Merge pull request #375 from saphid/release/v0.4.52

Prepare Frame Control v0.4.52 candidate

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.51",
+  "version": "0.4.52",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.51",
+      "version": "0.4.52",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.51",
+  "version": "0.4.52",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",

docs/evidence/v0452-candidate-2026-10-28.md

@@ -0,0 +1,63 @@
+# v0.4.52 candidate gate, 28 October 2026
+
+This candidate bumps the desktop app and lockfile to 0.4.52. It contains
+installer-fetch [PR #374](https://github.com/saphid/frame-control/pull/374),
+merged to main at `5847a810667724ef423f278a83650f9f1c6d18b5`. Its exact
+reviewed head `082af24115a87b3bf11a77c2cf93b5bcdd3b4409` passed
+[CI and e2e](https://github.com/saphid/frame-control/actions/runs/40706672771),
+[native Decky](https://github.com/saphid/frame-control/actions/runs/40706672854)
+and [all four installer previews](https://github.com/saphid/frame-control/actions/runs/40706672774).
+The merge commit's own CI is pending. No release has been published from this
+branch. The versioned source candidate tested below was
+`c88df07c816f1475268760add93a5ab072463688`.
+
+Since v0.4.51, main added the exact-archive Network Sentinel and Battery
+Tracker Framey adaptations and CI/release safety fixes. PR #374 retries
+transient installer dependency failures, including responses aborted after
+partial bytes; pinned SHA-256 verification remains required before writing a
+download. The exact-version official Decky catalog is **6 works / 54 partial /
+45 broken / 11 N/A**. Network Sentinel and Battery Tracker are partial;
+managed real Frame operation, worn visibility and physical-controller input
+remain unverified.
+
+## Locked real Frame smoke
+
+At 14:42:13 UTC, `scripts/frame-smoke.sh` ran from the versioned source
+candidate under its unique-owner atomic `/tmp/frame-test.lock`. Its read-only
+preflight found Frame OS 0.5.6 build `20261022.6153909`, SteamVR activity
+**3 (standby)**, proximity raw **2.3125**, and battery **100%**. ARM64 and
+Windows/Proton test titles installed, launched and were removed. The x86_64
+title installed and was removed; its optional launch was skipped because
+Steam Linux Runtime 4 was absent. The result was **12 passed, one optional
+skip, zero failed**. Owned cleanup passed and the runner released only its
+lock. The private result is
+`/tmp/frame-control-v0452-smoke-results/2026-10-28T144213Z-20261022.6153909.json`
+(SHA-256 `42ea66740d001cc097ce9e871be6b01be1a10f184ab4480019b0a306851cfc57`).
+
+A separate read-only audit acquired a fresh unique lock after smoke. It
+found activity **3**, proximity raw **2.3125**, battery **100%**, no exact
+reserved smoke title files or metadata, and no processes owned by those
+title paths. It released its own lock. The private audit result is
+`/tmp/frame-v0452-cleanup-audit.json` (SHA-256
+`daebfb5c02d6cf59e5cee092e3fa90a07b3dc9f105e167d46a4f4327c541c7ce`).
+No power setting or security state was changed. No wearer was confirmed; no
+worn panel, physical-controller or official plugin interaction was tested.
+The hourly worn check remains enabled.
+
+## Remaining release gates
+
+- Main's #374 merge commit needs green exact-commit CI, e2e and native Decky
+  runtime before the candidate can merge.
+- This candidate needs its own exact-head CI, e2e, native Decky runtime and
+  all four installer previews after its sync with the final main merge.
+- The locked source smoke and independent cleanup audit above passed. Their
+  optional x86_64 runtime skip does not prove that launch; no worn display or
+  physical-controller claim follows from standby smoke.
+- After candidate merge, the exact main commit needs green CI, e2e and native
+  Decky runtime. The annotated tag then needs all four installer builds and
+  checksums on that same commit, independent downloads and package checks,
+  release verification and a publisher dry run. Any failed, cancelled,
+  skipped, pending or unverified required gate holds publication.
+
+The published release and update channel remain at v0.4.51 until all gates
+pass and the draft is explicitly published.