Document v0.4.54 x86 runtime blocker (#393)

* Document v0.4.54 x86 runtime blocker

* Clarify FEX wrapper runtime dependency

---------

Co-authored-by: SAPHID <saphid@users.noreply.github.com>

docs/current-support-matrix.md

@@ -1,11 +1,11 @@
 # What we have tested
 
-Current published release: Frame Control **v0.4.52**, 28 October 2026. Rows identify the last direct check of each feature; an older row does not mean the latest installer was retested on that hardware. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. See each link for the exact procedure and limits.
+Current published release: Frame Control **v0.4.53**, 28 October 2026. Rows identify the last direct check of each feature; an older row does not mean the latest installer was retested on that hardware. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. See each link for the exact procedure and limits.
 
 | Feature | Real Frame + physical PC tested | VM only | Untested or limited | Last check and proof |
 |---|---|---|---|---|
 | Mac desktop release — tested on a real Mac | Physical MacBook Air (MacBookAir9,1), Intel Core i3, macOS 15.7.7 (24G720): official v0.4.39 x64 DMG and ZIP hashes/architectures verified; clean DMG app installed and launched. Native UI, preferences across restart, update discovery of 0.4.40, offline OBS Start/Stop and 116-entry Decky store checked. Actual Open at Login menu toggled on, persisted across Quit/relaunch, then restored off. A 54-byte relay upload/readback/delete passed under coordinator/headset locks | No | Ordinary browser quarantine, right-click Open and Open Anyway remain unverified; the synthetic quarantine probe was inconclusive. Actual login startup untested. Direct frame.local had no route and app SSH trust failed; relay transfer is not native Mac transfer acceptance. Real OBS/Framey VR unverified. Earlier shutdown race fix #284 shipped in v0.4.40, whose Intel installer was not tested here | 26 Oct, official v0.4.39 tag `fd0b0a9`: [repeat Intel acceptance evidence](evidence/intel-mac-v0.4.39-2026-10-26.md); [earlier release test](evidence/mac-v0439-2026-10-26.md) |
-| Core title smoke test | A Linux host ran the v0.4.52 versioned source candidate, whose tree matches the tagged release commit, against the real Frame under a unique lock: 12 steps passed, one optional x86_64 launch was skipped, zero failed; a separate locked cleanup audit passed | No | The headset was in standby and unworn. Steam Linux Runtime 4 was absent, so the x86_64 test executable did not launch. Worn rendering and physical-controller input were not checked | 28 Oct, v0.4.52 tag `v0.4.52`, Frame OS 0.5.6 build `20261022.6153909`: [release verification](evidence/v0452-release-2026-10-28.md), [candidate smoke](evidence/v0452-candidate-2026-10-28.md) |
+| Core title smoke test | A Linux host ran the v0.4.53 versioned source candidate against the real Frame under a unique lock; only documentation changed before the tagged release, leaving its executable source the same: 12 steps passed, one optional x86_64 launch was skipped, zero failed; a separate locked cleanup audit passed | No | The headset was in standby and unworn. Steam Linux Runtime 4 was absent, so the x86_64 test executable did not launch. Worn rendering and physical-controller input were not checked | 28 Oct, v0.4.53 tag `v0.4.53`, Frame OS 0.5.6 build `20261022.6153909`: [release verification](evidence/v0453-release-2026-10-28.md), [candidate smoke](evidence/v0453-candidate-2026-10-28.md) |
 | Windows desktop in the headset | No physical Windows PC test | Windows 11 VM sent a whole desktop to a real Frame; this used an intermediate fix, not the final native DLL | Physical GPU, capture and controller input; individual windows unavailable in bundled DXGI build | 24 Oct, v0.4.10 installer + candidate fix: [VM log](evidence/windows-vm-2026-10-24.md), [PC guide](pc-in-headset.md) |
 | Linux desktop in the headset | No | No | Native Linux PC capture is disabled; lxso2 lacked a desktop portal and PipeWire session. The separate Steam `-pipewire` helper is not Frame Control's PC capture | 24 Oct, v0.4.17: [host audit](evidence/linux-pc-host-lxso2-2026-10-24.md), [Steam helper PR #163](https://github.com/saphid/frame-control/pull/163) |
 | Mac desktop in the headset | A physical Mac sent its screen/window to a real Frame | No | Current v0.4.26 Mac installer and worn-headset controller input have not been repeated | 28 Sep, pre-v0.4 / Frame OS 0.4.1: [Mac guide and measurement](streaming.md#b-show-the-macs-desktop-inside-the-frame) |
@@ -24,7 +24,7 @@ Current published release: Frame Control **v0.4.52**, 28 October 2026. Rows iden
 | Open at login | No Frame needed; official v0.4.39 on the physical Intel Air toggled the actual native menu on, retained its checkmark after Quit/relaunch and restored it off. Linux autostart file previously toggled on a physical Linux host with an isolated config directory | No | A full OS login session and physical Windows host login remain untested | 26 Oct, v0.4.39: [native Intel toggle evidence](evidence/intel-mac-v0.4.39-2026-10-26.md); Linux v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
 | Local Frame Control extensions | Example panel displayed live Frame status in a browser preview; the real Frame served a read-only example in the experimental headset panel | No | No wearer-visible extension view; third-party extensions and physical Windows/macOS extension folders untested | 25 Oct, v0.4.29: [PR #194](https://github.com/saphid/frame-control/pull/194), [PR #201](https://github.com/saphid/frame-control/pull/201), [extension guide](extensions.md) |
 | Experimental Frame Control SteamVR panel | Frame OS 0.5.6 registered and served the opt-in overlay. A later unattended check safely woke SteamVR and found the panel in stereo compositor and mirror captures; it removed its temporary service and restored power settings | No | No person wore the headset for that check. Physical controller input, scrolling, VR keyboard, comfort and legibility remain unverified. The large status view has browser and packaging checks, not a wearer review | 26 Oct, v0.4.29–0.4.40: [panel PR #201](https://github.com/saphid/frame-control/pull/201), [unattended evidence](evidence/framey-vr-2026-10-25/README.md), [post-#292 unworn sample exercise](evidence/v0440-release-2026-10-26.md#post-tag-292-panel-regression), [earlier standby-gated exercise](evidence/framey-vr-standby-gate-2026-10-26.md), [worn checklist](framey-vr-check.md) |
-| Experimental Decky Loader manager | Earlier real Frame checks passed opt-in ARM64 user-service install/status/update/remove and managed ProtonDB install/update/remove. The current exact-version catalog records six scoped works: Notebook default drawing, Volume Mixer and Mixer silent per-app volume, Volume Boost muted sink controls, DeckySpy metrics, and Simple Timer silent in-panel timers | No | v0.4.52 classifies 116 exact-version plugins as **6 works / 54 partial / 45 broken / 11 N/A**. “Works” applies only to each documented behavior, never worn VR. Network Sentinel and Battery Tracker are partial; their managed real-Frame ARM64 behavior is unverified. Most other backends, audible output, physical-controller use and wearer-visible official panels remain unverified | 28 Oct, v0.4.52: [exact-version table](framey-compatibility.md), [release verification](evidence/v0452-release-2026-10-28.md), [DeckySpy evidence](evidence/framey-deckyspy-2026-10-26.md), [Simple Timer evidence](evidence/framey-simple-timer-2026-10-26.md), [audio evidence](evidence/framey-audio-arm64-2026-10-26.md) |
-| Experimental Framey VR plugin panels and store | An unattended Frame OS 0.5.6 exercise showed the repository sample panel in stereo compositor and mirror captures. Synthetic OpenVR clicks changed a live sample setting, read its Decky backend file, and confirmed it after a fresh iframe reopen; temporary services were removed and original power settings restored | No | This was the repository sample, not an official store plugin. Physical controllers, native scrolling, VR keyboard, wearer comfort and legibility remain unverified. Fake-Frame install/remove and local Chromium plugin initialization do not prove an official plugin is visible or usable in worn VR | 28 Oct, v0.4.52 catalog with earlier 25–26 Oct VR evidence: [unattended sample evidence](evidence/framey-vr-2026-10-25/README.md), [compatibility table](framey-compatibility.md), [worn checklist](framey-vr-check.md) |
+| Experimental Decky Loader manager | Earlier real Frame checks passed opt-in ARM64 user-service install/status/update/remove and managed ProtonDB install/update/remove. The current exact-version catalog records six scoped works: Notebook default drawing, Volume Mixer and Mixer silent per-app volume, Volume Boost muted sink controls, DeckySpy metrics, and Simple Timer silent in-panel timers | No | v0.4.53 classifies 116 exact-version plugins as **6 works / 54 partial / 45 broken / 11 N/A**. “Works” applies only to each documented behavior, never worn VR. Network Sentinel and Battery Tracker are partial; their managed real-Frame ARM64 behavior is unverified. Most other backends, audible output, physical-controller use and wearer-visible official panels remain unverified | 28 Oct, v0.4.53: [exact-version table](framey-compatibility.md), [release verification](evidence/v0453-release-2026-10-28.md), [DeckySpy evidence](evidence/framey-deckyspy-2026-10-26.md), [Simple Timer evidence](evidence/framey-simple-timer-2026-10-26.md), [audio evidence](evidence/framey-audio-arm64-2026-10-26.md) |
+| Experimental Framey VR plugin panels and store | An unattended Frame OS 0.5.6 exercise showed the repository sample panel in stereo compositor and mirror captures. Synthetic OpenVR clicks changed a live sample setting, read its Decky backend file, and confirmed it after a fresh iframe reopen; temporary services were removed and original power settings restored | No | This was the repository sample, not an official store plugin. Physical controllers, native scrolling, VR keyboard, wearer comfort and legibility remain unverified. Fake-Frame install/remove and local Chromium plugin initialization do not prove an official plugin is visible or usable in worn VR | 28 Oct, v0.4.53 catalog with earlier 25–26 Oct VR evidence: [unattended sample evidence](evidence/framey-vr-2026-10-25/README.md), [compatibility table](framey-compatibility.md), [worn checklist](framey-vr-check.md) |
 
