Record test-only main merge in v0.4.43 candidate

Merge remote-tracking branch 'origin/main' into release/v0.4.43
Merge pull request #310 from saphid/fix/windows-wireless-live-retry
2026-10-26 12:02:05 +01:00 · 2026-10-26 08:10:20 +00:00 · 2026-10-26 08:09:54 +00:00 · 2026-10-26 08:09:31 +00:00 · 2026-10-26 08:05:12 +00:00 · 2026-10-26 08:03:32 +00:00
44 changed files with 5059 additions and 128 deletions
@@ -1,12 +1,12 @@
 {
  "name": "frame-control",
-  "version": "0.4.41",
+  "version": "0.4.43",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "frame-control",
-      "version": "0.4.41",
+      "version": "0.4.43",
      "license": "MIT",
      "devDependencies": {
        "electron": "^44.4.5",
@@ -1,7 +1,7 @@
 {
  "name": "frame-control",
  "productName": "Frame Control",
-  "version": "0.4.41",
+  "version": "0.4.43",
  "description": "Desktop app for managing a Valve Steam Frame over SSH",
  "private": true,
  "main": "main.js",
@@ -1,11 +1,11 @@
 # What we have tested

-Release baseline: Frame Control **v0.4.40**, 26 October 2026. Rows also identify verified post-release main changes explicitly. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.
+Release baseline: Frame Control **v0.4.41**, 26 October 2026. Rows also identify verified post-release main changes explicitly. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.

 | Feature | Real Frame + physical PC tested | VM only | Untested or limited | Last check and proof |
 |---|---|---|---|---|
-| Mac desktop release — tested on a real Mac | Physical MacBook Air (MacBookAir9,1), Intel Core i3, macOS 15.7.7 (24G720): official v0.4.39 x64 DMG verified, installed and launched. Native UI, preference persistence across restart (original file restored), bundled Python logs, update check, offline OBS Start/Stop and 116-entry Decky store checked. A 40-byte relay upload/readback/delete passed under coordinator/headset locks | No | No quarantined Safari/Chrome download or Gatekeeper override test; native Open at Login/menu automation unavailable. Direct frame.local had no route and the app refused a stale SSH identity. Relay transfer is not native Mac transfer acceptance. Real OBS/Framey VR unverified. Quit exposed a server cleanup race; fix #284 shipped in v0.4.40 with physical-Mac source regression coverage, but the tagged Intel installer was not launched on physical Intel hardware | 26 Oct, official v0.4.39 tag `fd0b0a9`: [Intel release evidence](evidence/mac-v0439-2026-10-26.md); [earlier ARM64 failure](evidence/mac-desktop-2026-10-26.md) |
-| Core title smoke test | Linux lxso2 ran the exact v0.4.40 tagged source against the real Frame; all 13 reserved native/Proton title steps passed and cleanup completed | No | The headset was unworn; visible rendering and controller input were not checked. Other feature paths retain their separate limits below | 26 Oct, exact v0.4.40 tag `a4d8073`, Frame OS 0.5.6 build `20261022.6153909`: [tagged release evidence](evidence/v0440-release-2026-10-26.md); [earlier candidate smoke](evidence/v0440-candidate-frame-2026-10-26.md) |
+| Mac desktop release — tested on a real Mac | Physical MacBook Air (MacBookAir9,1), Intel Core i3, macOS 15.7.7 (24G720): official v0.4.39 x64 DMG and ZIP hashes/architectures verified; clean DMG app installed and launched. Native UI, preferences across restart, update discovery of 0.4.40, offline OBS Start/Stop and 116-entry Decky store checked. Actual Open at Login menu toggled on, persisted across Quit/relaunch, then restored off. A 54-byte relay upload/readback/delete passed under coordinator/headset locks | No | Ordinary browser quarantine, right-click Open and Open Anyway remain unverified; the synthetic quarantine probe was inconclusive. Actual login startup untested. Direct frame.local had no route and app SSH trust failed; relay transfer is not native Mac transfer acceptance. Real OBS/Framey VR unverified. Earlier shutdown race fix #284 shipped in v0.4.40, whose Intel installer was not tested here | 26 Oct, official v0.4.39 tag `fd0b0a9`: [repeat Intel acceptance evidence](evidence/intel-mac-v0.4.39-2026-10-26.md); [earlier release test](evidence/mac-v0439-2026-10-26.md) |
+| Core title smoke test | Linux lxso2 ran the exact v0.4.41 tagged source against the real Frame; 13/13 reserved title steps passed and cleanup completed | No | The headset was unworn; visible rendering and controller input were not checked. Optional Steam Linux Runtime 4 was absent, so the x86_64 test executable did not actually launch. Other feature paths retain their separate limits below | 26 Oct, exact v0.4.41 tag `b5d50a8`, Frame OS 0.5.6 build `20261022.6153909`: [tagged release evidence](evidence/v0441-release-2026-10-26.md); [earlier candidate smoke](evidence/v0441-candidate-frame-2026-10-26.md) |
 | Windows desktop in the headset | No physical Windows PC test | Windows 11 VM sent a whole desktop to a real Frame; this used an intermediate fix, not the final native DLL | Physical GPU, capture and controller input; individual windows unavailable in bundled DXGI build | 24 Oct, v0.4.10 installer + candidate fix: [VM log](evidence/windows-vm-2026-10-24.md), [PC guide](pc-in-headset.md) |
 | Linux desktop in the headset | No | No | Native Linux PC capture is disabled; lxso2 lacked a desktop portal and PipeWire session. The separate Steam `-pipewire` helper is not Frame Control's PC capture | 24 Oct, v0.4.17: [host audit](evidence/linux-pc-host-lxso2-2026-10-24.md), [Steam helper PR #163](https://github.com/saphid/frame-control/pull/163) |
 | Mac desktop in the headset | A physical Mac sent its screen/window to a real Frame | No | Current v0.4.26 Mac installer and worn-headset controller input have not been repeated | 28 Sep, pre-v0.4 / Frame OS 0.4.1: [Mac guide and measurement](streaming.md#b-show-the-macs-desktop-inside-the-frame) |
@@ -21,10 +21,10 @@ Release baseline: Frame Control **v0.4.40**, 26 October 2026. Rows also identify
 | Backup and restore after reset | Same-headset backup, no-op save restore and Return to Game Mode checks | No | Restore **after a factory reset**, replacement restore and Android data restore have not been tested on a headset. No headset reset was done | 24 Oct, v0.4.17: [backup guide](backup-and-recovery.md), [Return to Game Mode log](evidence/return-game-mode-packaged-2026-10-24.json) |
 | Android game backup import | F-Droid Basic APK with synthetic main and patch OBBs installed, transferred and read back on a real Frame | No | v0.4.30 restricted split-APK backup route has generated-fixture and existing merger tests only; no real split game or RE4 gameplay test | 20 Oct OBB headset check; 25 Oct, v0.4.30 split fixtures: [OBB device evidence](evidence/android-import/device.json), [split PR #206](https://github.com/saphid/frame-control/pull/206), [guide](android-backups.md) |
 | Passthrough in recordings | Real room pixels in OBS and a production MP4 after safe SteamVR wake | No | **Yes** for the checked 0.5.6 mirror. Raw cameras are not opened. Other games/modes and Steam clips may differ | 25 Oct: [validation](evidence/obs-validation-2026-10-25.md), [recording guide](recording.md#does-record-include-passthrough) |
-| Open at login | No Frame needed; Linux autostart file toggled on a physical Linux host with an isolated config directory | No | A full login session and physical Windows/macOS host login have not been checked; OS API calls were unit tested | 25 Oct, v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
+| Open at login | No Frame needed; official v0.4.39 on the physical Intel Air toggled the actual native menu on, retained its checkmark after Quit/relaunch and restored it off. Linux autostart file previously toggled on a physical Linux host with an isolated config directory | No | A full OS login session and physical Windows host login remain untested | 26 Oct, v0.4.39: [native Intel toggle evidence](evidence/intel-mac-v0.4.39-2026-10-26.md); Linux v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
 | Local Frame Control extensions | Example panel displayed live Frame status in a browser preview; the real Frame served a read-only example in the experimental headset panel | No | No wearer-visible extension view; third-party extensions and physical Windows/macOS extension folders untested | 25 Oct, v0.4.29: [PR #194](https://github.com/saphid/frame-control/pull/194), [PR #201](https://github.com/saphid/frame-control/pull/201), [extension guide](extensions.md) |
 | Experimental Frame Control SteamVR panel | Frame OS 0.5.6 registered and served the opt-in overlay. A later unattended check safely woke SteamVR and found the panel in stereo compositor and mirror captures; it removed its temporary service and restored power settings | No | No person wore the headset for that check. Physical controller input, scrolling, VR keyboard, comfort and legibility remain unverified. The large status view has browser and packaging checks, not a wearer review | 26 Oct, v0.4.29–0.4.40: [panel PR #201](https://github.com/saphid/frame-control/pull/201), [unattended evidence](evidence/framey-vr-2026-10-25/README.md), [post-#292 unworn sample exercise](evidence/v0440-release-2026-10-26.md#post-tag-292-panel-regression), [earlier standby-gated exercise](evidence/framey-vr-standby-gate-2026-10-26.md), [worn checklist](framey-vr-check.md) |
-| Experimental Decky Loader manager | Frame OS 0.5.6 ARM64 user-service install/status/update/remove and managed ProtonDB install/update/remove passed earlier. A private Decky 3.3.0 service returned read-only ProtonDB and Steam Status setting RPCs; a later locked check verified the official Notebook default drawing/save/reopen flow and Simple Timer backend events in local Chromium | No | The loader remains opt-in. Installs/updates reject an archive whose Decky name collides with another installed plugin before download and under the headset transaction lock; this safety path has host/fake Frame tests, not a new real-headset collision test. v0.4.40 classifies the 116 exact-version plugins as 1 works (Notebook default flow only), 49 partial, 55 broken and 11 not applicable. Post-tag PRs #289 and #293 give 3 works / 48 partial / 54 broken / 11 N/A on current main: TabMaster is partial, and Volume Mixer and Mixer work for tested per-app silent-stream volume control only. Deck Shelves moved to partial after its exact chunked frontend rendered settings in local Chromium; its backend and Steam Home shelves remain unverified. Steamback, PlayTime and Deck Settings became partial after detached read-only library/user snapshots and isolated amd64 backend checks; their official ARM64 backends, automatic behavior and VR panels remain unverified. A read-only Steam bridge returned the Frame country, install folders and system information; IsThereAnyDeal selected that country in local Chromium, but its deployed HTTP endpoint and deal lookup remain unverified. An isolated ARM64 LocalSend core answered its info endpoint, but the official x86-only plugin archive and file transfers remain blocked. Volume Mixer and Mixer controlled a named silent stream through real ARM64 Decky with independent Pulse readbacks; Volume Boost default-sink reads matched, but real writes were denied. Audible output, Bluetooth playback, internal-node controls and worn VR remain unverified. Most official backends and VR controls remain unverified. Physical controller use and wearer-visible official panels remain unverified | 26 Oct, v0.4.31–0.4.40: [managed store PR #208](https://github.com/saphid/frame-control/pull/208), [name-collision PR #269](https://github.com/saphid/frame-control/pull/269), [catalog PR #266](https://github.com/saphid/frame-control/pull/266), [backend event evidence](evidence/framey-events-backend-2026-10-26.json), [Steam read PR #274](https://github.com/saphid/frame-control/pull/274), [LocalSend evidence PR #275](https://github.com/saphid/frame-control/pull/275), [local audio evidence](evidence/framey-audio-backends-2026-10-26.md), [ARM64 audio evidence](evidence/framey-audio-arm64-2026-10-26.md), [post-release library evidence](evidence/framey-library-context-2026-10-26.md), [compatibility table](framey-compatibility.md) |
+| Experimental Decky Loader manager | Frame OS 0.5.6 ARM64 user-service install/status/update/remove and managed ProtonDB install/update/remove passed earlier. A private Decky 3.3.0 service returned read-only ProtonDB and Steam Status setting RPCs; a later locked check verified the official Notebook default drawing/save/reopen flow and Simple Timer backend events in local Chromium | No | The loader remains opt-in. Installs/updates reject an archive whose Decky name collides with another installed plugin before download and under the headset transaction lock; this safety path has host/fake Frame tests, not a new real-headset collision test. v0.4.41 classifies the 116 exact-version plugins as 3 works, 48 partial, 54 broken and 11 not applicable. Notebook works for its default flow; Volume Mixer and Mixer work for tested per-app silent-stream volume control only. TabMaster is partial. Deck Shelves moved to partial after its exact chunked frontend rendered settings in local Chromium; its backend and Steam Home shelves remain unverified. Steamback, PlayTime and Deck Settings became partial after detached read-only library/user snapshots and isolated amd64 backend checks; their official ARM64 backends, automatic behavior and VR panels remain unverified. A read-only Steam bridge returned the Frame country, install folders and system information; IsThereAnyDeal selected that country in local Chromium, but its deployed HTTP endpoint and deal lookup remain unverified. An isolated ARM64 LocalSend core answered its info endpoint, but the official x86-only plugin archive and file transfers remain blocked. Volume Mixer and Mixer controlled a named silent stream through real ARM64 Decky with independent Pulse readbacks; Volume Boost default-sink reads matched, but real writes were denied. Audible output, Bluetooth playback, internal-node controls and worn VR remain unverified. Most official backends and VR controls remain unverified. Physical controller use and wearer-visible official panels remain unverified | 26 Oct, v0.4.31–0.4.41: [managed store PR #208](https://github.com/saphid/frame-control/pull/208), [name-collision PR #269](https://github.com/saphid/frame-control/pull/269), [catalog PR #266](https://github.com/saphid/frame-control/pull/266), [backend event evidence](evidence/framey-events-backend-2026-10-26.json), [Steam read PR #274](https://github.com/saphid/frame-control/pull/274), [LocalSend evidence PR #275](https://github.com/saphid/frame-control/pull/275), [local audio evidence](evidence/framey-audio-backends-2026-10-26.md), [ARM64 audio evidence](evidence/framey-audio-arm64-2026-10-26.md), [post-release library evidence](evidence/framey-library-context-2026-10-26.md), [compatibility table](framey-compatibility.md) |
 | Experimental Framey VR plugin panels and store | Unattended Frame OS 0.5.6 runs showed the Framey sample panel in stereo compositor and mirror captures. The latest standby-gated exercise restored the original power settings and released its shared lock. Synthetic OpenVR clicks changed a live sample setting, read its Decky backend file and confirmed it after a fresh iframe reopen | No | This was the repository sample, not an official store plugin. Physical controllers, native scrolling, VR keyboard, wearer comfort and legibility remain unverified. CSS Loader and SteamGridDB exact archives passed fake Frame install/remove and panel packing; this does not establish theme or artwork controls in VR. Panel-local backend events and React toasts have local/real-backend checks, but no wearer review. Pause Games and Tailscale Control settings render in local Chromium; their live actions are unverified. The 116-plugin catalog had 60 fake installs/removals and 56 expected blocks; v0.4.40 recorded 101 local Chromium initializers ready and 15 failed, up from 98/18 in v0.4.39. Notebook is marked works only for its default drawing/save/reopen flow | 26 Oct, v0.4.38–0.4.40: [post-#294 unworn sample and scroll evidence](evidence/framey-scroll-probe-2026-10-26.md#post-294-exact-main-sample-check), [backend event PR #270](https://github.com/saphid/frame-control/pull/270), [settings/cache PR #271](https://github.com/saphid/frame-control/pull/271), [post-release sample exercise](evidence/v0439-release-2026-10-26.md#post-release-framey-library-change-282), [worn checklist](framey-vr-check.md) |

