly downloaded packages passed these independent checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `d5e6c2272a14a2aa77aa932db43f3ce887e09eb78c87bf2de410832b5df4827d`; launched under isolated Xvfb, bundled server returned HTTP 200 with `FrameControl/1`, and stopped on exit. |
+| Mac arm64 ZIP | SHA-256 `c6c4a9c74644c3479d1af112ec60d4c2770201fc366f21bca23a4e2fcc86194a`; ZIP CRC passed, bundle version 0.4.43, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `58dfc88bb71f1733add7477f9cd888417e4827e608fe910017837ba466a72a40`; ZIP CRC passed, bundle version 0.4.43, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `8c17522b0e96d54f53949f4df56a3e1ec1fe2da8df595482a358a3d014b6f1a9`; PE/Nullsoft installer format. The tagged Windows CI also installed and checked its packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `c00f141b6b63344c629bbd659a366a74705c52061d83572ae235a75ac6618df0`; package version 0.4.43 and architecture arm64. |
+
+Tagged Mac and Windows packages were not launched on physical machines in this
+release gate. Earlier Intel Mac acceptance covers an older version, not these
+tagged bytes.
+
+## Publication and later main
+
+`scripts/publish-release.sh v0.4.43` published
+[v0.4.43](https://github.com/saphid/frame-control/releases/tag/v0.4.43) at
+2026-10-26 08:39:09 UTC. GitHub's latest-release API returned `draft=false`,
+`prerelease=false`, the expected tag, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` parsed as
+version 0.4.43 with the stable release page, ten hashed assets and the worn-VR
+limits in its notes. The release catalog is **4 works / 49 partial / 52 broken /
+11 N/A**. Volume Boost's works label covers tested muted sink controls only.
+
+PRs #312 and #313 merged **after** the tag and are absent from v0.4.43. On their
+combined main commit `c50f96510fdb42a2aee227436a04c0cfe8817919`, a second
+locked `scripts/frame-smoke.sh` run at 08:37 UTC found activity 3, proximity 6.25
+and battery 99%, then passed 12 checks with the same optional x86 launch skip
+and zero failures. Test title and process cleanup passed; the command exited 0
+and released only its owned lock. The private result is
+`tests/smoke/results/2026-10-26T083719Z-20261022.6153909.json` in the test
+checkout. This post-tag smoke does not test the new Framey scroll buttons or
+Junk-Store's deployed headset panel.
+
+The guarded `scripts/framey-vr-check.py --exercise` then ran on the same code
+commit, using the existing direct `frame` SSH alias and its own shared-lock owner.
+It began at 08:45 UTC in SteamVR standby (activity 3, proximity 6.3125,
+battery 99%). The temporary sample panel passed setting save/reopen, quick
+action, slider and text checks. Synthetic native OpenVR clicks on the visible
+**Scroll plugin down/up** buttons moved the 160-pixel test region 0 → 120 → 0;
+the compositor screenshot hash changed. Native synthetic wheel attempts still
+produced no wheel event or movement. The private report is
+`/tmp/framey-scroll-postmerge-direct-20261026/result.json` on the test host.
+The command exited 0, removed its test services and power watchdog, read back
+the original `false` / `5` power settings, found battery 99%, and released its
+owned lock with no cleanup errors. It did not exercise an official plugin or a
+physical controller.
+
+No wearer confirmation was available, so no worn check, wake or input exercise
+ran. Physical controller use, optical readability, official-plugin VR panels,
+audible output and VR keyboard remain unverified. The hourly worn-check schedule
+stays enabled.

docs/evidence/v0444-candidate-2026-10-26.md

@@ -0,0 +1,56 @@
+# v0.4.44 candidate gate, 26 October 2026
+
+This candidate starts from main commit
+`c50f96510fdb42a2aee227436a04c0cfe8817919`, which contains PR #312's
+Framey scroll buttons and PR #313's read-only installed-app metadata projection.
+It also carries the documentation-only v0.4.43 release evidence from PR #314.
+The app and lockfile are bumped to 0.4.44. No compatibility label changes:
+the exact-version official Decky catalog remains **4 works / 49 partial /
+52 broken / 11 N/A**. Junk-Store's About and Dependencies pages now render in
+the local Chromium test with its actual ARM64 backend; the plugin remains partial.
+
+## Real Frame checks on the combined code
+
+At 08:37 UTC, `scripts/frame-smoke.sh` ran on that main commit under its own
+`/tmp/frame-test.lock` owner. Locked preflight found SteamVR activity 3
+(standby), proximity 6.25 and battery 99%. On Frame OS 0.5.6 build
+`20261022.6153909`, ARM64 and Proton executables launched; the optional x86_64
+launch was skipped because Steam Linux Runtime 4 is absent. The result was
+**12 passed / 1 skipped / 0 failed**. It removed its test titles, exited 0 and
+released its owned lock. The private result is
+`tests/smoke/results/2026-10-26T083719Z-20261022.6153909.json` on the test
+host.
+
+At 08:45 UTC, `scripts/framey-vr-check.py --exercise` ran the same code under
+a separate unique shared-lock owner, beginning in standby (activity 3,
+proximity 6.3125, battery 99%). Synthetic native OpenVR clicks on the new
+**Scroll plugin down/up** buttons moved a temporary sample region 0 → 120 → 0.
+The sample setting save/reopen, quick action, slider, text and compositor-change
+checks passed. Native synthetic wheel attempts still produced no event or
+movement. Cleanup removed test services and its power watchdog, restored the
+original `false` / `5` power values, read battery 99%, and released its lock
+with no errors. The private report is
+`/tmp/framey-scroll-postmerge-direct-20261026/result.json` on the test host.
+This is an unworn sample panel check. It does not prove physical controller
+scrolling, optical readability or an official-plugin panel in VR.
+
+## Publication boundary
+
+The version-bumped release branch also ran `scripts/frame-smoke.sh` after its
+normal merge of PR #314's documentation. At 08:59 UTC, its locked preflight
+found activity 3, proximity 6.3125 and battery 97%. The result was again
+**12 passed / 1 skipped / 0 failed** on the same Frame OS build; ARM64 and
+Proton launches passed, while the optional x86 launch was skipped for the
+missing Steam Linux Runtime 4. Owned test title/process cleanup passed, the
+command exited 0, and its lock was released. The private result is
+`tests/smoke/results/2026-10-26T085951Z-20261022.6153909.json` on the test
+host. This evidence-only paragraph is the sole change after that smoke.
+
+PR #313's own actual ARM64 backend/library test is documented in
+[installed-context evidence](framey-installed-context-2026-10-26.md). Its
+dependency installation, login, game operations, RSS and optional websocket
+remain unverified. The candidate still needs exact-head CI, tagged builds,
+ten installer digests with `SHA256SUMS`, downloaded package checks, publisher
+dry run and public updater readback before publication. A worn check requires
+activity, proximity and reliable wearer confirmation; none was available, so
+the hourly schedule stays enabled.

docs/evidence/v0444-release-2026-10-26.md

@@ -0,0 +1,58 @@
+# v0.4.44 tagged release, 26 October 2026
+
+The annotated `v0.4.44` tag dereferences to main merge commit
+`37e25e62ace388ce032f47d08398c26ea8540fdb` from PR #315. The app and
+lockfile both report 0.4.44. [Post-merge main checks](https://github.com/saphid/frame-control/actions/runs/40298400256)
+passed all seven jobs, including iOS and fake Frame end-to-end tests. The
+[tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40299460805)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum
+jobs. The tagged Linux build ran the AppImage under isolated Xvfb; this does
+not verify a physical display or headset.
+
+## Frame and package gates
+
+The [candidate evidence](v0444-candidate-2026-10-26.md) records a shared-lock
+real Frame smoke on the version-bumped candidate: **12 passed / 1 optional x86
+launch skipped / 0 failed**, with owned cleanup and lock release. The x86
+launch was skipped because Steam Linux Runtime 4 is absent. The candidate
+also records an unworn sample panel exercise: synthetic OpenVR clicks moved a
+temporary scroll region down and back, while a synthetic native wheel did
+not scroll. No physical controller or wearer-visible result follows from it.
+The final candidate edit was evidence only, and the merge commit added no
+runtime changes.
+
+The draft contained ten installers and `SHA256SUMS`. Every installer had a
+GitHub SHA-256 digest. A freshly downloaded `SHA256SUMS` listed exactly those
+ten names and matching digests; its downloaded bytes matched GitHub's digest
+`072f8084d6f9f145f4a58457d10f54390b50d11288bece42f6d801a356a69b1c`.
+After the release notes were attached, `scripts/publish-release.sh --dry-run
+v0.4.44` passed the remote tag, ten installer and checksum gates.
+
+Freshly downloaded packages passed these independent checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `d1cb5c3b590a44a9c61cf1d38d546cf89a835c73bece839c639f0d2be70ff139`; launched under isolated Xvfb, bundled server returned HTTP 200 with `FrameControl/1`, and stopped on exit. The first local attempt was blocked by the sandbox; the same downloaded bytes passed outside it. |
+| Mac arm64 ZIP | SHA-256 `5a25dfea9b3c645dae7acaf660b7127e9a46a03173a69d02ef4c64b0b39a5934`; ZIP CRC valid, bundle version 0.4.44, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `fde1c48eef4e3b4be12a862d32c1154afd1a93fe1f27a32f0799365205655021`; ZIP CRC valid, bundle version 0.4.44, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `e8cae0a8d0f8b76a41ca109f5ec4bf9947ca31531a8b93ebb8e326e453602a16`; PE/Nullsoft installer format. The tagged Windows CI also checked its packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `40f1704af89b5b824bc28e93328c516306aaefb2e0f441c1866197fc953eb21f`; package version 0.4.44 and architecture arm64. |
+
+The tagged Mac and Windows packages were not launched on physical machines
+in this release gate. Earlier Intel Mac acceptance covers older bytes.
+
+## Publication and limits
+
+`scripts/publish-release.sh v0.4.44` published
+[v0.4.44](https://github.com/saphid/frame-control/releases/tag/v0.4.44) at
+2026-10-26 09:38:50 UTC. GitHub's latest-release API returned `draft=false`,
+`prerelease=false`, the expected tag, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` reported
+version 0.4.44, the stable release page and ten hashed assets. Its notes
+retain the worn-VR limits. The exact-version official Decky catalog remains
+**4 works / 49 partial / 52 broken / 11 N/A** out of 116; Junk-Store remains
+partial.
+
+No reliable wearer confirmation was available. Official-plugin VR rendering,
+physical controller use, optical readability, audible output and VR keyboard
+remain unverified. The hourly shared-lock worn-check schedule stays enabled.

docs/evidence/v0445-candidate-2026-10-26.md

@@ -0,0 +1,84 @@
+# v0.4.45 candidate gate, 26 October 2026
+
+The candidate starts from main commit
+`f88e2ed209167a836282a969a71df4c897e658a8`, after PR #316 bound
+Framey chunk URLs to installed store receipts and PR #317 fixed shared Decky
+activation and confirmation controls. PR #319 also added a bounded retry to
+the fake Frame test image after Valve's ARM64 package server repeatedly
+truncated downloads. The app and lockfile are bumped to 0.4.45. The official
+116-plugin catalog remains **4 works / 49 partial / 52 broken / 11 N/A**.
+AlarMe remains partial: its silent timer, preset and stopwatch paths were
+exercised with the official ARM64 backend, while sound, reminders, sleep
+controls, closed-panel notifications and worn VR were not verified.
+
+## Locked real Frame smoke
+
+At 10:26 UTC, `scripts/frame-smoke.sh` ran on that combined main commit after
+atomically acquiring its own `/tmp/frame-test.lock`. Read-only preflight found
+SteamVR activity 3 (standby), proximity 6.3125 and battery 95%. On Frame OS
+0.5.6 build `20261022.6153909`, ARM64 and Proton test titles installed,
+launched and were removed. The optional x86_64 title installed and was
+removed, but its launch was skipped because Steam Linux Runtime 4 is absent.
+The result was **12 passed / 1 skipped / 0 failed**. Owned process and title
+cleanup passed, the command exited 0 and released its lock. The private
+detailed report is
+`tests/smoke/results/2026-10-26T102653Z-20261022.6153909.json` in the
+test checkout.
+
+## Unworn Framey panel exercise
+
+At 10:29 UTC, `scripts/framey-vr-check.py --exercise` ran the same combined
+main commit under a separate random shared-lock owner. It began in standby
+with proximity 6.3125 and battery 95%. The temporary managed panel, Decky
+service and repository sample passed the shipped host's setting save and
+fresh-iframe reopen, quick action, slider and text checks. A trusted
+synthetic OpenVR pointer reached the panel. The scroll buttons moved a
+temporary test region **0 → 120 → 0**; synthetic native wheel input still
+produced no wheel event or movement. The stereo compositor image changed and
+the `/dev/video99` mirror snapshot contained varied, nonblack pixels. This
+single mirror image does not establish moving passthrough content or what a
+wearer sees. The direct overlay image read returned error 24 and zero size,
+so it is not used as texture evidence.
+
+The private report and room-bearing images are in the test host's temporary
+output folder. Reported hashes are stereo before
+`84fe777535870c54cb381bbee3223684d1e0e4f2e6626e6d74ee902a4eec9c1b`,
+stereo after
+`4666d2b0908657489b8cc21520afc3deed4afa26a4c555c782298992b72abdd1`,
+and mirror
+`0769bbc45bd37266cc9ad80154cbd8a44ae3e1577cfa0d419e6af012afbf0fb4`.
+No raw image is committed.
+
+The exercise exited 0 with no cleanup errors, removed its temporary services
+and power recovery timer, restored and read back the original
+`power.pauseCompositorOnStandby=false` and
+`power.turnOffScreensTimeout=5`, found battery 95% and released only its lock.
+Its immediate post-run activity was 0 after the temporary wake. A separate
+locked read-only check at 10:31 UTC found activity **3 standby**, proximity
+6.3125, battery 95%, no cleanup errors, and released its lock.
+
+The sample is not an official plugin. This exercise does not test the new
+receipt-bound chunk path on real hardware or show AlarMe inside VR. Backend
+registration, synthetic pointer delivery and changing compositor pixels do
+not prove physical-controller or wearer-visible usability. No wearer
+confirmation was available, so `scripts/framey-worn-check.py` was not run;
+the hourly worn-headset schedule remains enabled.
+
+## Publication boundary
+
+The version-bumped candidate commit `59ea093` also ran
+`scripts/frame-smoke.sh` under its own shared-lock owner at 10:34 UTC. Its
+locked preflight again found activity 3 standby, proximity 6.3125 and
+battery 95%. The result was **12 passed / 1 optional x86 launch skipped /
+0 failed** on the same Frame OS build. Owned title/process cleanup passed,
+the command exited 0 and released its lock. The private result is
+`tests/smoke/results/2026-10-26T103419Z-20261022.6153909.json` in the test
+checkout. This evidence-only paragraph is the sole change after that smoke.
+
+This is candidate evidence, not a published-release result. Exact-head PR
+and post-merge CI, tagged installers, all ten installer digests with
+`SHA256SUMS`, independent package checks, publisher dry run and public
+`update.json` readback remain required before publication. Physical Mac and
+Windows launch of the eventual tagged bytes, audible alarms, official-plugin
+VR panels, optical readability, physical controllers, haptics and the VR
+keyboard remain unverified.

docs/evidence/v0445-release-2026-10-26.md

@@ -0,0 +1,61 @@
+# v0.4.45 tagged release, 26 October 2026
+
+The annotated `v0.4.45` tag dereferences to main merge commit
+`212f0af35c86eb651d5d23bfe0b1e6bf50c528b8` from PR #320. The app and
+lockfile both report 0.4.45. [Post-merge main checks](https://github.com/saphid/frame-control/actions/runs/40309949732)
+passed all seven jobs, including iOS and fake Frame end-to-end tests. The
+[tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40310897979)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum
+jobs. The tagged Linux builder launched its AppImage under isolated Xvfb;
+that does not verify a physical display, FUSE mount or headset connection.
+
+## Frame and package gates
+
+The [candidate evidence](v0445-candidate-2026-10-26.md) records two
+shared-lock real Frame smokes: one on the combined main code and one after
+the 0.4.45 version bump. Each finished **12 passed / 1 optional x86 launch
+skipped / 0 failed**, with owned cleanup and lock release. The optional
+x86_64 launch was skipped because Steam Linux Runtime 4 is absent. The
+candidate also records the unworn sample Framey exercise on the combined
+code. Synthetic OpenVR input, setting persistence and scroll-button
+movement passed; native synthetic wheel scrolling did not. The only change
+after the version-bumped smoke was its evidence paragraph.
+
+The draft had ten installers plus `SHA256SUMS`, each with a GitHub SHA-256
+digest. A fresh downloaded checksum list contained exactly those ten names
+and matching digests; its bytes matched GitHub's digest
+`d1d84f03c09881417610337cc48f0025535c8b0d227d55147f1f2b99592625fb`.
+`scripts/publish-release.sh --dry-run v0.4.45` passed the exact remote tag,
+installer and checksum gates after the release notes were attached.
+
+Freshly downloaded packages passed these independent checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `478ea6535979f049930351d5c0abba14e3bcc4bcb5e695ee7ee945a5fd5bf72f`; launched under isolated Xvfb, bundled server returned HTTP 200 with `FrameControl/1`, and stopped on exit. |
+| Mac arm64 ZIP | SHA-256 `0204b445bc35596170d85f7a1e05e793f1c1b247f3129fadad6f8c92730cf3e2`; ZIP CRC valid, bundle version 0.4.45, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `88ded8bc492501f467a9c51156661f3a25b0dc6347660caf0d2e230bda0f984e`; ZIP CRC valid, bundle version 0.4.45, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `c512d322b2022a233ed26aaa03e038b9a735a2df654ec7a3ebefc1ba86b04334`; PE/Nullsoft installer format. The tagged Windows CI also checked its packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `d08cc96dd18b1a602bd0af33a8e6d1f380d94195aec0f83b2898098956aeedc3`; package version 0.4.45 and architecture arm64. |
+
+Tagged Mac and Windows packages were not launched on physical machines in
+this release gate. Earlier Intel Mac acceptance covers older bytes.
+
+## Publication and limits
+
+`scripts/publish-release.sh v0.4.45` published
+[v0.4.45](https://github.com/saphid/frame-control/releases/tag/v0.4.45) at
+2026-10-26 11:02:08 UTC. GitHub's latest-release API returned
+`draft=false`, `prerelease=false`, the expected tag, ten installers,
+`SHA256SUMS` and `update.json`. A fresh public latest-download of
+`update.json` reported version 0.4.45, the stable release page, ten hashed
+assets and the worn-VR limits in its notes.
+
+The official exact-version Decky catalog remains **4 works / 49 partial /
+52 broken / 11 N/A** out of 116. AlarMe's tested silent timer, preset and
+stopwatch workflows do not establish its audio, reminders, sleep controls,
+closed-panel notifications or VR panel. The real Frame exercise used the
+repository sample, not an official plugin. No wearer confirmation was
+available. Physical controller use, optical readability, official-plugin
+VR rendering, audible output and the VR keyboard remain unverified. The
+hourly shared-lock worn-check schedule stays enabled.

docs/evidence/v0446-candidate-2026-10-26.md

@@ -0,0 +1,44 @@
+# v0.4.46 candidate gate, 26 October 2026
+
+This candidate includes merged Free Loader PR #325, the Decky user-tool PATH
+fix (#323), and the interactive worn-check proximity gate (#324).
+The official 116-plugin catalog is **4 works / 50 partial / 51 broken /
+11 N/A**. Free Loader is partial for its verified package, local frontend
+and isolated settings/empty-deals scope. No live feed or worn-VR claim follows.
+
+## Locked real Frame smoke before the version bump
+
+At 12:12 UTC, source commit `21b85ba99dfd742a56e2c20259f56f35d83590fc`
+ran `scripts/frame-smoke.sh` on the real Frame under a unique owner of
+`/tmp/frame-test.lock`. Locked preflight found SteamVR activity **3**
+(standby), proximity raw **3.0** and battery **100%** on Frame OS 0.5.6 build
+`20261022.6153909`. Test-owned ARM64 and Windows/Proton titles installed,
+launched and were removed. The optional x86_64 title installed and was
+removed; launch was **skipped** because Steam Linux Runtime 4 is absent.
+The result was **12 passed / 1 skipped / 0 failed**. Cleanup passed and the
+command exited 0, which includes release of its owned lock. The detailed
+result remains private at
+`tests/smoke/results/2026-10-26T121228Z-20261022.6153909.json` in the
+candidate checkout.
+
+This smoke checks release plumbing and temporary titles, not an installed
+official Decky plugin. No wearer was confirmed. The interactive worn-check
+script was not run, and no headset wake or controller input was sent. Free
+Loader's actual ARM64 Decky backend, live feeds, panel visibility to a wearer,
+physical controllers, keyboard and optical comfort remain unverified. The
+hourly worn-headset check stays enabled.
+
+## Publication boundary
+
+At 12:17 UTC, exact version-bumped candidate commit
+`9aff6adcec71852ce9bedf0ae37364bd32bb6627` ran the same locked
+`scripts/frame-smoke.sh`. Preflight again found activity **3** standby,
+proximity raw **3.0** and battery **100%**. The result was **12 passed /
+1 optional x86 launch skipped / 0 failed**. Owned title/process cleanup
+passed and the command exited 0 after releasing its lock. Its private result
+is `tests/smoke/results/2026-10-26T121721Z-20261022.6153909.json` in the
+candidate checkout. This paragraph is the only change after that smoke.
+
+Green release-PR and post-merge CI, tagged installer build, all ten installer
+digests with `SHA256SUMS`, independent package checks, publisher dry run and
+public `update.json` readback remain required before publication.