 Release notes must preserve these limits until a newer recorded check changes them. When a feature is retested, add its date, exact app/Frame version, host type and proof here. The older [v0.3.1 matrix](support-matrix.html) is a historical snapshot and does not describe current coverage.

docs/evidence/framey-battery-tracker-2026-10-28.md

@@ -9,3 +9,13 @@ Under a unique owner token on `/tmp/frame-test.lock`, a **read-only** real Frame
 In network/device-isolated, unprivileged **actual Decky 3.3.0 amd64**, the exact adapted archive was discovered. A private Frame-shaped supply fixture produced history and per-app power through public legacy RPC. The complete native regression runner, including existing negative controls, passed. Local managed install/remove tests and the exact-source/manifest guard passed. CI's native ARM64 and fake Frame e2e jobs remain required before merge.
 
 This supports **partial** compatibility. The official frontend initialized in the earlier opaque Chromium audit with backend calls denied; it has not been tested with these live samples. Actual managed recording on Frame ARM64, long-term history, foreground-app attribution, panel controls, and worn VR remain unverified. Existing copies need update or reinstall.
+
+## Hosted ARM64 follow-up
+
+The [main native Decky run](https://github.com/saphid/frame-control/actions/runs/40776292569)
+on `dad5f78a02dd477a689689865cd4ef4205b87e22` passed the exact Battery
+Tracker case on native amd64 **and ARM64** runners. Both logs report `PASS 67`
+for discovery, Frame-shaped private battery samples, history and per-app power
+through actual Decky 3.3.0 RPC. These were disposable fixture supplies inside
+isolated containers. The managed plugin still has not recorded a real Frame
+battery sample; the remaining limits above still apply.

docs/evidence/framey-fileserver-url-2026-10-28.md

@@ -0,0 +1,29 @@
+# DeckyFileServer 1.2.0 address correction, 28 October 2026
+
+Official store ID 60 and ZIP SHA-256
+`7dc2ecdcd05aa415d1ac90afaff28ecb17f77809a2bc7a77aee8e92505b976f0`.
+The exact bundled frontend `dist/index.js` has SHA-256
+`791015d8b3f234fad89ce422b09fb32bbad05e7c867d501706cfbcf9f7c6187f`.
+Only that pinned managed archive receives this change. A changed archive keeps
+the normal native/root rejection.
+
+The [pinned corresponding Go source](../../ui/vendor/deckyfileserver-1.2.0/README.md)
+calls `ListenAndServeTLS` for every server start. The official frontend instead
+constructs `http://steamdeck:<port>` when uploads are off, and toggles the
+second address between HTTP and HTTPS using the upload setting. Neither rule
+matches the server. The `steamdeck` hostname also has no verified resolution
+on Frame. Earlier [real Frame backend evidence](framey-fileserver-arm64-2026-10-27.md)
+confirmed private HTTPS listing and download with uploads disabled.
+
+The managed installer now checks the original frontend hash and replaces the
+two displayed addresses with one `https://<backend IP>:<port>` address. A
+rendered-element check executes the installed official bundle and verifies
+that URL with uploads off and on; it also checks that no `steamdeck` address
+remains. Receipts add `deckyfileserver-https-address`. Older managed copies
+without it display an update or reinstall notice; the compatibility status
+stays **partial**.
+
+This check does not prove a live browser can reach every returned IP, or that
+the folder picker works in Framey. Use a preconfigured directory. Uploads,
+generated thumbnails, worn VR, physical controllers and wearer readability
+remain unverified. This correction did not touch the real headset.

docs/evidence/framey-free-loader-native-2026-10-28.md

@@ -0,0 +1,35 @@
+# Free Loader 1.6.0: private Decky backend check
+
+The official store archive for ID 63 was downloaded and matched SHA-256
+`05208aee6f6ba824391d8ddc81b1168b2599a9711e7528cdaa789f6cc710b42a`.
+The published Decky 3.3.0 amd64 loader matched SHA-256
+`e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181`.
+
+An unprivileged, disposable Debian container ran that loader and the exact
+official plugin with no network, host devices, host session or writable host
+mount. Decky discovered Free Loader as enabled. Its API 1 methods returned 14
+default settings and an empty local deals map. A private `larger_text` setting
+changed to `true` and read back; startup created only the container's private
+settings file, and `read_deals` created an empty private deals cache. No feed,
+notification, Steam store or external account method was called. The local
+probe exited successfully; its container was removed. The committed native
+Decky runtime case repeats these calls and also checks persistence after a
+loader restart on the CI runner's native architecture. The local x86_64 run
+passed all 14 runtime cases, including Free Loader and the existing negative
+regressions. The runner removed its temporary containers and image.
+
+This strengthens the **partial** label. It does not verify a live feed refresh,
+notification delivery, real Frame ARM64 service, rendered deal cards, worn VR
+or controller interaction. The earlier opaque Chromium check had denied backend
+and network calls, so it could not establish that deal cards render with live
+data. No headset was touched for this check.
+
+## Hosted ARM64 follow-up
+
+The [main native Decky run](https://github.com/saphid/frame-control/actions/runs/40776292569)
+on `dad5f78a02dd477a689689865cd4ef4205b87e22` passed the exact Free Loader
+case on native amd64 **and ARM64** runners. Both logs report `PASS 63` for
+discovery, default settings, empty local deals, private setting write/read and
+restart persistence. The runners used separate network and device isolated
+containers; no feed was fetched and no real Frame service was started. The
+remaining partial-compatibility limits above still apply.

docs/evidence/framey-network-sentinel-2026-10-28.md

@@ -9,3 +9,13 @@ The managed install checks the complete archive digest, manifest and Python sour
 Local transaction tests installed and removed the exact archive, checked the native wheel and unmodified license, and rejected an altered archive. In network/device-isolated, unprivileged **actual Decky 3.3.0 amd64**, the managed plugin was discovered, imported native psutil, returned default and updated settings, reported empty history and bandwidth, started its monitoring loop, produced a history sample with quality and bandwidth fields, then stopped. The full native regression runner also passed its other cases, including FileServer and negative controls. The first run's existing large FileServer install timed out at 15 seconds under host load; its bounded timeout is now 30 seconds and the complete rerun passed. No external network call succeeded in the isolated container. Native ARM64 and fake Frame install/remove are CI gates for this change; neither is claimed by this local evidence.
 
 The preexisting local Chromium audit initialized the exact frontend with backend calls denied. It did not prove a functioning panel. External latency/DNS, Wi-Fi scans, actual Frame ARM64 runtime, frontend controls, and worn VR remain unverified. This is a **partial** compatibility result, not a full monitoring or headset-usability claim. No real Frame, normal service, power value, or physical network setting was touched in this check.
+
+## Hosted ARM64 follow-up
+
+The [main native Decky run](https://github.com/saphid/frame-control/actions/runs/40776292569)
+on `dad5f78a02dd477a689689865cd4ef4205b87e22` passed the exact Network
+Sentinel case on native amd64 **and ARM64** runners. Both logs report `PASS 114`
+for discovery, native psutil import, private settings and one isolated
+monitoring-loop sample through actual Decky 3.3.0 RPC. The containers had no
+external network or Frame device access. Real Frame monitoring, external
+latency/DNS, panel controls and worn VR remain unverified.