 Release notes must preserve these limits until a newer recorded check changes them. When a feature is retested, add its date, exact app/Frame version, host type and proof here. The older [v0.3.1 matrix](support-matrix.html) is a historical snapshot and does not describe current coverage.
@@ -0,0 +1,11 @@
+# Framey receipt guard, unworn Frame exercise (26 October 2026)
+
+The bounded `scripts/framey-vr-check.py --exercise` runner acquired `/tmp/frame-test.lock` with its own random owner before reading the real Frame. Its 05:26 UTC run used source commit `c2f94c242dac670e18259193311a7375f5a87942`. Preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. No wearer was confirmed.
+
+The temporary Frame Control dashboard overlay became visible to OpenVR. The stereo compositor image changed, and the `/dev/video99` mirror produced a frame. The sample settings panel displayed its stored off value, accepted a trusted synthetic OpenVR pointer event, saved on through the real Decky Python backend, read the setting from disk, and showed on after a fresh iframe reopen. The quick action read on. A native slider reached 50. Text entry used CDP after OpenVR focus. The runner exited 0 with `input.passed=true` and `compositorChanged=true`.
+
+The private capture files remain outside the repository at `/tmp/frame-pr301-unworn-vr-fixed/`. The before/after stereo SHA-256 values were `1683bf1dab70c1a0a1e8f313c8317dc04f992070b5b0de232de9008700130711` and `684a27eecf7bcbbc5308092ddbb1517c4596fb283e061e73dd6bb7f025954e8b`; the mirror frame SHA-256 was `5939149ea9c85fd2d86d3f8879c348f006c421a386bd66a93fe`. Room pixels are not committed.
+
+An earlier locked run at 05:24 UTC exposed a missing SHA-256 in the runner's temporary sample receipt: the new guard correctly asked to reopen the panel. Commit `c2f94c2` gives that sample a content digest; the second run passed. Both runs reported no cleanup errors, restored `power.pauseCompositorOnStandby=false` and `power.turnOffScreensTimeout=5`, removed their power recovery timers, and released only their own locks. Battery remained 99%.
+
+This is an **unworn sample-plugin result**. It does not prove wearer-visible pixels, physical controller input, native scrolling (the attempted scroll offset stayed 0), VR keyboard behavior, comfort, or any official Decky plugin's VR panel or backend. The hourly worn check remains enabled.
@@ -0,0 +1,101 @@
+# Running-game context and Discord Status, 2026-10-26
+
+Framey now projects running apps and the selected main app from Steam CEF into
+detached `SteamUIStore` / `DFL.Router` getters. It relays actual Steam lifetime
+callbacks while the panel is open. Public Steam CDN capsule URLs are projected
+for running apps; local artwork paths and URL query data never cross the bridge.
+The [machine-readable evidence](framey-running-context-2026-10-26.json) records
+the exact archives, fixtures, browser observations and cleanup results.
+
+| Plugin / scope | Result | Verification |
+| --- | --- | --- |
+| Discord Status 1.5.0 | **Broken → partial.** Disconnected panel renders; activity construction accepts the synthetic running game without the previous missing-store/artwork errors. | Exact unmodified official frontend in opaque Chromium iframe; backend/network denied. Actual official `is_connected` returns false in real Decky 3.3.0 ARM64, with no Discord IPC present. |
+| Pause Games | **Partial.** Running-list initialization reaches `pid_from_appid` for the synthetic game. | Local Chromium fixture; all backend calls, including settings writes and process actions, denied. |
+| Notebook | **Works for its previously verified default notebook scope.** Per-game context is now supplied, but real per-game selection remains unverified. | Synthetic game causes the official frontend to request `loadPage`; backend calls denied in this pass. Earlier default save/reopen ARM64 evidence remains separate. |
+| PlayTime | **Partial.** Running snapshots do not satisfy its private MobX observation. | Local Chromium explicitly logs that its running-app observer is unavailable. No automatic tracking claim. |
+| 14 other focused panels | Labels retained. Initialization alone does not establish backend functionality. | Exact frontends with synthetic nonempty running/library snapshots and backend/network denied; Game Sync still stops on the denied `get_config` read. |
+
+The bridge addresses a shared dependency detected in 34 official frontend
+bundles, including hardware-inapplicable plugins whose installation remains
+blocked. This is infrastructure coverage, not 34 working plugins. Catalog after
+this pass: **3 works / 49 partial / 53 broken / 11 N/A**.
+
+## Real Frame checks and cleanup
+
+Every device probe acquired the atomic `/tmp/frame-test.lock` and released only
+its matching owner. Read-only probes verified the actual RunningApps and
+MainRunningApp getter implementations, the lifetime API's object with an
+`unregister()` method, and a public `https://shared.steamstatic.com` capsule URL.
+
+A private removable user service ran the published Decky 3.3.0 ARM64 executable
+and the exact unmodified Discord Status 1.5.0 store archive. Production
+`framey_panel.call_method` returned false from `is_connected`. Production
+`poll_running` verified two empty running-list reads, an actual lifetime
+subscription and explicit close. The device had no running apps: **nonempty
+reads and launch/exit callbacks were not observed on hardware**. Decky startup
+reinjected its frontend/restarted Steam CEF. No plugin game, power, audio or process-control
+action was invoked, and no Discord connection/activity mutation was allowed.
+
+After close, CEF reported zero sessions and a null timer. The test service,
+unit and private base were removed. A fresh independently locked audit read
+`LoadState=not-found`, `ActiveState=inactive`, `MainPID=0`, absent paths and zero
+CEF sessions/timers. Battery stayed **99 → 99**; normal Decky stayed failed and
+the normal panel service stayed inactive. No headset wipe or system service
+installation was used.
+
+## Local verification and limits
+
+- Full current official store fetch: 116 IDs/versions/digests unchanged at
+  2026-10-26 05:18:22 UTC.
+- Fake Frame: 116 transport cases, 60 install/remove cycles and 56 expected
+  blockers; private Compose project and volumes removed. Plugin execution was
+  stubbed.
+- Full local Chromium sweep: 103 of 116 initializer-ready with explicitly
+  synthetic library/running data. No backend/network request was allowed.
+  The focused Discord Status observation lasted eight seconds and constructed
+  `Test Running Game` activity; the visible UI correctly remained disconnected.
+- Node contract tests cover actual-event queue projection, retry/deduplication,
+  bounds, expiry, unregister, reconnect, update-before-callback ordering,
+  invalid data, public-artwork filtering, stale sessions, overlapping reads,
+  failure clearing stale state and late replies after close. Nonempty app rows
+  and launch/exit notifications in these tests are explicit synthetic fixtures.
+
+The queue retains at most 64 real notifications per session; overflow can lose
+old callbacks. Polling runs about every two seconds with no overlap. At most four
+CEF sessions survive; unreachable cleanup expires after 15 seconds, checked
+every five seconds. The bridge does not implement private MobX internals,
+suspend/input events, game actions or closed-panel automation.
+
+Discord shortcut detection, real IPC connection/activity, local custom artwork,
+actual running-game transitions, worn VR and physical controller/keyboard use
+remain unverified. None of the new fixture checks promotes a plugin to works.
+
+After #301 merged, running polls and both close paths adopted its pinned SHA-256
+receipt guard. Local Python/Node tests verify the parent carries that receipt,
+missing/stale receipts are rejected before CEF after plugin replacement, and a
+reopened panel can poll and close with the new receipt. Rejected stale closes
+retain the tested finite-lease cleanup. This authorization-only follow-up did
+not repeat the device checks above; their recorded hardware scope is unchanged.
+
+## Post-merge unworn panel exercise
+
+On merged main `daee952873255b86018cce1d2a4d3bd070ec4341`,
+`scripts/framey-vr-check.py --exercise --output /tmp/framey-post304-exercise`
+acquired its own `/tmp/frame-test.lock` before any headset read. At 05:54 UTC,
+preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%.
+The temporary sample panel passed the real Decky setting save and fresh-iframe
+reopen, a trusted synthetic OpenVR pointer, quick action, slider value 50 and
+CDP text entry after OpenVR focus. Stereo compositor SHA-256 changed from
+`50fcab1ee25e6d9398106cc0c24ec6616e07bcf4573b52be1774c715b756060b`
+to `98241806fb1f775e7f4c5ef0b0564bfd3c552ee896ff225b4d0cb5b7b53f70d1`;
+the `/dev/video99` mirror capture hash was
+`c284c05f86b60362168c1d1f58fe775974b70ac54bbfd57834802b892eb4509e`.
+The command exited 0 with `passed=true`. The original power values (`false` and
+`5.000000`) were read back, battery remained 99%, the recovery timer was removed,
+cleanup errors were empty and the run released only its own lock. The private
+full report is `/tmp/framey-post304-exercise/result.json` on the test host.
+
+This exercise covered the sample panel path after the running-context merge. It
+did not observe a nonempty running-game list, a game lifetime callback, Discord
+activity, a worn display or physical controller input. Synthetic native scroll
+again did not move (`scrollTop=0`, no wheel event).
@@ -0,0 +1,184 @@
+{
+  "checkedAtUtc": "2026-10-26T07:22:08.822239+00:00",
+  "plugin": {
+    "id": 84,
+    "name": "Junk-Store",
+    "version": "1.1.13",
+    "sha256": "f7ad2a0103c85bf308929b2e96ec9aeeb0d76bcc6ae97eb1e4b5f31ffba0cbb1",
+    "license": "BSD-3-Clause",
+    "sourceModified": false
+  },
+  "installer": {
+    "beforeScriptMode": "0644",
+    "afterScriptMode": "0744",
+    "policy": "Add owner execute for a shebang or ZIP-declared executable; do not restore archive privilege/write bits. Existing installs require update or reinstall."
+  },
+  "isolatedBackend": {
+    "runtime": "published Decky 3.3.0 amd64",
+    "loaderSha256": "e80d03e641d1766a33a817cb27ab8d2e0a4633685e5d27e4de948a6687526181",
+    "isolation": [
+      "unprivileged",
+      "no network",
+      "no devices",
+      "no capabilities",
+      "read-only root",
+      "private tmpfs home and tmp"
+    ],
+    "beforeInit": {
+      "result": {
+        "Type": "Error",
+        "Content": {
+          "Message": "Error parsing json result Expecting value: line 1 column 1 (char 0)",
+          "Data": "",
+          "ActionName": "init",
+          "ActionSet": "init"
+        }
+      },
+      "success": true
+    },
+    "afterInit": {
+      "result": {
+        "Type": "Success",
+        "Content": {
+          "Message": "Initialized"
+        }
+      },
+      "success": true
+    },
+    "beforeInitActions": {
+      "result": {
+        "Type": "Error",
+        "Content": {
+          "Message": "Error parsing json result Expecting value: line 1 column 1 (char 0)",
+          "Data": "",
+          "ActionName": "InitActions",
+          "ActionSet": "init"
+        }
+      },
+      "success": true
+    },
+    "afterInitActions": {
+      "outerSuccess": true,
+      "innerType": "ActionSet",
+      "setName": "MainMenu",
+      "actionCount": 4
+    }
+  },
+  "realFrame": {
+    "os": "Frame OS 0.5.6",
+    "arch": "aarch64",
+    "uid": 1000,
+    "decky": {
+      "version": "v3.3.0",
+      "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+    },
+    "transport": "existing trusted SSH via lxso2",
+    "sharedLock": true,
+    "service": "private removable user service; not enabled; RuntimeMaxSec=600",
+    "installedWithProductionApply": true,
+    "scriptMode": "0o744",
+    "legendaryInstalled": false,
+    "backendMethods": [
+      "execute_action",
+      "get_websocket_port"
+    ],
+    "staticActions": [
+      "JunkStoreActions/GetContent",
+      "JunkStoreActions/GetEpicActions",
+      "MainMenu/GetContent",
+      "MainMenu/JunkStoreInit",
+      "init/InitActions"
+    ],
+    "websocketPort": 8765,
+    "websocketCommandsSent": false,
+    "librarySnapshotCounts": {
+      "apps": 1106,
+      "games": 895
+    },
+    "explicitInitActionInvoked": false,
+    "normalDeckyBeforeAfter": [
+      "inactive",
+      "inactive"
+    ],
+    "normalPanelBeforeAfter": [
+      "inactive",
+      "inactive"
+    ],
+    "batteryBeforeAfter": [
+      [
+        99
+      ],
+      [
+        100
+      ]
+    ],
+    "powerSettingChanged": false,
+    "cleanup": {
+      "baseAbsent": true,
+      "unitAbsent": true
+    },
+    "lockReleased": true
+  },
+  "localBrowser": {
+    "runtime": "local Chromium, real headset.html/framey-host.js, vendored React, official frontend in opaque iframe",
+    "backend": "production receipt-bound bridge to actual ARM64 backend",
+    "steamLibrary": "production receipt-bound GetLibrarySnapshot; only counts retained",
+    "outerStatusInstallResponses": "fixtures",
+    "passed": [
+      "Custom Stores main menu and Games/News/About navigation items render",
+      "Games route opens static Epic tab",
+      "Back returns to main menu",
+      "close/reopen returns to main menu"
+    ],
+    "remainingFailure": "About: Cannot read properties of undefined (reading 'installed'); detached app overview lacks local_per_client_data.installed",
+    "deniedActions": [
+      "fetch_rss_feed",
+      "EpicActions/GetContent"
+    ],
+    "denialIsNotBackendFailure": true
+  },
+  "cleanupAudit": {
+    "attempts": 3,
+    "allPrivateBasesAbsent": true,
+    "allPrivateUnitsAbsent": true,
+    "allArchivesAbsent": true,
+    "allServicesInactive": true,
+    "freshAuditLockReleased": true
+  },
+  "verification": {
+    "python": {
+      "run": 1628,
+      "skipped": 16,
+      "failures": 0
+    },
+    "site": {
+      "passed": 18
+    },
+    "focusedStore": {
+      "passed": 19
+    },
+    "fakeFrame": {
+      "blocked": 56,
+      "installed-removed": 60
+    },
+    "officialStore": {
+      "plugins": 116,
+      "errors": 0,
+      "identitySetUnchanged": true,
+      "checkedAtUtc": "2026-10-26T07:22:17.371046+00:00"
+    },
+    "staticEntrypointArchives": 28
+  },
+  "unverified": [