docs/evidence/v0446-release-2026-10-26.md

@@ -0,0 +1,58 @@
+# v0.4.46 tagged release, 26 October 2026
+
+[PR #326](https://github.com/saphid/frame-control/pull/326) passed every required
+check on exact head `fc978a2afdfa47e60477fcb0bb573e7b6181fa89` and merged
+at 12:31:06 UTC. Main became `f84a4da9b1ae938d15b658af17903c0e10a56e94`.
+All seven jobs in the [post-merge main run](https://github.com/saphid/frame-control/actions/runs/40323149126)
+passed, including iOS and fake-Frame e2e. The app and lockfile both say
+`0.4.46`. Annotated tag `v0.4.46` dereferences to that main commit. The
+[tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40324176903)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs.
+
+## Frame and package gates
+
+The [candidate evidence](v0446-candidate-2026-10-26.md) records a locked
+exact-version real Frame smoke: **12 passed / 1 optional x86 launch skipped /
+0 failed**, with owned cleanup and lock release. The x86 launch needs Steam
+Linux Runtime 4, which was absent. A separate 12:25 UTC read-only check acquired
+and released its own `/tmp/frame-test.lock`; SteamVR activity was **3**
+(standby), proximity raw **3.0**, and battery **100%**. No wearer was confirmed,
+so no wake, controller input or interactive worn-check script ran.
+
+The draft contained exactly ten installers plus `SHA256SUMS`, each with a
+GitHub SHA-256 digest. A fresh downloaded checksum file matched the ten digest
+lines regenerated from GitHub metadata byte for byte; its digest was
+`365e7f6d9549ff993162964920a6560480069ed04ce1eca5551696ce7bbc4ae8`.
+`scripts/publish-release.sh --dry-run v0.4.46` passed the exact tag, installer,
+checksum and update-manifest gates after release notes were attached.
+
+Independent downloads passed these checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `65f66f1bbb5908d49c179307950f93b643c2b8da8ac4da48a778c5c9bac5d41b`; launched under isolated Xvfb, bundled server returned HTTP 200 with `FrameControl/1`, then stopped. |
+| Mac arm64 ZIP | SHA-256 `9af88f75db7936472590022ca03a03da9de4f91de7b35c5d4d130b6dc78ab4b5`; ZIP CRC valid, bundle version 0.4.46, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `28d9ac00c9c918a7cb9f2caac54505faa8a953285bb40f82e02d9233b775d37a`; ZIP CRC valid, bundle version 0.4.46, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `68e303dcabb2c82ba5b9a5a58bace2ca8154f9645f1da2214ca4c6dbb05f157d`; PE/Nullsoft installer format. Tagged Windows CI checked packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `da9b00bd44ca7a91c542df26d8c5711ad564d618add34f89aef946785c0bd538`; package version 0.4.46 and architecture arm64. |
+
+Tagged Mac and Windows packages were not launched on physical machines during
+this release gate. Earlier physical Intel Mac acceptance covers older bytes.
+
+## Publication and limits
+
+`scripts/publish-release.sh v0.4.46` published
+[v0.4.46](https://github.com/saphid/frame-control/releases/tag/v0.4.46) at
+12:48:03 UTC. GitHub's latest-release API returned the expected tag,
+`draft=false`, `prerelease=false`, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` reported
+version 0.4.46, the stable release page, ten hashed installers and the
+worn-VR limit in its notes.
+
+The exact-version official catalog is **4 works / 50 partial / 51 broken /
+11 N/A** out of 116. Free Loader is partial for package, local frontend and
+isolated settings/empty-deals evidence. Its actual ARM64 Decky load, live
+feeds and notifications remain unverified. The real Frame was in standby;
+official-plugin wearer visibility, physical controller usability, keyboard
+and optical comfort remain unverified. The hourly shared-lock worn check stays
+enabled.

docs/evidence/v0447-candidate-2026-10-26.md

@@ -0,0 +1,46 @@
+# v0.4.47 candidate gate, 26 October 2026
+
+This candidate contains Game Theme Music's locally rendered Settings view
+(#330) and a digest-scoped Python import module for the official Shotty 0.1.0
+archive (#331). The 116-plugin table is **4 works / 52 partial / 49 broken /
+11 N/A**. Game Theme Music is partial for its local Settings view; its
+backend, network and playback were denied in that audit. Shotty is partial
+for its local frontend and synthetic screenshot copy in isolated Python;
+actual ARM64 Decky startup and live screenshot rescue are unverified.
+
+## Locked Frame candidate smoke
+
+At 14:18 UTC, source commit `1f5b37a7552880b40868617ef22398fcd39b3f5d`
+ran `scripts/frame-smoke.sh` on the real Frame. The script acquired its unique
+owner in `/tmp/frame-test.lock` before reading status. Locked preflight found
+SteamVR activity **3** (standby), proximity raw **3.0625**, and battery
+**100%** on Frame OS 0.5.6 build `20261022.6153909`. Owned ARM64 and
+Windows/Proton test titles installed, launched, and were removed. The
+optional x86_64 title installed and was removed; launch was **skipped**
+because Steam Linux Runtime 4 was absent. The result was **12 passed /
+1 skipped / 0 failed**. Cleanup passed and the command exited 0, including
+release of its owned lock. Detailed results stay private in
+`tests/smoke/results/2026-10-26T141812Z-20261022.6153909.json`.
+
+No wearer was confirmed. The interactive worn-check script was not run;
+the smoke did not wake the headset or test the Framey panel. Game Theme
+Music playback, Shotty live rescue, wearer-visible official-plugin UI,
+physical controllers, keyboard and optical comfort remain unverified.
+The hourly shared-lock worn check remains enabled.
+
+## Publication boundary
+
+At 14:23 UTC, the exact version-bumped candidate commit
+`e07fa155928d1609304e317d15e0c4ef4a977579` ran the same token-locked
+`scripts/frame-smoke.sh`.
+Preflight again found activity **3** (standby), proximity raw **3.0625** and
+battery **100%**. The result was **12 passed / 1 optional x86 launch skipped /
+0 failed**. Owned cleanup passed and the command exited 0 after releasing its
+lock. Its private result is
+`tests/smoke/results/2026-10-26T142321Z-20261022.6153909.json`.
+This paragraph is the only change after that smoke.
+
+PR #331's combined-head CI, green release-PR and post-merge CI, tagged
+installer builds, all ten installer digests with `SHA256SUMS`, independent
+package checks, publisher dry run, and public `update.json` readback remain
+required.

docs/evidence/v0447-release-2026-10-26.md

@@ -0,0 +1,62 @@
+# v0.4.47 tagged release, 26 October 2026
+
+The release PR [#332](https://github.com/saphid/frame-control/pull/332)
+passed its exact-head checks and all four installer preview jobs, including
+Intel Mac. It merged at main commit
+`035c59ee1134aa158c3cd818e8dd35f822cbfc4b`. The seven-job post-merge
+main [checks run](https://github.com/saphid/frame-control/actions/runs/40342375912)
+passed, including iOS and fake-Frame e2e. Annotated tag `v0.4.47`
+dereferences to that main commit. The tagged
+[release workflow](https://github.com/saphid/frame-control/actions/runs/40344549980)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac, and checksum
+jobs.
+
+## Frame and package gates
+
+The [candidate evidence](v0447-candidate-2026-10-26.md) records a locked
+exact-version real Frame smoke: **12 passed / one optional x86 launch skipped /
+zero failed**, with owned cleanup and lock release. The x86 launch needs Steam
+Linux Runtime 4, which was absent. The headset was in standby and no wearer was
+confirmed, so the interactive worn-check script was not run. No panel or
+physical-controller claim follows from the smoke.
+
+The draft contained exactly ten installers and `SHA256SUMS`, each with a
+GitHub SHA-256 digest. An independently downloaded `SHA256SUMS` matched a
+fresh ten-line list regenerated from GitHub asset metadata byte for byte;
+its SHA-256 was
+`ab1a95e5d51333dfc962723a21b044da935e07c24cedbd430222dc482d725508`.
+`scripts/publish-release.sh --dry-run v0.4.47` passed the tag, installer,
+checksum, and update-manifest gates after release notes were attached.
+
+Independent downloads passed these checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `e7c83cf9177d11de724caf40a829b5c97ac3d2f0a04df24bcb1e4107310f1f49`; launched under isolated Xvfb on lxso1, bundled server returned HTTP 200 with `FrameControl/1`, then stopped. |
+| Mac arm64 ZIP | SHA-256 `10092131b7fd43950e0dc436a51da1e41b42803d532a89363e2b71880b92b212`; ZIP CRC valid, bundle version 0.4.47, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `24531b088e85d2e7e9174289b0b9532c78fb85e7a29775c24369c00bc61e5408`; ZIP CRC valid, bundle version 0.4.47, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `a697a7e9042eb0d9545d99639e39ff53fbf993491c0728f59f038f21175b77cc`; PE/Nullsoft installer format. Tagged Windows CI checked packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `e0be95ffc714e71487889a7da4886676b75c993f86bb674d180dc3ea4cd4b3b6`; package version 0.4.47 and architecture arm64. |
+
+The tagged Mac and Windows packages were not launched on physical machines
+in this release gate. Earlier physical Intel Mac acceptance covers older
+bytes.
+
+## Publication and limits
+
+`scripts/publish-release.sh v0.4.47` published
+[v0.4.47](https://github.com/saphid/frame-control/releases/tag/v0.4.47) at
+15:07:28 UTC. GitHub's latest-release API returned that tag with
+`draft=false`, `prerelease=false`, ten installers, `SHA256SUMS`, and
+`update.json`. A fresh public latest-download of `update.json` reported
+version 0.4.47, the stable release page, ten hashed installers, and the
+worn-VR limit in its notes.
+
+The exact-version official catalog is **4 works / 52 partial / 49 broken /
+11 N/A** out of 116. Game Theme Music has a local Settings view; its music
+playback and live backend are unverified. Shotty's backend imported and
+copied a synthetic screenshot in isolated Python; live ARM64 Decky loading
+and screenshot rescue are unverified. The real Frame was in standby;
+official-plugin wearer visibility, physical controller usability, VR
+keyboard, and optical comfort remain unverified. The hourly shared-lock
+worn check remains enabled.

docs/evidence/v0448-candidate-2026-10-26.md

@@ -0,0 +1,50 @@
+# v0.4.48 candidate gate, 26 October 2026
+
+This candidate contains the exact-archive Music Control 1.1.7 Python call
+repair from [#335](https://github.com/saphid/frame-control/pull/335). All
+**11** hosted checks passed on its head
+`ff465accc508e40158c590eebffd4aec924503ac`, including fake-Frame e2e,
+Windows, macOS, Linux, ARM64 host libraries and iOS. The catalog remains
+**4 works / 52 partial / 49 broken / 11 N/A** out of 116. Music Control is
+partial: an isolated D-Bus command fixture proves dispatch after the repair;
+a live player and actual Decky ARM64 backend were not tested.
+
+## Locked real Frame smoke
+
+At 15:36 UTC, source head `ff465accc508e40158c590eebffd4aec924503ac`
+ran `scripts/frame-smoke.sh` on SteamOS 0.5.6 build `20261022.6153909`.
+The runner acquired its own unique `/tmp/frame-test.lock` owner before
+reading device status. Preflight found SteamVR activity **3** (standby),
+proximity raw **3.0625**, and battery **99%**. Owned ARM64 and Windows/Proton
+titles installed, launched and were removed. The optional x86_64 title
+installed and was removed; its launch was **skipped** because Steam Linux
+Runtime 4 was absent. The result was **12 passed / 1 skipped / 0 failed**.
+Owned cleanup passed and the command exited 0, including lock release.
+A separate fresh locked read found battery **100%**, activity **3** and no
+`fc_smoke_*` title directories; it released only its own lock. The private
+runner result is `2026-10-26T153655Z-20261022.6153909.json`.
+
+At 15:42 UTC, exact version-bumped commit
+`a31b4a426cf4204e45fe218e204a26328aa0b1c9` ran the same token-locked
+smoke. Preflight found activity **3**, proximity raw **3.0625** and battery
+**100%**. It passed **12 / 1 optional x86 launch skipped / 0 failed**.
+Cleanup passed and the command exited 0 after releasing its lock. The
+private runner result is `2026-10-26T154258Z-20261022.6153909.json`.
+A fresh separately locked read found battery **100%**, activity **3** and
+no test-title directories, then released that lock. Merging current main
+into the candidate created commit
+`a8bf01d660cd9abb8d2a724626a06a0e7e6c2a6a`; its tree before this
+evidence document was byte-identical to the tested version-bumped commit
+(`d45c2465ddfcf877fe2c8bc30420d4719da5035e`).
+
+No wearer was confirmed. Neither smoke woke the headset or ran the
+interactive worn-check script. Official-plugin wearer visibility, physical
+controllers, VR keyboard and optical comfort remain unverified. The hourly
+shared-lock worn check remains enabled.
+
+## Remaining publication gates
+
+The release PR's exact-head CI and installer previews, post-merge main CI,
+tagged builds with all ten installers and `SHA256SUMS`, independent package
+checks, publisher dry run and public `update.json` readback are required
+before publication.

docs/frame-plugin-author.md

@@ -36,7 +36,7 @@ remain unavailable. Wearer-visible use is not yet verified.
 The [settings sample](../examples/framey-settings/README.md) shows an official
 Decky JSX build, backend persistence, a toggle and a local toast. Framey offers
 only official-store-owned plugins in its VR panel.
-For persistent backend settings, use Decky's `decky.decky_SETTINGS_DIR` rather
+For persistent backend settings, use Decky's `decky.DECKY_PLUGIN_SETTINGS_DIR` rather
 than assuming an environment variable or Steam Deck home path. Validate stored
 types when reading, write through a temporary file before replacing the old
 file, and give the panel a safe default if settings are missing or damaged.
@@ -57,23 +57,36 @@ none of these frontend controls has passed a worn-headset check yet.
 | Decky API or UI feature | Framey behavior | Verified in |
 | --- | --- | --- |
 | `definePlugin` with `content`, `titleView` | Renders a React panel and optional title | Local browser with ProtonDB Badges; host unit test |
-| API v1 manifest with the modern Decky API initializer | Attempts to render the plugin's panel; older API v1 bundles still show an incompatibility message | Pinned Storage Cleaner 1.4.0 archive, fake Frame install/pack test, local Chromium with stub backend. Cleanup actions were not tested. |
+| API v1 manifest with the modern Decky API initializer | Attempts to render the plugin's panel; recognized legacy IIFE bundles also use the legacy bridge | Pinned Storage Cleaner 1.4.0 archive, fake Frame install/pack test, local Chromium with stub backend. Cleanup actions were not tested. |
+| Legacy Decky IIFE frontend, with no API manifest field | Wraps the returned initializer as an ES module inside the same opaque iframe; passes `serverAPI` and preserves the legacy title | MusicControl 1.1.6 exact official archive, local Chromium startup with backend methods blocked; fake Frame installation/pack/removal |
+| Legacy `serverAPI.callPluginMethod(method, kwargs)` | Uses Decky's `loader/call_legacy_plugin_method` RPC, preserving keyword arguments and `{success, result}` replies | Fake Frame HTTP/CDP read/write with a synthetic backend; no official plugin backend action or worn VR result |
 | Official `@decky/rollup` JSX (`SP_JSX.jsx`, `jsxs`, `Fragment`) | Creates React elements in the isolated panel | Sample bundle smoke test; host unit test |
 | `PanelSection`, rows, buttons, toggles, dropdowns | Local touch-sized controls; disabled controls stay inert during a backend call | Local browser and host unit test |
 | `TextField`, `SliderField`, grouped `Dropdown` options | Native text, range and select controls in the panel; disabled state, numeric slider callback and basic input types | Host unit test; worn VR use unverified |
+| Scrollable panel content | Visible Scroll plugin up/down buttons move the last region reached by a trusted pointer, or the document if that region disappears. Plugins may still use ordinary CSS overflow containers. | Parent/iframe message tests; physical controller scroll remains unverified |
+| `Tabs`, `SidebarNavigation`, spinners, dialog/menu wrappers, progress bars | Local tab navigation and ordinary HTML controls; no Steam navigation or controller focus tree | Host tests and catalog frontend smoke checks in local Chromium |
+| `SteamUIStore` / `DFL.Router.RunningApps`, `MainRunningApp` | Bounded detached Steam CEF reads while the panel is open; refresh about every two seconds; no MobX observation. Failed reads clear stale context. | Locked real Frame empty-list reads; nonempty local Chromium fixtures. Real running-game selection unverified. |
+| `GameSessions.RegisterForAppLifetimeNotifications` | Actual Steam callbacks, bounded queue and disposable `.unregister()` handle; no events inferred from snapshot changes; lease cleanup after lost panels | Real Frame registration/poll/close; launch/exit, retry, expiry and duplicate tests use explicit fixtures. Real game transitions unverified. |
+| Other `SteamClient` subscriptions | Explicit inert registration methods return disposable handles; no fabricated power/input/game-action events. Mutating Steam/power methods are unavailable. | Host contract tests; safe fallbacks only |
 | `DialogCheckbox`, `DialogButtonPrimary` | Native checkbox and button controls in the panel | Host unit test; Storage Cleaner empty-data browser check |
-| Optional `settings`, `frameyQuickActions` | Separate settings tab; up to eight actions with result text | Host unit test; these fields are Framey additions |
-| `serverAPI.call` / `callable` | Calls only that plugin's Decky Python backend via the headset service | Fake Frame e2e for setting read/write across CEF calls, update, and reinstall; host unit test. Real Decky persistence remains unverified. |
-| `toaster.toast` | Visible toast inside the plugin panel; `dismiss` and optional `onClick` | Host unit test; no Steam system notification |
+| Optional `settings`, `frameyQuickActions` | Separate settings tab when content also exists; settings-only plugins have no empty Panel tab; up to eight actions with result text | Host unit test; these fields are Framey additions |
+| `serverAPI.call` / `callable` | Calls only that plugin's Decky Python backend via the headset service | Fake Frame e2e; real ARM64 Notebook save/reopen across backend restart and Simple Timer settings/recents persistence via local Chromium. No worn-VR claim. |
+| API v1/v2 `addEventListener` / `removeEventListener` | Plugin-scoped real backend events while panel is open; bounded queue, about one-second polling, subscription expiry | Real ARM64 Simple Timer countdown, start/cancel and completion toast via local Chromium; scope/bounds/reconnect tests. No closed-panel notifications. |
+| `toaster.toast` | Visible toast inside the plugin panel; plain text or React nodes for title, body, icon, logo and subtext; `dismiss` and optional `onClick` | Host unit test; no Steam system notification or worn VR check |
 | `localStorage` | Synchronous, per-plugin cache backed by the Frame Control panel origin. Up to 64 keys, 64 KiB per value and 128 KiB total; `clear()` removes only this plugin's cache. Falls back to memory if panel storage is denied. | Parent/iframe round-trip and reopen in the local host test; real headset persistence remains unverified. |
-| `routerHook.addRoute` / `removeRoute`, `Navigation.Navigate` / `NavigateBack` | Local routes inside this plugin panel only | Host unit test |
+| IndexedDB / localForage | IndexedDB is deliberately absent inside the opaque iframe so feature detection chooses the bounded localStorage driver. Plugins requiring IndexedDB directly remain unsupported. | HLTB official frontend in local Chromium: its previous `IDBFactory.open` SecurityError disappeared. No live HLTB data request was run. |
+| `routerHook.addRoute` / `removeRoute`, `Navigation.Navigate` / `NavigateBack`, `useParams` | Local routes inside this plugin panel, with named segments such as `/plugin/game/:appid/:view?`; `useParams()` reads the current segment values | Host unit test; VR navigation unverified |
 | `routerHook.addPatch`, global components | No-op; cannot patch Steam routes | Not applicable |
+| `findModuleChild`, `Navigation.CloseSideMenus` | Steam module lookup returns `null`; close returns to this plugin's main panel | Pinned HLTB for Deck 2.0.12 entry point and shallow settings view in local host test. Steam library patch and live HLTB search remain unverified. |
 | Steam library/store patches, CEF tab injection | Unavailable; no matching target in the isolated panel | Frame CEF inspection |
-| `fetchNoCors`, Decky event listeners, file picker, root calls | Unavailable | Not supported by Framey |
+| `fetchNoCors`, file picker, root calls | Unavailable | Not supported by Framey |
 