docs/evidence/framey-shotty-native-2026-10-28.md

@@ -0,0 +1,28 @@
+# Shotty native Decky backend check, 28 October 2026
+
+The exact official Shotty 0.1.0 archive (store ID 53, SHA-256
+`ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe`)
+receives Frame Control's digest-scoped `shotty-click-app-dir` module during a
+managed install. The [earlier isolated Python check](framey-shotty-python-2026-10-26.md)
+copied one synthetic screenshot into a temporary `Pictures` folder.
+
+The [main native Decky run](https://github.com/saphid/frame-control/actions/runs/40776292569)
+on commit `dad5f78a02dd477a689689865cd4ef4205b87e22` passed Shotty's
+`tests/decky-runtime/cases.json` case on both native amd64 and ARM64 runners.
+The test used the digest-verified published Decky 3.3.0 loader and exact archive
+in separate disposable, network and device isolated containers. It installed
+the managed archive, checked the shim receipt and plugin discovery, then called
+the legacy backend methods through Decky's real websocket RPC:
+
+| Runner | Observed result |
+| --- | --- |
+| Ubuntu amd64 | `was_rescued` returned `false`; `aggregate_all(allapps=[])` returned `0` |
+| Ubuntu ARM64 | `was_rescued` returned `false`; `aggregate_all(allapps=[])` returned `0` |
+
+Both job logs report `PASS 53: discovery, backend import and empty screenshot
+aggregation passed`. The containers were removed by the test runner. This
+corrects the prior catalog statement that actual Decky ARM64 backend loading
+was unverified. The empty RPCs do not exercise a real screenshot or the
+continuous rescuer. The managed backend on a real Frame, live screenshot
+notifications and copies, wearer-visible panel and physical controllers remain
+unverified, so Shotty stays **partial**.

docs/evidence/framey-shotty-rpc-2026-10-28.md

@@ -0,0 +1,27 @@
+# Shotty screenshot copy through native Decky RPC, 28 October 2026
+
+The exact official Shotty 0.1.0 archive (store ID 53, SHA-256
+`ab7f6618b264a0cb766525e788cef6c3e1478c0fef98a701225e5e8af441e2fe`)
+was installed with Frame Control's digest-scoped `shotty-click-app-dir` shim.
+The local `scripts/framey-test-decky-runtime.py` run used the published,
+digest-verified Decky 3.3.0 amd64 loader in a disposable unprivileged container
+with no network, host devices or writable host mount. Its full 14-case native
+suite, including three negative controls, exited successfully.
+
+The Shotty case placed two small marker files under a private synthetic Steam
+screenshots directory in the container's temporary home. Calls went through
+Decky's real legacy websocket RPC. `set_id_map_fronend` supplied a private game
+name; `copy_screenshot` returned `true` for the selected file. Independent
+reads of `Pictures/Screenshots/Private Game/selected.jpg` and
+`Pictures/Screenshots/most_recent.jpg` matched the marker bytes. A later
+`aggregate_all` returned `1`, and the historical file in the named folder
+also matched its source bytes. Empty aggregation and `was_rescued=false` still
+passed. The runner removed its owned containers and image; no headset or user
+screenshot was accessed.
+
+This local run checks the real Decky RPC and same-filesystem copy path with
+synthetic files on amd64. The PR's hosted native ARM64 gate must pass before
+merge; this local result alone does not establish ARM64 behavior. Steam's live
+screenshot notification, cross-filesystem copies, the continuous rescuer, real
+Frame installation, wearer-visible VR and physical controller use remain
+unverified. Shotty remains **partial**.

docs/evidence/v0454-candidate-2026-10-28.md

@@ -0,0 +1,42 @@
+# v0.4.54 candidate hold, 28 October 2026
+
+The local, unpushed `release/v0.4.54` candidate is commit
+`3eefedd8d4dd2ce8db7d62d0dd2d7cff1fe2089b`, based on main
+`e7b037ce883e45990bf239aee29b05434a39a399`. It changes only the
+version in `app/package.json` and `app/package-lock.json`. It has not been
+tagged or published. The latest public release remains
+[v0.4.53](https://github.com/saphid/frame-control/releases/tag/v0.4.53).
+
+The locked real Frame smoke at 20:28 UTC read SteamVR activity 3 (standby),
+proximity 2.3125 and battery 100% on Frame OS build `20261022.6153909`.
+ARM64 and Windows/Proton test titles launched. The x86_64 test title did
+**not** launch: Steam reported that Steam Linux Runtime 4.0 was found but
+not installed. The result has **12 passed, 1 skipped, 0 failed**. Its final
+cleanup step passed and its unique lock was released. The private JSON result
+is `/tmp/frame-v0454-smoke-results/2026-10-28T202826Z-20261022.6153909.json`
+with SHA-256 `d86edaec0b86faf130c21aa3d7113cc1ac5b2ae0869dbd15f811bf3bb5b76b88`.
+
+A separate read-only audit acquired and released a fresh unique headset lock.
+It read activity 3, proximity 2.3125 and battery 100%, and found no reserved
+smoke title directories or owned test processes. It did not wake the Frame or
+send input. Nobody confirmed wearing the Frame, so no wearer-visible or
+physical-controller result follows.
+
+Follow-up probes at about 22:40–22:45 UTC each acquired a new unique owner in
+the shared headset lock before reading status. SteamVR stayed at activity 3
+(standby), proximity was 2.3125–2.375 and battery was 100%. A bounded,
+read-only `FEXBash --help` probe reported that `SteamLinuxRuntime_4` did not
+exist in Steam's common directory. A separate read of `/usr/bin/FEXBash` found
+that its wrapper exits when that directory is absent. The probes did not
+install a runtime, launch a title, wake the headset or send input. Each owner
+released its lock. The available FEX wrapper therefore did not provide an
+immediate x86 Linux launch path; this does not establish that every possible
+runtime source is absent.
+
+**Release decision: hold v0.4.54.** The smoke script at the candidate commit
+returned exit 0 even though it recorded a skipped launch. Under the current
+release rule, a skip cannot satisfy the smoke gate. The accompanying change
+makes a skipped smoke return nonzero while preserving the explicit skipped
+step and cleanup record. Exact release-commit CI, release verification, tagged
+installer builds, checksums and publisher dry run have not been performed for
+this local candidate.

docs/framey-compatibility.md

@@ -25,13 +25,13 @@ python3 scripts/framey-audit-browser.py --cache /tmp/framey-archives
 
 Open the browser audit URL in local Chromium, run `runAudit()` and inspect/download `results`. All backend/network actions remain denied.
 
-A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates-2026-10-26.md) accepts only byte-identical duplicate ZIP members whose modes differ at most in execute bits. The exact archive passed private local and focused fake-Frame install/remove; its frontend rendered in opaque Chromium and isolated Python settings/empty-deals reads passed with a Decky stub. The earlier full 116-plugin fake-Frame audit blocked this archive before the fix. Actual Decky, feed updates and worn VR remain unverified.
+A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates-2026-10-26.md) accepts only byte-identical duplicate ZIP members whose modes differ at most in execute bits. The exact archive passed private local and focused fake-Frame install/remove; its frontend rendered in opaque Chromium. The earlier full 116-plugin fake-Frame audit blocked this archive before the fix. A later [native Decky 3.3.0 check](evidence/framey-free-loader-native-2026-10-28.md) verified plugin discovery, default settings, empty local deals and private setting persistence after restart in network-isolated amd64 and ARM64 containers. Live feed updates, notifications, Steam store integration, real Frame ARM64 service and worn VR remain unverified.
 
 A [2026-10-28 static action-limit review](evidence/framey-static-action-limits-2026-10-28.md) hash-checked the exact AutoSuspend and CheatDeck archives. AutoSuspend contains Steam suspend/shutdown paths, and CheatDeck's advertised trainer flow needs a Steam game context menu and launch-option writes. Neither plugin was executed; both retain their broken labels.
 
-A [Network Sentinel user-service check](evidence/framey-network-sentinel-2026-10-28.md) adapts only the exact 1.0.4 digest. In isolated actual Decky 3.3.0 amd64, the pinned plugin-local psutil wheel, private settings RPC and one monitoring-loop sample pass. External ping/DNS, Frame ARM64, panel controls and worn VR remain unverified; this is partial compatibility.
+A [Network Sentinel user-service check](evidence/framey-network-sentinel-2026-10-28.md) adapts only the exact 1.0.4 digest. In isolated actual Decky 3.3.0 amd64 and ARM64, the pinned plugin-local psutil wheel, private settings RPC and one monitoring-loop sample pass. External ping/DNS, a real Frame backend, panel controls and worn VR remain unverified; this is partial compatibility.
 
-A [Battery Tracker user-service check](evidence/framey-battery-tracker-2026-10-28.md) adapts only the exact 0.2.0 digest. A locked read-only Frame probe confirmed a Battery-type supply with the required fields; actual Decky 3.3.0 amd64 recorded private Frame-shaped samples and returned history/per-app power. The managed plugin has not run on the real Frame, and panel controls and worn VR remain unverified; this is partial compatibility.
+A [Battery Tracker user-service check](evidence/framey-battery-tracker-2026-10-28.md) adapts only the exact 0.2.0 digest. A locked read-only Frame probe confirmed a Battery-type supply with the required fields; actual Decky 3.3.0 amd64 and ARM64 recorded private Frame-shaped samples and returned history/per-app power. The managed plugin has not run on the real Frame, and panel controls and worn VR remain unverified; this is partial compatibility.
 