+    "Legendary dependency installation",
+    "Epic login",
+    "game listing",
+    "game downloads or launch",
+    "RSS feed",
+    "Steam shortcut mutation",
+    "optional websocket operations",
+    "deployed headset HTTP endpoint",
+    "worn VR"
+  ],
+  "status": "partial"
+}
@@ -0,0 +1,76 @@
+# Executable script entrypoints: Junk-Store
+
+Junk-Store 1.1.13 (official ID 84) moves **broken → partial**. The exact unmodified
+BSD-3-Clause archive is pinned in the [redacted results](framey-script-entrypoints-2026-10-26.json).
+No ARM64 rebuild or upstream plugin source patch was needed.
+
+Python ZIP extraction drops execute permissions. This archive also publishes its
+shebang scripts as 0644, relying on upstream Decky's recursive permission setup.
+Framey's user service disables that setup. Direct script calls therefore fail.
+The installer now adds **owner execute only** to shebang scripts or ZIP-declared
+executables. It does not restore archive privilege/write bits, grant group/other
+execute, or change unmarked data permissions. Archive validation and installation
+blocks remain in place. Existing installations need update/reinstall for repair.
+
+The upstream comparison is Decky 3.3.0's
+[permission setup](https://github.com/SteamDeckHomebrew/decky-loader/blob/v3.3.0/backend/decky_loader/browser.py)
+and [Linux implementation](https://github.com/SteamDeckHomebrew/decky-loader/blob/v3.3.0/backend/decky_loader/localplatform/localplatformlinux.py).
+Static inspection found 28 accepted official archives with shebang or declared
+executable members. This is shared installer coverage, not 28 functional claims.
+
+## Before and after in an isolated real backend
+
+Both runs used the exact official plugin and published Decky 3.3.0 amd64, with no
+network/devices/capabilities, a read-only root and private temporary home/tmp.
+The only difference was the production installer before/after this change.
+
+| Check | Before | After |
+| --- | --- | --- |
+| `scripts/get-json.py` | 0644 | 0744 |
+| `execute_action(init, init)` | inner `Type:Error`, empty output / JSON parse error | `Type:Success`, `Initialized` |
+| `execute_action(init, InitActions)` | inner `Type:Error` | `Type:ActionSet`, `MainMenu`, four actions |
+
+The legacy wrapper reports `success:true` even for the failing inner error.
+Startup log text alone is also insufficient: the baseline emits initialized/started
+messages despite those errors. Both private containers were removed.
+
+## Real ARM64 Frame and local Chromium
+
+Under the shared headset lock, the patched production installer installed the
+official archive into a private, bounded, removable Decky 3.3.0 ARM64 user service
+on Frame OS 0.5.6. The service was not enabled. Legendary was absent before and
+after; no dependency installer, login, download, launch or websocket command ran.
+
+The production receipt-bound bridge called the actual backend through live Steam
+CEF. Static action sets, main-menu content and the Epic action set returned real
+results. `get_websocket_port` returned 8765. Explicit `init/init` success was tested
+in the isolated amd64 backend; it was not explicitly invoked in the final Frame run.
+
+Local Chromium ran the actual Framey host and official frontend in an opaque
+iframe, relaying only allowed static calls to that ARM64 backend. Main menu,
+Games → static Epic tab, Back and fresh close/reopen passed. Steam library reads
+used the production receipt-bound bridge; only counts were retained. Outer
+status/install responses were fixtures, and the deployed headset HTTP endpoint
+was not tested.
+
+The About route still crashes on missing `local_per_client_data.installed` in
+the detached app overview. Epic game-list and RSS calls were deliberately denied;
+their loading/error views do not demonstrate backend failure. Dependency
+installation, login, game operations, RSS, Steam shortcut mutation and worn VR
+remain unverified. This supports **partial**, not works.
+
+Three temporary attempts were cleaned, including an initial Steam reinjection
+readiness failure and a test-relay omission of the library endpoint. A fresh
+shared-lock audit found all three services inactive/unloaded (PID 0), with their
+private bases, unit files and archives absent. Normal managed Decky/panel services
+stayed inactive; final battery was 99 → 100 while charging. No power-setting action
+ran. The audit lock was released, and local relays/browser tabs were closed.
+
+## Verification
+
+- Python suite: 1,628 tests, 16 skipped, no failures; store suite: 19 passed.
+- Site suite: 18 passed. Two new regression tests failed before the fix.
+- All 116 official plugins: fake-Frame 60 installed/removed, 56 expected blocks;
+  no actual plugin backends run by this harness. Disposable project cleaned.
+- Fresh official-store audit: 116 plugins, zero errors; ID/version/digest set
+  matches the catalog. Other plugin statuses are unchanged.
@@ -0,0 +1,405 @@
+{
+  "baseCommit": "daee952873255b86018cce1d2a4d3bd070ec4341",
+  "plugin": {
+    "id": 58,
+    "name": "Volume Boost",
+    "version": "0.0.7",
+    "sha256": "2cc576a7f60751306d690268e227df626e59d3733680ced753de4c116629a9cc"
+  },
+  "runtime": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6",
+    "os": "Frame OS 0.5.6",
+    "arch": "aarch64"
+  },
+  "verificationLimits": {
+    "fakeFrame": "Prior exact archive HTTP/SSH install/receipt/removal; plugin execution stubbed, not repeated",
+    "localBrowser": "Actual headset.html, React and Framey host, exact unmodified official frontend in opaque iframe; direct RPC relay to actual ARM64 backend",
+    "realFrameSSH": "Production receipt-bound framey_panel.call_method over SSH and live Steam CEF DeckyBackend.call into actual Decky 3.3.0 ARM64 plugin; default speaker sink remained muted throughout",
+    "wornVR": "Not tested",
+    "audibleOutput": "Not tested; gain writes and readbacks only",
+    "deployedHTTP": "Not tested; outer status/install/check responses were fixtures, methods used production call_method with exact current receipt"
+  },
+  "catalogRefresh": {
+    "checkedAtUtc": "2026-10-26T06:10:58.537029+00:00",
+    "plugins": 116,
+    "changedIdsVersionsDigests": 0
+  },
+  "runs": [
+    {
+      "timeUtc": "2026-10-26T06:07:19.370988+00:00",
+      "locale": "LC_ALL=C for the private Decky service",
+      "originalSink": {
+        "mute": true,
+        "volumes": {
+          "front-left": 0,
+          "front-right": 0
+        }
+      },
+      "writes": [
+        {
+          "request": {
+            "value": 125,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 81920,
+              "front-right": 81920
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 125,
+              "success": true
+            },
+            "right": {
+              "result": 125,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 75,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 49152,
+              "front-right": 49152
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 75,
+              "success": true
+            },
+            "right": {
+              "result": 75,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 74,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 48496,
+              "front-right": 48496
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 74,
+              "success": true
+            },
+            "right": {
+              "result": 74,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 33,
+            "channel": "left"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 21626,
+              "front-right": 0
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 33,
+              "success": true
+            },
+            "right": {
+              "result": 0,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 67,
+            "channel": "right"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 0,
+              "front-right": 43909
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 0,
+              "success": true
+            },
+            "right": {
+              "result": 67,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        },
+        {
+          "request": {
+            "value": 33,
+            "channel": "right"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 0,
+              "front-right": 21626
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 0,
+              "success": true
+            },
+            "right": {
+              "result": 33,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        }
+      ],
+      "reads": [
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        },
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        }
+      ],
+      "reopen": "Fresh query/session, ready; UI returned to actual restored zero; no write on mount",
+      "before": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "after": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "cleanup": {
+        "baseAbsent": true,
+        "unitAbsent": true
+      },
+      "exactSinkRestored": true,
+      "lockReleased": true
+    },
+    {
+      "timeUtc": "2026-10-26T06:12:04.889613+00:00",
+      "locale": "Inherited user-service environment, matching production unit; no LANG or LC_ALL override",
+      "originalSink": {
+        "mute": true,
+        "volumes": {
+          "front-left": 0,
+          "front-right": 0
+        }
+      },
+      "writes": [
+        {
+          "request": {
+            "value": 150,
+            "channel": "both"
+          },
+          "result": {
+            "result": true,
+            "success": true
+          },
+          "independentPulseReadback": {
+            "mute": true,
+            "volumes": {
+              "front-left": 98304,
+              "front-right": 98304
+            }
+          },
+          "backendReadback": {
+            "left": {
+              "result": 150,
+              "success": true
+            },
+            "right": {
+              "result": 150,
+              "success": true
+            }
+          },
+          "guardArmedBeforeWrite": true,
+          "exactOriginalRestored": true
+        }
+      ],
+      "reads": [
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        },
+        {
+          "id": 58,
+          "method": "get_volume_state",
+          "args": [
+            {
+              "channel": "left"
+            }
+          ],
+          "result": {
+            "result": 0,
+            "success": true
+          }
+        }
+      ],
+      "reopen": "Fresh query/session, ready; UI returned to actual restored zero; no write on mount",
+      "before": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "after": {
+        "battery": [
+          100
+        ],
+        "uid": 1000,
+        "arch": "aarch64",
+        "decky": "inactive",
+        "panel": "inactive"
+      },
+      "cleanup": {
+        "baseAbsent": true,
+        "unitAbsent": true
+      },
+      "exactSinkRestored": true,
+      "lockReleased": true
+    }
+  ],
+  "guard": {
+    "scope": "Private test helper only; not a shipped feature or plugin patch",
+    "timeoutSeconds": 60,
+    "runtimeMaxSec": 120,
+    "sequence": [
+      "Capture exact default sink identity, native per-channel volume integers and original mute",
+      "Persist recovery state; start bounded device-side systemd watchdog before mute/write",
+      "Require stereo front-left/front-right and mute readback before plugin call",
+      "Only official get_volume_state/set_volume_state; value 0..150, known channels",
+      "Read native Pulse volume and mute independently; read both channels through actual plugin",
+      "Restore exact native volume while muted, verify, then restore original mute and verify exact snapshot",
+      "Remove recovery state, stop only own watchdog; cleanup own service/base and release matching lock"
+    ],
+    "automaticTimeoutExercised": false,
+    "explicitRestoreExercised": true
+  },
+  "freshCleanupAudit": {
+    "exactSinkRestored": true,
+    "baseAbsent": true,
+    "unitAbsent": true,
+    "services": {
+      "framey-boost-kp0z857q58-b4126054.service": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n",
+      "framey-boost-kp0z857q58-b4126054-guard.service": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n"
+    },
+    "battery": [
+      100
+    ]
+  },
+  "remaining": [
+    "Audible sound/quality, perceived loudness and physical speaker gain are unverified",
+    "Worn VR, headset controller input and Bluetooth sinks are unverified",
+    "No default route change, playback or power-setting action was invoked",
+    "Decky startup reinjects its frontend and can restart Steam CEF; normal managed services stayed inactive"
+  ],
+  "repositoryChecks": {
+    "python": "1,626 tests, 16 skips, no failures",
+    "site": "18 passed",
+    "catalogDocCheck": "passed",
+    "diffCheck": "passed"
+  }
+}
@@ -0,0 +1,96 @@
+# Volume Boost sink controls on the ARM64 Frame
+
+Volume Boost 0.0.7 (official store ID 58) now qualifies as **works for sink
+controls**. The exact official, unmodified Python backend ran in Decky 3.3.0
+ARM64 on Frame OS 0.5.6. Local Chromium rendered its official frontend through
+Framey's existing legacy bridge. Actual control changes reached the Frame's
+default speaker sink, including above-100% gain, with independent Pulse
+readbacks. The sink stayed muted; no audible-output or worn-VR claim is made.
+
+[Digest-pinned observations and cleanup](framey-volume-boost-arm64-2026-10-26.json)
+record both runs. This supersedes the Volume Boost read-only limitation in the
+[previous ARM64 audio check](framey-audio-arm64-2026-10-26.md). No plugin patch,
+native rebuild or new compatibility shim was necessary. Volume Boost's backend
+uses Python and the Frame's existing ARM64 `pactl`; its hard-coded UID 1000
+matches the actual Frame user.
+
+| Local Chromium action | Actual ARM64 result, independently read back |
+| --- | --- |
+| Linked numeric input 125% | Native Pulse channel values 81920 / 81920; plugin reads 125 / 125 |
+| Linked slider click, then ArrowDown | 75% then 74%; native values 49152 / 49152 then 48496 / 48496 |
+| Unlink, set left to 33% | Native values 21626 / 0; plugin reads 33 / 0 |
+| Set right to 67% | Native values 0 / 43909; plugin reads 0 / 67 |
+| Re-link | Official frontend issues a right-only 33% write; native values 0 / 21626 |