 Keep routes local to the panel and give every operation a visible result. A
 plugin that calls `Navigation.Navigate('/decky/store')` will not open the
 Frame Control store; only paths registered by that same plugin can navigate.
+Optional route segments must be at the end. Framey accepts local path segments
+only; query strings, external URLs, Steam library routes and duplicate parameter
+names are rejected. Removing an active route returns to the plugin panel.
 Toasts stay inside the panel, so keep essential errors in the plugin UI too.
 An API v1 manifest does not guarantee a working Framey panel. Test the exact
 store archive and do not assume SteamClient app details, library patches, or
@@ -85,3 +98,9 @@ The Framey `localStorage` bridge is for disposable frontend caches, including
 the cache read attempted by Steam Status 1.2.3. It does not expose another
 plugin's cache or the Frame Control UI key. A real Steam Status panel reopen
 and a worn-headset settings check are still needed.
+
+HLTB for Deck 2.0.12 demonstrates the limit of the panel shim: its official
+bundle can start and produce a settings view with Framey's Steam module lookup
+stub, but its game page and context menu patches have no Steam target in the
+isolated panel. The tests do not call its HLTB network search or Python backend.
+Do not claim game length badges work in VR from this result.

docs/framey-compatibility.md

@@ -0,0 +1,315 @@
+# Official Decky store compatibility with Framey
+
+Snapshot: 2026-10-26T06:10:58.537029+00:00; 116 current visible official plugins from https://plugins.deckbrew.xyz/plugins.
+
+This table and both store views use [`ui/framey-compatibility.json`](../ui/framey-compatibility.json). Results apply only to the exact store ID, version and SHA-256. A changed digest/version is **unverified**. Regenerate this document with `python3 scripts/framey-compatibility-doc.py`; use `--check` in review.
+
+**Works: 4 · Partial: 52 · Broken: 49 · N/A: 11.**
+
+- **Works** requires verified useful plugin behavior with its real backend. Read the reason for the verified scope and remaining limits; it does not imply worn-VR verification.
+- **Partial** means only a subset or a local fixture scope was verified, often just frontend/settings initialization. The remaining backend/device functionality is unverified; read the reason for the exact scope.
+- **Broken** means a concrete archive, frontend or Steam dependency blocks the audited version. An artificial backend/network denial alone is not evidence that the real backend is broken.
+- **N/A** means the plugin targets hardware or a display/UI surface that Framey does not provide. The store disables installation for these versions.
+
+## Verification limits
+
+All exact archives were hash-checked and statically inspected. The local Chromium host used Framey commit `779f9c5`, React 18.3.1 and an opaque `allow-scripts` iframe. Each frontend was attempted for 1.2 seconds, including React effects. All plugin backend calls, fetches and websockets were denied. Some plugins attempt mutating actions on mount; none reached a backend. Initialization (`ready`) does not guarantee React rendered, and delayed errors/actions may occur after the observation window. The JSON preserves initializer errors, capped console observations and attempted method names.
+
+The optional full-catalog fake-Frame audit exercises the real HTTP/SSH installer, receipt, frontend bytes and removal, or expected rejection. It uses a private disposable Compose project with all plugin backend execution stubbed. It checks archive transport and safeguards, not Python/native execution. Run it with:
+
+```sh
+python3 scripts/framey-audit-store.py --cache /tmp/framey-archives --output /tmp/framey-observations.json
+python3 scripts/framey-audit-fake.py --cache /tmp/framey-archives --output /tmp/framey-fake/results.json
+python3 scripts/framey-audit-browser.py --cache /tmp/framey-archives
+```
+
+Open the browser audit URL in local Chromium, run `runAudit()` and inspect/download `results`. All backend/network actions remain denied.
+
+A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates-2026-10-26.md) accepts only byte-identical duplicate ZIP members whose modes differ at most in execute bits. The exact archive passed private local and focused fake-Frame install/remove; its frontend rendered in opaque Chromium and isolated Python settings/empty-deals reads passed with a Decky stub. The earlier full 116-plugin fake-Frame audit blocked this archive before the fix. Actual Decky, feed updates and worn VR remain unverified.
+
+The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.
+
+After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. Simple Timer remains partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSS, the optional Line truncated
+
+## Every current plugin
+
+The API column shows manifest / actual bundled frontend API. Many manifests say v1 while their bundle connects API2. Missing manifest API is labelled legacy; an unrecognized bundle is unknown. Globals and hardware are static signals, not exhaustive dependencies.
+
+| Plugin / version | Manifest / bundle API | Status | Reason | Verified by |
+| --- | --- | --- | --- | --- |
+| 1: XR Gaming 1.6.2 | 1 / 2 | N/A | Not supported on Frame: Requires supported external XR glasses and the Breezy/XRLinuxDriver stack; it does not target Steam Frame displays. | static archive, local browser, fake-Frame |
+| 7: CSS Loader 2.1.3 | legacy / legacy | partial | Panel initialization succeeds; CSS themes patch Steam UI and cannot theme the isolated VR shell. | static archive, local browser, fake-Frame |
+| 10: vibrantDeck 2.0.1 | legacy / legacy | N/A | Not supported on Frame: Changes X11 gamescope color properties, not the Frame SteamVR compositor. | static archive, local browser, fake-Frame |
+| 11: Fantastic 0.5.1 | legacy / legacy | N/A | Not supported on Frame: Targets Steam Deck fan hardware; no Frame fan-control mapping is provided. | static archive, local browser, fake-Frame |
+| 12: MusicControl 1.1.6 | legacy / legacy | partial | Legacy media controls initialize; player discovery and playback are unverified. | static archive, local browser, fake-Frame |
+| 13: Pause Games 1.0.3 | 1 / 2 | partial | Settings and running-game list initialize in local Chromium with an explicit synthetic game; live Frame empty-list reads and lifetime registration/cleanup passed. Process pause/resume, automatic pausing and suspend integration remain unverified/unsupported; backend writes were denied. | static archive, local browser, fake-Frame |
+| 14: ProtonDB Badges 1.3.4 | 2 / 2 | partial | Settings render locally and read-only get_setting RPC returned the default through real Decky 3.3.0 on ARM64 Frame. Steam game-page badges have no patch target; live writes and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 16: Audio Loader 1.6.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. Steam UI sound lookup is present as explicitly unsupported; the frontend still requires Steam m_GamepadUIAudioStore.m_AudioPlaybackManager, which is unavailable in the isolated panel. | static archive, local browser, fake-Frame |
+| 18: Bluetooth 3.1.1 | 1 / 2 | partial | Controls render with fixture replies; actual Bluetooth discovery, labels and connections remain unverified. | static archive, local browser, fake-Frame |
+| 19: Notebook 0.1.5 | legacy / legacy | works | Default notebook drawing, save and reopen verified in Chromium with real Decky 3.3.0 ARM64, including backend restart. Running-game context is now supplied; per-game selection was attempted with a synthetic game and backend calls denied. Real per-game selection, background artwork and worn-VR input remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 21: PowerTools 2.0.3 | legacy / legacy | N/A | Not supported on Frame: Targets AMD Ryzen power controls; Frame uses an ARM64 SoC. | static archive, local browser, fake-Frame |
+| 22: Memory Deck 0.1.8 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: memory-deck/bin/libscanmem.so.1.0.0. | static archive, local browser, fake-Frame |
+| 23: Animation Changer 1.3.2 | legacy / legacy | partial | Initializer succeeds; forced backend failure prevents loading animations. Boot-video changes untested. | static archive, local browser, fake-Frame |
+| 24: RadiYo! 1.3 | legacy / legacy | partial | Initializer succeeds; radio discovery and playback remain unverified. | static archive, local browser, fake-Frame |
+| 26: HLTB for Deck 2.0.12 | 1 / 2 | partial | Settings render without the prior IndexedDB SecurityError; Steam library badges have no patch target, and live lookup is unverified. | static archive, local browser, fake-Frame |
+| 27: AutoSuspend 2.2.0 | legacy / legacy | broken | Frontend audit failed: Cannot read properties of null (reading '6'). | static archive, local browser, fake-Frame |
+| 28: Emuchievements 2.0.5 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: Emuchievements/bin/hash. | static archive, local browser, fake-Frame |
+| 30: TunnelDeck 1.0.4 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 32: AutoFlatpaks 1.6.8 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 35: MoonDeck 1.13.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: moondeck/python/externals/yarl/_quoting_c.cpython-313-x86_64-linux-gnu.so. Frontend initializes; native CPython wheels and executables in the published archive are x86_64. | static archive, local browser, fake-Frame |
+| 36: SteamGridDB 1.8.1 | 1 / 2 | broken | Local module mapping is available; frontend still requires the Steam LibraryContextMenu implementation, which has no target in the isolated Framey panel. | static archive, local browser, fake-Frame |
+| 37: Discord Status 1.5.0 | 1 / 2 | partial | Disconnected panel renders; running-activity construction accepts a synthetic game in local Chromium. Exact official is_connected returned false in real Decky 3.3.0 ARM64. Empty live running-list reads and lifetime registration/cleanup passed. Real game transitions, Discord shortcut detection/connection/activity, local custom artwork and worn VR remain unverified/unsupported. | static archive, local browser, fake-Frame, real Frame SSH |
+| 38: Volume Mixer 1.2.1-1 | legacy / legacy | works | Per-app stream discovery and slider/keyboard volume changes pass in local Chromium through real Decky 3.3.0 ARM64 on the Frame audio session, with independent Pulse readback of a silent test stream. Bluetooth playback, audible output and worn-VR controls unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
+| 40: Controller Tools 2.0.2 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: ControllerTools/bin/backend. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
+| 43: Tailscale Control 0.1.3 | legacy / legacy | partial | Settings render locally after the SuspensefulImage fallback. On the real Frame, exact official read-only backend status calls returned live state, exit-node and device entries when ~/.local/bin was in PATH; a transient user unit found the CLI with the proposed managed-service PATH. Live Framey Decky RPC, connection/exit-node changes and worn VR remain unverified; the bundled localhost QR asset is unavailable. No network settings were changed. | static archive, local browser, fake-Frame, real Frame read-only backend |
+| 44: DeckMTP 1.0.5 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: DeckMTP/bin/umtprd. | static archive, local browser, fake-Frame |
+| 46: Steamback 1.0.0-1 | legacy / legacy | partial | Panel opens using the real Frame current-user/library snapshot. Account setup and empty save-list reads pass through actual Decky 3.3.0 amd64 in isolation. ARM64 backend, supported-save discovery, automatic backups and restore remain unverified; no backup/restore ran. | static archive, local browser, fake-Frame, real Frame SSH |
+| 48: Quick Launch 1.2.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 49: Decky Cloud Save 1.4.2 | legacy / legacy | broken | Unsafe plugin archive member. | static archive, local browser, fake-Frame |
+| 50: Storage Cleaner 1.4.0 | 1 / 2 | partial | Empty-data panel rendered; cleanup was deliberately not run because it can remove local data. | static archive, local browser, fake-Frame |
+| 52: Game Theme Music 1.7.1-1 | 1 / 2 | partial | An inert local component lets the exact frontend initialize and render its Settings view in opaque Chromium. Backend get_setting and plugin network were denied in the audit; Steam game-page theme injection has no verified target in Framey. Music search, playback, downloads, settings persistence and worn VR remain unverified. | static archive, local browser, fake-Frame |
+| 53: Shotty 0.1.0 | legacy / legacy | partial | The frontend starts with the read-only Frame library snapshot. Frame Control adds a digest-scoped click.get_app_dir compatibility module to the managed install; the exact backend then imports and copies a synthetic Steam screenshot into a temporary Pictures folder in isolated Python. Actual Decky 3.3.0 ARM64 loading, live screenshots/rescue, in-VR panel and physical controller use remain unverified. | static archive, local browser, fake-Frame, real Frame SSH, isolated Python backend |
+| 56: MangoPeel 0.0.7 | 1 / 2 | partial | Initializer succeeds; gamescope/MangoHud actions and backend are unverified. | static archive, local browser, fake-Frame |
+| 58: Volume Boost 0.0.7 | legacy / legacy | works | Default-sink controls pass in local Chromium through real Decky 3.3.0 ARM64: linked slider/keyboard and numeric writes, separate channels, re-link and reopen, with independent Pulse readback including 125%/150% while muted. Exact original volume/mute restored. Audible output, Bluetooth sinks and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
+| 59: Web Browser 1.4.3 | legacy / legacy | broken | The exact frontend now initializes with a null Steam React-root lookup. The browser itself still requires Steam GamepadUI CDP injection and a backend WebSocket unavailable in Framey; no working browser tab was verified. | static archive, local browser, fake-Frame, focused local browser |
+| 60: DeckyFileServer 1.2.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: DeckyFileServer/bin/backend. | static archive, local browser, fake-Frame |
+| 61: TabMaster 2.15.1 | 1 / 2 | partial | Local Chromium rendered the QAM and navigable Overview/Filters documentation with an actual Decky 3.3.0 amd64 backend. Library-tab editing remains unavailable: Steam login/library patches and MobX reactions have no target. ARM64 and worn VR unverified. | static archive, local browser, fake-Frame |
+| 62: TS3 QuickAccess 1.2.0 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: ts3-qs4sd/bin/ts3-qs4sd.so. | static archive, local browser, fake-Frame |
+| 63: Free Loader 1.6.0 | 1 / 2 | partial | The exact archive's duplicate names contain identical bytes and differ only in execute bits; the guarded installer now accepts them, and a private local install/remove transaction passed. The current opaque Chromium host renders Free Games but cannot load deals with backend/network denied. Exact official Python settings and empty local-deals methods passed in a no-network container with a Decky stub. Real Decky, feed refresh, notifications and worn VR remain unverified. | static archive, local browser, fake-Frame pinned install/remove, local exact-archive transaction, isolated Python backend |
+| 64: Syncthing 0.2.7 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog. | static archive, local browser, fake-Frame |
+| 65: Decky Terminal 0.5.3 | 1 / 2 | partial | Local routes initialize after parameter-route support; no shell commands were run. | static archive, local browser, fake-Frame |
+| 66: PlayTime 3.2.5 | 1 / 2 | partial | Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. Running snapshots are now exposed, but its private MobX observation is unsupported; automatic recording and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 67: Battery Tracker 0.2.0 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 68: Wine Cellar 0.2.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-wine-cellar/bin/backend. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
+| 70: MicroSDeck 0.11.2 | legacy / 2 | broken | Plugin contains a non-ARM64 Linux binary: MicroSDeck/bin/backend. | static archive, local browser, fake-Frame |
+| 72: ScreenshotUploader 0.0.3 | legacy / legacy | partial | Initializer succeeds; screenshot upload requires external credentials/network and was not run. | static archive, local browser, fake-Frame |
+| 73: EmuDecky 1.0.2-1 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: EmuDecky/bin/hello. | static archive, local browser, fake-Frame |
+| 74: KDE Connect 0.1.0-1 | legacy / legacy | partial | Initializer succeeds; KDE Connect installation/pairing/file transfers unverified. | static archive, local browser, fake-Frame |
+| 75: Reshadeck 0.2.0 | legacy / legacy | partial | Initializer succeeds; ReShade deployment into Proton games is unverified. | static archive, local browser, fake-Frame |
+| 76: CheatDeck 1.1.6 | 1 / 2 | broken | Frontend audit failed: Cannot convert undefined or null to object. | static archive, local browser, fake-Frame |
+| 77: BT Wake Control 1.2.0 | 1 / 2 | partial | Initializer succeeds; backend uses DMI board paths and Bluetooth wake permissions, unverified on ARM64 Frame. | static archive, local browser, fake-Frame |
+| 78: Brightness Bar 1.0.4 | legacy / legacy | N/A | Not supported on Frame: Targets Steam/QAM brightness shortcuts and a global Steam overlay; neither is attached to the Framey panel. | static archive, local browser, fake-Frame |
+| 79: Decky Notifications 1.0.1 | legacy / legacy | partial | Initializer succeeds; device/account setup and notification delivery unverified. | static archive, local browser, fake-Frame |
+| 80: MagicBlack 2.0.2 | 1 / 2 | N/A | Not supported on Frame: Targets a global Steam Deck screen-black overlay; the isolated panel cannot black out the Frame compositor. | static archive, local browser, fake-Frame |
+| 81: IsThereAnyDeal for Deck 1.1.1 | legacy / legacy | partial | Country settings render and select the real Frame Steam country through the read-only bridge. Settings writes, deal lookups and Steam page integration remain unverified; plugin backend calls were denied. | static archive, local browser, fake-Frame, real Frame SSH |
+| 82: MagicPods 2.0.21 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: MagicPodsDecky/bin/magicpodscore. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
+| 84: Junk-Store 1.1.13 | legacy / legacy | partial | Official Decky 3.3.0 ARM64 static menu/backend calls pass; local Chromium Games/Epic navigation, About/Dependencies tabs, Back and reopen render with real Frame library metadata. Legendary is absent; dependency install, login, game operations, RSS, optional websocket and worn VR remain unverified. Existing installs need update/reinstall for script permissions. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
+| 85: Decky-Undervolt 1.0.8 | 1 / 2 | N/A | Not supported on Frame: RyzenAdj Curve Optimizer requires an AMD CPU; Frame is ARM64. | static archive, local browser, fake-Frame |
+| 87: ScreenSaver 1.1.2 | legacy / legacy | partial | Initializer succeeds; global screen overlay and idle/suspend integration have no verified VR target. | static archive, local browser, fake-Frame |
+| 88: steamdeck-input-disabler 1.0.2 | legacy / legacy | N/A | Not supported on Frame: Targets the built-in Steam Deck USB gamepad; Frame has different controllers. | static archive, local browser, fake-Frame |
+| 89: DeckySpy 0.6.7 | legacy / legacy | partial | Initializer succeeds; account tokens and external service integration were not exercised. | static archive, local browser, fake-Frame |
+| 90: Picture in Picture 1.0.0 | 1 / 2 | partial | Initializer succeeds; global picture-in-picture injection cannot escape the isolated panel. | static archive, local browser, fake-Frame |
+| 91: PlayCount 1.7 | 1 / 2 | partial | Initializer succeeds; Steam game-page play-count patch has no supported VR target. | static archive, local browser, fake-Frame |
+| 92: Crosshair 1.1.0 | 1 / 2 | partial | Initializer succeeds; global crosshair injection has no supported compositor target. | static archive, local browser, fake-Frame |
+| 93: Deck Settings 1.2.6 | 1 / 2 | partial | Game picker renders with detached real Frame library/install-folder reads; search modal opens in local Chromium. Snapshot refreshes on panel reopen. Remote reports/proxy fetch, settings changes and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 94: Decky DoT DNS 0.0.2 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 95: Decky-SpoofDPI 0.12.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-spoof-dpi/bin/spoofdpi. | static archive, local browser, fake-Frame |
+| 96: Simple Timer 1.0.0 | 1 / 2 | partial | Live start/cancel, countdown events, completion toast, persisted recents/subtle mode verified in Chromium with real ARM64 Decky. Upstream expired-timer restart raises missing timer_task. Audio/suspend unsupported; alerts require an open panel; worn VR unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 97: Decky-Framegen 0.11.15 | 1 / 2 | broken | Plugin archive size or SHA-256 did not match the store. | static archive, local browser, fake-Frame |
+| 98: Decky-Lookup 0.1.0 | 1 / 2 | partial | Initializer succeeds; game-page context actions and live lookups remain unverified. | static archive, local browser, fake-Frame |
+| 99: Decky Zerotier 0.3.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 100: Virtual Surround Sound 0.0.5 | 1 / 2 | partial | Initializer succeeds; avatar proxy is unavailable and live audio-routing backend unverified. | static archive, local browser, fake-Frame |
+| 101: XIVOmega 1.0.2 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 102: DeckSP 1.1.3 | 1 / 2 | broken | Optional UI-audio lookup succeeds, but the published frontend raises "Cannot access PluginManager before initialization" when Steam MobX reaction lookup is unavailable. JamesDSP installation/audio routing and ARM64 remain unverified. | static archive, local browser, fake-Frame |
+| 103: Decky Ludusavi 1.2.2 | 1 / 2 | partial | Initializer succeeds; Flatpak Ludusavi discovery and backup/restore unverified. | static archive, local browser, fake-Frame |
+| 104: Game Sync 1.0.4 | 1 / 2 | partial | Backend get_config is intentionally rejected by the audit before initialization completes; actual backend compatibility is unknown. | static archive, local browser, fake-Frame |
+| 105: WiFi Locker 1.0.2 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 106: LetMeReShade 1.8 | 1 / 2 | partial | Initializer succeeds; Deck-model assumptions, shader downloads and game modifications unverified. | static archive, local browser, fake-Frame |
+| 107: Decky Sunshine 2025.10.27-dddf365 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 108: HueSync 3.8.0 | 1 / 2 | N/A | Not supported on Frame: Targets handheld RGB/LED controllers (AYANEO/Ally/MSI), not Frame hardware. | static archive, local browser, fake-Frame |
+| 109: MuraDeck 2.1.4 | 1 / 2 | N/A | Not supported on Frame: Calibration is specifically for defective Samsung Steam Deck OLED panels, not Frame displays. | static archive, local browser, fake-Frame |
+| 110: Dimmer Deck 0.0.4 | 1 / 2 | N/A | Not supported on Frame: Changes gamescope/X11 dimming properties; no mapping to Frame VR display brightness exists. | static archive, local browser, fake-Frame |
+| 111: Music Control 1.1.7 | legacy / legacy | partial | Exact official backend bound-method calls are repaired in managed installs. An isolated fake dbus-send target accepted player discovery, transport and volume commands after the patch; real MPRIS players, actual Decky ARM64, album art and worn VR remain unverified. | static archive, local browser, fake-Frame, isolated Python backend |
+| 112: Better Keyboard 0.3.4 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Frontend audit failed: window.SteamClient.UI.GetUIMode is not a function. | static archive, local browser, fake-Frame |
+| 113: Decky LSFG-VK 0.12.2 | 1 / 2 | partial | Initializer succeeds; runtime LSFG/Windows DLL downloads and Vulkan integration are not ARM64-validated. | static archive, local browser, fake-Frame |
+| 114: Network Sentinel 1.0.4 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 115: Decky Clash 1.3.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 116: Muon 0.2.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 117: DeckyParty File Manager 1.0.0 | legacy / legacy | partial | Initializer succeeds; privileged file operations and backend are unverified. No file changes were run. | static archive, local browser, fake-Frame |
+| 118: Speed Test 1.0.2 | 1 / 2 | partial | Initializer succeeds; automatic bandwidth tests were blocked by the audit network policy. | static archive, local browser, fake-Frame |
+| 119: Decky Clipboard 1.0.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-clipboard/bin/xclip. | static archive, local browser, fake-Frame |
+| 120: Reroll 0.2.1 | 1 / 2 | broken | Frontend now initializes with inert game-action subscriptions, but the archive contains x86_64 memscan.so and requests root. No process-memory access was run. | static archive, local browser, fake-Frame |
+| 121: DeckPass 1.1.1 | 1 / 2 | partial | Initializer succeeds; KeePass Flatpak discovery and secrets integration were not exercised. | static archive, local browser, fake-Frame |
+| 123: Steam Status 1.2.3 | 2 / 2 | partial | Settings/public status rendered locally; cache errors fixed. Read-only get_settings RPC returned actual Decky 3.3.0 defaults on ARM64 Frame. Persistence, live backend diagnostics and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 124: AlarMe 1.6.3 | 1 / 2 | partial | Silent labeled timer create/ticks/pause/cancel, preset save/cancel-confirm/delete and stopwatch start/lap/pause/reset/reopen pass in local Chromium with the official Decky 3.3.0 ARM64 backend. Audio, alarms/reminders, suspend inhibition, Steam overlays and worn VR remain unverified; notifications require the panel to stay open. | static archive, local browser, fake-Frame, real Frame SSH |
+| 125: Decky Localsend 0.4.5 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-localsend/bin/localsend-core. | static archive, local browser, fake-Frame |
+| 126: Launch Options 1.9.2 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-launch-options/bin/hello. Frontend audit failed: Cannot convert undefined or null to object. | static archive, local browser, fake-Frame |