 The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.
 
@@ -74,18 +74,18 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 49: Decky Cloud Save 1.4.2 | legacy / legacy | broken | The exact official ZIP contains a 60,776,600-byte x86_64 rclone member, above the 30 MiB member limit and unusable on ARM64. Installation remains blocked. | static archive, local browser, fake-Frame |
 | 50: Storage Cleaner 1.4.0 | 1 / 2 | partial | Empty-data panel rendered; cleanup was deliberately not run because it can remove local data. | static archive, local browser, fake-Frame |
 | 52: Game Theme Music 1.7.1-1 | 1 / 2 | partial | An inert local component lets the exact frontend initialize and render its Settings view in opaque Chromium. Backend get_setting and plugin network were denied in the audit; Steam game-page theme injection has no verified target in Framey. Music search, playback, downloads, settings persistence and worn VR remain unverified. | static archive, local browser, fake-Frame |
-| 53: Shotty 0.1.0 | legacy / legacy | partial | The frontend starts with the read-only Frame library snapshot. Frame Control adds a digest-scoped click.get_app_dir compatibility module to the managed install; the exact backend then imports and copies a synthetic Steam screenshot into a temporary Pictures folder in isolated Python. Actual Decky 3.3.0 ARM64 loading, live screenshots/rescue, in-VR panel and physical controller use remain unverified. | static archive, local browser, fake-Frame, real Frame SSH, isolated Python backend |
+| 53: Shotty 0.1.0 | legacy / legacy | partial | The frontend starts with the read-only Frame library snapshot. The exact-digest click.get_app_dir shim lets actual Decky 3.3.0 in isolated amd64 and ARM64 containers discover Shotty and complete empty screenshot RPCs; isolated Python also copied a synthetic screenshot into a temporary Pictures folder. The managed backend on the real Frame, live screenshots/rescue, in-VR panel and physical controller use remain unverified. | static archive, local browser, fake-Frame, real Frame SSH, isolated Python backend, isolated Decky 3.3.0 amd64/ARM64 empty backend RPCs |
 | 56: MangoPeel 0.0.7 | 1 / 2 | partial | Initializer succeeds; gamescope/MangoHud actions and backend are unverified. | static archive, local browser, fake-Frame |
 | 58: Volume Boost 0.0.7 | legacy / legacy | works | Default-sink controls pass in local Chromium through real Decky 3.3.0 ARM64: linked slider/keyboard and numeric writes, separate channels, re-link and reopen, with independent Pulse readback including 125%/150% while muted. Exact original volume/mute restored. Audible output, Bluetooth sinks and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
 | 59: Web Browser 1.4.3 | legacy / legacy | broken | The exact frontend now initializes with a null Steam React-root lookup. The browser itself still requires Steam GamepadUI CDP injection and a backend WebSocket unavailable in Framey; no working browser tab was verified. | static archive, local browser, fake-Frame, focused local browser |
-| 60: DeckyFileServer 1.2.0 | 1 / 2 | partial | Managed install supplies a native ARM64 helper and removes the exact archive's unnecessary root request. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. Frontend address/picker limitations remain; use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame, real Decky 3.3.0 amd64, real Frame SSH |
+| 60: DeckyFileServer 1.2.0 | 1 / 2 | partial | Managed install supplies a native ARM64 helper, removes the exact archive's unnecessary root request, and displays the backend-returned IP with HTTPS. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. The Steam folder picker remains unavailable; use a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. Existing managed copies need update or reinstall for the address fix. | static archive, local browser, fake-Frame, real Decky 3.3.0 amd64, real Frame SSH |
 | 61: TabMaster 2.15.1 | 1 / 2 | partial | Local Chromium rendered the QAM and navigable Overview/Filters documentation with an actual Decky 3.3.0 amd64 backend. Library-tab editing remains unavailable: Steam login/library patches and MobX reactions have no target. ARM64 and worn VR unverified. | static archive, local browser, fake-Frame |
 | 62: TS3 QuickAccess 1.2.0 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: ts3-qs4sd/bin/ts3-qs4sd.so. | static archive, local browser, fake-Frame |
-| 63: Free Loader 1.6.0 | 1 / 2 | partial | The exact archive's duplicate names contain identical bytes and differ only in execute bits; the guarded installer now accepts them, and a private local install/remove transaction passed. The current opaque Chromium host renders Free Games but cannot load deals with backend/network denied. Exact official Python settings and empty local-deals methods passed in a no-network container with a Decky stub. Real Decky, feed refresh, notifications and worn VR remain unverified. | static archive, local browser, fake-Frame pinned install/remove, local exact-archive transaction, isolated Python backend |
+| 63: Free Loader 1.6.0 | 1 / 2 | partial | The exact archive's byte-identical duplicate ZIP members pass guarded install/remove. Actual Decky 3.3.0 in private network-isolated amd64 and ARM64 containers discovers the plugin, reads default settings and empty local deals, and retains a settings change after restart. Live deal-feed refresh, notifications, Steam store integration, real Frame ARM64 service and worn VR remain unverified; no feed request was made. | static archive, local browser, fake-Frame pinned install/remove, local exact-archive transaction, isolated Python backend, isolated Decky 3.3.0 amd64/ARM64 backend |
 | 64: Syncthing 0.2.7 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 65: Decky Terminal 0.5.3 | 1 / 2 | partial | Local routes initialize after parameter-route support; no shell commands were run. | static archive, local browser, fake-Frame |
 | 66: PlayTime 3.2.5 | 1 / 2 | partial | Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. Running snapshots are now exposed, but its private MobX observation is unsupported; automatic recording and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
-| 67: Battery Tracker 0.2.0 | legacy / legacy | partial | Exact managed install removes the unnecessary root flag, selects a readable Battery-type power supply, and repairs empty history and per-app sample grouping. Actual Decky 3.3.0 amd64 recorded Frame-shaped private battery samples and returned history/power data. A locked real Frame read verified the required sysfs fields, not the managed plugin. Live ARM64 recording, long-term battery history, foreground-app labeling, panel controls and worn VR remain unverified; existing copies need update or reinstall. | static archive, local browser, fake-Frame, isolated Decky amd64 backend, real Frame read-only sysfs |
+| 67: Battery Tracker 0.2.0 | legacy / legacy | partial | Exact managed install removes the unnecessary root flag, selects a readable Battery-type power supply, and repairs empty history and per-app sample grouping. Actual Decky 3.3.0 in isolated amd64 and ARM64 containers recorded Frame-shaped private battery samples and returned history/per-app power. A locked real Frame read verified the required sysfs fields, not the managed plugin. Real Frame ARM64 recording, long-term history, foreground-app labeling, panel controls and worn VR remain unverified; existing copies need update or reinstall. | static archive, local browser, fake-Frame, isolated Decky 3.3.0 amd64/ARM64 backend, real Frame read-only sysfs |
 | 68: Wine Cellar 0.2.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-wine-cellar/bin/backend. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
 | 70: MicroSDeck 0.11.2 | legacy / 2 | broken | Plugin contains a non-ARM64 Linux binary: MicroSDeck/bin/backend. | static archive, local browser, fake-Frame |
 | 72: ScreenshotUploader 0.0.3 | legacy / legacy | partial | Initializer succeeds; screenshot upload requires external credentials/network and was not run. | static archive, local browser, fake-Frame |
@@ -128,7 +128,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 111: Music Control 1.1.7 | legacy / legacy | partial | Managed reinstall preserves Decky’s legacy calling convention and repairs the Frame OS shell library-path failure. Chromium transport/seek/volume against a silent MPRIS fixture and real ARM64 empty-player discovery pass; actual Frame media playback, album art and worn VR remain unverified. Reinstall existing copies to apply. | static archive, local browser, fake-Frame, isolated Python backend, isolated Decky 3.3.0 + MPRIS fixture, real Frame SSH |
 | 112: Better Keyboard 0.3.4 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Frontend audit failed: window.SteamClient.UI.GetUIMode is not a function. | static archive, local browser, fake-Frame |
 | 113: Decky LSFG-VK 0.12.2 | 1 / 2 | partial | Initializer succeeds; runtime LSFG/Windows DLL downloads and Vulkan integration are not ARM64-validated. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
-| 114: Network Sentinel 1.0.4 | 1 / 2 | partial | Exact managed install removes the unnecessary root flag and adds pinned plugin-local psutil wheels. Actual Decky 3.3.0 amd64 in network isolation loads the backend and records a network sample; private settings and read-only RPCs pass. External ping/DNS, real Frame ARM64, Wi-Fi scan behavior, panel controls and worn VR remain unverified. Existing copies need update or reinstall. | static archive, local browser, fake-Frame, isolated Decky amd64 backend |
+| 114: Network Sentinel 1.0.4 | 1 / 2 | partial | Exact managed install removes the unnecessary root flag and adds pinned plugin-local psutil wheels. Actual Decky 3.3.0 in isolated amd64 and ARM64 containers loads the backend and records a private network sample; settings and read-only RPCs pass. External ping/DNS, real Frame ARM64 backend, Wi-Fi scan behavior, panel controls and worn VR remain unverified. Existing copies need update or reinstall. | static archive, local browser, fake-Frame, isolated Decky 3.3.0 amd64/ARM64 backend |
 | 115: Decky Clash 1.3.0 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 116: Muon 0.2.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. Shared Toggle value rendering is repaired; other listed blockers remain. | static archive, local browser, fake-Frame |
 | 117: DeckyParty File Manager 1.0.0 | legacy / legacy | partial | Initializer succeeds; privileged file operations and backend are unverified. No file changes were run. | static archive, local browser, fake-Frame |
@@ -287,7 +287,7 @@ DFL includes exports imported through decky-frontend-lib / @decky/ui. Steam stor
 