+| Close and reopen | New document/session, ready; backend reads and displayed linked value return to the restored 0%; no mount write |
+| Repeat linked numeric 150% with inherited service locale | Native values 98304 / 98304; plugin reads 150 / 150; reopen again reads restored zero |
+
+The test restores the original sink state after **each** write. Therefore the
+separate-channel checks intentionally begin from 0% / 0%, rather than from the
+previous UI value. A right-only re-link request is the published plugin's
+behavior. These checks verify channel selection and preservation of the other
+channel; they do not claim a continuous unmuted listening session. Pulse's
+integer conversion truncates fractional native values; the evidence retains
+those integers rather than replacing them with rounded percentages.
+
+## Runtime and transport
+
+Each run separately acquired the atomic `/tmp/frame-test.lock`; neither stole
+an existing lock. A unique private Decky user service used its own plugin,
+settings and runtime directories, was never enabled, and had an eight-minute
+runtime limit. The upstream ARM64 loader matched GitHub's published SHA-256
+and ELF machine 183. The plugin ZIP matched the official digest.
+
+The local relay served actual `ui/headset.html`, vendored React and
+`framey-host.js`, with exact official frontend bytes in an opaque
+`allow-scripts` iframe. Outer status/install/check responses were fixtures.
+Plugin calls used production `framey_panel.call_method`, including the current
+store receipt, SSH through lxso2, live Steam CEF and `DeckyBackend.call` into the
+actual plugin subprocess. Only the temporary install paths were redirected.
+This does not verify the deployed headset HTTP endpoint or a VR compositor.
+
+The first private service explicitly used `LC_ALL=C`. The second inherited the
+user-service locale without a `LANG` or `LC_ALL` override, matching the
+production service configuration, and repeated actual reads, a 150% write and
+reopen. Zero alone was not accepted as success: upstream returns zero on
+command failure. Every write returned true, both backend channel reads agreed,
+and independent native Pulse readbacks confirmed nonzero changes.
+
+## Bounded muted writes and restoration
+
+The default sink was already muted at native channel values 0 / 0. Before each
+plugin write, a private device-side helper captured the exact sink identity,
+channel values and mute state; persisted recovery state; and started a bounded
+60-second systemd watchdog. It then required a successful mute readback before
+allowing the plugin call. The relay allowed only `get_volume_state` and
+`set_volume_state`, known channels and values from 0 through 150.
+
+After the call, independent `pactl --format=json list sinks` and both plugin
+reads checked the result. In `finally`, the helper restored exact native
+channel values while muted, checked them, restored the original mute state,
+and verified the entire snapshot before removing recovery state and stopping
+its watchdog. No default route, playback, existing stream or power setting was
+changed. Automatic watchdog expiry was armed but not deliberately exercised;
+explicit restoration passed after all seven writes.
+
+Both private Decky services/bases were removed and their locks released.
+Fresh-lock cleanup audits found their Decky and guard units unloaded/inactive
+with PID 0, paths absent, and the exact original sink/mute restored. Battery
+stayed 100 → 100; normal managed Decky and headset-panel services stayed
+inactive. Decky startup reinjects its frontend and can restart Steam CEF.
+
+## Catalog and verification limits
+
+The canonical store catalog and generated table report **4 works / 48 partial /
+53 broken / 11 N/A**. A fresh full official-store fetch at 06:10:58 UTC found
+all 116 IDs, versions and digests unchanged. Historical fake-Frame checks cover
+this exact archive's install/receipt/removal with backend execution stubbed;
+that test was not repeated or relabelled as real-backend evidence.
+
+Audible gain, sound quality, physical speaker output, Bluetooth sinks,
+headset-controller input and worn VR remain unverified. The store row includes
+these limits. This change records new real-backend evidence and updates its
+compatibility classification; it changes no shipped audio implementation.
+
+The full server suite completed 1,626 tests with no failures (16 skips); all
+18 site tests passed. Generated-document consistency and `git diff --check`
+also passed. No implementation change followed those tests.
@@ -0,0 +1,48 @@
+# Official Web Browser 1.4.3 frontend follow-up
+
+The exact official Decky store archive for ID 59 is 91,859 bytes and matched
+SHA-256 `1192864fddc5d72550346b8dff02c21d71f0c40a06ac41c4e67bb6220d267f9d`.
+Its legacy bundle calls `deckyFrontendLib.getReactRoot` when attempting to patch
+Steam's main menu and search bar. The prior full-catalog audit recorded
+`getReactRoot is not a function` and initializer failure.
+
+Framey's isolated iframe has no Steam React root. The host now exposes
+`getReactRoot()` with a **null** result, consistent with its existing inert
+`findInReactTree()` lookup. It never returns a fabricated Steam tree or permits
+patching the user's Steam UI. The focused Node host test checks this contract.
+
+A focused local Chromium run used the verified archive through
+`scripts/framey-audit-browser.py`, with every backend method, fetch and
+WebSocket denied. The exact frontend reported `ready=true` with no initializer
+error after 2.5 seconds, and again during a longer ten-second observation.
+It attempted `set_main_tab` and `load`; the audit denied both. Console output
+reported that no Steam window or main-menu root was available. The panel did
+not show a usable browser view in the audited state.
+
+Static inspection of this archive's published Python backend shows
+`set_main_tab()` requesting a Steam GamepadUI CDP tab, then returning a key and
+port for its own WebSocket server. That Steam tab and browser injection path
+are outside Framey's isolated panel. No real plugin backend was executed, no
+browser tab or navigation was verified, and no real Frame or worn-VR check was
+performed for this change. The catalog retains **broken** for this digest; its
+reason and focused observation now distinguish successful initialization from
+the unresolved core browser dependency. The full 116-plugin browser baseline
+still refers to its earlier host commit; this is a one-plugin follow-up.
+
+## Unworn Framey regression gate
+
+The exact code commit `d5e62f643d462b7070f27c2c47b11b4aa9982094` ran
+`scripts/framey-vr-check.py --exercise` under its own shared-lock owner at
+07:26 UTC. Preflight found SteamVR activity 3 (standby), proximity 6.25 and
+battery 100%. The real Decky sample setting saved `enabled=true`, survived a
+fresh iframe, and the quick action read the saved value. A trusted synthetic
+OpenVR pointer, slider value 50, CDP text entry after focus and changed stereo
+compositor hashes passed. The mirror capture SHA-256 was
+`4f0d977fab7c144a3490b12ebefddacf3126db585057eb022006ffdf844a7498`.
+The command exited 0 with `passed=true`; original power settings (`false` and
+`5.000000`) were read back, battery ended at 99%, the recovery timer was
+removed, cleanup errors were empty and only its own lock was released. The
+private full report is `/tmp/framey-web-browser-vr-d5e62f6/result.json` on the
+test host. This verifies the sample-panel regression path, not the official
+Web Browser plugin or a worn headset. Synthetic native scroll still did not
+move.
@@ -0,0 +1,288 @@
+{
+  "release": "v0.4.39",
+  "tagCommit": "fd0b0a946f11d92fd1cc480cd9d1a83be795bf71",
+  "job": "1vbt29ptkw",
+  "date": "2026-10-26",
+  "host": {
+    "model": "MacBookAir9,1",
+    "cpu": "Intel Core i3-1000NG4",
+    "arch": "x86_64",
+    "macOS": "15.7.7",
+    "build": "24G720"
+  },
+  "artifacts": {
+    "Frame-Control-mac-x64.dmg": {
+      "bytes": 169230398,
+      "sha256": "f47b5a188b5090f97a72467394d4fa65ccc73fe3169a6276e2a32cab5c8019d8",
+      "matchesSHA256SUMS": true
+    },
+    "Frame-Control-mac-x64.zip": {
+      "bytes": 169141014,
+      "sha256": "bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7",
+      "matchesSHA256SUMS": true
+    }
+  },
+  "native": {
+    "title": "Apps \u00b7 Frame Control",
+    "bridge": true,
+    "preferencesBefore": {},
+    "views": [
+      {
+        "view": "apps",
+        "title": "Apps \u00b7 Frame Control",
+        "heading": [
+          "Apps"
+        ]
+      },
+      {
+        "view": "games",
+        "title": "Games \u00b7 Frame Control",
+        "heading": [
+          "Games"
+        ]
+      },
+      {
+        "view": "tools",
+        "title": "Tools \u00b7 Frame Control",
+        "heading": [
+          "Tools"
+        ]
+      },
+      {
+        "view": "settings",
+        "title": "Settings \u00b7 Frame Control",
+        "heading": [
+          "Settings"
+        ]
+      },
+      {
+        "view": "privacy",
+        "title": "Privacy & updates \u00b7 Frame Control",
+        "heading": [
+          "Privacy & updates"
+        ]
+      },
+      {
+        "view": "capture",
+        "title": "Capture \u00b7 Frame Control",
+        "heading": [
+          "Capture & Live"
+        ]
+      },
+      {
+        "view": "decky",
+        "title": "Decky Loader \u00b7 Frame Control",
+        "heading": [
+          "Decky Loader"
+        ]
+      }
+    ],
+    "decky": {
+      "state": "116 plugins in the official store. Select a plugin to install it.",
+      "rows": 40,
+      "search": "ProtonDB Badges \u00b7 1.3.4 Display tappable ProtonDB badges on your game pages\n\npartial: Settings render locally and read-only get_setting RPC returned the default through real Decky 3.3.0 on ARM64 Frame. Steam game-page badges have no patch target; live writes and VR controls unverified. Verified: static archive, local browser, fake-Frame, real Frame SSH.\n\nInstall",
+      "installDisabled": [
+        {
+          "text": "Install",
+          "disabled": true
+        }
+      ]
+    },
+    "preferenceWritten": "0",
+    "preferencesAfter": {
+      "mvSeparate": "0"
+    },
+    "update": {
+      "status": "available",
+      "current": "0.4.39",
+      "error": null,
+      "canInstall": true,
+      "latest": "0.4.40"
+    },
+    "obs": {
+      "before": {
+        "state": "idle",
+        "alias": "",
+        "port": 15099,
+        "error": "",
+        "supported": true
+      },
+      "start": {
+        "state": "starting",
+        "alias": "frame",
+        "port": 15139,
+        "error": "",
+        "supported": true
+      },
+      "stop": {
+        "state": "stopping",
+        "alias": "frame",
+        "port": 15139,
+        "error": "",
+        "supported": true
+      },
+      "after": {
+        "state": "idle",
+        "alias": "frame",
+        "port": 15139,
+        "error": "",
+        "supported": true
+      }
+    },
+    "preferencesAfterRestart": {
+      "mvSeparate": "0"
+    }
+  },
+  "loginItem": {
+    "enabledBeforeQuit": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "nativeQuit": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\nPRESS 0\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "restartPid": 50393,
+    "enabledAfterRestart": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "beforeRestore": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "restoreOff": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": \"\\u2713\", \"role\": \"AXMenuItem\"}\nPRESS 0\n",
+    "finalMenu": "trusted True\n{\"title\": \"Check for Updates\\u2026\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Quit Frame Control\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Open at Login\", \"mark\": null, \"role\": \"AXMenuItem\"}\n{\"title\": \"Show Server Log\", \"mark\": null, \"role\": \"AXMenuItem\"}\n",
+    "restoredOriginalOff": true
+  },
+  "macHelper": {
+    "permissions": {
+      "accessibility": false,
+      "screen": false
+    },
+    "displays": {
+      "displays": [
+        {
+          "h": 900,
+          "id": 69734464,
+          "main": true,
+          "name": "Built-in Retina Display",
+          "src": "display:69734464",
+          "w": 1440
+        }
+      ]
+    },
+    "windows": {
+      "screen": false,
+      "count": 3,
+      "frameControlCount": 2
+    }
+  },
+  "headset": {
+    "timestamp": "2026-10-26T04:56:52.808203+00:00",
+    "route": "Mac SSH -> pinned lxso2 -> trusted frame SSH",
+    "owner": "intel-v0439-1vbt29ptkw-20261026",
+    "payloadBytes": 54,
+    "coordinatorLock": "locked\n",
+    "headset": {
+      "os": {
+        "VERSION_ID": "0.5.6",
+        "BUILD_ID": "20261022.6153909",
+        "VARIANT_ID": "vr"
+      },
+      "battery": [
+        {
+          "percent": 99,
+          "status": "Not charging"
+        }
+      ],
+      "homeStorage": {
+        "total": 996984774656,
+        "free": 769012412416
+      },
+      "screenshotJpegs": 7,
+      "transfer": {
+        "path": "/tmp/intel-v0439-1vbt29ptkw-20261026-vtynzyky/intel-mac-check.txt",
+        "bytes": 54,
+        "sha256": "82029b7e8b519bac65e43a6e90386a06da9988b23330aa7c48fea0abdfac0a8b",
+        "deleted": true
+      }
+    },
+    "headsetLockReleased": true,
+    "coordinatorLockRelease": "released\n"
+  },
+  "gatekeeper": {
+    "downloadMethod": "gh release download",
+    "downloadQuarantinePresent": false,
+    "controlledSyntheticQuarantine": "inconclusive",
+    "cleanQuarantinedOpen": "NSPOSIXErrorDomain Code=16 Resource busy",
+    "cleanSpctl": "timeout after 15 seconds",
+    "rightClickOpenVerified": false,
+    "openAnywayVerified": false,
+    "appSpecificXattrFallbackUsed": true,
+    "globalGatekeeperChanged": false
+  },
+  "headsetCleanupReadback": {
+    "headset": {
+      "testFoldersAbsent": true,
+      "lockAbsent": false,
+      "subsequentLockOwner": "frame-smoke-92bb2294f1d9cd4b7084",
+      "subsequentLockLeftUntouched": true
+    },
+    "coordinatorLockAbsent": true
+  },
+  "cleanup": {
+    "debugPortClosed": true,
+    "originalPreferencesRestored": true,
+    "ownedAppRemaining": [],
+    "desk": {
+      "foreground_apps": [
+        "Finder",
+        "Messages",
+        "cmux"
+      ],
+      "display_on": false,
+      "notifications_found": 0,