+| 127: Decky Translator 0.9.0 | 1 / 2 | partial | Initializer succeeds; x86_64 download and hidraw/controller assumptions need an ARM64 audit. OCR/translation not exercised. | static archive, local browser, fake-Frame |
+| 128: Quick User Switcher 1.0.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 129: ShadowDeck 1.1.11 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 130: Games Prefix Manager 1.0.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 131: Download All 1.1.0 | 1 / 2 | broken | Initializer succeeds; Steam download registration is absent, so the primary action is unavailable. | static archive, local browser, fake-Frame |
+| 132: SuggestMe 1.5.3 | 1 / 2 | partial | Initializer succeeds; recommendation backend and Steam library data unverified. | static archive, local browser, fake-Frame |
+| 133: Non-Steam Badges 0.1.0 | 1 / 2 | partial | Initializer succeeds; Non-Steam game badges have no supported Steam page injection target. | static archive, local browser, fake-Frame |
+| 134: Deck Progress Tracker 1.3.6 | 1 / 2 | partial | Initializer succeeds; Steam game/library statistics and page patches unverified. | static archive, local browser, fake-Frame |
+| 135: Deck Shelves 2.0.0 | 1 / 1 | partial | The exact chunked frontend renders settings in opaque local Chromium. The official Python backend saved a shelf and returned it after reopen with a stub Decky module and temporary settings directory. Actual Decky RPC, real Frame settings, Steam Home shelf injection and worn VR remain unverified. | static archive, local browser, fake-Frame, isolated Python backend |
+| 136: Decky-Clipper 1.0.2 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: Decky-Clipper/bin/gstreamer-1.0/libgstproxy.so. | static archive, local browser, fake-Frame |
+| 137: Decky Proton Launch 0.9.0 | 1 / 2 | partial | Initializer succeeds; Proton wrapper installation and launch changes were not run. | static archive, local browser, fake-Frame |
+| 138: Docky 1.4.13 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 139: Output Manager 1.4.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 140: IPv6 Enabler Plugin 0.0.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 141: DeckyClocker 1.0.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 142: MuteOnSleep 1.0.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+| 143: Desktop Apps 0.1.0 | 1 / 2 | partial | Initializer succeeds; Flatpak app discovery and Steam shortcut changes unverified. | static archive, local browser, fake-Frame |
+| 144: Mixer 0.1.0 | 1 / 2 | works | Per-app discovery and numeric volume changes pass in local Chromium through real Decky 3.3.0 ARM64 on the Frame audio session, independently read back on a silent test stream. Filters persist on amd64; ARM64 filter persistence, Reset, internal audio nodes, audible output and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
+| 145: VARTA 1.0.21 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
+
+## API, UI and backend inventory
+
+DFL includes exports imported through decky-frontend-lib / @decky/ui. Steam stores and router/toaster/QAM signals are listed separately. No signal means the static scan did not detect one, not that no dependency exists. Native binaries are classified by ELF machine or Windows MZ header; Python files and source links are preserved in the JSON.
+
+| Plugin | SteamClient methods | DFL / @decky/ui exports | Other Steam globals / UI surfaces | Backend | Hardware / OS signals |
+| --- | --- | --- | --- | --- | --- |
+| XR Gaming | none detected | ButtonItem, ConfirmModal, DialogButton, DialogButtonPrimary, DialogButtonSecondary, DropdownItem, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, SliderField, Spinner, TextField, ToggleField, definePlugin, gamepadDialogClasses, showModal, staticClasses | window.SP_REACT | Python | Requires supported external XR glasses and the Breezy/XRLinuxDriver stack; it does not target Steam Frame displays. |
+| CSS Loader | none detected | ButtonItem, ColorPickerModal, ConfirmModal, DialogButton, DialogCheckbox, Dropdown, DropdownItem, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, ScrollPanelGroup, SidebarNavigation, SliderField, Tabs, TextField, Toggle, ToggleField, classMap, definePlugin, findModuleChild, gamepadDialogClasses, gamepadSliderClasses, getGamepadNavigationTrees, replacePatch, showModal, staticClasses | routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| vibrantDeck | none detected | PanelSection, PanelSectionRow, Router, SliderField, ToggleField, definePlugin, staticClasses | Router, window.SP_REACT | Python | Changes X11 gamescope color properties, not the Frame SteamVR compositor. |
+| Fantastic | none detected | Field, Navigation, PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | window.SP_REACT, QAM/global tabs | Python + native payload; x86_64 | Targets Steam Deck fan hardware; no Frame fan-control mapping is provided. |
+| MusicControl | none detected | ButtonItem, DialogButton, Focusable, Menu, MenuItem, PanelSection, PanelSectionRow, Router, SidebarNavigation, SliderField, SteamSpinner, definePlugin, showContextMenu, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Pause Games | Apps, Apps.RegisterForGameActionTaskChange, GameSessions.RegisterForAppLifetimeNotifications, System.RegisterForOnResumeFromSuspend, System.RegisterForOnSuspendRequest, System.UI.RegisterForFocusChangeEvents, System.UI.RegisterForSystemKeyEvents | Button, Field, Focusable, Marquee, PanelSection, PanelSectionRow, Router, Toggle, ToggleField, beforePatch, sleep | Router, window.SP_REACT, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| ProtonDB Badges | none detected | ButtonItem, ConfirmModal, DialogButton, DropdownItem, Field, Focusable, Navigation, PanelSection, PanelSectionRow, ScrollPanel, ScrollPanelGroup, ToggleField, afterPatch, appDetailsClasses, appDetailsHeaderClasses, createReactTreePatcher, definePlugin, findInReactTree, findModuleExport, showModal, staticClasses, useParams | SteamUIStore, appStore, routerHook, toaster, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Audio Loader | GameSessions.RegisterForAppLifetimeNotifications, d.ts | ButtonItem, DialogButton, Dropdown, DropdownItem, Focusable, Navigation, PanelSection, PanelSectionRow, Router, SliderField, Tabs, TextField, ToggleField, afterPatch, beforePatch, definePlugin, findModuleChild, gamepadDialogClasses, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Bluetooth | none detected | DialogButton, Field, Focusable, PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | none detected | Python | /sys/class/power_supply |
+| Notebook | System.UI.RegisterForFocusChangeEvents | DialogButton, Dropdown, Marquee, PanelSection, PanelSectionRow, Router, definePlugin, staticClasses | Router, toaster, window.SP_REACT, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| PowerTools | Apps.RegisterForGameActionEnd, Apps.RegisterForGameActionStart, GameSessions.RegisterForAppLifetimeNotifications, User.GetLoginUsers, User.RegisterForCurrentUserChanges | ButtonItem, DialogButton, Dropdown, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, QuickAccessTab, Router, SliderField, Spinner, TextField, ToggleField, definePlugin, showModal, staticClasses | Router, appStore, routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam stores | Python + native payload; x86_64 | Targets AMD Ryzen power controls; Frame uses an ARM64 SoC. |
+| Memory Deck | none detected | ButtonItem, DialogButton, DropdownItem, Focusable, PanelSection, PanelSectionRow, Router, SteamSpinner, definePlugin, gamepadDialogClasses, joinClassNames, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes, Steam stores | Python + native payload; x86_64 | gamescope |
+| Animation Changer | none detected | ButtonItem, DialogButton, Dropdown, DropdownItem, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, Spinner, Tabs, TextField, ToggleField, definePlugin, findModule, findSP, showModal, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| RadiYo! | none detected | ConfirmModal, DialogButton, Dropdown, Focusable, ModalRoot, Navigation, PanelSection, QuickAccessTab, Router, SliderField, Spinner, TextField, definePlugin, showModal, staticClasses | Router, window.SP_REACT | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| HLTB for Deck | none detected | ButtonItem, DialogButtonPrimary, DropdownItem, MenuItem, Navigation, PanelSection, PanelSectionRow, SliderField, SteamSpinner, ToggleField, afterPatch, appDetailsClasses, appDetailsHeaderClasses, createReactTreePatcher, definePlugin, fakeRenderComponent, findInReactTree, findInTree, findModuleChild, removeHookStubs, staticClasses | routerHook, local/Steam routes, Steam page patches/module lookup, Steam stores | no Python/native backend found | No specific hardware requirement detected statically; runtime requirements unverified. |
+| AutoSuspend | Downloads.RegisterForDownloadItems, Input.RegisterForControllerInputMessages, Settings.RegisterForSettingsChanges, System, System.RegisterForOnResumeFromSuspend, System.RegisterForOnSuspendRequest, System.ShutdownPC, URL.ExecuteSteamURL, User.GetLoginUsers, User.RegisterForShutdownDone | ConfirmModal, DialogBody, DialogButton, DialogControlsSection, DropdownItem, Field, Focusable, Navigation, SidebarNavigation, SliderField, TextField, ToggleField, definePlugin, findModuleChild, showModal, sleep, staticClasses | routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Emuchievements | Apps.RegisterForAppDetails, GameSessions.RegisterForAppLifetimeNotifications, User.RegisterForLoginStateChange | ButtonItem, Dropdown, Field, Focusable, Navigation, PanelSection, PanelSectionRow, ProgressBarItem, ProgressBarWithInfo, Router, SidebarNavigation, TextField, ToggleField, afterPatch, beforePatch, callOriginal, definePlugin, findInTree, findModuleChild, replacePatch, sleep, staticClasses | Router, appDetailsStore, appStore, collectionStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam page patches/module lookup, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| TunnelDeck | none detected | ButtonItem, Field, Navigation, PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | window.SP_REACT | Python | systemctl |
+| AutoFlatpaks | InstallFolder.GetInstallFolders | ConfirmModal, DialogButton, Dropdown, Focusable, ModalRoot, PanelSection, PanelSectionRow, Router, ScrollPanel, SteamSpinner, Tabs, TextField, Toggle, ToggleField, definePlugin, findModuleChild, showModal, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | flatpak; x86_64 |
+| MoonDeck | Apps.AddShortcut, Apps.CancelGameAction, Apps.GetResolutionOverrideForApp, Apps.RegisterForAppDetails, Apps.RegisterForGameActionEnd, Apps.RegisterForGameActionStart, Apps.RegisterForGameActionTaskChange, Apps.RemoveShortcut, Apps.RunGame, Apps.SetAppLaunchOptions, Apps.SetAppResolutionOverride, Apps.SetShortcutName, Apps.SetThirdPartyControllerConfiguration, Apps.TerminateApp, Apps.ToggleOverrideResolutionForInternalDisplay, GameSessions.RegisterForAppLifetimeNotifications, System.Audio.GetDevices, System.DisplayManager.RegisterForStateChanges, User.RegisterForLoginStateChange, User.StartRestart | Button, ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogButtonPrimary, DialogButtonSecondary, DialogControlsSection, DialogControlsSectionHeader, DialogHeader, Dropdown, Field, Focusable, Menu, MenuItem, ModalRoot, NavEntryPositionPreferences, Navigation, PanelSection, PanelSectionRow, SidebarNavigation, Spinner, TextField, ToggleField, afterPatch, appDetailsClasses, appDetailsHeaderClasses, basicAppDetailsSectionStylerClasses, createReactTreePatcher, findInReactTree, findModuleExport, findSP, joinClassNames, playSectionClasses, showContextMenu, showModal, sleep, staticClasses | appStore, collectionStore, routerHook, toaster, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python + native payload; x86_64 | /dev/input; /sys/socket.h; amd64; flatpak; x86_64 |
+| SteamGridDB | Apps.ClearCustomArtworkForApp, Apps.RegisterForAppDetails, Apps.SetCustomArtworkForApp, Apps.SetShortcutName, User.StartRestart | ConfirmModal, ControlsList, DialogBody, DialogBodyText, DialogButton, DialogButtonPrimary, DialogCheckbox, DialogControlsSection, DialogControlsSectionHeader, DialogFooter, DialogHeader, Dropdown, Field, Focusable, IconsModule, Marquee, Menu, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, ProgressBar, ReorderableList, SliderField, Spinner, Tabs, TextField, ToggleField, afterPatch, appDetailsHeaderClasses, callOriginal, createModuleMapping, definePlugin, fakeRenderComponent, findClassModule, findInReactTree, findInTree, findModule, findModuleByExport, findModuleExport, findSP, joinClassNames, quickAccessMenuClasses, replacePatch, showContextMenu, showModal, useParams, wrapReactType | appDetailsStore, appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Discord Status | Apps.RegisterForAppDetails, Apps.RunGame, GameSessions.RegisterForAppLifetimeNotifications, User.RegisterForPrepareForSystemSuspendProgress, User.RegisterForResumeSuspendedGamesProgress | ButtonItem, DropdownItem, Field, PanelSection, PanelSectionRow, Router, Spinner, sleep, staticClasses | Router, appStore, toaster, window.SP_REACT, toasts, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Volume Mixer | none detected | DialogButton, Focusable, PanelSection, PanelSectionRow, SliderField, definePlugin, staticClasses | window.SP_REACT | Python | PulseAudio/PipeWire, libpulse/libdbus and D-Bus; optional Bluetooth playback |
+| Controller Tools | none detected | ButtonItem, PanelSection, PanelSectionRow, ToggleField, definePlugin, gamepadDialogClasses, joinClassNames, staticClasses | toaster, window.SP_REACT, toasts | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Tailscale Control | none detected | ButtonItem, ConfirmModal, DropdownItem, Field, Focusable, PanelSection, PanelSectionRow, SuspensefulImage, TextField, ToggleField, definePlugin, showModal, staticClasses | window.SP_REACT | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| DeckMTP | none detected | PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | window.SP_REACT | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Steamback | GameSessions.RegisterForAppLifetimeNotifications, InstallFolder.GetInstallFolders | ButtonItem, ConfirmModal, Navigation, PanelSection, PanelSectionRow, Router, definePlugin, showModal, staticClasses | Router, appStore, toaster, window.SP_REACT, toasts, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Quick Launch | Apps.AddShortcut, Apps.RunGame, Apps.SetCustomArtworkForApp, Apps.SetShortcutExe, Apps.SetShortcutLaunchOptions, Apps.SetShortcutName, Apps.SpecifyCompatTool | ButtonItem, ConfirmModal, DialogButton, Dropdown, Focusable, ModalRoot, PanelSection, PanelSectionRow, TextField, ToggleField, definePlugin, showModal, staticClasses | appStore, toaster, window.SP_REACT, toasts, Steam stores | Python | flatpak |
+| Decky Cloud Save | GameSessions.RegisterForAppLifetimeNotifications, Settings, Settings.GetCurrentLanguage | ButtonItem, ConfirmModal, Menu, MenuItem, Navigation, PanelSection, PanelSectionRow, TextField, ToggleField, definePlugin, showContextMenu, showModal, sleep, staticClasses | appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Storage Cleaner | Apps.RegisterForAppDetails | ButtonItem, ConfirmModal, DialogCheckbox, PanelSection, PanelSectionRow, definePlugin, showModal, staticClasses | window.SP_REACT | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Game Theme Music | GameSessions.RegisterForAppLifetimeNotifications | ButtonItem, ConfirmModal, DialogButton, DropdownItem, Field, Focusable, Menu, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, ProgressBarWithInfo, SliderField, SteamSpinner, Tabs, TextField, ToggleField, afterPatch, appDetailsClasses, createReactTreePatcher, definePlugin, fakeRenderComponent, findInReactTree, findInTree, findModuleChild, showContextMenu, showModal, staticClasses, useParams | appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Shotty | GameSessions.RegisterForScreenshotNotification | ButtonItem, PanelSection, PanelSectionRow, Router, definePlugin, staticClasses | Router, appStore, toaster, window.SP_REACT, toasts, Steam stores | Python | gamescope |
+| MangoPeel | none detected | ButtonItem, ConfirmModal, DropdownItem, Field, Focusable, Marquee, PanelSection, PanelSectionRow, Router, SliderField, Tabs, TextField, ToggleField, definePlugin, findModuleChild, showModal, sleep, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Volume Boost | none detected | PanelSection, PanelSectionRow, SliderField, ToggleField, definePlugin, staticClasses | window.SP_REACT | Python | PulseAudio/PipeWire and pactl; hard-coded /run/user/1000 |
+| Web Browser | GameSessions.RegisterForAppLifetimeNotifications, Input.ControllerKeyboardSetKeyState, Overlay.RegisterForOverlayActivated, System, System.RegisterForOnResumeFromSuspend | ButtonItem, ConfirmModal, DialogBodyText, DialogButton, DialogButtonSecondary, DialogSubHeader, DropdownItem, Field, Focusable, GamepadButton, Marquee, Menu, MenuGroup, MenuItem, ModalPosition, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, SimpleModal, SteamSpinner, Tabs, TextField, ToggleField, afterPatch, definePlugin, findClassModule, findInReactTree, findModuleChild, gamepadContextMenuClasses, gamepadDialogClasses, gamepadTabbedPageClasses, getFocusNavController, getReactRoot, quickAccessControlsClasses, replacePatch, showContextMenu, showModal, sleep, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| DeckyFileServer | none detected | ButtonItem, DialogBody, DialogButton, DialogFooter, DialogHeader, DialogSubHeader, DropdownItem, Field, Focusable, ModalRoot, PanelSection, PanelSectionRow, TextField, Toggle, ToggleField, definePlugin, showModal, staticClasses | window.SP_REACT | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| TabMaster | Apps.GetStoreTagLocalization, GameSessions.RegisterForAppLifetimeNotifications, InstallFolder.RegisterForInstallFolderChanges, System, System.RegisterForOnResumeFromSuspend, System.RestartPC, User.RegisterForLoginStateChange | Button, ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogCheckbox, DialogControlsSection, DialogHeader, Dropdown, DropdownItem, Field, Focusable, GamepadButton, Marquee, Menu, MenuGroup, MenuItem, ModalPosition, ModalRoot, Navigation, PanelSection, PanelSectionRow, ReorderableList, ScrollPanelGroup, SidebarNavigation, SliderField, TextField, ToggleField, achievementClasses, afterPatch, findInReactTree, findInTree, findModuleExport, gamepadContextMenuClasses, gamepadDialogClasses, gamepadSliderClasses, gamepadTabbedPageClasses, joinClassNames, mainMenuAppRunningClasses, quickAccessControlsClasses, quickAccessMenuClasses, replacePatch, scrollPanelClasses, showContextMenu, showModal, sleep, wrapReactType | DeckyPluginLoader, appStore, collectionStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| TS3 QuickAccess | none detected | DialogBody, DialogButton, DialogFooter, DialogHeader, Dropdown, Field, Focusable, ModalRoot, PanelSection, PanelSectionRow, SliderField, TextField, definePlugin, showModal | none detected | Python + native payload; x86_64 | flatpak |
+| Free Loader | none detected | ButtonItem, ConfirmModal, DialogButton, Focusable, Navigation, PanelSection, PanelSectionRow, QuickAccessTab, SliderField, SteamSpinner, ToggleField, showModal | DeckyPluginLoader, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Syncthing | none detected | DialogBody, DialogButton, DialogControlsSection, DialogControlsSectionHeader, DialogHeader, Dropdown, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, ProgressBarItem, QuickAccessTab, Router, SidebarNavigation, Spinner, SteamSpinner, TextField, Toggle, definePlugin, showModal, sleep, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes | Python + native payload; x86_64 | flatpak; gamescope |
+| Decky Terminal | none detected | DialogButton, Dropdown, Field, Focusable, GamepadButton, PanelSection, Router, SidebarNavigation, SteamSpinner, TextField, ToggleField, definePlugin, staticClasses, useParams | Router, routerHook, window.SP_REACT, local/Steam routes, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| PlayTime | Apps.RegisterForAppDetails, Input.RegisterForControllerInputMessages, Storage.GetJSON, Storage.SetObject, System, System.RegisterForOnResumeFromSuspend, System.RegisterForOnSuspendRequest, User, User.RegisterForLoginStateChange, User.RegisterForPrepareForSystemSuspendProgress, User.RegisterForResumeSuspendedGamesProgress | ButtonItem, ConfirmModal, DialogButton, Dropdown, Field, Focusable, Menu, MenuGroup, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, ScrollPanelGroup, SidebarNavigation, Tabs, TextField, afterPatch, definePlugin, findClass, findSP, showContextMenu, showModal, staticClasses, useParams | SteamUIStore, appStore, collectionStore, routerHook, toaster, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Battery Tracker | none detected | PanelSection, PanelSectionRow, Router, SliderField, definePlugin, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes | Python | /sys/class/power_supply/BAT1/capacity; /sys/class/power_supply/BAT1/current_now; /sys/class/power_supply/BAT1/status; /sys/class/power_supply/BAT1/voltage_now |
+| Wine Cellar | Apps.GetAvailableCompatTools, Apps.SpecifyCompatTool, InstallFolder.GetInstallFolders, Settings.GetGlobalCompatTools, User.StartRestart | ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogControlsSection, DialogControlsSectionHeader, Dropdown, Field, Focusable, GamepadButton, Menu, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, ProgressBar, Router, ScrollPanelGroup, SidebarNavigation, TextField, definePlugin, showContextMenu, showModal, staticClasses | Router, appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| MicroSDeck | none detected | ConfirmModal, DialogButton, DialogCheckbox, Field, Focusable, Menu, MenuItem, ModalPosition, Navigation, PanelSection, ReorderableList, ScrollPanelGroup, SideMenu, SidebarNavigation, SimpleModal, TextField, ToggleField, afterPatch, appDetailsClasses, createReactTreePatcher, definePlugin, findInReactTree, findModule, findModuleChild, gamepadDialogClasses, quickAccessControlsClasses, showContextMenu, showModal, staticClasses | collectionStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam page patches/module lookup, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| ScreenshotUploader | GameSessions.RegisterForScreenshotNotification, Screenshots.UploadLocalScreenshot | DropdownItem, Field, PanelSection, PanelSectionRow, ToggleField, definePlugin, findModuleChild, staticClasses | toaster, window.SP_REACT, toasts, Steam page patches/module lookup | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| EmuDecky | none detected | ButtonItem, DialogButton, Dropdown, Menu, MenuItem, PanelSection, PanelSectionRow, Router, SteamSpinner, ToggleField, definePlugin, showContextMenu, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| KDE Connect | none detected | PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | window.SP_REACT | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Reshadeck | Input.RegisterForControllerStateChanges, System.RegisterForOnResumeFromSuspend, System.RegisterForOnSuspendRequest | ButtonItem, Dropdown, PanelSection, PanelSectionRow, definePlugin, staticClasses | toaster, window.SP_REACT, toasts | Python | gamescope |
+| CheatDeck | Apps.RegisterForAppDetails, Apps.SetAppLaunchOptions | DialogBodyText, DialogButton, DialogHeader, Dropdown, Field, Focusable, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, SidebarNavigation, TextField, ToggleField, afterPatch, definePlugin, fakeRenderComponent, findInReactTree, findInTree, findModuleByExport, showModal, staticClasses, useParams | routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam page patches/module lookup | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| BT Wake Control | none detected | ButtonItem, IconsModule, PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | toaster, window.SP_REACT, toasts | Python | /sys/devices/virtual/dmi/id/board_name; /sys/devices/virtual/dmi/id/board_vendor; bluetoothctl |
+| Brightness Bar | System.Display.RegisterForBrightnessChanges | ButtonItem, ColorPickerModal, PanelSection, PanelSectionRow, SliderField, ToggleField, definePlugin, findModuleChild, showModal, staticClasses | routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup | Python | Targets Steam/QAM brightness shortcuts and a global Steam overlay; neither is attached to the Framey panel. |
+| Decky Notifications | none detected | ButtonItem, Menu, MenuItem, PanelSection, PanelSectionRow, definePlugin, showContextMenu, staticClasses | DeckyPluginLoader, toaster, window.SP_REACT, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| MagicBlack | System.Audio.GetDevices, System.Audio.SetDeviceVolume | DialogButton, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, SliderField, ToggleField, definePlugin, findModuleChild, findModuleExport, gamepadDialogClasses, joinClassNames, quickAccessMenuClasses, showModal, staticClasses | SteamUIStore, routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | Targets a global Steam Deck screen-black overlay; the isolated panel cannot black out the Frame compositor. |
+| IsThereAnyDeal for Deck | User.GetIPCountry | DialogButton, DropdownItem, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, ToggleField, definePlugin, findModuleChild, showModal, staticClasses | routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| MagicPods | Input.RegisterForControllerStateChanges, System.Audio.GetDevices, System.Audio.RegisterForDeviceVolumeChanged, System.Audio.SetDeviceVolume, System.Bluetooth, System.Bluetooth.RegisterForStateChanges, System.Bluetooth.SetEnabled | ButtonItem, DialogButton, Field, Focusable, Menu, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, SliderField, Tabs, ToggleField, afterPatch, definePlugin, findClassModule, findModuleChild, findModuleDetailsByExport, findSP, gamepadDialogClasses, gamepadSliderClasses, getGamepadNavigationTrees, joinClassNames, quickAccessMenuClasses, showContextMenu, showModal, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Junk-Store | Apps.AddShortcut, Apps.GetAvailableCompatTools, Apps.RemoveShortcut, Apps.RunGame, Apps.SetAppLaunchOptions, Apps.SetCustomArtworkForApp, Apps.SetShortcutExe, Apps.SetShortcutLaunchOptions, Apps.SetShortcutName, Apps.SetShortcutStartDir, Apps.SpecifyCompatTool, GameSessions.RegisterForAppLifetimeNotifications, Input.RegisterForControllerInputMessages, Installs.OpenInstallWizard | Button, ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogControlsSection, DialogLabel, Dropdown, Field, Focusable, GamepadButton, Marquee, Menu, MenuItem, ModalPosition, ModalRoot, Navigation, PanelSection, PanelSectionRow, ProgressBar, ScrollPanelGroup, SidebarNavigation, SliderField, Spinner, SteamSpinner, Tabs, TextField, ToggleField, afterPatch, definePlugin, findClassModule, gamepadDialogClasses, gamepadTabbedPageClasses, joinClassNames, quickAccessControlsClasses, quickAccessMenuClasses, scrollPanelClasses, showContextMenu, showModal, sleep, staticClasses, useParams | Router, SteamUIStore, appDetailsStore, appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | sudo |