 All published Linux native payloads in this snapshot are x86_64; no published aarch64 payload was found. The three Windows DLLs belong to Decky-Framegen. Except for the exact managed DeckyFileServer and Decky Localsend adaptations below, the installer still rejects these archives. Apart from LocalSend and DeckyFileServer, ARM64 builds were not attempted: the constraints below remain unresolved.
 
-A [DeckyFileServer ARM64 follow-up](evidence/framey-fileserver-arm64-2026-10-27.md) ships an offline, digest-checked GPL helper build, corresponding vendored source and a build recipe. Only its exact managed archive can replace the x86 helper and remove its unnecessary root flag. Actual Decky 3.3.0 discovery/RPC and real Frame HTTPS private-fixture listing/download pass; uploads stay disabled. Hostname-DNS failures and empty optional arguments are repaired. Decky 3.3.0 still exposes `decky.HOME`; that call is unchanged. The plugin moves from broken to partial: its frontend advertises HTTP/steamdeck URLs and needs a Steam folder picker. Use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR remain unverified.
+A [DeckyFileServer ARM64 follow-up](evidence/framey-fileserver-arm64-2026-10-27.md) ships an offline, digest-checked GPL helper build, corresponding vendored source and a build recipe. Only its exact managed archive can replace the x86 helper and remove its unnecessary root flag. Actual Decky 3.3.0 discovery/RPC and real Frame HTTPS private-fixture listing/download pass; uploads stay disabled. Hostname-DNS failures and empty optional arguments are repaired. Decky 3.3.0 still exposes `decky.HOME`; that call is unchanged. The plugin remains partial. A [frontend URL follow-up](evidence/framey-fileserver-url-2026-10-28.md) changes only the exact managed bundle to display the backend-returned IP with HTTPS, matching the helper. Existing managed copies need update or reinstall. The Steam folder picker is still unavailable; use a preconfigured directory. Uploads, generated thumbnails and worn VR remain unverified.
 
 [LocalSend ARM64 build/runtime evidence](evidence/framey-localsend-arm64-2026-10-26.md) covers an isolated real-Frame protocol 2.0 info response from an earlier helper build. [Exact official source matching](evidence/framey-localsend-source-match-2026-10-27.md) now identifies the official helper source and a reproducible ARM64 build from that revision. The exact official x86 backend passed one local private-namespace transfer, and the rebuilt ARM64 helper passed one locked real-Frame private marker transfer. Published Decky 3.3.0 AMD64/ARM64 runtime checks discovered the adapted plugin and read its stopped status and configuration. Only the exact managed 0.4.5 archive can replace its x86 helper on Frame. The actual managed Decky service on Frame, user-facing transfer, local discovery and worn VR remain unverified ([managed adaptation evidence](evidence/framey-localsend-managed-2026-10-27.md)).
 

docs/testing.md

@@ -233,8 +233,9 @@ before (if it was, it stays, synced to this checkout as Frame Control always
 does). A cleanup that fails counts as a failed step. Results go to
 `tests/smoke/results/<time>-<BUILD_ID>.json` (not committed) with a summary on
 screen. The summary counts passed, skipped and failed steps separately. It
-exits 0 when no step failed (including a skipped optional runtime), 1 if a step
-failed, or 2 if the headset isn't reachable.
+exits 0 only when every step passed, 1 if a step failed or was skipped, or 2 if
+the headset isn't reachable. A skipped x86-64 launch blocks a release smoke
+gate even though it remains separately labeled in the result.
 
 Smoke process cleanup runs before and after title removal and during the
 initial/final leftover sweeps. It targets only the reserved `fc_smoke_arm64`,

scripts/framey-compatibility-doc.py

@@ -40,10 +40,10 @@ def render(data):
         'python3 scripts/framey-audit-browser.py --cache /tmp/framey-archives',
         '```', '',
         'Open the browser audit URL in local Chromium, run `runAudit()` and inspect/download `results`. All backend/network actions remain denied.', '',
-        'A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates-2026-10-26.md) accepts only byte-identical duplicate ZIP members whose modes differ at most in execute bits. The exact archive passed private local and focused fake-Frame install/remove; its frontend rendered in opaque Chromium and isolated Python settings/empty-deals reads passed with a Decky stub. The earlier full 116-plugin fake-Frame audit blocked this archive before the fix. Actual Decky, feed updates and worn VR remain unverified.', '',
+        'A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates-2026-10-26.md) accepts only byte-identical duplicate ZIP members whose modes differ at most in execute bits. The exact archive passed private local and focused fake-Frame install/remove; its frontend rendered in opaque Chromium. The earlier full 116-plugin fake-Frame audit blocked this archive before the fix. A later [native Decky 3.3.0 check](evidence/framey-free-loader-native-2026-10-28.md) verified plugin discovery, default settings, empty local deals and private setting persistence after restart in network-isolated amd64 and ARM64 containers. Live feed updates, notifications, Steam store integration, real Frame ARM64 service and worn VR remain unverified.', '',
         'A [2026-10-28 static action-limit review](evidence/framey-static-action-limits-2026-10-28.md) hash-checked the exact AutoSuspend and CheatDeck archives. AutoSuspend contains Steam suspend/shutdown paths, and CheatDeck\'s advertised trainer flow needs a Steam game context menu and launch-option writes. Neither plugin was executed; both retain their broken labels.', '',
-        'A [Network Sentinel user-service check](evidence/framey-network-sentinel-2026-10-28.md) adapts only the exact 1.0.4 digest. In isolated actual Decky 3.3.0 amd64, the pinned plugin-local psutil wheel, private settings RPC and one monitoring-loop sample pass. External ping/DNS, Frame ARM64, panel controls and worn VR remain unverified; this is partial compatibility.', '',
-        'A [Battery Tracker user-service check](evidence/framey-battery-tracker-2026-10-28.md) adapts only the exact 0.2.0 digest. A locked read-only Frame probe confirmed a Battery-type supply with the required fields; actual Decky 3.3.0 amd64 recorded private Frame-shaped samples and returned history/per-app power. The managed plugin has not run on the real Frame, and panel controls and worn VR remain unverified; this is partial compatibility.', '',
+        'A [Network Sentinel user-service check](evidence/framey-network-sentinel-2026-10-28.md) adapts only the exact 1.0.4 digest. In isolated actual Decky 3.3.0 amd64 and ARM64, the pinned plugin-local psutil wheel, private settings RPC and one monitoring-loop sample pass. External ping/DNS, a real Frame backend, panel controls and worn VR remain unverified; this is partial compatibility.', '',
+        'A [Battery Tracker user-service check](evidence/framey-battery-tracker-2026-10-28.md) adapts only the exact 0.2.0 digest. A locked read-only Frame probe confirmed a Battery-type supply with the required fields; actual Decky 3.3.0 amd64 and ARM64 recorded private Frame-shaped samples and returned history/per-app power. The managed plugin has not run on the real Frame, and panel controls and worn VR remain unverified; this is partial compatibility.', '',
         'The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. '
         'Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.', '',
         'After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. '
@@ -131,7 +131,7 @@ def render(data):
         'A [DeckyFileServer ARM64 follow-up](evidence/framey-fileserver-arm64-2026-10-27.md) ships an offline, digest-checked GPL helper build, corresponding vendored source and a build recipe. '
         'Only its exact managed archive can replace the x86 helper and remove its unnecessary root flag. Actual Decky 3.3.0 discovery/RPC and real Frame HTTPS private-fixture listing/download pass; uploads stay disabled. '
         'Hostname-DNS failures and empty optional arguments are repaired. Decky 3.3.0 still exposes `decky.HOME`; that call is unchanged. '
-        'The plugin moves from broken to partial: its frontend advertises HTTP/steamdeck URLs and needs a Steam folder picker. Use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR remain unverified.', '',
+        'The plugin remains partial. A [frontend URL follow-up](evidence/framey-fileserver-url-2026-10-28.md) changes only the exact managed bundle to display the backend-returned IP with HTTPS, matching the helper. Existing managed copies need update or reinstall. The Steam folder picker is still unavailable; use a preconfigured directory. Uploads, generated thumbnails and worn VR remain unverified.', '',
         '[LocalSend ARM64 build/runtime evidence](evidence/framey-localsend-arm64-2026-10-26.md) '
         'covers an isolated real-Frame protocol 2.0 info response from an earlier helper build. '
         '[Exact official source matching](evidence/framey-localsend-source-match-2026-10-27.md) '