+      "attention": []
+    },
+    "dmgejected": true,
+    "installedSignatureValidAfterRuntime": true,
+    "finalInstalledSignature": {
+      "removedOnlyGeneratedBytecodeFiles": 36,
+      "finalSignatureExit": 0,
+      "finalSignatureStderr": ""
+    }
+  },
+  "validation": {
+    "sourceBase": "741735aa98e615fb51bb1a5adb665c9d12e3fd2a",
+    "initialMacFullSuite": {
+      "python": "system 3.9",
+      "tests": 1621,
+      "failures": 6,
+      "skipped": 20,
+      "seconds": 818.353
+    },
+    "affectedMacModulesAfterFix": {
+      "python": "official bundled 3.12",
+      "tests": 87,
+      "skipped": 2,
+      "seconds": 37.605,
+      "result": "OK"
+    },
+    "focusedAppTests": {
+      "tests": 14,
+      "passed": 14
+    },
+    "websiteTests": {
+      "tests": 18,
+      "passed": 18
+    },
+    "testFixes": [
+      "Skip local Frame recording shell fixtures on Bash 3.2, whose read timeout status differs from Frame Bash 5",
+      "Require actual XCTest.framework for standalone XCTest contracts",
+      "Separate OBS fixture interpreter startup from stream-stall deadlines and synchronize signal-handler readiness",
+      "Leave margin between panel fixture delays and individual X tool timeouts"
+    ],
+    "linuxFullSuiteAfterFix": {
+      "tests": 1621,
+      "skipped": 16,
+      "seconds": 170.313,
+      "result": "OK",
+      "isolation": "temporary archived checkout on lxso2"
+    },
+    "testedFileSHA256": {
+      "tests/test_clips.py": "00ba70866cda2b6cacaa0dd9bd19e9f2a9532a035cef66c9d8e2bd0021b1f489",
+      "tests/test_ios_contracts.py": "f1cc22e54873617e381025233c6b422245e6943ba7432331fc2d01e7a9ae4fc1",
+      "tests/test_obs_headset_source.py": "62462cbadbfcf67d4c200edf54ee45697b6f8d6547cd4c538f0344d71cf70241",
+      "tests/test_touch.py": "c34c646d134e57130c4fb43cd3d53e6c859369f774f9b7fd1dd8c3e718b72b6f"
+    }
+  }
+}
@@ -0,0 +1,181 @@
+# Intel Mac acceptance test: official v0.4.39, 26 October 2026
+
+Tested on the physical **MacBookAir9,1, Intel Core i3-1000NG4 1.10 GHz,
+8 GB RAM, macOS 15.7.7 (24G720), x86_64**. Job `1vbt29ptkw` repeated the
+[earlier release test](mac-v0439-2026-10-26.md) and added ZIP verification,
+native menu actions and Open at Login persistence. The app under test was
+the official [v0.4.39 release](https://github.com/saphid/frame-control/releases/tag/v0.4.39),
+tag commit `fd0b0a946f11d92fd1cc480cd9d1a83be795bf71`.
+It was not rebuilt or patched. Current source validation is reported separately.
+
+## Download and clean DMG installation
+
+Downloaded both Intel assets and `SHA256SUMS` from that exact tag with
+`gh release download`. Independently calculated SHA-256 values matched the
+same-release manifest:
+
+| Asset | Bytes | SHA-256 |
+|---|---:|---|
+| `Frame-Control-mac-x64.dmg` | 169,230,398 | `f47b5a188b5090f97a72467394d4fa65ccc73fe3169a6276e2a32cab5c8019d8` |
+| `Frame-Control-mac-x64.zip` | 169,141,014 | `bafc1aec0c11c1fae097dbe1e4b585ebc13a0f8eaf1b249717c14d78811e08d7` |
+
+Mounted the DMG read-only with `hdiutil attach -readonly -nobrowse` and
+unpacked the ZIP separately. For each app, `file` reported
+`Mach-O 64-bit executable x86_64` and `lipo -info` reported:
+
+```text
+Non-fat file: …/Contents/MacOS/Frame Control is architecture: x86_64
+```
+
+The DMG's bundled Python and `frame-mac-view` are also x86_64; `adb` is
+universal with x86_64 and arm64 slices. Both fresh bundles passed
+`codesign --verify --deep --strict --verbose=2`. Signing is ad hoc, with no
+TeamIdentifier. This verifies the resource seal, not Apple notarization.
+
+Preserved the existing `/Applications/Frame Control.app` in the task's
+temporary directory. An initial `ditto` overlay retained that installation's
+extra Python bytecode caches and failed signature verification. Moved that
+copy aside and copied the DMG app into an empty destination. The clean copy
+passed `codesign --verify --strict`; the release bundles themselves passed.
+The final installed app is the clean DMG copy.
+
+## Gatekeeper: tested fallback, incomplete first-open coverage
+
+The CLI downloads had **no `com.apple.quarantine` attribute**. This Air had
+already launched the same app in the earlier job, so it is not a pristine
+first-install trust environment. A controlled probe added only this app's
+quarantine attribute (`0083;<timestamp>;FrameControlIntelReleaseTest;`).
+That is synthetic metadata, not a Safari or Chrome download.
+
+The overlaid copy's first `open` returned 0 and later produced a translocated
+app process. After making the clean copy, a quarantined `open` returned:
+
+```text
+The application cannot be opened, error=Error Domain=NSPOSIXErrorDomain Code=16 "Resource busy"
+```
+
+Assessment of the clean copy with `spctl --assess --type execute -vv` did
+not finish within 15 seconds. No readable Gatekeeper warning was captured;
+the controlled probe is **inconclusive**. Do not interpret `open` returning
+0 as proof of passing Gatekeeper. Native screen capture was unavailable.
+
+The exact app-specific fallback used for the verified clean copy was:
+
+```sh
+xattr -dr com.apple.quarantine "/Applications/Frame Control.app"
+```
+
+The installed app then launched successfully. No global Gatekeeper setting
+was changed. For a normal user, verify the Intel download, mount the DMG,
+drag the app to Applications and open it. If macOS blocks it, Apple's
+documented route is **System Settings → Privacy & Security → Open Anyway →
+Open**, after the initial attempt. **Right-click Open and Open Anyway were
+not exercised in this run**; neither is certified here. The Terminal command
+above is the fallback actually exercised, limited to this trusted app.
+
+## Official native app checks
+
+Controlled runs disabled telemetry and used a task-local server data
+directory. A temporary loopback CDP port inspected the actual Electron
+renderer and its real `window.frameApp` bridge. This was not a web-only
+substitute. Native menu actions used Apple's Accessibility API through an
+existing authorized SSH session; no Accessibility grant was added. Direct
+System Events/AppleScript calls timed out. The API route is why this run can
+verify native menu actions that the earlier evidence left untested.
+
+| Check | Result |
+|---|---|
+| Launch | **Pass.** Native window, real IPC bridge and bundled Python server loaded. Version remained 0.4.39 |
+| Offline UI | **Pass.** Apps, Games, Tools, Settings, Privacy & updates, Capture & Live and Decky rendered their expected headings |
+| Decky store | **Pass.** Official store returned 116 plugins, with 40 initial rows. Search displayed ProtonDB Badges 1.3.4 and its compatibility text. Install stayed disabled; no loader or plugin was installed |
+| Settings save | **Pass.** Native preferences initially `{}`; `mvSeparate="0"` saved, read back and survived a real app restart. Restored the original absence of the preferences file afterward |
+| Update check | **Pass.** Native IPC returned `available`, current 0.4.39, latest 0.4.40, `error=null`, `canInstall=true`. The actual Check for Updates menu action also succeeded. No update installed |
+| OBS Start/Stop | **Partial.** Native status supported/idle → Start on port 15139 returned starting → Stop returned stopping → idle. This checks local helper lifecycle; no OBS receiver or headset stream was exercised |
+| Open at Login | **Pass for toggle and persistence.** Native menu began unchecked. AXPress returned success, then the checkmark appeared. Native Quit/relaunch preserved it. Toggled off and independently read the unchecked menu back. Actual logout/login execution remains untested |
+| Show Server Log | **Partial.** Native menu AXPress succeeded and launched Console. The log contains startup with the installed bundled Python/server paths. The viewer's displayed document was not independently read back |
+| Intel Mac helper | **Pass for read-only commands.** `permissions`, `displays` and `windows` returned JSON. One 1440×900 built-in display was listed; screen/accessibility permissions were false. No capture or permission request was initiated by these commands |
+
+[Native searched Decky store screenshot](intel-mac-v0.4.39-2026-10-26.png).
+[Structured observations](intel-mac-v0.4.39-2026-10-26.json).
+
+## Headset: read-only checks and one temporary transfer
+
+`frame.local` resolved, but its LAN port 22 returned **No route to host**.
+The Tailscale endpoint answered TCP 22, but direct SSH and the app refused
+the Air's stale/missing host trust. No pin was replaced to bypass that
+failure. Used the already-pinned `saphid@lxso2` coordinator relay and its
+trusted `frame` SSH connection instead.
+
+Atomically acquired `/tmp/frame-test.lock` on the coordinator and headset
+with owner `intel-v0439-1vbt29ptkw-20261026`. Under those locks:
+
+- Read SteamOS **0.5.6**, variant `vr`, build **20261022.6153909**.
+- Read battery **99%, Not charging**.
+- Read home storage: **996,984,774,656 bytes total**, **769,012,412,416 free**.
+- Listed **7** JPEGs matching Steam's
+  `userdata/*/760/remote/*/screenshots/*.jpg`; no screenshots were copied.
+- Sent a **54-byte** payload originating on this Mac through the relay into
+  an exclusively created `/tmp/intel-v0439-1vbt29ptkw-20261026-…/` folder.
+  Its readback SHA-256 matched
+  `82029b7e8b519bac65e43a6e90386a06da9988b23330aa7c48fea0abdfac0a8b`.
+  Deleted the exact file and its temporary folder.
+- Released only matching owned locks. Separate readback confirmed the
+  headset lock was absent immediately after release. A later independent check
+  found the transfer folder absent and coordinator lock absent, while the
+  headset lock had been acquired by another job (`frame-smoke-92bb2294f1d9cd4b7084`);
+  that different owner was left untouched.
+
+This verifies a relay transfer, **not the native app's direct file-transfer
+path**. No existing headset content, installs, services, settings, power
+state or SteamVR state was changed. No wipe or reboot was attempted.
+
+## Bugs, validation and remaining limits
+
+No new Intel-specific product bug was isolated in these runtime checks.
+The earlier v0.4.39 shutdown race already has a merged fix in
+[PR #284](https://github.com/saphid/frame-control/pull/284), shipped in
+v0.4.40. This run did not install or validate the v0.4.40 Intel app.
+
+The initial full source suite on system Python 3.9 ran **1,621 tests in
+818.353 seconds**, with **six failed assertions and 20 skips**. These were
+source-test issues, separate from the released native checks:
+
+- The recording fixture's time limit ended with `q`, because macOS Bash 3.2
+  reports read timeout as status 1, the same as EOF. Frame Bash 5 reports a
+  value above 128. Local recording-shell tests now explicitly require Bash 4+.
+- The Foundation XCTest test found `swiftc` but failed `import XCTest`:
+  the active Command Line Tools installation has no XCTest framework.
+  It now checks for the actual framework and skips when unavailable.
+- Two OBS tests (three assertions, including subtests) started 0.15/0.3-second
+  watchdog clocks before the fixture's Python interpreter and signal handler
+  were ready. Fixture startup is now synchronized or separately budgeted;
+  the short stream-stall checks remain. Production watchdog limits did not change.
+- The panel timeout fixture's 4.6-second sleeps were too close to each tool's
+  five-second timeout once process startup was included, causing the wrong
+  failure path. Three-second sleeps still exhaust the 12-second overall
+  deadline before a panel is complete, with margin for process startup.
+
+All four affected modules then passed on this physical Air with the official
+app's bundled Python 3.12: **87 tests, two explicit prerequisite skips,
+37.605 seconds**. Focused native app tests passed **14/14** and website tests
+**18/18**. An isolated Linux checkout of base `741735a` plus the exact four
+test-file changes passed the **full 1,621-test suite, 16 skips, 170.313 seconds**,
+including recording-shell fixtures under modern Bash. No full Mac suite pass
+after these corrections is claimed.
+
+Final native cleanup confirmed the app processes and loopback debug port were
+closed, original preferences restored, Open at Login off, the DMG ejected and
+its installed signature still valid. External test subprocesses had generated
+36 Python bytecode files inside the bundle; removed only those absent from
+the verified clean release before the final signature check. The native app
+uses `-B` itself. The installed desk cleanup tool reported
+only **Finder, Messages and cmux** in front, **zero notifications**, no items
+needing attention and the **display asleep**. The official app remains installed;
+previous copies and raw test logs are retained in `/tmp/frame-control-v0439-intel`.
+The desk hold is released at the end of the task.
+
+Actual login startup, ordinary browser quarantine/first-open override,
+direct app/headset transfer, real OBS audio/video, Mac screen capture,
+headset VR interaction, wearer comfort and controller input remain untested.
+No social post was made. PR #113 was left untouched; merging and releasing
+remain with the lxso2 coordinator.
@@ -0,0 +1,23 @@
+# v0.4.41 tagged release, 26 October 2026
+
+The annotated `v0.4.41` tag dereferences to main merge commit `b5d50a8d896f790a94baf4e937db914eab475ed9` from PR #297. The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40271174791) passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs. The platform jobs launched the built Linux AppImage, checked the Windows installation and bundled PC Python libraries, and checked Mac bundle architectures. These CI results do not establish a physical Windows or Mac launch.
+
+## Real Frame, exact tag
+
+From an exact tag checkout, `scripts/frame-smoke.sh` acquired its unique owner in `/tmp/frame-test.lock` before reading the headset. Preflight found SteamVR activity 3 (standby) and battery 99%. On Frame OS 0.5.6 build `20261022.6153909`, all **13/13 reserved title steps passed**; the command exited 0, including test title and process cleanup and release of its owned lock. ARM64 and Proton test executables launched. The x86_64 launch step recorded that optional Steam Linux Runtime 4 was **not installed**, so that executable did not actually launch. The private detailed result is `tests/smoke/results/2026-10-26T045140Z-20261022.6153909.json` in the exact-tag checkout.
+