+| Decky-Undervolt | GameSessions.RegisterForAppLifetimeNotifications, System.RegisterForOnResumeFromSuspend | ButtonItem, DialogButton, DropdownItem, Navigation, PanelSection, PanelSectionRow, Router, SidebarNavigation, SliderField, TextField, ToggleField, definePlugin | Router, appStore, routerHook, window.SP_REACT, local/Steam routes, Steam stores | Python + native payload; x86_64 | RyzenAdj Curve Optimizer requires an AMD CPU; Frame is ARM64. |
+| ScreenSaver | Input.RegisterForControllerInputMessages, Input.RegisterForControllerStateChanges, Settings.SetSetting, System.RegisterForOnSuspendRequest, System.UpdateSettings, User.RegisterForPrepareForSystemSuspendProgress | PanelSection, PanelSectionRow, ToggleField, definePlugin, findModuleChild, staticClasses | toaster, window.SP_REACT, toasts, Steam page patches/module lookup | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| steamdeck-input-disabler | none detected | PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | window.SP_REACT | Python | Targets the built-in Steam Deck USB gamepad; Frame has different controllers. |
+| DeckySpy | System.RegisterForOnResumeFromSuspend | ButtonItem, Field, PanelSection, PanelSectionRow, Router, SliderField, ToggleField, definePlugin, staticClasses | Router, toaster, window.SP_REACT, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Picture in Picture | none detected | ButtonItem, ConfirmModal, DropdownItem, PanelSection, PanelSectionRow, Router, SliderField, TextField, ToggleField, findModuleChild, getGamepadNavigationTrees, quickAccessMenuClasses, showModal | Router, routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup, Steam stores | no Python/native backend found | No specific hardware requirement detected statically; runtime requirements unverified. |
+| PlayCount | none detected | Button, ButtonItem, DialogBody, DialogButton, DialogControlsSection, DialogHeader, DropdownItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, SliderField, Tabs, ToggleField, afterPatch, appDetailsClasses, createReactTreePatcher, definePlugin, findInReactTree, findModuleChild, showModal, staticClasses | routerHook, window.SP_REACT, local/Steam routes, QAM/global tabs, Steam page patches/module lookup, Steam stores | no Python/native backend found | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Crosshair | none detected | ButtonItem, PanelSection, PanelSectionRow, staticClasses | window.SP_REACT, QAM/global tabs | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Deck Settings | InstallFolder.GetInstallFolders, System.GetSystemInfo | ButtonItem, ConfirmModal, DialogBody, DialogButton, Dropdown, Field, Focusable, GamepadButton, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, ScrollPanelGroup, SliderField, Spinner, TextField, ToggleField, gamepadDialogClasses, scrollPanelClasses, showModal, staticClasses | Router, collectionStore, toaster, window.SP_REACT, toasts, QAM/global tabs, Steam stores | Python | /sys/class/dmi/id/sys_vendor; /sys/class/dmi/id/sys_vendor, |
+| Decky DoT DNS | none detected | ButtonItem, Dropdown, PanelSection, PanelSectionRow, TextField, ToggleField, staticClasses | window.SP_REACT | Python | systemctl |
+| Decky-SpoofDPI | User.StartRestart | ButtonItem, PanelSection, PanelSectionRow, TextField, ToggleField, staticClasses | toaster, window.SP_REACT, toasts | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Simple Timer | none detected | Button, ButtonItem, ConfirmModal, Focusable, PanelSection, PanelSectionRow, ToggleField, findModuleChild, showModal, staticClasses | toaster, window.SP_REACT, toasts, Steam page patches/module lookup | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Decky-Framegen | none detected | ButtonItem, ConfirmModal, PanelSection, PanelSectionRow, showModal | toaster, window.SP_REACT, toasts | Python + native payload; Windows | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Decky-Lookup | none detected | ButtonItem, PanelSection, PanelSectionRow, Router, staticClasses | Router, window.SP_REACT | no Python/native backend found | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Decky Zerotier | none detected | ConfirmModal, DialogBody, DialogButton, DialogSubHeader, Field, Focusable, PanelSection, PanelSectionRow, TextField, ToggleField, showModal | Router, toaster, window.SP_REACT, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Virtual Surround Sound | none detected | ConfirmModal, DialogButton, Dropdown, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, SliderField, ToggleField, showModal, staticClasses | Router, window.SP_REACT, QAM/global tabs | Python | pactl |
+| XIVOmega | none detected | ButtonItem, Menu, MenuItem, Navigation, PanelSection, PanelSectionRow, Router, SidebarNavigation, Spinner, TextField, ToggleField, showContextMenu, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes | Python | /sys/net/ethertypes.h; /sys/net/if_pflog.h; /sys/net/pfvar.h; /sys/socket.h.auto.html; /sys/sys/socket.h; sudo; x86_64 |
+| DeckSP | Input.ControllerKeyboardSetKeyState, System, System.Audio.GetDevices, System.Audio.RegisterForDeviceAdded, UI.RegisterForUIModeChanged, User.RegisterForShutdownStart | ButtonItem, ConfirmModal, DialogButton, Dropdown, DropdownItem, EUIMode, Field, Focusable, GamepadButton, Marquee, Menu, MenuGroup, MenuItem, ModalPosition, ModalRoot, Navigation, PanelSection, PanelSectionRow, ScrollPanelGroup, SimpleModal, SliderField, TextField, ToggleField, findModuleExport, gamepadContextMenuClasses, gamepadDialogClasses, quickAccessControlsClasses, quickAccessMenuClasses, scrollPanelClasses, showContextMenu, showModal, sleep | SteamUIStore, appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | flatpak; systemctl |
+| Decky Ludusavi | Apps.GetLaunchOptionsForApp, GameSessions.RegisterForAppLifetimeNotifications | ButtonItem, ConfirmModal, DialogButton, Dropdown, Focusable, Navigation, PanelSection, PanelSectionRow, TextField, ToggleField, showModal | appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam stores | Python | flatpak |
+| Game Sync | GameSessions.RegisterForAppLifetimeNotifications, GameSessions.RegisterForScreenshotNotification, Screenshots.DeleteLocalScreenshot | ButtonItem, ConfirmModal, DialogButton, Field, Focusable, Menu, MenuItem, Navigation, PanelSection, PanelSectionRow, ReorderableList, SidebarNavigation, TextField, ToggleField, afterPatch, fakeRenderComponent, findInReactTree, findInTree, findModuleByExport, showContextMenu, showModal, sleep, useParams | appStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | amd64 |
+| WiFi Locker | none detected | ButtonItem, Field, PanelSection, PanelSectionRow, staticClasses | toaster, window.SP_REACT, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| LetMeReShade | Apps.SetAppLaunchOptions | ButtonItem, ConfirmModal, DropdownItem, PanelSection, PanelSectionRow, ToggleField, showModal | window.SP_REACT | Python | /sys/devices/virtual/dmi/id/board_name; /sys/devices/virtual/dmi/id/product_name; /sys/devices/virtual/dmi/id/sys_vendor |
+| Decky Sunshine | none detected | ButtonItem, DialogButton, DialogButtonPrimary, Field, ModalRoot, PanelSection, PanelSectionRow, Spinner, TextField, definePlugin, showModal | window.SP_REACT | Python | flatpak |
+| HueSync | Settings.GetCurrentLanguage, System.GetSystemInfo, System.RegisterForBatteryStateChanges, System.RegisterForOnResumeFromSuspend, System.RegisterForOnSuspendRequest, User.RegisterForPrepareForSystemSuspendProgress, User.RegisterForResumeSuspendedGamesProgress | DialogButton, DropdownItem, Field, Focusable, Marquee, ModalRoot, PanelSection, PanelSectionRow, Router, SliderField, TextField, ToggleField, definePlugin, findModuleChild, gamepadSliderClasses, showModal, staticClasses | Router, toaster, window.SP_REACT, toasts, Steam page patches/module lookup, Steam stores | Python + native payload; x86_64 | Targets handheld RGB/LED controllers (AYANEO/Ally/MSI), not Frame hardware. |
+| MuraDeck | System.Display.RegisterForBrightnessChanges | ButtonItem, ConfirmModal, Field, Focusable, Navigation, PanelSection, PanelSectionRow, SideMenu, SidebarNavigation, SliderField, ToggleField, quickAccessControlsClasses, showModal | SteamUIStore, routerHook, window.SP_REACT, local/Steam routes, Steam stores | Python | Calibration is specifically for defective Samsung Steam Deck OLED panels, not Frame displays. |
+| Dimmer Deck | Settings.GetCurrentLanguage, System.Display.RegisterForBrightnessChanges, System.Display.SetBrightness | PanelSection, PanelSectionRow, SliderField, ToggleField, staticClasses | toaster, window.SP_REACT, toasts, Steam stores | Python | Changes gamescope/X11 dimming properties; no mapping to Frame VR display brightness exists. |
+| Music Control | none detected | ButtonItem, DialogButton, Focusable, PanelSection, PanelSectionRow, Router, SidebarNavigation, SliderField, SteamSpinner, definePlugin, staticClasses | Router, routerHook, window.SP_REACT, local/Steam routes | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Better Keyboard | Settings.GetCurrentLanguage, UI.GetUIMode, UI.RegisterForUIModeChanged | ButtonItem, EUIMode, PanelSection, PanelSectionRow, ToggleField, staticClasses | SteamUIStore, window.SP_REACT, Steam stores | Python | /dev/input |
+| Decky LSFG-VK | none detected | ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogControlsSection, DialogControlsSectionHeader, DialogHeader, Dropdown, Field, Focusable, ModalRoot, PanelSection, PanelSectionRow, Router, SliderField, Spinner, TextField, Toggle, ToggleField, showModal, staticClasses | Router, toaster, window.SP_REACT, toasts | Python | flatpak; x86_64 |
+| Network Sentinel | none detected | ButtonItem, Navigation, PanelSection, PanelSectionRow, SliderField, ToggleField, staticClasses | toaster, window.SP_REACT, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Decky Clash | Settings.GetCurrentLanguage | ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogControlsSection, DialogControlsSectionHeader, Dropdown, DropdownItem, Field, Focusable, GamepadButton, Menu, MenuItem, Navigation, PanelSection, PanelSectionRow, Router, SidebarNavigation, SliderField, Spinner, TextField, ToggleField, showContextMenu, showModal, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Muon | System, System.RegisterForOnResumeFromSuspend, System.RegisterForOnSuspendRequest | ButtonItem, DialogButton, Field, Focusable, ModalRoot, PanelSection, PanelSectionRow, TextField, Toggle, findModuleExport, showModal, staticClasses | toaster, window.SP_REACT, toasts, Steam page patches/module lookup | Python | sudo; systemctl |
+| DeckyParty File Manager | none detected | PanelSection, PanelSectionRow, ToggleField, definePlugin, staticClasses | window.SP_REACT | Python | sudo |
+| Speed Test | none detected | ButtonItem, PanelSection, PanelSectionRow, staticClasses | none detected | no Python/native backend found | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Decky Clipboard | none detected | ButtonItem, DialogBody, DialogButton, DialogControlsSection, DialogControlsSectionHeader, Field, Navigation, PanelSection, PanelSectionRow, Router, SidebarNavigation, SliderField, TextField, ToggleField, staticClasses | Router, routerHook, toaster, local/Steam routes, toasts | Python + native payload; x86_64 | gamescope; sudo |
+| Reroll | Apps.RegisterForGameActionUserRequest, GameSessions.RegisterForAppLifetimeNotifications, Settings.GetCurrentLanguage | ButtonItem, DialogButton, Field, Focusable, Marquee, ModalRoot, PanelSection, PanelSectionRow, SliderField, libraryAssetImageClasses, mainMenuAppRunningClasses, quickAccessMenuClasses, showModal | SteamUIStore, QAM/global tabs, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| DeckPass | Apps.AddShortcut, Apps.RunGame, Apps.SetCustomArtworkForApp, Apps.SetShortcutExe, Apps.SetShortcutLaunchOptions, Apps.SetShortcutName, Input.ControllerKeyboardSendText | Button, ButtonItem, DialogButton, Field, Focusable, ModalRoot, PanelSection, PanelSectionRow, Router, TextField, findSP, showModal, sleep, staticClasses | Router, appDetailsStore, appStore, toaster, window.SP_REACT, toasts, Steam stores | Python | flatpak |
+| Steam Status | none detected | ButtonItem, ConfirmModal, DialogButton, Field, Focusable, Navigation, PanelSection, PanelSectionRow, SliderField, ToggleField, definePlugin, showModal, staticClasses | toaster, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| AlarMe | GameSessions.RegisterForAppLifetimeNotifications | ButtonItem, ConfirmModal, Dropdown, Focusable, Navigation, PanelSection, PanelSectionRow, ProgressBarWithInfo, SidebarNavigation, SliderField, TextField, ToggleField, findModuleChild, showModal, staticClasses | routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup | Python | Timers/stopwatch use Python. Optional sleep inhibition opens /dev/uinput; sound and auto-suspend are unverified. Steam game overlays have no target in the isolated panel. |
+| Decky Localsend | none detected | ButtonItem, DialogBody, DialogButton, DialogButtonPrimary, DialogFooter, DialogHeader, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, SidebarNavigation, TextField, ToggleField, showModal, staticClasses | Router, routerHook, toaster, local/Steam routes, toasts, Steam stores | Python + native payload; x86_64 | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Launch Options | Apps.RegisterForAppDetails, Apps.SetAppLaunchOptions | ButtonItem, ConfirmModal, DialogBody, DialogButton, DialogButtonPrimary, DialogControlsSection, DialogControlsSectionHeader, DialogFooter, DialogHeader, Dropdown, Field, Focusable, MenuItem, ModalRoot, Navigation, PanelSection, PanelSectionRow, ScrollPanel, SidebarNavigation, SteamSpinner, Tabs, TextField, Toggle, ToggleField, afterPatch, createReactTreePatcher, fakeRenderComponent, findInReactTree, findInTree, findModule, findModuleByExport, showModal, staticClasses, useParams | SteamUIStore, routerHook, local/Steam routes, Steam page patches/module lookup, Steam stores | Python + native payload; x86_64 | flatpak; gamescope |
+| Decky Translator | User.RegisterForPrepareForSystemSuspendProgress | ButtonItem, DialogButton, Dropdown, DropdownItem, Field, Focusable, ModalRoot, Navigation, PanelSection, PanelSectionRow, Router, SliderField, Tabs, TextField, ToggleField, findModuleChild, showModal, staticClasses | Router, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup | Python | /dev/hidraw; /sys/class/hidraw/hidraw{i}; /sys/class/hidraw/hidraw{i}/device/uevent; x86_64 |
+| Quick User Switcher | none detected | ButtonItem, ConfirmModal, Focusable, PanelSection, PanelSectionRow, ToggleField, afterPatch, showModal, staticClasses, wrapReactType | Router, routerHook, local/Steam routes, Steam page patches/module lookup | Python | sudo |
+| ShadowDeck | none detected | ButtonItem, DialogButton, DropdownItem, Focusable, PanelSection, PanelSectionRow, TextField, Toggle, showModal, staticClasses | toaster, toasts | Python | amd64 |
+| Games Prefix Manager | none detected | ButtonItem, DialogButton, Focusable, ModalRoot, PanelSection, PanelSectionRow, TextField, definePlugin, showModal, staticClasses | none detected | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Download All | Downloads, Downloads.RegisterForDownloadItems | ButtonItem, PanelSection, PanelSectionRow, SliderField | appStore, toaster, toasts, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| SuggestMe | GameSessions.RegisterForAppLifetimeNotifications | ButtonItem, ConfirmModal, DropdownItem, Focusable, Navigation, PanelSection, PanelSectionRow, ProgressBar, SidebarNavigation, SliderField, Spinner, TextField, ToggleField, showModal, staticClasses | appStore, collectionStore, routerHook, toaster, window.SP_REACT, local/Steam routes, toasts, QAM/global tabs, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Non-Steam Badges | none detected | DialogButton, DropdownItem, Navigation, PanelSection, PanelSectionRow, ToggleField, afterPatch, appDetailsClasses, createReactTreePatcher, findInReactTree, getGamepadNavigationTrees | collectionStore, routerHook, local/Steam routes, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Deck Progress Tracker | Apps.GetAllApps, Apps.GetMyAchievementsForApp | ButtonItem, DialogButton, Focusable, Navigation, PanelSection, PanelSectionRow, afterPatch, appDetailsClasses, appDetailsHeaderClasses, createReactTreePatcher, findInReactTree, staticClasses | appStore, collectionStore, routerHook, toaster, local/Steam routes, toasts, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Deck Shelves | Apps.RegisterForAppDetails, System.GetOSVersion, System.GetSystemInfo | showContextMenu | SteamUIStore, appDetailsStore, appStore, collectionStore, routerHook, toaster, local/Steam routes, toasts, QAM/global tabs, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Decky-Clipper | none detected | ButtonItem, ModalRoot, Navigation, PanelSection, Router, ToggleField, showModal, staticClasses | Router | Python + native payload; x86_64 | gamescope |
+| Decky Proton Launch | Apps.RegisterForAppDetails, Apps.SetAppLaunchOptions, User.StartRestart | ConfirmModal, DialogButton, DropdownItem, Focusable, GamepadButton, ModalRoot, PanelSection, PanelSectionRow, TextField, ToggleField, showModal, staticClasses | toaster, toasts, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| Docky | none detected | ButtonItem, ConfirmModal, DialogButton, DropdownItem, Field, Focusable, ModalRoot, PanelSection, PanelSectionRow, TextField, ToggleField, definePlugin, showModal | toaster, window.SP_REACT, toasts | Python | /sys/bus/usb/devices/; /sys/bus/usb/devices/*; /sys/bus/usb/drivers/usb/; /sys/bus/usb/drivers/usb/%s; /sys/class/drm/*/status; /sys/class/drm/card*-*/; /sys/class/hwmon/hwmon*; /sys/class/hwmon/hwmonN; /sys/class/power_supply/*/online; /sys/class/thermal; /sys/class/thermal/thermal_zone*/temp; amdgpu; flatpak; gamescope; hwmon; pactl; sudo; systemctl |
+| Output Manager | none detected | ButtonItem, Navigation, PanelSection, PanelSectionRow, TextField, ToggleField, staticClasses | none detected | Python | /sys/class/drm; /sys/class/drm/card{card_number}/device; /sys/kernel/debug/dri; pactl |
+| IPv6 Enabler Plugin | none detected | DropdownItem, Field, PanelSection, PanelSectionRow, staticClasses | toaster, toasts | Python | /sys/net/ipv6/conf |
+| DeckyClocker | none detected | ButtonItem, Field, PanelSection, PanelSectionRow, SliderField | toaster, toasts | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+| MuteOnSleep | none detected | PanelSection, PanelSectionRow, ToggleField | Steam stores | Python | pactl; sudo |
+| Desktop Apps | Apps.AddShortcut, Apps.RemoveShortcut, Apps.RunGame, Apps.SetShortcutExe, Apps.SetShortcutLaunchOptions, Apps.SetShortcutName, Apps.SetShortcutStartDir, GameSessions.RegisterForAppLifetimeNotifications | DialogButton, Focusable, Menu, MenuItem, PanelSection, PanelSectionRow, showContextMenu, staticClasses | appStore, toaster, toasts, Steam stores | Python | flatpak |
+| Mixer | none detected | ButtonItem, ConfirmModal, DialogButton, Focusable, PanelSection, PanelSectionRow, SliderField, TextField, showModal, staticClasses | toaster, toasts | Python | PipeWire, pw-dump and wpctl |
+| VARTA | Store.SetWishlist, StoreItems.SetWishlist, User, User.GetSteamID | ButtonItem, DropdownItem, Field, PanelSection, PanelSectionRow, Spinner, ToggleField, afterPatch, appDetailsClasses, beforePatch, createReactTreePatcher, findInReactTree, findModule, findModuleByExport, findModuleExport, staticClasses, useParams | routerHook, toaster, local/Steam routes, toasts, Steam page patches/module lookup, Steam stores | Python | No specific hardware requirement detected statically; runtime requirements unverified. |
+
+## Native payload portability
+
+All published Linux native payloads in this snapshot are x86_64; no published aarch64 payload was found. The three Windows DLLs belong to Decky-Framegen. The installer still rejects these archives. Apart from the explicitly described LocalSend experiment, ARM64 builds were not attempted: the constraints below remain unresolved.
+
+[LocalSend ARM64 build/runtime evidence](evidence/framey-localsend-arm64-2026-10-26.md) covers a reproducible MIT helper build and its isolated real-Frame protocol 2.0 info response. The official x86 archive remains blocked; full plugin integration and file transfers are unverified.
+
+| Plugin | Native payloads | ARM64 result / remaining blocker |
+| --- | --- | --- |
+| Fantastic | bin/backend | Fan backend/driver is Deck-specific; an ARM64 rebuild would not provide compatible Frame hardware. |
+| PowerTools | bin/libryzenadj.so, bin/ryzenadj, bin/backend | RyzenAdj and AMD power backend cannot control an ARM64 Frame SoC. |
+| Memory Deck | bin/libscanmem.so.1.0.0 | libscanmem must be rebuilt for aarch64 and validated against target process architecture; memory writes were not tested. |
+| Emuchievements | bin/hash | A source-matched ARM64 bin/hash helper matched the official x86_64 helper on one synthetic ROM on the real Frame (docs/evidence/framey-emuchievements-arm-2026-10-26.md). The official ZIP still bundles x86_64 bytes and remains blocked; format coverage, packaging, plugin backend/UI, login and worn VR are unverified. |
+| MoonDeck | python/externals/yarl/_quoting_c.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_http_parser.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_websocket/reader_c.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_websocket/mask.cpython-313-x86_64-linux-gnu.so, python/externals/aiohttp/_http_writer.cpython-313-x86_64-linux-gnu.so, … 26 total; full list in JSON | Rebuild vendored CPython 3.13 extension wheels for the headset Python ABI and ARM64; buddy/helper dependencies also need ports. |
+| Controller Tools | bin/backend | Native backend needs an ARM64 build and controller/HID dependencies; its direct websocket also bypasses the Framey bridge. |
+| DeckMTP | bin/umtprd | umtprd needs ARM64 libusb/MTP dependencies and USB gadget permissions; root user-service blocker remains. |
+| Decky Cloud Save | bin/rclone | rclone needs an ARM64 artifact; this ZIP also fails safe member validation. Cloud writes were not exercised. |
+| DeckyFileServer | bin/backend | Native file-server backend needs ARM64 dependencies; root requirement also blocks the user service. |
+| TS3 QuickAccess | bin/ts3-qs4sd.so | TeamSpeak client plugin must match an ARM64 TeamSpeak client and SDK ABI, not merely rebuild the .so. |
+| Syncthing | bin/decky-syncthing-watchdog | The watchdog needs an ARM64 build, plus a supported Syncthing runtime/package and safe path validation. |
+| Wine Cellar | bin/backend | Native backend needs an ARM64 build; direct websocket and Wine runtime assumptions also need integration. |
+| MicroSDeck | bin/backend | Native backend needs an ARM64 build and block-device/mount permission audit; no storage actions were run. |
+| EmuDecky | bin/hello | Published bin/hello is x86_64 even if unused; upstream must remove it or publish an ARM64 archive, plus remove root dependency. |
+| MagicPods | bin/magicpodscore | magicpodscore requires an upstream ARM64 artifact/source and protocol tests; frontend uses a direct websocket. |
+| Decky-Undervolt | bin/libryzenadj.so, bin/ryzenadj | RyzenAdj is AMD-specific and cannot be ported to control the Frame SoC. |
+| Decky-SpoofDPI | bin/spoofdpi | SpoofDPI is a separate upstream helper; needs an ARM64 artifact/protocol and network-permission validation. |
+| Decky-Framegen | bin/nvngx.dll, bin/dlssg_to_fsr3_amd_is_better.dll, bin/nvapi64.dll | Windows DLL payload targets x86 game translation rather than a native ARM backend; archive is 75,140,408 bytes, beyond the 50 MiB installer limit. |
+| HueSync | bin/hello, py_modules/portio.so | portio and handheld LED backends depend on x86 I/O/unsupported hardware; ARM64 compilation alone is insufficient. |
+| Decky Clipboard | bin/xclip | xclip needs ARM64 X11 libraries/server; root and gamescope assumptions also block this archive. |
+| Reroll | bin/memscan.so | memscan.so needs ARM64 process-memory support and ABI testing; root requirement remains. Frontend initializes but no memory access was tested. |
+| Decky Localsend | bin/localsend-core | MIT LocalSend-Go 66edc509a28b9f877e7374504892dcbc653a4da4 reproducibly cross-built with Go 1.25.7/CGO_ENABLED=0 for ARM64; SHA-256 e79238f6051ce34f172f765ae918d3d902b819e27377989a55e5b1eba10e46f9. Help/official backend CLI flags and protocol 2.0 info endpoint passed on real Frame in an isolated network namespace. No file transfer or full plugin/CEF integration tested; exact source match to shipped helper unproven. Official ZIP stays x86_64 and blocked. |
+| Launch Options | bin/hello | Remove the template x86 bin/hello or publish an ARM64 rebuild; missing Steam module mapping also prevents frontend initialization. |
+| Decky-Clipper | bin/gstreamer-1.0/libgstproxy.so, bin/gstreamer-1.0/libgstmidi.so, bin/gstreamer-1.0/libgstmpegtsmux.so, bin/gstreamer-1.0/gst-plugin-scanner, bin/gstreamer-1.0/libgstivfparse.so, … 115 total; full list in JSON | Rebuild all bundled GStreamer libraries/plugins for ARM64 and verify capture/codec ABI against Frame SteamVR; gamescope capture differs. |
+
+## Evidence and maintenance
+
+The canonical JSON contains full archive hashes, native paths, source URLs, frontend observations and fake-Frame outcomes. Store compatibility is advisory except known installation/hardware blockers; removal always remains available. A panel retains its compatibility reason after the initializer reports ready. Upstream fixes require a new digest-scoped audit. Do not mark a plugin works based on archive installation, fake backend replies or initializer completion.