scripts/framey-test-decky-runtime.py

@@ -41,7 +41,8 @@ def check_coverage():
             shims.add(node.args[0].value)
     cases = json.loads((ROOT/'tests/decky-runtime/cases.json').read_text())
     # Frontend-only compatibility probes need no archive/backend adaptation.
-    if shims != {case['shim'] for case in cases if case['shim'] is not None}:
+    covered = {shim for case in cases for shim in ([case['shim']] if case['shim'] else []) + case.get('additionalShims', [])}
+    if shims != covered:
         raise ValueError('Every managed shim needs an actual Decky runtime case')
     return cases
 

tests/decky-runtime/cases.json

@@ -14,6 +14,11 @@
     "shim": null,
     "probe": "toggle-settings"
   },
+  {
+    "id": 63,
+    "shim": null,
+    "probe": "free-loader"
+  },
   {
     "id": 12,
     "shim": "music-control-system-dbus-env",
@@ -42,7 +47,10 @@
   {
     "id": 60,
     "shim": "deckyfileserver-user-native",
-    "probe": "fileserver"
+    "probe": "fileserver",
+    "additionalShims": [
+      "deckyfileserver-https-address"
+    ]
   },
   {
     "id": 125,

tests/decky-runtime/check.py

@@ -90,7 +90,8 @@ def main():
     plugin = base/'plugins'/record['folder']
     receipt = json.loads((plugin/'.frame-control-store.json').read_text())
     if not args.reproduce_timer_regression:
-        assert receipt.get('compatShims', []) == ([case['shim']] if case['shim'] else []), receipt
+        expected_shims = ([case['shim']] if case['shim'] else []) + case.get('additionalShims', [])
+        assert receipt.get('compatShims', []) == expected_shims, receipt
     else:
         assert record['id'] == 96
         with zipfile.ZipFile(io.BytesIO(data)) as original:
@@ -240,6 +241,30 @@ def main():
                 report['result'] = ('original empty argument bug reproduced: thumbnail policy ignored'
                     if args.reproduce_fileserver_empty_flag_regression else
                     'discovery, API1 settings, native HTTPS listing/download, thumbnail policy and stop passed; uploads disabled')
+            elif case['probe'] == 'free-loader':
+                settings = current('settings_read')
+                assert settings['notify_on_free_games'] is True, settings
+                assert settings['larger_text'] is False, settings
+                assert current('read_deals') == {}
+                # This plugin commits defaults on startup and writes an empty
+                # deals cache on first read. Both paths are private to this
+                # disposable container; no feed, notification or store call.
+                settings_dir = base/'settings'/record['folder']
+                assert (settings_dir/'settings.json').is_file()
+                assert (settings_dir/'deal_db.json').is_file()
+                current('settings_setSetting', 'larger_text', True)
+                assert current('settings_read')['larger_text'] is True
+                os.killpg(backend.pid, signal.SIGTERM)
+                backend.wait(timeout=8)
+                backend = subprocess.Popen([str(loader)], env=env, stdout=log, stderr=log,
+                                           start_new_session=True)
+                processes.append(backend)
+                until_ready(lambda: rpc('loader/get_plugins'), 'restarted Decky discovery')
+                assert until_ready(lambda: current('settings_read')['larger_text'],
+                                   'private Free Loader setting after restart') is True
+                assert current('read_deals') == {}
+                report['result'] = ('discovery, default settings, empty local deals, '
+                    'private setting write/read and restart persistence passed; feed, notifications and VR unverified')
             elif case['probe'] == 'toggle-settings':
                 def call(method, *values):
                     result = rpc('loader/call_plugin_method', record['name'], method, *values)
@@ -333,7 +358,22 @@ def main():
                 assert case['probe'] == 'screenshots'
                 assert legacy('was_rescued') is False
                 assert legacy('aggregate_all', allapps=[]) == 0
-                report['result'] = 'discovery, backend import and empty screenshot aggregation passed'
+                screenshots = home/'.local/share/Steam/userdata/9001/760/remote/4242/screenshots'
+                screenshots.mkdir(parents=True)
+                marker = b'Framey private screenshot fixture\n'
+                (screenshots/'selected.jpg').write_bytes(marker)
+                legacy('set_id_map_fronend', allapps=[[4242, 'Private Game']])
+                assert legacy('copy_screenshot', app_id=4242,
+                              url='https://localhost/selected.jpg') is True
+                copied = home/'Pictures/Screenshots/Private Game/selected.jpg'
+                assert copied.read_bytes() == marker
+                assert (home/'Pictures/Screenshots/most_recent.jpg').read_bytes() == marker
+                (screenshots/'historical.jpg').write_bytes(b'Framey historical fixture\n')
+                assert legacy('aggregate_all', allapps=[[4242, 'Private Game']]) == 1
+                assert (copied.parent/'historical.jpg').read_bytes() == b'Framey historical fixture\n'
+                assert legacy('was_rescued') is False
+                report['result'] = ('discovery, backend import, empty aggregation, private screenshot '
+                                    'copy and historical aggregation passed')
             log.flush()
             log.seek(0)
             assert 'Starting Decky version v3.3.0' in log.read()

tests/e2e/test_framey.py

@@ -9,7 +9,8 @@ import subprocess
 import threading
 import zipfile
 
-from harness import FrameTestCase, ROOT, Server, api, finished, ok, require, ssh
+from harness import FrameTestCase, ROOT, Server, api, finished, ok, require, reset, ssh
+import frame_decky_store
 from framey_official import LEGACY_PLUGINS, PLUGINS as PANEL_PLUGINS, archive as official_archive
 
 OFFICIAL_PLUGINS = PANEL_PLUGINS + LEGACY_PLUGINS
@@ -99,6 +100,13 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                               input=source, capture_output=True, timeout=20)
         self.assertEqual(copy.returncode, 0, copy.stderr)
 
+    def test_fake_frame_reset_clears_managed_decky_state(self):
+        ssh('mkdir -p ~/.local/share/frame-control/decky/plugins/test-leftover ~/.config/systemd/user')
+        ssh('touch ~/.config/systemd/user/frame-control-decky.service')
+        reset()
+        self.assertEqual(ssh('test -e ~/.local/share/frame-control/decky && echo yes || echo no').strip(), 'no')
+        self.assertEqual(ssh('test -e ~/.config/systemd/user/frame-control-decky.service && echo yes || echo no').strip(), 'no')
+
     def test_store_install_update_remove_and_guards(self):
         self.backend()
         status, _, _ = api('GET', '/api/decky/store', headers={'X-Frame-UI':''})
@@ -190,6 +198,9 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                 installed = f"~/.local/share/frame-control/decky/plugins/{plugin['folder']}"
                 with zipfile.ZipFile(io.BytesIO(official_archive(plugin))) as bundle:
                     expected = hashlib.sha256(bundle.read(plugin['folder']+'/dist/index.js')).hexdigest()
+                if plugin['id'] == 60:
+                    # The pinned managed bundle rewrites the two incorrect addresses.
+                    expected = '05819ddd0ee9c3ce7eeb184977a2f7905d7c8f5cfaec8bdff837d7935985a0e7'
                 self.assertEqual(ssh(f'sha256sum {installed}/dist/index.js').split()[0], expected)
                 self.assertEqual(json.loads(ssh(f'cat {installed}/plugin.json')).get('api_version', 'legacy'), plugin['api_version'])
                 if plugin['id'] == 96:
@@ -205,8 +216,8 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                 if plugin['id'] == 60:
                     self.assertEqual(json.loads(ssh(f'cat {installed}/plugin.json'))['flags'], [])
                     receipt = json.loads(ssh(f'cat {installed}/.frame-control-store.json'))
-                    self.assertEqual(receipt['compatShims'], ['deckyfileserver-user-native'])
-                    import frame_decky_store
+                    self.assertEqual(receipt['compatShims'],
+                                     ['deckyfileserver-user-native', 'deckyfileserver-https-address'])
                     arch = ssh('uname -m').strip()
                     self.assertEqual(ssh(f'sha256sum {installed}/bin/backend').split()[0],
                                      frame_decky_store.FILESERVER_BINARIES[arch])