+No person wore the headset. This title smoke does not verify active passthrough pixels, wearer-visible panels, physical controller input, official Decky plugin panels, audio output, comfort or VR keyboard use. The separate [unworn Framey sample exercise](framey-scroll-probe-2026-10-26.md) established live sample setting persistence, stereo compositor changes and trusted synthetic OpenVR input; it did not establish a worn result. The hourly worn check remains enabled.
+
+## Downloaded installer and checksum checks
+
+The draft held ten installers plus `SHA256SUMS`, each with a GitHub SHA-256 digest. `scripts/publish-release.sh --dry-run v0.4.41` checked the exact tag and all ten installer digests, regenerated `SHA256SUMS` from those digests and matched its own GitHub digest. A fresh downloaded checksum list independently matched `e7555956aeb9ec3a464081aaafe1ed6762f65a17c04edaa6ea45286f10927109`.
+
+A fresh Linux x86_64 AppImage download matched `5d1f50dc8527faf299f2058c7b5ed19057ec7c81c41449f6ccd44d68e6b4d212`. `scripts/check-appimage-launch.py` launched that exact file under isolated Xvfb: the bundled server answered HTTP 200 with `FrameControl/1`, then stopped. The first local attempt failed at Chromium sandbox startup inside the command sandbox; rerunning the same downloaded file with normal host permissions passed. The release workflow's independent Linux launch also passed.
+
+Fresh Mac ZIP downloads matched GitHub digests: arm64 `84615ec8a0c62481a9f33bae1815d55ec902db9aa9d4bd767fcf9380c3d44d7a`, x64 `2800b749cda98d15207950eca4a6bd205d35f30551f16efd7720b41347edc7ca`. Both contain bundle version 0.4.41; the app executable Mach-O CPU types are arm64 and x86_64 respectively. The physical Mac was unreachable over SSH, so neither tagged ZIP was launched there. The physical Intel Air was also not tested with this tag.
+
+## Publication and updater readback
+
+The final dry run passed with the release notes and hardware limits in the draft. `scripts/publish-release.sh v0.4.41` published [v0.4.41](https://github.com/saphid/frame-control/releases/tag/v0.4.41) at 2026-10-26 05:01:47 UTC. GitHub's latest-release API read back `draft=false`, tag `v0.4.41`, ten installers, `SHA256SUMS` and `update.json`. A fresh public latest-download of `update.json` parsed as version 0.4.41 with the stable release page, ten SHA-256 digests and the unworn-test limits in its notes. The release contains the tagged `b5d50a8` commit; no post-tag changes are implied.
+
+The exact-version official Decky catalog in this release is **3 works / 48 partial / 54 broken / 11 N/A**. Volume Mixer and Mixer are works only for the tested per-app silent-stream volume scope on real ARM64 Decky; [audio evidence](framey-audio-arm64-2026-10-26.md) describes the independent Pulse readbacks. Volume Boost remains partial. Audible playback, Bluetooth, other mixer controls and official-plugin worn VR remain unverified.
@@ -0,0 +1,9 @@
+# v0.4.42 candidate gate, 26 October 2026
+
+This branch bumps the app and lockfile to 0.4.42. It includes the [v0.4.41 release evidence](v0441-release-2026-10-26.md), the Framey panel lifecycle change in PR #299, the truthful optional-runtime smoke result in PR #300, the physical Intel Mac acceptance and host-test fixes in PR #303 (`fe1da43171883dc31161ff607c6b5a6ddf75f6ef`), and the receipt-bound API guard in PR #301 (`ad57662d40d3bbf6c850dd80ddc275280d389c86`). All 11 hosted checks passed on PR #301's exact head before its normal merge. The combined release candidate's own headset gates passed; exact-head CI and installer previews remain pending.
+
+The exact v0.4.42 candidate at `27af46dd20d7af30dde4c3f954d7b57b94843594` ran `scripts/frame-smoke.sh` under its unique shared lock at 05:40 UTC. Locked preflight found standby activity 3, proximity 6.25 and battery 99%. It recorded **12 passed / 1 skipped / 0 failed** on Frame OS 0.5.6 build `20261022.6153909`; ARM64 and Proton test executables launched. The x86_64 launch was skipped because Steam Linux Runtime 4 was not installed. Cleanup passed and the command exited 0. The private detailed result is `tests/smoke/results/2026-10-26T054014Z-20261022.6153909.json` in the candidate checkout. The prior PR #300 result is documented [separately](frame-smoke-runtime-skip-2026-10-26.md).
+
+The exact candidate then ran `scripts/framey-vr-check.py --exercise` under a fresh owned lock at 05:41 UTC. Preflight again found activity 3 and battery 99%. The real Decky sample setting saved `enabled=true` and survived a fresh iframe; the quick action read the same value. A trusted synthetic OpenVR pointer reached the panel; the sample slider reached 50 and CDP text entry after OpenVR focus reached `framey-ci`. Stereo compositor hashes changed from `38265343e13f5915869c9622ab1ceda7c31ab2e9b050f44564cfb9b6dc9f6e6d` to `64cc4c6f865bb8b2f756632c922d17dee12af40d480171586f2e9a51797b83e6`; the mirror capture hash was `165289dca9ad2bd895eb544f5be5d5fa2db7d2f635a927ac68a0c74267f69ee2`. The exercise exited 0 with `passed=true`, battery 99% afterward, original power values restored (`false` / `5.000000`), recovery timer removed, no cleanup errors and its own lock released. Its private full result is `/tmp/framey-v0442-exercise/result.json` on the test host. Synthetic scroll events left `scrollTop=0` and produced no wheel events. No person wore the Frame; physical controller interaction, official plugin VR panels, optical readability, VR keyboard and comfort remain unverified. The earlier [receipt-guard exercise](framey-receipt-live-2026-10-26.md) is separate evidence.
+
+The release tag and published installers do not exist at this candidate stage. Publication remains gated on this combined head's exact-head CI, then tagged installer checksums, package checks and public updater readback. The 116 exact-version Decky catalog remains **3 works / 48 partial / 54 broken / 11 N/A**; the two additional works claims are restricted to tested per-app silent-stream volume control. The official v0.4.39 Intel installer ran on a physical MacBook Air, but no tagged v0.4.42 Mac launch or real OBS audio/video check is claimed.
@@ -0,0 +1,62 @@
+# v0.4.42 tagged release, 26 October 2026
+
+The annotated `v0.4.42` tag dereferences to main merge commit
+`98909cb54374a7bd7ec1f665f50eda20fa196f32` from PR #302. The app and
+lockfile both report 0.4.42. The [tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40276685171)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum jobs.
+The Linux job launched its built AppImage under isolated Xvfb. CI does not prove
+a physical Windows or Mac launch.
+
+## Real Frame, exact tag
+
+From an exact tag checkout, `scripts/frame-smoke.sh` acquired its own unique
+owner in `/tmp/frame-test.lock` before reading the headset. Preflight found
+SteamVR activity 3 (standby), proximity 6.25 and battery 100%. On Frame OS 0.5.6
+build `20261022.6153909`, it recorded **12 passed / 1 skipped / 0 failed** and
+exited 0. ARM64 and Proton test executables launched. The x86_64 title was
+installed and removed, but its launch was skipped because optional Steam Linux
+Runtime 4 was absent. Test title/process cleanup passed and only the run's lock
+was released. The private result is
+`tests/smoke/results/2026-10-26T055940Z-20261022.6153909.json` in the exact tag
+checkout.
+
+The separate [unworn Framey candidate exercise](v0442-candidate-2026-10-26.md)
+passed real sample setting save/reopen, synthetic OpenVR pointer delivery and
+stereo compositor change, with power restored and cleanup complete. It was run
+on the release branch's code before the evidence-only final commit. No person
+wore the Frame. Neither run verifies official plugin VR panels, physical
+controller usability, native scrolling, VR keyboard or optical comfort. The
+hourly worn check remains enabled.
+
+## Installer, checksum and updater checks
+
+The draft held ten installers plus `SHA256SUMS`, each with a GitHub SHA-256
+digest. `scripts/publish-release.sh --dry-run v0.4.42` checked the exact remote
+tag and every installer digest, regenerated the checksum list from those
+metadata digests, and matched the uploaded `SHA256SUMS` digest. A fresh
+checksum-list download independently matched
+`e5c85f5a46d789dccafae5259bd00b9b048dd10ca4f2a6cdc52d1f432a6db989`.
+
+A fresh Linux x86_64 AppImage download matched
+`16fc9fbe448bccbe59aa4206bc171c6bfc741973d2b4da0a79652a5c11d837b3`.
+`scripts/check-appimage-launch.py` launched those exact bytes under isolated
+Xvfb: the bundled server answered HTTP 200 with `FrameControl/1` and then
+stopped. Fresh Mac ZIP downloads matched GitHub digests: arm64
+`394d6088e732a19289b7b92366dd247f14f7293a345d57ed5c4e9c83a50abad3`
+and x64 `66d4606e38210d02af59dc87e4d1216282ad9e968056d7096f247fcc51e72395`.
+Both bundles report version 0.4.42; their main Mach-O CPU types are arm64 and
+x86_64 respectively. Neither tagged Mac ZIP was launched on a physical Mac.
+
+`scripts/publish-release.sh v0.4.42` published
+[v0.4.42](https://github.com/saphid/frame-control/releases/tag/v0.4.42) at
+2026-10-26 06:02:20 UTC. GitHub's latest-release API read back `draft=false`,
+`prerelease=false`, the expected tag, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` parsed as
+version 0.4.42 with the stable release page and ten SHA-256 installer digests.
+The tag contains #299, #300, #301 and #303 through #302's release merge.
+#304 merged after the tag and is not in this release.
+
+The exact-version official Decky table for v0.4.42 is **3 works / 48 partial /
+54 broken / 11 N/A**. The two additional works labels are restricted to tested
+per-app silent-stream volume control. Audible playback and official-plugin
+worn VR remain unverified.
@@ -0,0 +1,7 @@
+# v0.4.43 candidate Frame gate, 26 October 2026
+
+The combined code head `232b253e7a9400aa9829f9fea6a5d2011dd2a8f3` (PR #309 after merging main with PR #308) ran `scripts/frame-smoke.sh` under its own `/tmp/frame-test.lock` owner at 07:57 UTC. Its locked preflight found SteamVR activity 3 (standby), proximity 6.25 and battery 99%. On Frame OS 0.5.6 build `20261022.6153909`, it recorded **12 passed / 1 skipped / 0 failed**. The ARM64 and Proton executables launched; x86_64 launch was skipped because Steam Linux Runtime 4 is absent. It removed its test titles, exited 0 and released its lock. The private detailed result is `/tmp/frame-smoke-pr309/2026-10-26T075752Z-20261022.6153909.json` on the test host. A fresh, separately owned read-only lock then found activity 3 and battery 99%, and was released. PR #310 subsequently changed only the Windows wireless CI smoke test; the release branch merged that test change and bumped the app version, with no further headset runtime code change after this Frame smoke.
+
+PR #308's panel code commit `d5e62f643d462b7070f27c2c47b11b4aa9982094` previously passed the temporary Framey sample `scripts/framey-vr-check.py --exercise` machine check, with cleanup and power restoration; see [Web Browser follow-up](framey-web-browser-2026-10-26.md). That test used synthetic OpenVR input and a repository sample, not the official Web Browser plugin or a person wearing the headset. No wake or VR input exercise ran on this combined code head because wearer confirmation was absent. The current smoke made no worn visual, physical-controller, audible-output or official-plugin VR claim.
+
+This is candidate evidence, not a published-release result. Publication still needs all exact-head PR and release checks, ten tagged installers with matching `SHA256SUMS`, package validation, the publisher dry run, and public updater readback. The exact-version official Decky catalog in this candidate is **4 works / 49 partial / 52 broken / 11 N/A**. Volume Boost's works claim covers tested muted sink controls; Junk-Store remains partial, and Web Browser remains broken.
@@ -64,7 +64,9 @@ none of these frontend controls has passed a worn-headset check yet.
 | `PanelSection`, rows, buttons, toggles, dropdowns | Local touch-sized controls; disabled controls stay inert during a backend call | Local browser and host unit test |
 | `TextField`, `SliderField`, grouped `Dropdown` options | Native text, range and select controls in the panel; disabled state, numeric slider callback and basic input types | Host unit test; worn VR use unverified |
 | `Tabs`, `SidebarNavigation`, spinners, dialog/menu wrappers, progress bars | Local tab navigation and ordinary HTML controls; no Steam navigation or controller focus tree | Host tests and catalog frontend smoke checks in local Chromium |
-| `SteamClient` subscriptions and `DFL.Router.MainRunningApp` | Explicit inert registration methods return disposable handles; no events or attached running game. Mutating Steam/power methods are unavailable. | Host contract tests; these are safe fallbacks, not live Steam functionality |
+| `SteamUIStore` / `DFL.Router.RunningApps`, `MainRunningApp` | Bounded detached Steam CEF reads while the panel is open; refresh about every two seconds; no MobX observation. Failed reads clear stale context. | Locked real Frame empty-list reads; nonempty local Chromium fixtures. Real running-game selection unverified. |
+| `GameSessions.RegisterForAppLifetimeNotifications` | Actual Steam callbacks, bounded queue and disposable `.unregister()` handle; no events inferred from snapshot changes; lease cleanup after lost panels | Real Frame registration/poll/close; launch/exit, retry, expiry and duplicate tests use explicit fixtures. Real game transitions unverified. |
+| Other `SteamClient` subscriptions | Explicit inert registration methods return disposable handles; no fabricated power/input/game-action events. Mutating Steam/power methods are unavailable. | Host contract tests; safe fallbacks only |
 | `DialogCheckbox`, `DialogButtonPrimary` | Native checkbox and button controls in the panel | Host unit test; Storage Cleaner empty-data browser check |
 | Optional `settings`, `frameyQuickActions` | Separate settings tab when content also exists; settings-only plugins have no empty Panel tab; up to eight actions with result text | Host unit test; these fields are Framey additions |
 | `serverAPI.call` / `callable` | Calls only that plugin's Decky Python backend via the headset service | Fake Frame e2e; real ARM64 Notebook save/reopen across backend restart and Simple Timer settings/recents persistence via local Chromium. No worn-VR claim. |
@@ -1,10 +1,10 @@
 # Official Decky store compatibility with Framey