docs/framey-loader.md

@@ -6,6 +6,8 @@ user services under `~/.local/share/frame-control`; neither needs root or a
 read-write SteamOS root filesystem. Decky's standard Quick Access menu still
 does not appear in the separate SteamVR CEF target.
 
+See the [complete official-store compatibility table](framey-compatibility.md) for version-specific statuses, blockers and verification limits. Both stores and installed panels show the same digest-scoped results; a new published archive starts unverified.
+
 ## Use in the headset
 
 Install **Frame Control in VR** and **Decky Loader on Frame** from Frame Control
@@ -14,6 +16,10 @@ plugins → Open official store**. Search the catalogue, confirm an install, and
 choose **Open panel** from the installed plugin list. The panel contains the
 plugin's own controls and settings. Update and Remove affect only plugin
 folders that Frame Control's store manager installed.
+Use **Scroll plugin up** and **Scroll plugin down** above an open panel when
+wheel scrolling is unavailable. Point at a scrollable part of the plugin first
+to move that section; otherwise the buttons move the panel document. Each
+press moves about three quarters of the visible section and stops at its edge.
 Removing a plugin keeps its Decky settings. Removing the Frame Control headset
 panel or Decky backend keeps plugin folders until each is removed separately.
 
@@ -24,7 +30,10 @@ and swaps one managed plugin
 folder with rollback on failure. It rejects non-ARM64 ELF and Windows binaries.
 The Decky user service restarts after a file change. Framey's panel host accepts
 API v2 bundles and API v1 bundles using Decky's modern frontend initializer,
-with `dist/index.js`; other installed plugins remain manageable but have no
+with `dist/index.js`. Legacy `(function (...) {...})(DFL, SP_REACT)` bundles are
+also accepted: their returned initializer receives the legacy `serverAPI`, and
+keyword backend calls use Decky's legacy RPC. The wrapper runs as a blob ES
+module inside the same sandbox; it does not require `eval`. Other installed plugins remain manageable but have no
 Framey panel. API v1 admission is a compatibility attempt, not a guarantee
 that the plugin's controls work in VR. The store manager does not currently
 screen a plugin's runtime network downloads.
@@ -46,10 +55,42 @@ restores the cache when a panel reopens if the parent's browser storage is
 available. If storage is denied or cleared, the cache lasts only for the current
 panel. Use the plugin backend for settings that must survive cache loss.
 
+Decky API v1/v2 `addEventListener` and `removeEventListener` receive real backend
+events while the panel is open. The parent resolves the plugin name from its
+installed store receipt, polls Steam's existing Decky event connection, and sends
+only subscribed events to that panel session. A subscription is established
+before a backend call can emit its response. The bridge allows 32 event names,
+queues at most 64 events and 48 KiB, and drops any event whose arguments exceed
+8 KiB. Polling occurs about once a second, so this is unsuitable for high-rate
+input/audio streams. Closing/reopening a panel removes its subscriptions;
+abandoned CEF subscriptions expire after 15 seconds. This does not deliver
+global notifications while a Framey panel is closed.
+
+The [26 October live checks](evidence/framey-events-backend-2026-10-26.json)
+used the actual official Notebook and Simple Timer Python backends in a private
+removable ARM64 Decky service. Notebook's default notebook saved a pointer stroke
+and loaded it after a backend restart. Simple Timer's start/cancel controls,
+countdown, completion toast and persisted recents/subtle mode worked. Simple
+Timer remains partial: its own expired-timer startup raises a missing
+`timer_task` error, sound/suspend are unsupported, and worn VR was not checked.
+
+DFL module and class lookup searches a finite registry of Framey's own controls,
+CSS maps and an explicitly unsupported optional UI-audio player. It follows DFL's
+module/export filter and mapping contracts; unknown Steam modules return
+`undefined`, and unknown module mappings are empty. Returned IDs describe local
+Framey exports, not Steam webpack IDs. Sound playback throws an unsupported
+error, and Steam audio stores, function-source signatures and global patches are
+not fabricated. The [module lookup checks](evidence/framey-module-lookup-2026-10-26.md)
+record the resulting TabMaster documentation support and remaining blockers.
+
 The host currently supplies sections, rows, buttons, toggles, text fields,
 sliders, grouped dropdowns,
 scroll containers, a modal, locale information, local panel routes and toasts,
-and backend calls for the plugin that owns the panel. Steam library/store page
+and backend calls for the plugin that owns the panel. The headset's scroll
+buttons send only a direction to the isolated iframe. They target the last
+scrollable region reached by a trusted pointer move and fall back to the iframe
+document when that region disappears. A result message reports whether content
+moved; this bridge has no backend or Steam privilege. Steam library/store page
 patches, global Steam UI components, file pickers, and privileged root methods
 have no VR target. A plugin that depends on them can render only part of its UI
 or show an incompatibility message. A Decky plugin's Python backend still runs as
@@ -80,6 +121,64 @@ work in VR. Storage Cleaner rendered an
 [empty-data panel in local Chromium](evidence/framey-api-v1-browser-2026-10-25.md).
 Its cleanup actions were not tested; they may remove local game saves.
 