tests/fakeframe/rootfs/usr/local/lib/fakeframe/init.py

@@ -304,6 +304,8 @@ def clean_home():
             pass
     for pattern in (fs.DEVKIT_GAMES + '/*', fs.DEVKIT_GAMES + '/.[!.]*', HOME + '/devkit-utils',
                     HOME + '/.devkit-utils.frame-control', HOME + '/Applications', HOME + '/Downloads/*',
+                    HOME + '/.local/share/frame-control',
+                    HOME + '/.config/systemd/user/frame-control-decky.service',
                     fs.STEAM_ROOT + '/steamapps/compatdata', fs.STEAM_ROOT + '/steamapps/shadercache',
                     fs.STEAM_ROOT + '/logs', '/var/log/fakeframe/devkit-*', '/var/log/fakeframe/shortcut-*'):
         for p in glob.glob(pattern):

tests/page/framey_fileserver_url.mjs

@@ -0,0 +1,42 @@
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import vm from 'node:vm';
+
+const source = readFileSync(process.argv[2], 'utf8');
+const testSource = source.replace(/export \{ index as default \};/, 'globalThis.__Content = Content;');
+assert.notEqual(testSource, source, 'official module export must be present');
+
+const DFL = new Proxy({
+  definePlugin: factory => factory(),
+  staticClasses: {Title: 'title'},
+}, {get(target, name) { return target[name] ?? name; }});
+const createElement = (type, props, ...children) => ({type, props: props ?? {}, children});
+
+for (const allow_uploads of [false, true]) {
+  const SP_REACT = {
+    createElement,
+    createContext: value => ({value}),
+    useState: initial => [{...initial, server_running: true,
+      ip_address: '192.0.2.5', port: 8421, allow_uploads}, () => {}],
+    useEffect() {},
+  };
+  const window = {SP_REACT,
+    __DECKY_SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED_deckyLoaderAPIInit: {
+      connect: () => ({_version: 2, callable: () => async () => ({}), openFilePicker: async () => ({})}),
+    },
+  };
+  const context = vm.createContext({window, SP_REACT, DFL, setInterval() {}, clearInterval() {}});
+  vm.runInContext(testSource, context);
+  const tree = context.__Content();
+  const fields = [];
+  function visit(value) {
+    if (!value || typeof value !== 'object') return;
+    if (value.type === DFL.Field) fields.push(value);
+    for (const child of value.children ?? []) visit(child);
+  }
+  visit(tree);
+  const addresses = fields.filter(field => field.props.label === 'Server Address');
+  assert.equal(addresses.length, 1);
+  assert.equal(addresses[0].children.join(''), 'https://192.0.2.5:8421');
+  assert.equal(fields.filter(field => field.children.join('').includes('steamdeck')).length, 0);
+}

tests/smoke/frame_smoke.py

@@ -28,8 +28,8 @@ rechecked around deletion; shared Proton services are never stopped by name.
 
 Usage: python3 tests/smoke/frame_smoke.py [--pair]     (or scripts/frame-smoke.sh)
 Env:   FRAME_ALIAS (default frame), FRAME_SMOKE_RESULTS (default tests/smoke/results)
-Exit status: 0 no step failed (optional runtime may skip a launch), 1 a step
-failed, 2 the headset isn't reachable.
+Exit status: 0 every step passed, 1 a step failed or was skipped, 2 the
+headset isn't reachable. A skipped launch is not a release smoke pass.
 """
 import argparse
 import json
@@ -425,7 +425,7 @@ def run_smoke(args, before):
                                'passed': passed, 'skipped': skipped, 'failed': failed,
                                'devkit_utils_there_before': had_utils, 'steps': smoke.steps}, indent=1))
     print(f'==> {passed} passed, {skipped} skipped, {failed} failed on build {build}; results in {out}')
-    return 0 if failed == 0 else 1
+    return 0 if failed == 0 and skipped == 0 else 1
 
 
 def main():

tests/test_frame_decky_store.py

@@ -228,12 +228,16 @@ class StoreTransaction(unittest.TestCase):
         self.assertEqual(result.returncode, 0, result.stderr)
         plugin = self.folder.parent/record['folder']
         self.assertEqual(json.loads((plugin/'plugin.json').read_text())['flags'], [])
-        self.assertEqual(json.loads((plugin/'.frame-control-store.json').read_text())['compatShims'], ['deckyfileserver-user-native'])
+        self.assertEqual(json.loads((plugin/'.frame-control-store.json').read_text())['compatShims'],
+                         ['deckyfileserver-user-native', 'deckyfileserver-https-address'])
         helper = plugin/'bin/backend'
         self.assertEqual(hashlib.sha256(helper.read_bytes()).hexdigest(), frame_decky_store.FILESERVER_BINARIES[platform.machine()])
         self.assertEqual(helper.stat().st_mode & 0o777, 0o700)
         compile((plugin/'main.py').read_text(), str(plugin/'main.py'), 'exec')
         self.assertIn('if arg]', (plugin/'main.py').read_text())
+        rendered = subprocess.run(['node', str(Path(__file__).parent/'page/framey_fileserver_url.mjs'),
+                                   str(plugin/'dist/index.js')], capture_output=True, text=True, timeout=20)
+        self.assertEqual(rendered.returncode, 0, rendered.stderr)
 
     @unittest.skipUnless(__import__('platform').machine() in ('x86_64', 'aarch64'), 'native Linux helper architecture')
     def test_exact_localsend_gets_verified_native_helper_and_preserves_source(self):

tests/test_framey_compatibility.py

@@ -80,6 +80,16 @@ class Compatibility(unittest.TestCase):
         self.assertIn('Update or reinstall', result[0]['compatibility']['reason'])
         self.assertEqual(result[1]['compatibility']['status'], 'works')
 
+    def test_fileserver_old_copy_requires_https_address_update(self):
+        plugin = next(p for p in json.loads(compatibility.DATA.read_text())['plugins'] if p['id'] == 60)
+        old = dict(storeId=60, version=plugin['version'], sha256=plugin['sha256'],
+                   compatShims=['deckyfileserver-user-native'])
+        updated = dict(old, compatShims=['deckyfileserver-user-native', 'deckyfileserver-https-address'])
+        result = frame_decky.status(lambda *a, **k: json.dumps({'plugins': [old, updated]}))['plugins']
+        self.assertIn('Update or reinstall', result[0]['compatibility']['reason'])
+        self.assertNotIn('Update or reinstall', result[1]['compatibility']['reason'])
+        self.assertEqual([p['compatibility']['status'] for p in result], ['partial', 'partial'])
+
     def test_missing_audit_data_is_unverified(self):
         with patch.object(compatibility, 'DATA', Path('/nonexistent/framey-audit.json')):
             self.assertEqual(compatibility.lookup(12, 'a'*64, '1.0')['status'], 'unverified')

tests/test_framey_decky_runtime.py

@@ -21,7 +21,7 @@ class RuntimeCoverage(unittest.TestCase):
             self.assertIn(case['id'], official)
             self.assertIn(case['probe'], ('mpris', 'screenshots', 'system-monitor', 'timer-lifecycle',
                                          'toggle-settings', 'fileserver', 'localsend', 'network-sentinel',
-                                         'battery-tracker'))
+                                         'battery-tracker', 'free-loader'))
 
     def test_new_shim_without_runtime_case_fails_coverage(self):
         import frame_decky_store

tests/test_smoke_cleanup.py

@@ -134,7 +134,7 @@ class Safety(unittest.TestCase):
         launch.assert_called_once_with(gid)
         remove.assert_called_once_with(gid)
 
-    def test_optional_runtime_skip_is_counted_separately_in_saved_result(self):
+    def test_optional_runtime_skip_fails_gate_and_is_counted_in_saved_result(self):
         with tempfile.TemporaryDirectory() as root:
             output = Path(root) / 'results'
             folder = Path(root) / 'titles'
@@ -156,7 +156,7 @@ class Safety(unittest.TestCase):
                  mock.patch.object(frame_smoke, 'title_cycle', side_effect=cycle), \
                  mock.patch.object(frame_smoke.tempfile, 'mkdtemp', return_value=str(folder)):
                 self.assertEqual(frame_smoke.run_smoke(mock.Mock(pair=False),
-                                 {'activity': 3, 'proximity': [], 'battery': [100]}), 0)
+                                 {'activity': 3, 'proximity': [], 'battery': [100]}), 1)
             result = json.loads(next(output.glob('*-fake.json')).read_text())
             self.assertEqual((result['passed'], result['skipped'], result['failed']), (6, 1, 0))
             self.assertEqual(next(s for s in result['steps'] if s['step'] == 'x86_64: launch')