-Snapshot: 2026-10-25T23:19:48.854504+00:00; 116 current visible official plugins from https://plugins.deckbrew.xyz/plugins.
+Snapshot: 2026-10-26T06:10:58.537029+00:00; 116 current visible official plugins from https://plugins.deckbrew.xyz/plugins.

 This table and both store views use [`ui/framey-compatibility.json`](../ui/framey-compatibility.json). Results apply only to the exact store ID, version and SHA-256. A changed digest/version is **unverified**. Regenerate this document with `python3 scripts/framey-compatibility-doc.py`; use `--check` in review.

-**Works: 3 · Partial: 48 · Broken: 54 · N/A: 11.**
+**Works: 4 · Partial: 49 · Broken: 52 · N/A: 11.**

 - **Works** requires verified useful plugin behavior with its real backend. Read the reason for the verified scope and remaining limits; it does not imply worn-VR verification.
 - **Partial** means only a subset or a local fixture scope was verified, often just frontend/settings initialization. The remaining backend/device functionality is unverified; read the reason for the exact scope.
@@ -27,7 +27,7 @@ Open the browser audit URL in local Chromium, run `runAudit()` and inspect/downl

 The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.

-After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. Simple Timer remains partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. Volume Boost stays partial: default-sink reads matched, but real sink writes were denied. Audible output, Bluetooth playback and worn VR remain unverified. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. Junk-Store loading/error views render, but its real backend cannot execute the extracted startup script, so it stays broken. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. TabMaster/Junk-Store ran in actual isolated amd64 Decky; no ARM64 or worn-VR result is claimed. Beyond the documented checks, official backends remain unexecuted. The separate VR job proves Frame Control/sample compositor rendering, not any official plugin. No worn-VR official-plugin result is claimed. A [local UI follow-up](evidence/framey-ui-fallbacks-2026-10-26.json) rendered Pause Games and Tailscale Control settings with all backend/network actions denied; it does not verify process pausing or Tailscale changes. A [read-only Steam bridge follow-up](evidence/framey-steam-reads-2026-10-26.json) verified actual Frame country, install folders and system information, plus IsThereAnyDeal's country dropdown in local Chromium. The installed-plugin status was fixture-shaped in that relay; plugin backends stayed denied and the deployed headset HTTP endpoint remains unverified. Earlier focused checks cover [ProtonDB](evidence/framey-browser-2026-10-25.md), [Steam Status/cache](evidence/framey-cache-browser-2026-10-25.md), [Storage Cleaner](evidence/framey-api-v1-browser-2026-10-25.md), and [legacy MusicControl](evidence/framey-legacy-2026-10-25.md).
+After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. Simple Timer remains partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. Beyond the documented checks, official backends remain unexecuted. The separate VR job proves Frame Control/sample compositor rendering, not any official plugin. No worn-VR official-plugin result is claimed. A [local UI follow-up](evidence/framey-ui-fallbacks-2026-10-26.json) rendered Pause Games and Tailscale Control settings with all backend/network actions denied; it does not verify process pausing or Tailscale changes. A [read-only Steam bridge followLine truncated

 ## Every current plugin

@@ -40,11 +40,11 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 10: vibrantDeck 2.0.1 | legacy / legacy | N/A | Not supported on Frame: Changes X11 gamescope color properties, not the Frame SteamVR compositor. | static archive, local browser, fake-Frame |
 | 11: Fantastic 0.5.1 | legacy / legacy | N/A | Not supported on Frame: Targets Steam Deck fan hardware; no Frame fan-control mapping is provided. | static archive, local browser, fake-Frame |
 | 12: MusicControl 1.1.6 | legacy / legacy | partial | Legacy media controls initialize; player discovery and playback are unverified. | static archive, local browser, fake-Frame |
-| 13: Pause Games 1.0.3 | 1 / 2 | partial | Settings render locally with inert system-key subscriptions and empty detached Steam context. Live-game discovery, process pause/resume and suspend integration are unsupported/unverified; no backend actions ran. | static archive, local browser, fake-Frame |
+| 13: Pause Games 1.0.3 | 1 / 2 | partial | Settings and running-game list initialize in local Chromium with an explicit synthetic game; live Frame empty-list reads and lifetime registration/cleanup passed. Process pause/resume, automatic pausing and suspend integration remain unverified/unsupported; backend writes were denied. | static archive, local browser, fake-Frame |
 | 14: ProtonDB Badges 1.3.4 | 2 / 2 | partial | Settings render locally and read-only get_setting RPC returned the default through real Decky 3.3.0 on ARM64 Frame. Steam game-page badges have no patch target; live writes and VR controls unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 16: Audio Loader 1.6.1 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. Steam UI sound lookup is present as explicitly unsupported; the frontend still requires Steam m_GamepadUIAudioStore.m_AudioPlaybackManager, which is unavailable in the isolated panel. | static archive, local browser, fake-Frame |
 | 18: Bluetooth 3.1.1 | 1 / 2 | partial | Controls render with fixture replies; actual Bluetooth discovery, labels and connections remain unverified. | static archive, local browser, fake-Frame |
-| 19: Notebook 0.1.5 | legacy / legacy | works | Default notebook drawing, save and reopen verified in Chromium with real Decky 3.3.0 ARM64, including backend restart. Per-game auto-selection and background artwork unavailable; worn-VR input unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 19: Notebook 0.1.5 | legacy / legacy | works | Default notebook drawing, save and reopen verified in Chromium with real Decky 3.3.0 ARM64, including backend restart. Running-game context is now supplied; per-game selection was attempted with a synthetic game and backend calls denied. Real per-game selection, background artwork and worn-VR input remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 21: PowerTools 2.0.3 | legacy / legacy | N/A | Not supported on Frame: Targets AMD Ryzen power controls; Frame uses an ARM64 SoC. | static archive, local browser, fake-Frame |
 | 22: Memory Deck 0.1.8 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: memory-deck/bin/libscanmem.so.1.0.0. | static archive, local browser, fake-Frame |
 | 23: Animation Changer 1.3.2 | legacy / legacy | partial | Initializer succeeds; forced backend failure prevents loading animations. Boot-video changes untested. | static archive, local browser, fake-Frame |
@@ -56,7 +56,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 32: AutoFlatpaks 1.6.8 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 35: MoonDeck 1.13.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: moondeck/python/externals/yarl/_quoting_c.cpython-313-x86_64-linux-gnu.so. Frontend initializes; native CPython wheels and executables in the published archive are x86_64. | static archive, local browser, fake-Frame |
 | 36: SteamGridDB 1.8.1 | 1 / 2 | broken | Local module mapping is available; frontend still requires the Steam LibraryContextMenu implementation, which has no target in the isolated Framey panel. | static archive, local browser, fake-Frame |
-| 37: Discord Status 1.5.0 | 1 / 2 | broken | Detached app overviews are now available, but RunningApps/lifetime observations and Steam artwork helpers still lack a live mapping. Discord activity integration remains unavailable/unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 37: Discord Status 1.5.0 | 1 / 2 | partial | Disconnected panel renders; running-activity construction accepts a synthetic game in local Chromium. Exact official is_connected returned false in real Decky 3.3.0 ARM64. Empty live running-list reads and lifetime registration/cleanup passed. Real game transitions, Discord shortcut detection/connection/activity, local custom artwork and worn VR remain unverified/unsupported. | static archive, local browser, fake-Frame, real Frame SSH |
 | 38: Volume Mixer 1.2.1-1 | legacy / legacy | works | Per-app stream discovery and slider/keyboard volume changes pass in local Chromium through real Decky 3.3.0 ARM64 on the Frame audio session, with independent Pulse readback of a silent test stream. Bluetooth playback, audible output and worn-VR controls unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
 | 40: Controller Tools 2.0.2 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: ControllerTools/bin/backend. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
 | 43: Tailscale Control 0.1.3 | legacy / legacy | partial | Settings render locally after the SuspensefulImage fallback. Tailscale daemon/state, connection and exit-node changes unverified; bundled localhost QR asset remains unavailable. No network settings were changed. | static archive, local browser, fake-Frame |
@@ -68,15 +68,15 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 52: Game Theme Music 1.7.1-1 | 1 / 2 | broken | Frontend audit failed: Cannot read properties of null (reading 'type'). | static archive, local browser, fake-Frame |
 | 53: Shotty 0.1.0 | legacy / legacy | broken | Library snapshot fixes the frontend allApps crash. Actual published Decky 3.3.0 amd64 backend fails importing click.get_app_dir (ModuleNotFoundError); the archive does not bundle click. Screenshot aggregation/rescue was not run. | static archive, local browser, fake-Frame, real Frame SSH |
 | 56: MangoPeel 0.0.7 | 1 / 2 | partial | Initializer succeeds; gamescope/MangoHud actions and backend are unverified. | static archive, local browser, fake-Frame |
-| 58: Volume Boost 0.0.7 | legacy / legacy | partial | Real Decky 3.3.0 ARM64 default-sink reads match independent Frame pactl channel volumes; controls render locally. Sliders/numeric writes passed on an isolated amd64 virtual sink only. Real default-sink writes, boost above 100%, audible output and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
-| 59: Web Browser 1.4.3 | legacy / legacy | broken | Frontend audit failed: deckyFrontendLib.getReactRoot is not a function. | static archive, local browser, fake-Frame |
+| 58: Volume Boost 0.0.7 | legacy / legacy | works | Default-sink controls pass in local Chromium through real Decky 3.3.0 ARM64: linked slider/keyboard and numeric writes, separate channels, re-link and reopen, with independent Pulse readback including 125%/150% while muted. Exact original volume/mute restored. Audible output, Bluetooth sinks and worn VR unverified. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
+| 59: Web Browser 1.4.3 | legacy / legacy | broken | The exact frontend now initializes with a null Steam React-root lookup. The browser itself still requires Steam GamepadUI CDP injection and a backend WebSocket unavailable in Framey; no working browser tab was verified. | static archive, local browser, fake-Frame, focused local browser |
 | 60: DeckyFileServer 1.2.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: DeckyFileServer/bin/backend. | static archive, local browser, fake-Frame |
 | 61: TabMaster 2.15.1 | 1 / 2 | partial | Local Chromium rendered the QAM and navigable Overview/Filters documentation with an actual Decky 3.3.0 amd64 backend. Library-tab editing remains unavailable: Steam login/library patches and MobX reactions have no target. ARM64 and worn VR unverified. | static archive, local browser, fake-Frame |
 | 62: TS3 QuickAccess 1.2.0 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: ts3-qs4sd/bin/ts3-qs4sd.so. | static archive, local browser, fake-Frame |
 | 63: Free Loader 1.6.0 | 1 / 2 | broken | Unsafe plugin archive member. | static archive, local browser, fake-Frame |
 | 64: Syncthing 0.2.7 | legacy / legacy | broken | Plugin contains a non-ARM64 Linux binary: decky-syncthing/bin/decky-syncthing-watchdog. | static archive, local browser, fake-Frame |
 | 65: Decky Terminal 0.5.3 | 1 / 2 | partial | Local routes initialize after parameter-route support; no shell commands were run. | static archive, local browser, fake-Frame |
-| 66: PlayTime 3.2.5 | 1 / 2 | partial | Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. ARM64 backend, live MobX/running-game observations and automatic recording remain unverified/unsupported. | static archive, local browser, fake-Frame, real Frame SSH |
+| 66: PlayTime 3.2.5 | 1 / 2 | partial | Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. Running snapshots are now exposed, but its private MobX observation is unsupported; automatic recording and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 67: Battery Tracker 0.2.0 | legacy / legacy | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 68: Wine Cellar 0.2.1 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-wine-cellar/bin/backend. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
 | 70: MicroSDeck 0.11.2 | legacy / 2 | broken | Plugin contains a non-ARM64 Linux binary: MicroSDeck/bin/backend. | static archive, local browser, fake-Frame |
@@ -91,7 +91,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 80: MagicBlack 2.0.2 | 1 / 2 | N/A | Not supported on Frame: Targets a global Steam Deck screen-black overlay; the isolated panel cannot black out the Frame compositor. | static archive, local browser, fake-Frame |
 | 81: IsThereAnyDeal for Deck 1.1.1 | legacy / legacy | partial | Country settings render and select the real Frame Steam country through the read-only bridge. Settings writes, deal lookups and Steam page integration remain unverified; plugin backend calls were denied. | static archive, local browser, fake-Frame, real Frame SSH |
 | 82: MagicPods 2.0.21 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: MagicPodsDecky/bin/magicpodscore. Frontend audit failed: Audit blocks WebSocket. | static archive, local browser, fake-Frame |
-| 84: Junk-Store 1.1.13 | legacy / legacy | broken | Local CSS lookup fixes the loading view crash. Actual Decky 3.3.0 amd64 startup/static InitActions return a script execution/JSON error; the published scripts are not executable after extraction. Store install/login/game launch and ARM64 remain unverified. | static archive, local browser, fake-Frame |
+| 84: Junk-Store 1.1.13 | legacy / legacy | partial | Executable script extraction repaired. Official Decky 3.3.0 ARM64 static menu/backend calls and local Chromium Games/Epic navigation, back and reopen pass. About still fails on missing installed-app metadata; Legendary is absent. Dependency install, login, game operations, RSS and worn VR remain unverified. Existing installs need update/reinstall. | static archive, local browser, fake-Frame, isolated Linux backend, real Frame SSH |
 | 85: Decky-Undervolt 1.0.8 | 1 / 2 | N/A | Not supported on Frame: RyzenAdj Curve Optimizer requires an AMD CPU; Frame is ARM64. | static archive, local browser, fake-Frame |
 | 87: ScreenSaver 1.1.2 | legacy / legacy | partial | Initializer succeeds; global screen overlay and idle/suspend integration have no verified VR target. | static archive, local browser, fake-Frame |
 | 88: steamdeck-input-disabler 1.0.2 | legacy / legacy | N/A | Not supported on Frame: Targets the built-in Steam Deck USB gamepad; Frame has different controllers. | static archive, local browser, fake-Frame |
@@ -115,9 +115,9 @@ Its cleanup actions were not tested; they may remove local game saves.

 Framey also supplies local tabs/sidebar pages, spinners, dialog/menu wrappers
 and progress bars. Its explicit SteamClient subscription fallbacks return
-disposable handles without emitting fabricated events. There is no attached
-running game in `DFL.Router`, and power, app launch and hardware mutation methods
-are not supplied. Plugins that need live Steam stores still require integration
+disposable handles without emitting fabricated events. Running-game reads and
+lifetime notifications use the scoped bridge described below; power, app launch
+and hardware mutation methods are not supplied. Other live Steam stores require integration
 work. IndexedDB is hidden because the browser exposes it but denies access in
 an opaque iframe; localForage can then select Framey's bounded localStorage.
 Direct IndexedDB users remain unsupported.
@@ -125,13 +125,40 @@ Direct IndexedDB users remain unsupported.
 `SuspensefulImage` renders a native image. SteamClient `Storage.GetJSON` and
 `SetObject` use the same bounded per-plugin cache, including panel reopen
 persistence; they do not read Steam's account/global JSON store. Missing keys
-reject with `Not found`. Detached `SteamUIStore.RunningApps` is a frozen empty
-list, and the suspend store has no methods. Optional Steam app/account globals
-are undefined. These fallbacks let settings render without inventing live
+reject with `Not found`. The suspend store has no methods. Optional Steam app/account globals
+are undefined until a successful library read. These fallbacks let settings render without inventing live
 games or account identity. [The exact-bundle follow-up](evidence/framey-ui-fallbacks-2026-10-26.json)
 verifies Pause Games and Tailscale Control settings in local Chromium; their
 primary backend actions remain unverified. PlayTime still requires Steam's
-real app store and game observers.
+MobX game observers for automatic tracking.
+
+Panels referencing running-game APIs now receive a detached, read-only
+`SteamUIStore.RunningApps` / `MainRunningApp` snapshot, also exposed through
+`DFL.Router`. The authenticated headset-only `/api/framey/running` endpoint
+checks installed store ownership; the parent checks the active panel session.
+Poll and close requests also carry the panel's pinned SHA-256 receipt. A missing
+or changed installed receipt is rejected before any Steam CEF request; a rejected
+stale close relies on the existing finite subscription lease for cleanup.
+Fixed bundled code runs in Steam CEF. It copies at most 64 running app overviews, a main app and
+public Steam CDN capsule URLs; it never copies local artwork paths, launch
+commands or Steam objects. The host refreshes about every two seconds without
+overlapping requests. Failure clears stale context and sets
+`SteamUIStore.FrameyRunningAvailable` to false.
+
+`GameSessions.RegisterForAppLifetimeNotifications` relays actual Steam
+`{unAppID, bRunning}` callbacks through a bounded 64-event queue. Snapshot
+changes never fabricate launch/exit callbacks. Handles support `.unregister()`;
+panel close/replacement removes the CEF subscription, with a 15-second lease
+(checked every five seconds) if cleanup cannot reach Steam. At most four panel
+sessions are retained. These are open-panel observations, not closed-panel
+automation or a MobX implementation. Queue overflow can lose old callbacks.
+`appStore` capsule helpers expose only projected public URLs for running apps;
+unavailable or local custom artwork returns an empty value.
+
+[Running-context evidence](evidence/framey-running-context-2026-10-26.md) separates
+real Frame empty-list/subscription/cleanup reads, the exact Discord Status
+ARM64 backend connection check, and synthetic nonempty/transition fixtures.
+Real game transitions, Discord activity and worn-VR operation remain unverified.

 Three parameterless SteamClient reads use Steam's actual CEF context:
 `User.GetIPCountry`, `InstallFolder.GetInstallFolders` and `System.GetSystemInfo`.
@@ -177,6 +204,15 @@ the store and review the new version before retrying. If Frame Control restarts,
 job result. The panel clears that job ID and asks you to refresh the installed
 list before making another change.