+Framey also supplies local tabs/sidebar pages, spinners, dialog/menu wrappers
+and progress bars. Its explicit SteamClient subscription fallbacks return
+disposable handles without emitting fabricated events. Running-game reads and
+lifetime notifications use the scoped bridge described below; power, app launch
+and hardware mutation methods are not supplied. Other live Steam stores require integration
+work. IndexedDB is hidden because the browser exposes it but denies access in
+an opaque iframe; localForage can then select Framey's bounded localStorage.
+Direct IndexedDB users remain unsupported.
+
+`SuspensefulImage` renders a native image. SteamClient `Storage.GetJSON` and
+`SetObject` use the same bounded per-plugin cache, including panel reopen
+persistence; they do not read Steam's account/global JSON store. Missing keys
+reject with `Not found`. The suspend store has no methods. Optional Steam app/account globals
+are undefined until a successful library read. These fallbacks let settings render without inventing live
+games or account identity. [The exact-bundle follow-up](evidence/framey-ui-fallbacks-2026-10-26.json)
+verifies Pause Games and Tailscale Control settings in local Chromium; their
+primary backend actions remain unverified. PlayTime still requires Steam's
+MobX game observers for automatic tracking.
+
+Panels referencing running-game APIs now receive a detached, read-only
+`SteamUIStore.RunningApps` / `MainRunningApp` snapshot, also exposed through
+`DFL.Router`. The authenticated headset-only `/api/framey/running` endpoint
+checks installed store ownership; the parent checks the active panel session.
+Poll and close requests also carry the panel's pinned SHA-256 receipt. A missing
+or changed installed receipt is rejected before any Steam CEF request; a rejected
+stale close relies on the existing finite subscription lease for cleanup.
+Fixed bundled code runs in Steam CEF. It copies at most 64 running app overviews, a main app and
+public Steam CDN capsule URLs; it never copies local artwork paths, launch
+commands or Steam objects. The host refreshes about every two seconds without
+overlapping requests. Failure clears stale context and sets
+`SteamUIStore.FrameyRunningAvailable` to false.
+
+`GameSessions.RegisterForAppLifetimeNotifications` relays actual Steam
+`{unAppID, bRunning}` callbacks through a bounded 64-event queue. Snapshot
+changes never fabricate launch/exit callbacks. Handles support `.unregister()`;
+panel close/replacement removes the CEF subscription, with a 15-second lease
+(checked every five seconds) if cleanup cannot reach Steam. At most four panel
+sessions are retained. These are open-panel observations, not closed-panel
+automation or a MobX implementation. Queue overflow can lose old callbacks.
+`appStore` capsule helpers expose only projected public URLs for running apps;
+unavailable or local custom artwork returns an empty value.
+
+[Running-context evidence](evidence/framey-running-context-2026-10-26.md) separates
+real Frame empty-list/subscription/cleanup reads, the exact Discord Status
+ARM64 backend connection check, and synthetic nonempty/transition fixtures.
+Real game transitions, Discord activity and worn-VR operation remain unverified.
+
+Three parameterless SteamClient reads use Steam's actual CEF context:
+`User.GetIPCountry`, `InstallFolder.GetInstallFolders` and `System.GetSystemInfo`.
+The authenticated headset-only endpoint checks that the plugin is installed,
+selects an expression from a fixed allowlist, and caps replies at 256 KiB.
+The iframe cannot supply a Steam property path or executable source, and replies
+are discarded if the panel session changed. Unsupported APIs remain unavailable.
+[Locked Frame checks](evidence/framey-steam-reads-2026-10-26.json) verified all
+three reads and IsThereAnyDeal's country dropdown in local Chromium. Its backend
+settings/deal calls stayed denied; Deck Settings still needs real Steam library
+context. A deployed headset HTTP endpoint and worn-VR behavior remain unverified.
+
 The fake Frame integration test now writes a Decky setting through Framey's
 scoped backend endpoint, reads it in a new CEF request, updates the plugin,
 then checks it again. It also confirms removal blocks method calls and a
@@ -102,7 +201,10 @@ Install, Update, and Remove show the current job stage in the headset panel.
 The store verifies each downloaded archive and the headset applies it with a
 rollback if Decky cannot start. The panel remembers the current job ID for this
 browser session, so **Check result** can resume polling after a navigation or
-temporary connection error. Refresh the installed list before starting another
+temporary connection error. After a polling error, Install, Update, and Remove
+stay disabled while the saved job's result is unknown; use **Check result**
+before starting another change.
+Refresh the installed list before starting another
 operation after an error. The headset panel and desktop app send the hash of
 the version you saw; if the official store changes that version before the job
 starts, Frame Control stops before downloading or changing the headset. Refresh
@@ -110,6 +212,19 @@ the store and review the new version before retrying. If Frame Control restarts,
 job result. The panel clears that job ID and asks you to refresh the installed
 list before making another change.
 
+An open plugin panel closes before its own Update or Remove starts, so its old
+frontend cannot call the changing backend. Open panel is unavailable while a
+store job is pending. A later installed-status refresh also closes an open panel
+if Decky stopped, its store receipt changed, or the status read failed. Reopen
+the plugin after a successful refresh to use its current frontend.
+Chunked frontends load modules through URLs bound to the installed store
+receipt. If a desktop store update replaces the plugin during panel startup,
+old module requests fail and the panel must be reopened; Framey does not mix
+chunks from two installed versions.
+The headset also includes the panel's store SHA-256 receipt with each backend
+call, Steam read, and event poll. It rejects a request if the installed receipt
+changed before the next status refresh; reopen the panel to use the new version.
+
 ## For plugin authors
 
 Start with the [Framey settings sample](../examples/framey-settings/README.md)
@@ -130,13 +245,16 @@ and the fake Frame flow before asking users to install it.
 
 An API v2 plugin's normal `content` is its default VR panel. Framey also shows
 an optional `settings` React element under a **Settings** tab and an optional
-`titleView` above it. For one-tap headset controls, return
+`titleView` above it. A plugin with only `settings` opens that view directly;
+Framey shows tabs only when both views exist. For one-tap headset controls, return
 `frameyQuickActions: [{label: 'Refresh data', onClick: refreshData}]` from the
 plugin initializer. Framey displays up to eight actions and reports a pending,
-success, or failure state. These descriptor fields are Framey additions; Decky
+success, or failure state. It ignores extra taps while an action is pending,
+and a failed action can be retried. Invalid action descriptors do not count
+toward the eight-action limit. These descriptor fields are Framey additions; Decky
 ignores them. Use a plugin backend method through `@decky/api` for work needing
 persistent state, and keep a quick action safe to repeat.
-See the [API v2 compatibility table](frame-plugin-author.md#framey-api-v2-compatibility)
+See the [Decky API compatibility table](frame-plugin-author.md#framey-decky-api-compatibility)
 for tested behavior and remaining limits.
 
 The [Frame Control extension API](extensions.md) is an alternative for a
@@ -159,7 +277,7 @@ The Decky and headset service manual removal commands are in
 ## Fast worn-headset check
 
 With an already installed Framey plugin and someone wearing the headset, run
-`python3 scripts/framey-worn-check.py` from a paired computer. The script
+`python3 scripts/framey-worn-check.py --worn-confirmed` from a paired computer. The script
 atomically acquires `/tmp/frame-test.lock` before reading battery or SteamVR
 activity. If another job owns the lock, it makes no sensor reads. It releases
 its own lock without starting the interaction when the headset is in standby.
@@ -172,3 +290,14 @@ color count, then removes the private temporary image from both devices.
 Pixel variety alone cannot prove the UI text was legible; a person must still
 confirm the view in the headset. The script does not install or remove a plugin,
 alter Steam settings, or wake the headset.
+
+
+## Unattended VR checks
+
+The [unattended check](framey-vr-check.md) can wake, inspect and capture the
+real compositor, send OpenVR mouse input, and exercise a temporary sample
+against live Decky with restoration and shared-lock protection. Its
+[device evidence](evidence/framey-vr-2026-10-25/README.md) distinguishes these
+checks from physical controller and wearer validation. A trusted pointer event
+and active-headset telemetry are both reproducible without wearing the Frame;
+they must not be labelled as physical controller proof.

docs/framey-vr-check.md

@@ -0,0 +1,131 @@
+# Checking Framey without wearing the Frame
+
+Use the existing paired SSH alias, directly or through lxso2. Start with the
+read-only check, then a temporary wake. A full input exercise is opt in:
+
+```sh
+python3 scripts/framey-vr-check.py --via lxso2 --output /tmp/framey-inspect
+python3 scripts/framey-vr-check.py --via lxso2 --wake --output /tmp/framey-wake
+python3 scripts/framey-vr-check.py --via lxso2 --exercise --output /tmp/framey-exercise
+```
+
+Omit `--via` when the computer can already `ssh frame`; use `--host` for another
+paired alias. No SSH trust or credentials are changed. The output folder is
+private by default. Stereo screenshots and the OBS mirror can contain room
+pixels. Review/redact them before committing or sharing. JSON reports have
+screenshot hashes and no UI access keys.
+
+The runner acquires `/tmp/frame-test.lock` by atomic `mkdir`, writes a random
+owner, then reads battery, proximity and SteamVR state. A foreign lock prevents
+sensor reads, wake, installation and input. Unknown battery or below 20% aborts.
+`--wake` and `--exercise` also require SteamVR activity 3 (standby); awake or
+unknown activity exits before power changes, service installation or input.
+Battery is read again before release. The default check never wakes or
+installs anything; it returns nonzero when the panel is absent/hidden.
+
+`--wake` saves the exact current `power.pauseCompositorOnStandby` and
+`power.turnOffScreensTimeout`, sets them to `0` and `120`, calls the supported
+`vrcmd --handlewakeup` and requests the Frame Control dashboard panel. It reads
+OpenVR state, captures a stereo compositor screenshot through the production
+`ui/frame_vrshot.py` API, and captures `/dev/video99`, the same SteamVR mirror
+used by OBS. The mirror reader drains 60 frames before selecting its image,
+because the first loopback buffer can contain a previous session. It restores the saved power values and reads them back. It hides
+the test dashboard if the dashboard was originally closed. It does not change
+the proximity sensor, tracking driver, display hardware, root filesystem,
+room setup, or spatial panel placement. An unreachable suspended Frame still
+needs a physical wake; an SSH command cannot reach it.
+
+`--exercise` requires the managed headset panel and Decky services to be absent;
+it refuses to replace an existing installation. It creates a random test
+plugin folder, checks that its settings folder does not exist, and installs
+the repository's actual sample frontend/backend, with only the plugin name
+and receipt changed to distinguish this test. It installs the verified official
+ARM64 Decky release through Frame Control's existing installer, followed by the
+normal headset app bundle. Only the test bundle's browser startup is modified:
+loopback-only `--remote-debugging-port=0` and a disposable `/tmp` browser profile.
+Production browser startup is unchanged. Decky's installer can reload Steam's
+web helper; this is not a Steam/SteamVR restart, but its current UI can change.
+The test should run while the headset is unattended.
+
+CDP opens the actual plugin through `openFrameyPanel`, observes the opaque
+iframe through its own debugging target, and reads control geometry. OpenVR's
+`IVROverlayView_003.PostOverlayEvent` supplies mouse move/down/up to the
+actual gamescope overlay. The check verifies delivery to the intended element
+and a trusted pointer event, toggles the sample, reads its real Decky settings
+file, reopens a fresh iframe, and checks the saved value. It also clicks the
+Settings/Panel tabs and quick action. The scroll diagnostic creates a temporary
+160-pixel-high region with more than 700 pixels of content, moves the native
+pointer over it, then attempts OpenVR smooth and discrete scroll events. It
+reports region geometry, trusted pointer events, wheel events and `scrollTop`.
+No wheel event or offset change means this synthetic injection path remains
+unverified; it does not establish whether a physical controller can scroll.
+The exercise then clicks the visible **Scroll plugin down/up** buttons through
+the same native OpenVR pointer transport and requires the test region to move
+down and return to the top. This proves the button path only; it does not
+identify a physical controller or repair native wheel delivery.
+Temporary controls exercise the shipped
+`DFL.SliderField` and `DFL.TextField`; their values remain UI-only. Text uses
+CDP `Input.insertText` after OpenVR pointer focus. This is synthetic input,
+not proof of a physical controller or the SteamVR virtual keyboard.
+
+SteamVR can leave a recreated panel hidden with a stale focus request. The
+exercise waits briefly for the new overlay, then retries once by removing and
+reapplying `STEAM_GAME` on its own test
+browser window, then requests focus again. It never retags another application.
+If the overlay stays hidden, it records a small read-only registration/service
+diagnostic and stops before synthetic input. The report records whether this
+recovery was needed. Registration, dashboard
+visibility, actual panel visibility, and pixel capture are separate checks.
+A visible docked panel can report `IsDashboardVisible=false` and
+`IsActiveDashboardOverlay=false`. A zero-sized main texture or failed image
+read must not be described as a texture-refresh measurement. The compositor
+before/after images provide independent pixel evidence.
+
+Normal cleanup removes only the test-created managed services and random
+plugin/profile paths, restores power, cancels its power watchdog, checks battery
+and settings, then releases its own lock. A four-minute independent systemd
+user timer restores the saved power values even if the controlling process is
+killed or disconnected. It deliberately leaves the lock and test artifacts
+for recovery. `recovery.json` records the host, owner, timer, remote restore
+script and original values as soon as the timer starts. The final report is
+`result.json`. Cleanup errors force a nonzero exit and retain the lock; inspect
+that report before manually releasing it. Never remove another job's lock.
+A power watchdog is not a promise to complete service cleanup after a hard
+kill. The next owner must finish that recorded cleanup first.
+
+Exit 0 means the requested machine checks and cleanup passed. It never means
+a wearer has approved readability, comfort, controller rays, haptics or text
+entry on the VR keyboard. The [real-device evidence](evidence/framey-vr-2026-10-25/README.md)
+records the exact tested version and limits. No public CI runner should contact
+the shared headset: run this command on a paired, serialized self-hosted worker.
+Ordinary CI runs `tests/test_framey_vr_check.py`, the sample backend tests, and
+the same-plugin navigation regression without a headset.
+
+## Three-minute worn checklist
+
+1. **0:00–0:30:** Coordinate the shared lock. With an installed managed panel,
+   Decky backend and harmless sample, wear the headset and open SteamVR →
+   Frame Control. Check the panel is in front of you, both eyes agree, text is
+   legible, and the size is comfortable. Do not use a save-cleaning plugin.
+2. **0:30–1:15:** Run
+   `python3 scripts/framey-worn-check.py --via lxso2 --worn-confirmed`. Within its 35-second
+   interaction window, use the physical controller to open the sample and
+   toggle **Example setting**. Confirm the laser aims where expected and the
+   script records a fresh input/panel event and visible stereo output. The flag
+   is the operator’s statement. The script requires valid locked SteamVR activity
+   and proximity readings before input; proximity alone cannot establish wear.
+   Sensor activity and trusted pointers can also be produced synthetically and
+   cannot identify controller hardware.
+3. **1:15–2:15:** Use the controller to open Settings, return to Panel, invoke
+   **Read saved setting**, close/reopen the plugin, and confirm the value
+   remains. Try controller scroll, a slider and a harmless text field in an
+   installed compatible plugin; check SteamVR's actual keyboard and Back.
+4. **2:15–3:00:** Restore the original sample setting. Switch away and back,
+   close/reopen the Frame Control panel, and confirm controller input still
+   works. Record comfort/legibility, controller model, any haptic behavior,
+   keyboard behavior and the command's JSON separately. Confirm battery and
+   release only your lock. Do not infer these human checks from synthetic input.
+
+The watchdog's creation and cancellation are exercised on the real Frame.
+A forced host kill/network loss followed by timer recovery has not been fault
+injected. Its saved recovery script remains available on a cleanup failure.

docs/headset-app.md

@@ -41,8 +41,9 @@ frontend host is browser-tested, but wearer-visible VR use remains unverified.
 The panel also lists Decky plugins and can install, update, or remove compatible
 plugins from the official store when the opt-in managed loader is running.
 Each change asks for confirmation. The Frame VR shell does not show Decky's
-Steam Deck Quick Access Menu, so Decky plugin pages, settings, routes, and
-toasts are not available in this panel yet. The [compatibility table](decky-frame.md)
+Steam Deck Quick Access Menu. Framey's separate panel can show compatible
+plugin pages, settings, local routes, and local toasts, but these controls
+still need a worn-headset check. The [compatibility table](decky-frame.md)
 separates backend loading from VR use. Authors can use the
 [Frame plugin and extension guide](frame-plugin-author.md).
 

docs/releasing.md

@@ -13,13 +13,19 @@ count. So a build reaches people only when you publish it, after testing it.
    ```
 
    `.github/workflows/release.yml` builds macOS, Windows and Linux, and
-   attaches everything to a **draft** release for that tag. After all eight
+   attaches everything to a **draft** release for that tag. After all ten
    installers upload, the workflow also attaches `SHA256SUMS` built from
    GitHub's SHA-256 digests of those uploaded bytes. Nobody is
    offered a draft. Editing a draft while installers are uploading can make
    GitHub temporarily show its tag as `untagged-…`. The workflow finds that
    draft by its exact version title, restores the tag association and retries
    the affected upload; it refuses ambiguous matches.
+   The Linux build runs `scripts/check-appimage-launch.py` before upload. It
+   starts the built x86_64 AppImage on an isolated Xvfb display, checks that
+   its bundled server answers, and checks that the server stops on exit. The
+   check disables telemetry and update requests, and keeps extraction in its
+   temporary profile. This CI test does not test a physical display, FUSE mount
+   or a headset.
 
 2. Download the draft's installers and test them. An installed copy of the
    previous version won't offer the draft, so install it directly.
@@ -33,9 +39,9 @@ count. So a build reaches people only when you publish it, after testing it.
    scripts/publish-release.sh v0.4.0
    ```
 
-   The script checks that the tag is on GitHub and that all eight installers
+   The script checks that the tag is on GitHub and that all ten installers
    are attached, each with the SHA-256 digest GitHub records. It also checks
-   that the uploaded `SHA256SUMS` digest matches a fresh list of those eight
+   that the uploaded `SHA256SUMS` digest matches a fresh list of those ten
    installer digests. It attaches
    `update.json` (the version, the notes, the release page and each
    installer's digest), then publishes the release and marks it latest. It

docs/testing.md

@@ -176,19 +176,21 @@ switch while SSH is down:
 
 ## Headset smoke test
 
-**Documented shared-device procedure:** before a test installs, launches or
-stops an application, acquire `ssh frame 'mkdir /tmp/frame-test.lock'`. If it
-fails, leave that lock alone and continue offline work. Only the thread that
-acquired it releases it with `ssh frame 'rmdir /tmp/frame-test.lock'`, after
-cleanup. Keep each device session to a few minutes.
+**Documented shared-device procedure:** before any headset read or a test that
+installs, launches or stops an application, atomically create
+`/tmp/frame-test.lock` on the Frame and write a unique token to its `owner`
+file. If creation fails, leave that lock alone and continue offline work. Only
+the owner that verifies its token may remove its `owner` file and lock directory
+after cleanup. Keep each device session to a few minutes.
 
 Check battery capacity and charging state under `/sys/class/power_supply`
 before and after; keep capacity above 20%. Stop only processes started by the
 test, remove temporary installs and profiles, and restore the prior dashboard
 state. Leave Steam and SteamVR running. Do not reboot or change global settings.
 Record the build, actual interaction results, cleanup and any unworn-headset
-limits alongside screenshots or logs. These are caller responsibilities; the
-smoke script below does not acquire this shared lock itself.
+limits alongside screenshots or logs. The smoke script below acquires and
+releases its own tokenized shared lock; other device tests follow this
+procedure themselves.
 
 [Packaged Desktop Capture evidence, 2026-10-24](evidence/desktop-capture-packaged-2026-10-24.md)
 records v0.4.17 GUI button captures of a real mapped nested desktop on SteamOS
@@ -208,22 +210,31 @@ It resolves the checkout path independently of the current working directory.
 `/path/to/checkout/scripts/frame-smoke.sh --help` is safe to run offline and
 does not contact the headset.
 
+Before reading headset status or changing titles, the smoke script atomically
+acquires the shared `/tmp/frame-test.lock` with a unique owner token. It reads
+SteamVR activity, proximity and battery while locked. An awake headset, unknown
+activity, battery below 20%, or a busy lock stops the run without installing
+anything. It releases only its own lock after cleanup. The JSON result includes
+the read-only preflight for completed smoke runs.
+
 It checks `properties.json` and the status, then installs, launches and
 removes three tiny titles built from bytes by `tests/smoke/tiny_programs.py`
 (an ARM64 and an x86-64 static Linux program that sleep for ten seconds, and
 an x86-64 `.exe` that exits at once). A launch passes only with fresh evidence:
 the ARM64 program running, the `.exe` started (its process or Steam's log),
-and the x86-64 program running or Steam logging that its runtime isn't
-installed, which is what the Frame does today. Steam's log lines about each
-title are kept.
+and the x86-64 program running. If Steam logs that the optional x86-64 runtime
+is not installed, that launch is **skipped**, with the reason and log saved in
+the result. It does not prove that the x86-64 title ran. Steam's log lines about
+each title are kept.
 
 Everything it installs is removed again, also after a failure: the titles and
 their Steam shortcuts, a paired key, and `~/devkit-utils` if it wasn't there
 before (if it was, it stays, synced to this checkout as Frame Control always
 does). A cleanup that fails counts as a failed step. Results go to
 `tests/smoke/results/<time>-<BUILD_ID>.json` (not committed) with a summary on
-screen; it exits 0 when every step passed, 1 if one failed, 2 if the headset
-isn't reachable.
+screen. The summary counts passed, skipped and failed steps separately. It
+exits 0 when no step failed (including a skipped optional runtime), 1 if a step
+failed, or 2 if the headset isn't reachable.
 
 Smoke process cleanup runs before and after title removal and during the
 initial/final leftover sweeps. It targets only the reserved `fc_smoke_arm64`,

examples/framey-settings/README.md

@@ -2,9 +2,11 @@
 
 This is a small Decky API v2 plugin for authors. Its panel uses the official
 `@decky/api`, `@decky/ui`, and `@decky/rollup` packages. A toggle calls a Python
-backend method, stores one boolean under `decky.decky_SETTINGS_DIR`,
+backend method, stores one boolean under `decky.DECKY_PLUGIN_SETTINGS_DIR`,
 and reads it back when the panel opens. The backend rejects other keys and
-values. The frontend also shows a local toast after a successful save. A
+values. The frontend also shows a local toast with a React body after a
+successful save. The toast stays inside the Framey panel; it is not a Steam
+system notification. A
 Framey settings tab exposes the same toggle, and a read-only quick action
 fetches the saved value without changing it. These two fields are Framey
 additions; Decky's own menu still uses the main panel content. The quick
@@ -12,6 +14,17 @@ action calls the backend, so it reads the persisted setting rather than a
 browser cache. A missing, damaged, or old non-boolean value reads as the
 caller's default;
 the next save atomically replaces the sample's settings file.
+The panel also guards its own read and write calls synchronously. If two
+controller events arrive before React redraws a disabled control, the second
+event is ignored; after the request settles, a new change can be saved.
+
+The **About this setting** button opens a local detail page at
+`/framey-sample/details/saved-setting`. It demonstrates `routerHook.addRoute`,
+`Navigation.Navigate`, `useParams`, `NavigateBack`, and removal of the route in
+`onDismount`. The `:topic?` segment is optional. Framey keeps this navigation
+inside the plugin panel; it does not open a Steam library page. Put optional
+segments at the end of the path and do not use query strings. This detail page
+has not been checked with headset controllers.
 