ui/frame_decky_store.py

@@ -385,7 +385,38 @@ try:
                 new='            if "disable_thumbnails" in status:\n                await Plugin.set_disable_thumbnails(self, status["disable_thumbnails"])\n            if "server_running" in status:\n                await Plugin.set_server_running(self, status["server_running"])'
                 if old not in text: raise RuntimeError('DeckyFileServer start configuration changed')
                 source.write_text(text.replace(old,new))
+                # The helper always calls ListenAndServeTLS. The published panel
+                # prints HTTP when uploads are disabled and hard-codes a Deck
+                # hostname that the Frame does not provide. Keep only the
+                # actual address returned by this backend.
+                frontend=unpacked/'dist/index.js'
+                original=frontend.read_bytes()
+                if hashlib.sha256(original).hexdigest()!='791015d8b3f234fad89ce422b09fb32bbad05e7c867d501706cfbcf9f7c6187f':
+                    raise RuntimeError('DeckyFileServer frontend source changed')
+                bundle=original.decode('utf-8')
+                old_url="""            window.SP_REACT.createElement(DFL.Field, { inlineWrap: "shift-children-below", label: "Server Address", bottomSeparator: "none" },
+                "http",
+                state.allow_uploads ? "s" : "",
+                "://steamdeck:",
+                state.port),
+            window.SP_REACT.createElement(DFL.Field, { inlineWrap: "shift-children-below" },
+                "http",
+                state.allow_uploads ? "s" : "",
+                "://",
+                state.ip_address,
+                ":",
+                state.port),
+"""
+                new_url="""            window.SP_REACT.createElement(DFL.Field, { inlineWrap: "shift-children-below", label: "Server Address", bottomSeparator: "none" },
+                "https://",
+                state.ip_address,
+                ":",
+                state.port),
+"""
+                if bundle.count(old_url)!=1: raise RuntimeError('DeckyFileServer address UI changed')
+                frontend.write_text(bundle.replace(old_url,new_url),encoding='utf-8')
                 compat_shims.append('deckyfileserver-user-native')
+                compat_shims.append('deckyfileserver-https-address')
             # Simple Timer 1.0.0 has annotation-only task state, orphaned
             # replacement tasks and canceled deadlines that resume on restart.
             # Preserve its API1 instance convention and upstream license.

ui/framey-compatibility.json

@@ -3903,14 +3903,15 @@
         "https://github.com/safijari/Shotty"
       ],
       "status": "partial",
-      "reason": "The frontend starts with the read-only Frame library snapshot. Frame Control adds a digest-scoped click.get_app_dir compatibility module to the managed install; the exact backend then imports and copies a synthetic Steam screenshot into a temporary Pictures folder in isolated Python. Actual Decky 3.3.0 ARM64 loading, live screenshots/rescue, in-VR panel and physical controller use remain unverified.",
+      "reason": "The frontend starts with the read-only Frame library snapshot. The exact-digest click.get_app_dir shim lets actual Decky 3.3.0 in isolated amd64 and ARM64 containers discover Shotty and complete empty screenshot RPCs; isolated Python also copied a synthetic screenshot into a temporary Pictures folder. The managed backend on the real Frame, live screenshots/rescue, in-VR panel and physical controller use remain unverified.",
       "blockInstall": false,
       "verification": [
         "static archive",
         "local browser",
         "fake-Frame",
         "real Frame SSH",
-        "isolated Python backend"
+        "isolated Python backend",
+        "isolated Decky 3.3.0 amd64/ARM64 empty backend RPCs"
       ],
       "browser": {
         "id": 53,
@@ -3943,11 +3944,12 @@
         "frontendReady": true
       },
       "backendFollowUp": {
-        "evidence": "docs/evidence/framey-shotty-python-2026-10-26.md",
-        "mode": "exact archive managed transaction and isolated Python import/copy with temporary HOME",
+        "evidence": "docs/evidence/framey-shotty-native-2026-10-28.md",
+        "mode": "exact archive managed transaction, isolated Python copy, and actual Decky 3.3.0 amd64/ARM64 discovery with empty backend RPCs",
         "compatShim": "shotty-click-app-dir",
         "syntheticScreenshotCopied": true,
-        "actualDeckyArm64": false
+        "actualDeckyArm64": true,
+        "actualFrameBackend": false
       }
     },
     {
@@ -4349,7 +4351,7 @@
         "https://github.com/grimkor/DeckyFileServer"
       ],
       "status": "partial",
-      "reason": "Managed install supplies a native ARM64 helper and removes the exact archive's unnecessary root request. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. Frontend address/picker limitations remain; use HTTPS and a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. Shared Toggle value rendering is repaired; other listed blockers remain.",
+      "reason": "Managed install supplies a native ARM64 helper, removes the exact archive's unnecessary root request, and displays the backend-returned IP with HTTPS. Real Decky 3.3.0 on Frame passes private read-only HTTPS listing/download and upload denial. The Steam folder picker remains unavailable; use a preconfigured directory. Uploads, generated thumbnails and worn VR are unverified. Existing managed copies need update or reinstall for the address fix.",
       "blockInstall": false,
       "verification": [
         "static archive",
@@ -4385,7 +4387,8 @@
         "reason": "ValueError: Root plugins are not supported by the Frame user service"
       },
       "requiredShims": [
-        "deckyfileserver-user-native"
+        "deckyfileserver-user-native",
+        "deckyfileserver-https-address"
       ],
       "managedNative": {
         "shim": "deckyfileserver-user-native",
@@ -4703,14 +4706,15 @@
         "https://github.com/jwhitlow45/free-loader.git"
       ],
       "status": "partial",
-      "reason": "The exact archive's duplicate names contain identical bytes and differ only in execute bits; the guarded installer now accepts them, and a private local install/remove transaction passed. The current opaque Chromium host renders Free Games but cannot load deals with backend/network denied. Exact official Python settings and empty local-deals methods passed in a no-network container with a Decky stub. Real Decky, feed refresh, notifications and worn VR remain unverified.",
+      "reason": "The exact archive's byte-identical duplicate ZIP members pass guarded install/remove. Actual Decky 3.3.0 in private network-isolated amd64 and ARM64 containers discovers the plugin, reads default settings and empty local deals, and retains a settings change after restart. Live deal-feed refresh, notifications, Steam store integration, real Frame ARM64 service and worn VR remain unverified; no feed request was made.",
       "blockInstall": false,
       "verification": [
         "static archive",
         "local browser",
         "fake-Frame pinned install/remove",
         "local exact-archive transaction",
-        "isolated Python backend"
+        "isolated Python backend",
+        "isolated Decky 3.3.0 amd64/ARM64 backend"
       ],
       "browser": {
         "id": 63,
@@ -5177,7 +5181,7 @@
         "https://github.com/safijari/steam-deck-battery-tracker.git"
       ],
       "status": "partial",
-      "reason": "Exact managed install removes the unnecessary root flag, selects a readable Battery-type power supply, and repairs empty history and per-app sample grouping. Actual Decky 3.3.0 amd64 recorded Frame-shaped private battery samples and returned history/power data. A locked real Frame read verified the required sysfs fields, not the managed plugin. Live ARM64 recording, long-term battery history, foreground-app labeling, panel controls and worn VR remain unverified; existing copies need update or reinstall.",
+      "reason": "Exact managed install removes the unnecessary root flag, selects a readable Battery-type power supply, and repairs empty history and per-app sample grouping. Actual Decky 3.3.0 in isolated amd64 and ARM64 containers recorded Frame-shaped private battery samples and returned history/per-app power. A locked real Frame read verified the required sysfs fields, not the managed plugin. Real Frame ARM64 recording, long-term history, foreground-app labeling, panel controls and worn VR remain unverified; existing copies need update or reinstall.",
       "blockInstall": false,
       "requiredShims": [
         "battery-tracker-user-supply"
@@ -5186,7 +5190,7 @@
         "static archive",
         "local browser",
         "fake-Frame",
-        "isolated Decky amd64 backend",
+        "isolated Decky 3.3.0 amd64/ARM64 backend",
         "real Frame read-only sysfs"
       ],
       "browser": {
@@ -9974,7 +9978,7 @@
         "https://github.com/SteamDeckHomebrew/decky-loader"
       ],
       "status": "partial",
-      "reason": "Exact managed install removes the unnecessary root flag and adds pinned plugin-local psutil wheels. Actual Decky 3.3.0 amd64 in network isolation loads the backend and records a network sample; private settings and read-only RPCs pass. External ping/DNS, real Frame ARM64, Wi-Fi scan behavior, panel controls and worn VR remain unverified. Existing copies need update or reinstall.",
+      "reason": "Exact managed install removes the unnecessary root flag and adds pinned plugin-local psutil wheels. Actual Decky 3.3.0 in isolated amd64 and ARM64 containers loads the backend and records a private network sample; settings and read-only RPCs pass. External ping/DNS, real Frame ARM64 backend, Wi-Fi scan behavior, panel controls and worn VR remain unverified. Existing copies need update or reinstall.",
       "blockInstall": false,
       "requiredShims": [
         "network-sentinel-user-psutil"
@@ -9983,7 +9987,7 @@
         "static archive",
         "local browser",
         "fake-Frame",
-        "isolated Decky amd64 backend"
+        "isolated Decky 3.3.0 amd64/ARM64 backend"
       ],
       "browser": {
         "id": 114,