 ## Build
 
@@ -35,7 +48,7 @@ plugin directory does not enable its VR panel.
 Run `python3 -m unittest discover -s tests -p test_framey_sample.py` from the
 repository root. It checks backend persistence and evaluates the built bundle
 against Framey's actual host script, including the quick action's scoped
-backend call. The fake Frame store flow is exercised by
+backend call and local route registration/navigation. The fake Frame store flow is exercised by
 the repository's e2e suite. No worn-headset visibility or controller-input test
 has passed for this sample yet.
 

examples/framey-settings/dist/index.js

@@ -16,6 +16,7 @@ if (api._version != API_VERSION) {
     console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version ${api._version}. Some features may not work.`);
 }
 const callable = api.callable;
+const routerHook = api.routerHook;
 const toaster = api.toaster;
 const definePlugin = (fn) => {
     return (...args) => {
@@ -29,7 +30,11 @@ function Content() {
     const [enabled, setEnabled] = SP_REACT.useState(false);
     const [busy, setBusy] = SP_REACT.useState(true);
     const [message, setMessage] = SP_REACT.useState('Loading setting…');
+    const pending = SP_REACT.useRef(false);
     async function refresh() {
+        if (pending.current)
+            return;
+        pending.current = true;
         setBusy(true);
         try {
             const value = await getSetting('enabled', false);
@@ -40,43 +45,59 @@ function Content() {
             setMessage(`Could not read setting: ${String(error)}`);
         }
         finally {
+            pending.current = false;
             setBusy(false);
         }
     }
     SP_REACT.useEffect(() => { void refresh(); }, []);
     async function change(value) {
+        // Two controller events can arrive before React redraws the disabled toggle.
+        // Keep writes ordered so a late first reply cannot replace the final choice.
+        if (pending.current)
+            return;
+        pending.current = true;
         setBusy(true);
         try {
             await setSetting('enabled', value);
             setEnabled(value);
             setMessage(`Saved setting: ${value ? 'on' : 'off'}`);
-            toaster.toast({ title: 'Framey sample', body: 'Setting saved' });
+            toaster.toast({ title: 'Framey sample',
+                body: SP_JSX.jsxs("span", { children: ["Setting saved: ", SP_JSX.jsx("strong", { children: value ? 'on' : 'off' })] }) });
         }
         catch (error) {
             setMessage(`Could not save setting: ${String(error)}`);
         }
         finally {
+            pending.current = false;
             setBusy(false);
         }
     }
-    return SP_JSX.jsxs(DFL.PanelSection, { title: "Framey settings sample", children: [SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ToggleField, { label: "Example setting", description: "Stored by the Decky Python backend", checked: enabled, disabled: busy, onChange: (value) => { void change(value); } }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ButtonItem, { disabled: busy, onClick: () => { void refresh(); }, children: "Reload saved setting" }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx("p", { role: "status", children: message }) })] });
+    return SP_JSX.jsxs(DFL.PanelSection, { title: "Framey settings sample", children: [SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ToggleField, { label: "Example setting", description: "Stored by the Decky Python backend", checked: enabled, disabled: busy, onChange: (value) => { void change(value); } }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ButtonItem, { disabled: busy, onClick: () => { void refresh(); }, children: "Reload saved setting" }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ButtonItem, { onClick: () => DFL.Navigation.Navigate('/framey-sample/details/saved-setting'), children: "About this setting" }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx("p", { role: "status", children: message }) })] });
 }
-var index = definePlugin(() => Object.assign({
-    name: 'Framey Settings Sample',
-    icon: SP_JSX.jsx("span", { "aria-hidden": "true", children: "\u2699" }),
-    content: SP_JSX.jsx(Content, {}),
-}, {
-    // Framey additions are ignored by Decky's own menu. Keep the main content
-    // usable there too, while showing authors the extra VR settings view.
-    settings: SP_JSX.jsx(Content, {}),
-    frameyQuickActions: [{
-            label: 'Read saved setting',
-            onClick: async () => {
-                const enabled = await getSetting('enabled', false);
-                return `Saved setting is ${enabled ? 'on' : 'off'}`;
-            },
-        }],
-}));
+function Details() {
+    const { topic } = DFL.useParams();
+    return SP_JSX.jsxs(DFL.PanelSection, { title: "Sample detail page", children: [SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsxs("p", { children: ["Topic: ", topic || 'overview'] }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx("p", { children: "The toggle is stored by this plugin's Decky backend in the user's settings directory." }) }), SP_JSX.jsx(DFL.PanelSectionRow, { children: SP_JSX.jsx(DFL.ButtonItem, { onClick: () => DFL.Navigation.NavigateBack(), children: "Back to setting" }) })] });
+}
+var index = definePlugin(() => {
+    routerHook.addRoute('/framey-sample/details/:topic?', Details);
+    return Object.assign({
+        name: 'Framey Settings Sample',
+        icon: SP_JSX.jsx("span", { "aria-hidden": "true", children: "\u2699" }),
+        content: SP_JSX.jsx(Content, {}),
+        onDismount: () => routerHook.removeRoute('/framey-sample/details/:topic?'),
+    }, {
+        // Framey additions are ignored by Decky's own menu. Keep the main content
+        // usable there too, while showing authors the extra VR settings view.
+        settings: SP_JSX.jsx(Content, {}),
+        frameyQuickActions: [{
+                label: 'Read saved setting',
+                onClick: async () => {
+                    const enabled = await getSetting('enabled', false);
+                    return `Saved setting is ${enabled ? 'on' : 'off'}`;
+                },
+            }],
+    });
+});
 
 export { index as default };
 //# sourceMappingURL=index.js.map

examples/framey-settings/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["decky://decky/plugin/Framey%20Settings%20Sample/node_modules/.pnpm/@decky+api@1.1.3/node_modules/@decky/api/dist/index.js","decky://decky/plugin/Framey%20Settings%20Sample/src/index.tsx"],"sourcesContent":["import _manifest from '@decky/manifest';\nexport * from \"./types\";\nconst manifest = _manifest;\nconst API_VERSION = 2;\nif (!manifest?.name) {\n    throw new Error('[@decky/api]: Failed to find plugin manifest.');\n}\nconst internalAPIConnection = window.__DECKY_SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED_deckyLoaderAPIInit;\nif (!internalAPIConnection) {\n    throw new Error('[@decky/api]: Failed to connect to the loader as as the loader API was not initialized. This is likely a bug in Decky Loader.');\n}\nlet api;\ntry {\n    api = internalAPIConnection.connect(API_VERSION, manifest.name);\n}\ncatch {\n    api = internalAPIConnection.connect(1, manifest.name);\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version 1. Some features may not work.`);\n}\nif (api._version != API_VERSION) {\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version ${api._version}. Some features may not work.`);\n}\nexport const call = api.call;\nexport const callable = api.callable;\nexport const addEventListener = api.addEventListener;\nexport const removeEventListener = api.removeEventListener;\nexport const routerHook = api.routerHook;\nexport const toaster = api.toaster;\nexport const openFilePicker = api.openFilePicker;\nexport const executeInTab = api.executeInTab;\nexport const injectCssIntoTab = api.injectCssIntoTab;\nexport const removeCssFromTab = api.removeCssFromTab;\nexport const fetchNoCors = api.fetchNoCors;\nexport const getExternalResourceURL = api.getExternalResourceURL;\nexport const useQuickAccessVisible = api.useQuickAccessVisible;\nexport const definePlugin = (fn) => {\n    return (...args) => {\n        return fn(...args);\n    };\n};\n","import {callable, definePlugin, toaster} from '@decky/api';\nimport {ButtonItem, PanelSection, PanelSectionRow, ToggleField} from '@decky/ui';\nimport {useEffect, useState} from 'react';\n\nconst getSetting = callable<[key: string, fallback: boolean], boolean>('get_setting');\nconst setSetting = callable<[key: string, value: boolean], boolean>('set_setting');\n\nfunction Content() {\n  const [enabled, setEnabled] = useState(false);\n  const [busy, setBusy] = useState(true);\n  const [message, setMessage] = useState('Loading setting…');\n\n  async function refresh() {\n    setBusy(true);\n    try {\n      const value = await getSetting('enabled', false);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n    } catch (error) {\n      setMessage(`Could not read setting: ${String(error)}`);\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  useEffect(() => {void refresh();}, []);\n\n  async function change(value: boolean) {\n    setBusy(true);\n    try {\n      await setSetting('enabled', value);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n      toaster.toast({title: 'Framey sample', body: 'Setting saved'});\n    } catch (error) {\n      setMessage(`Could not save setting: ${String(error)}`);\n    } finally {\n      setBusy(false);\n    }\n  }\n\n  return <PanelSection title=\"Framey settings sample\">\n    <PanelSectionRow>\n      <ToggleField label=\"Example setting\" description=\"Stored by the Decky Python backend\"\n        checked={enabled} disabled={busy} onChange={(value: boolean) => {void change(value);}} />\n    </PanelSectionRow>\n    <PanelSectionRow><ButtonItem disabled={busy} onClick={() => {void refresh();}}>Reload saved setting</ButtonItem></PanelSectionRow>\n    <PanelSectionRow><p role=\"status\">{message}</p></PanelSectionRow>\n  </PanelSection>;\n}\n\nexport default definePlugin(() => Object.assign({\n  name: 'Framey Settings Sample',\n  icon: <span aria-hidden=\"true\">⚙</span>,\n  content: <Content />,\n}, {\n  // Framey additions are ignored by Decky's own menu. Keep the main content\n  // usable there too, while showing authors the extra VR settings view.\n  settings: <Content />,\n  frameyQuickActions: [{\n    label: 'Read saved setting',\n    onClick: async () => {\n      const enabled = await getSetting('enabled', false);\n      return `Saved setting is ${enabled ? 'on' : 'off'}`;\n    },\n  }],\n}));\n"],"names":[],"mappings":"AAEA,MAAA,QAAA,GAAiB,CAAA,MAAA,CAAA,wBAAA,CAAS;AAC1B,MAAA,WAAA,GAAA,CAAA;AAIA,MAAA,qBAAA,GAAA,MAAA,CAAA,2EAAA;AACA,IAAA,CAAA,qBAAA,EAAA;AACA,IAAA,MAAA,IAAA,KAAA,CAAA,+HAAA,CAAA;AACA;AACA,IAAA,GAAA;AACA,IAAA;AACA,IAAA,GAAA,GAAA,qBAAA,CAAA,OAAA,CAAA,WAAA,EAAA,QAAA,CAAA,IAAA,CAAA;AACA;AACA,MAAA;AACA,IAAA,GAAA,GAAA,qBAAA,CAAA,OAAA,CAAA,CAAA,EAAA,QAAA,CAAA,IAAA,CAAA;AACA,IAAA,OAAA,CAAA,IAAA,CAAA,CAAA,mCAAA,EAAA,WAAA,CAAA,4EAAA,CAAA,CAAA;AACA;AACA,IAAA,GAAA,CAAA,QAAA,IAAA,WLine truncated
+{"version":3,"file":"index.js","sources":["decky://decky/plugin/Framey%20Settings%20Sample/node_modules/.pnpm/@decky+api@1.1.3/node_modules/@decky/api/dist/index.js","decky://decky/plugin/Framey%20Settings%20Sample/src/index.tsx"],"sourcesContent":["import _manifest from '@decky/manifest';\nexport * from \"./types\";\nconst manifest = _manifest;\nconst API_VERSION = 2;\nif (!manifest?.name) {\n    throw new Error('[@decky/api]: Failed to find plugin manifest.');\n}\nconst internalAPIConnection = window.__DECKY_SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED_deckyLoaderAPIInit;\nif (!internalAPIConnection) {\n    throw new Error('[@decky/api]: Failed to connect to the loader as as the loader API was not initialized. This is likely a bug in Decky Loader.');\n}\nlet api;\ntry {\n    api = internalAPIConnection.connect(API_VERSION, manifest.name);\n}\ncatch {\n    api = internalAPIConnection.connect(1, manifest.name);\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version 1. Some features may not work.`);\n}\nif (api._version != API_VERSION) {\n    console.warn(`[@decky/api] Requested API version ${API_VERSION} but the running loader only supports version ${api._version}. Some features may not work.`);\n}\nexport const call = api.call;\nexport const callable = api.callable;\nexport const addEventListener = api.addEventListener;\nexport const removeEventListener = api.removeEventListener;\nexport const routerHook = api.routerHook;\nexport const toaster = api.toaster;\nexport const openFilePicker = api.openFilePicker;\nexport const executeInTab = api.executeInTab;\nexport const injectCssIntoTab = api.injectCssIntoTab;\nexport const removeCssFromTab = api.removeCssFromTab;\nexport const fetchNoCors = api.fetchNoCors;\nexport const getExternalResourceURL = api.getExternalResourceURL;\nexport const useQuickAccessVisible = api.useQuickAccessVisible;\nexport const definePlugin = (fn) => {\n    return (...args) => {\n        return fn(...args);\n    };\n};\n","import {callable, definePlugin, routerHook, toaster} from '@decky/api';\nimport {ButtonItem, Navigation, PanelSection, PanelSectionRow, ToggleField, useParams} from '@decky/ui';\nimport {useEffect, useRef, useState} from 'react';\n\nconst getSetting = callable<[key: string, fallback: boolean], boolean>('get_setting');\nconst setSetting = callable<[key: string, value: boolean], boolean>('set_setting');\n\nfunction Content() {\n  const [enabled, setEnabled] = useState(false);\n  const [busy, setBusy] = useState(true);\n  const [message, setMessage] = useState('Loading setting…');\n  const pending = useRef(false);\n\n  async function refresh() {\n    if (pending.current) return;\n    pending.current = true;\n    setBusy(true);\n    try {\n      const value = await getSetting('enabled', false);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n    } catch (error) {\n      setMessage(`Could not read setting: ${String(error)}`);\n    } finally {\n      pending.current = false;\n      setBusy(false);\n    }\n  }\n\n  useEffect(() => {void refresh();}, []);\n\n  async function change(value: boolean) {\n    // Two controller events can arrive before React redraws the disabled toggle.\n    // Keep writes ordered so a late first reply cannot replace the final choice.\n    if (pending.current) return;\n    pending.current = true;\n    setBusy(true);\n    try {\n      await setSetting('enabled', value);\n      setEnabled(value);\n      setMessage(`Saved setting: ${value ? 'on' : 'off'}`);\n      toaster.toast({title: 'Framey sample',\n        body: <span>Setting saved: <strong>{value ? 'on' : 'off'}</strong></span>});\n    } catch (error) {\n      setMessage(`Could not save setting: ${String(error)}`);\n    } finally {\n      pending.current = false;\n      setBusy(false);\n    }\n  }\n\n  return <PanelSection title=\"Framey settings sample\">\n    <PanelSectionRow>\n      <ToggleField label=\"Example setting\" description=\"Stored by the Decky Python backend\"\n        checked={enabled} disabled={busy} onChange={(value: boolean) => {void change(value);}} />\n    </PanelSectionRow>\n    <PanelSectionRow><ButtonItem disabled={busy} onClick={() => {void refresh();}}>Reload saved setting</ButtonItem></PanelSectionRow>\n    <PanelSectionRow><ButtonItem onClick={() => Navigation.Navigate('/framey-sample/details/saved-setting')}>About this setting</ButtonItem></PanelSectionRow>\n    <PanelSectionRow><p role=\"status\">{message}</p></PanelSectionRow>\n  </PanelSection>;\n}\n\nfunction Details() {\n  const {topic} = useParams<{topic?: string}>();\n  return <PanelSection title=\"Sample detail page\">\n    <PanelSectionRow><p>Topic: {topic || 'overview'}</p></PanelSectionRow>\n    <PanelSectionRow><p>The toggle is stored by this plugin's Decky backend in the user's settings directory.</p></PanelSectionRow>\n    <PanelSectionRow><ButtonItem onClick={() => Navigation.NavigateBack()}>Back Line truncated

examples/framey-settings/main.py

@@ -8,7 +8,7 @@ import decky
 
 def settings_file():
     # Decky provides this per-plugin path through its official Python module.
-    return Path(decky.decky_SETTINGS_DIR) / 'settings.json'
+    return Path(decky.DECKY_PLUGIN_SETTINGS_DIR) / 'settings.json'
 
 
 class Plugin:

examples/framey-settings/src/index.tsx

@@ -1,6 +1,6 @@
-import {callable, definePlugin, toaster} from '@decky/api';
-import {ButtonItem, PanelSection, PanelSectionRow, ToggleField} from '@decky/ui';
-import {useEffect, useState} from 'react';
+import {callable, definePlugin, routerHook, toaster} from '@decky/api';
+import {ButtonItem, Navigation, PanelSection, PanelSectionRow, ToggleField, useParams} from '@decky/ui';
+import {useEffect, useRef, useState} from 'react';
 
 const getSetting = callable<[key: string, fallback: boolean], boolean>('get_setting');
 const setSetting = callable<[key: string, value: boolean], boolean>('set_setting');
@@ -9,8 +9,11 @@ function Content() {
   const [enabled, setEnabled] = useState(false);
   const [busy, setBusy] = useState(true);
   const [message, setMessage] = useState('Loading setting…');
+  const pending = useRef(false);
 
   async function refresh() {
+    if (pending.current) return;
+    pending.current = true;
     setBusy(true);
     try {
       const value = await getSetting('enabled', false);
@@ -19,6 +22,7 @@ function Content() {
     } catch (error) {
       setMessage(`Could not read setting: ${String(error)}`);
     } finally {
+      pending.current = false;
       setBusy(false);
     }
   }
@@ -26,15 +30,21 @@ function Content() {
   useEffect(() => {void refresh();}, []);
 
   async function change(value: boolean) {
+    // Two controller events can arrive before React redraws the disabled toggle.
+    // Keep writes ordered so a late first reply cannot replace the final choice.
+    if (pending.current) return;
+    pending.current = true;
     setBusy(true);
     try {
       await setSetting('enabled', value);
       setEnabled(value);
       setMessage(`Saved setting: ${value ? 'on' : 'off'}`);
-      toaster.toast({title: 'Framey sample', body: 'Setting saved'});
+      toaster.toast({title: 'Framey sample',
+        body: <span>Setting saved: <strong>{value ? 'on' : 'off'}</strong></span>});
     } catch (error) {
       setMessage(`Could not save setting: ${String(error)}`);
     } finally {
+      pending.current = false;
       setBusy(false);
     }
   }
@@ -45,14 +55,27 @@ function Content() {
         checked={enabled} disabled={busy} onChange={(value: boolean) => {void change(value);}} />
     </PanelSectionRow>
     <PanelSectionRow><ButtonItem disabled={busy} onClick={() => {void refresh();}}>Reload saved setting</ButtonItem></PanelSectionRow>
+    <PanelSectionRow><ButtonItem onClick={() => Navigation.Navigate('/framey-sample/details/saved-setting')}>About this setting</ButtonItem></PanelSectionRow>
     <PanelSectionRow><p role="status">{message}</p></PanelSectionRow>
   </PanelSection>;
 }
 
-export default definePlugin(() => Object.assign({
+function Details() {
+  const {topic} = useParams<{topic?: string}>();
+  return <PanelSection title="Sample detail page">
+    <PanelSectionRow><p>Topic: {topic || 'overview'}</p></PanelSectionRow>
+    <PanelSectionRow><p>The toggle is stored by this plugin's Decky backend in the user's settings directory.</p></PanelSectionRow>
+    <PanelSectionRow><ButtonItem onClick={() => Navigation.NavigateBack()}>Back to setting</ButtonItem></PanelSectionRow>
+  </PanelSection>;
+}
+
+export default definePlugin(() => {
+  routerHook.addRoute('/framey-sample/details/:topic?', Details);
+  return Object.assign({
   name: 'Framey Settings Sample',
   icon: <span aria-hidden="true">⚙</span>,
   content: <Content />,
+  onDismount: () => routerHook.removeRoute('/framey-sample/details/:topic?'),
 }, {
   // Framey additions are ignored by Decky's own menu. Keep the main content
   // usable there too, while showing authors the extra VR settings view.
@@ -64,4 +87,5 @@ export default definePlugin(() => Object.assign({
       return `Saved setting is ${enabled ? 'on' : 'off'}`;
     },
   }],
-}));
+  });
+});