+An open plugin panel closes before its own Update or Remove starts, so its old
+frontend cannot call the changing backend. Open panel is unavailable while a
+store job is pending. A later installed-status refresh also closes an open panel
+if Decky stopped, its store receipt changed, or the status read failed. Reopen
+the plugin after a successful refresh to use its current frontend.
+The headset also includes the panel's store SHA-256 receipt with each backend
+call, Steam read, and event poll. It rejects a request if the installed receipt
+changed before the next status refresh; reopen the panel to use the new version.
+
 ## For plugin authors

 Start with the [Framey settings sample](../examples/framey-settings/README.md)
@@ -36,7 +36,7 @@ Ready means initializer completion, not useful plugin behavior. No plugin backen
 <button id=run>Run catalog</button> <button id=download>Download observations</button><p id=progress></p>
 <iframe id=panel sandbox="allow-scripts" style="width:1100px;height:740px"></iframe>
 <script>
-const plugins=CATALOG_DATA, librarySnapshot=LIBRARY_DATA;
+const plugins=CATALOG_DATA, librarySnapshot=LIBRARY_DATA, runningSnapshot=RUNNING_DATA;
 window.results=[];let active=null,running=false;
 addEventListener('message',event=>{
  if(event.source!==panel.contentWindow||!active)return;
@@ -45,6 +45,8 @@ addEventListener('message',event=>{
  if(data.type==='framey:error')active.error=String(data.message).slice(0,500);
  if(data.type==='framey:ready')active.ready=true;
  if(data.type==='framey:events')event.source.postMessage({type:'framey:reply',id:data.id,result:{events:[],cursor:0}},'*');
+  if(data.type==='framey:running')event.source.postMessage({type:'framey:reply',id:data.id,
+    ...(runningSnapshot?{result:runningSnapshot}:{error:'Read-only compatibility audit: live running context blocked'})},'*');
  if(data.type==='framey:steam')event.source.postMessage({type:'framey:reply',id:data.id,
    ...(data.method==='GetLibrarySnapshot'&&librarySnapshot?
      {result:librarySnapshot}:{error:'Read-only compatibility audit: live Steam API blocked'})},'*');
@@ -53,13 +55,14 @@ addEventListener('message',event=>{
    event.source.postMessage({type:'framey:reply',id:data.id,error:'Read-only compatibility audit: backend method blocked'},'*');}
  if(data.type==='framey:cache:init')event.source.postMessage({type:'framey:cache:seed',session:data.session,entries:{}},'*');
 });
-window.runAudit=async(ids)=>{
+window.runAudit=async(ids,settleMs=1200)=>{
+  if(!Number.isInteger(settleMs)||settleMs<1200||settleMs>10000)throw Error('Invalid audit settle time');
  if(running)throw Error('Audit already running');running=true;run.disabled=true;
  try{for(const plugin of plugins.filter(plugin=>!ids||ids.includes(plugin.id))){
    active={id:plugin.id,name:plugin.name,ready:false,error:null,logs:[],methods:[],
-      library:librarySnapshot?'snapshot replay':'unavailable'};
+      library:librarySnapshot?'snapshot replay':'unavailable',running:runningSnapshot?'snapshot replay':'unavailable'};
    progress.textContent=plugin.id+' '+plugin.name;panel.src='/panel/'+plugin.id;
-    await new Promise(resolve=>setTimeout(resolve,1200));results.push(active);active=null;
+    await new Promise(resolve=>setTimeout(resolve,settleMs));results.push(active);active=null;
    panel.src='about:blank';await new Promise(resolve=>setTimeout(resolve,30));
  }}finally{running=false;run.disabled=false;progress.textContent='Done: '+results.length;}
  return results;
@@ -77,6 +80,8 @@ def main():
    parser.add_argument('--port', type=int, default=18765)
    parser.add_argument('--library-snapshot', type=Path,
                        help='Optional detached Steam library JSON; replay only, not live Steam/backend evidence')
+    parser.add_argument('--running-snapshot', type=Path,
+                        help='Optional detached running-app JSON; replay only, not live Steam/backend evidence')
    args = parser.parse_args()
    plugins = json.loads(args.catalog.read_text())['plugins']
    records = {p['id']: p for p in plugins}
@@ -86,6 +91,12 @@ def main():
        if len(raw) > 2*1024*1024:
            parser.error('library snapshot exceeds 2 MiB')
        library = json.loads(raw)
+    running = None
+    if args.running_snapshot:
+        raw = args.running_snapshot.read_bytes()
+        if len(raw) > 256*1024:
+            parser.error('running snapshot exceeds 256 KiB')
+        running = json.loads(raw)

    class Handler(BaseHTTPRequestHandler):
        def log_message(self, *_):
@@ -99,7 +110,8 @@ def main():
                # Only names/IDs are needed by the UI; never embed raw executable source.
                catalog = json.dumps([{'id': p['id'], 'name': p['name']} for p in plugins]).replace('<', '\\u003c')
                body = PAGE.replace('CATALOG_DATA', catalog).replace(
-                    'LIBRARY_DATA', json.dumps(library).replace('<', '\\u003c')).encode()
+                    'LIBRARY_DATA', json.dumps(library).replace('<', '\\u003c')).replace(
+                    'RUNNING_DATA', json.dumps(running).replace('<', '\\u003c')).encode()
            elif path.startswith('/panel/'):
                try:
                    record = records[int(path.split('/')[-1])]
@@ -54,7 +54,8 @@ def render(data):
        'A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer '
        'through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, '
        'independent server readbacks and Mixer filter persistence across a runtime restart passed. '
-        'An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. Volume Boost stays partial: default-sink reads matched, but real sink writes were denied. Audible output, Bluetooth playback and worn VR remain unverified. '
+        'An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. '
+        'A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. '
        'A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs '
        'and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot '
        'to render Deck Settings game selection, Steamback\'s empty save panel and PlayTime statistics/settings. '
@@ -63,7 +64,7 @@ def render(data):
        'A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 '
        'through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. '
        'Its backend was denied; Steam Home shelves and worn VR remain unverified. '
-        'A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. Junk-Store loading/error views render, but its real backend cannot execute the extracted startup script, so it stays broken. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. TabMaster/Junk-Store ran in actual isolated amd64 Decky; no ARM64 or worn-VR result is claimed. Beyond the documented checks, official backends remain unexecuted. '
+        'A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. Beyond the documented checks, official backends remain unexecuted. '
        'The separate VR job proves Frame Control/sample compositor rendering, not any official plugin. '
        'No worn-VR official-plugin result is claimed. '
        'A [local UI follow-up](evidence/framey-ui-fallbacks-2026-10-26.json) rendered Pause Games and Tailscale Control settings '
@@ -71,6 +72,7 @@ def render(data):
        'A [read-only Steam bridge follow-up](evidence/framey-steam-reads-2026-10-26.json) verified actual Frame country, '
        'install folders and system information, plus IsThereAnyDeal\'s country dropdown in local Chromium. '
        'The installed-plugin status was fixture-shaped in that relay; plugin backends stayed denied and the deployed headset HTTP endpoint remains unverified. '
+        'A [Web Browser frontend follow-up](evidence/framey-web-browser-2026-10-26.md) verified its exact archive now initializes with an inert null Steam React-root lookup. Its GamepadUI CDP/browser backend path remains unavailable, so it stays broken. '
        'Earlier focused checks cover [ProtonDB](evidence/framey-browser-2026-10-25.md), '
        '[Steam Status/cache](evidence/framey-cache-browser-2026-10-25.md), '
        '[Storage Cleaner](evidence/framey-api-v1-browser-2026-10-25.md), and '
@@ -210,7 +210,7 @@ def main(argv=None):
            files = {name: base64.b64encode((ROOT/'examples/framey-settings'/name).read_bytes()).decode()
                     for name in ('plugin.json', 'main.py', 'dist/index.js')}
            source = '''
-import base64,json,pathlib
+import base64,hashlib,json,pathlib
 base=pathlib.Path.home()/'.local/share/frame-control/decky'
 folder=%r
 p=base/'plugins'/folder
@@ -219,7 +219,10 @@ p.mkdir(parents=True); (p/'dist').mkdir()
 for name,data in %r.items(): (p/name).write_bytes(base64.b64decode(data))
 manifest=json.loads((p/'plugin.json').read_text());manifest['name']='Framey VR Check '+folder
 (p/'plugin.json').write_text(json.dumps(manifest))
-(p/'.frame-control-store.json').write_text(json.dumps({'storeId':2000000001,'version':'local-vr-check'}))
+digest=hashlib.sha256()
+for name in ('plugin.json','main.py','dist/index.js'):
+ digest.update(name.encode()+b'\\0'+(p/name).read_bytes())
+(p/'.frame-control-store.json').write_text(json.dumps({'storeId':2000000001,'version':'local-vr-check','sha256':digest.hexdigest()}))
 print(json.dumps({'created':True}))
 ''' % (folder, files)
            remote.python(source)
@@ -112,25 +112,28 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
        self.assertFalse(job.get('error'), job)
        self.assertEqual(ok('GET', '/api/decky')['plugins'][0]['version'], '1.0.0')
        self.assertIn('Sample 1.0.0', ssh('cat ~/.local/share/frame-control/decky/plugins/sample-panel/dist/index.js'))
+        receipt = HASHES[0]
+        def framey_call(body):
+            return ok('POST', '/api/framey/method', dict(body, receipt=receipt))
        status, _, _ = api('POST', '/api/framey/method', {'id':999,'method':'get_setting','args':[]},
                           headers={'X-Frame-UI':''})
        self.assertEqual(status, 403)
        status, _, _ = api('POST', '/api/framey/method', {'id':999,'method':'x;alert(1)','args':[]})
        self.assertEqual(status, 400)
-        self.assertEqual(ok('POST', '/api/framey/method',
+        self.assertEqual(framey_call(
                            {'id':999,'method':'get_setting','args':['theme','dark']})['result'], 'dark')
-        self.assertTrue(ok('POST', '/api/framey/method',
+        self.assertTrue(framey_call(
                           {'id':999,'method':'set_setting','args':['theme','light']})['result'])
-        self.assertEqual(ok('POST', '/api/framey/method',
+        self.assertEqual(framey_call(
                            {'id':999,'method':'get_setting','args':['theme','dark']})['result'], 'light')

-        self.assertEqual(ok('POST', '/api/framey/method',
+        self.assertEqual(framey_call(
                            {'id':999,'method':'get_setting','args':[{'key':'theme','default':'dark'}],
                             'legacy':True})['result'], {'success':True,'result':'light'})
-        self.assertEqual(ok('POST', '/api/framey/method',
+        self.assertEqual(framey_call(
                            {'id':999,'method':'set_setting','args':[{'key':'legacy','value':'saved'}],
                             'legacy':True})['result'], {'success':True,'result':True})
-        self.assertEqual(ok('POST', '/api/framey/method',
+        self.assertEqual(framey_call(
                            {'id':999,'method':'get_setting','args':['legacy','default']})['result'], 'saved')

        StoreFixture.release = 1
@@ -138,7 +141,12 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                          {'action':'update','id':999,'acknowledged':True}))
        self.assertFalse(job.get('error'), job)
        self.assertEqual(ok('GET', '/api/decky')['plugins'][0]['version'], '1.1.0')
-        self.assertEqual(ok('POST', '/api/framey/method',
+        status, stale_reply, _ = api('POST', '/api/framey/method',
+            {'id':999,'receipt':receipt,'method':'get_setting','args':['theme','dark']})
+        self.assertEqual(status, 400)
+        self.assertIn('changed', str(stale_reply))
+        receipt = HASHES[1]
+        self.assertEqual(framey_call(
                            {'id':999,'method':'get_setting','args':['theme','dark']})['result'], 'light')
        job = finished(ok('POST', '/api/decky/plugin',
                          {'action':'remove','id':999,'acknowledged':True}))
@@ -151,7 +159,7 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
        job = finished(ok('POST', '/api/decky/plugin',
                          {'action':'install','id':999,'acknowledged':True}))
        self.assertFalse(job.get('error'), job)
-        self.assertEqual(ok('POST', '/api/framey/method',
+        self.assertEqual(framey_call(
                            {'id':999,'method':'get_setting','args':['theme','dark']})['result'], 'light')
        stale = finished(ok('POST', '/api/decky/plugin',
                            {'action':'update','id':999,'sha256':HASHES[0],
@@ -3,7 +3,7 @@ import {readFileSync} from 'node:fs';
 import vm from 'node:vm';

 const source=readFileSync(new URL('../../ui/framey-host.js',import.meta.url),'utf8');
-const testSource=source.replace(/\n  start\(\);\n\}\)\(\);\s*$/, '\n  window.__surface=PluginSurface; window.__legacy=legacyServerAPI; window.__library=setLibrarySnapshot;\n})();');
+const testSource=source.replace(/\n  start\(\);\n\}\)\(\);\s*$/, '\n  window.__surface=PluginSurface; window.__legacy=legacyServerAPI; window.__library=setLibrarySnapshot; window.__running=setRunningSnapshot; window.__refreshRunning=refreshRunning;\n})();');
 assert.notEqual(testSource,source);
 const states=[];
 const React={Fragment:'fragment',Component:class {},createElement:(type,props,...children)=>({type,props:props||{},children}),
@@ -24,6 +24,9 @@ const context=vm.createContext({window,document:{getElementById:id=>{
  navigator:{language:'en'}, parent,DOMException,addEventListener:(type,handler)=>listeners.push({type,handler}),
  setTimeout:()=>1,clearTimeout(){}});
 vm.runInContext(testSource,context);
+// No Steam React tree exists inside the isolated Framey iframe.
+assert.equal(window.DFL.getReactRoot({}),null);
+assert.equal(window.DFL.findInReactTree(window.DFL.getReactRoot(null),()=>true),null);
 // Official @decky/rollup bundles use the automatic JSX runtime, including keyed lists.
 const jsx=window.SP_JSX.jsx('p',{id:'message',children:'Saved'},'message-key');
 assert.equal(jsx.type,'p');
@@ -254,6 +257,7 @@ assert.equal(window.SteamClient.System.ShutdownPC,undefined);
 assert.equal(window.DFL.Router.MainRunningApp,undefined);
 assert.equal(window.DFL.Router.RunningApps.length,0);
 assert.equal(window.DFL.Router.RunningApps,window.SteamUIStore.RunningApps);
+assert.equal(window.SteamUIStore.FrameyRunningAvailable,false);
 assert.ok(Object.isFrozen(window.SteamUIStore));
 assert.ok(Object.isFrozen(window.SuspendResumeStore));
 assert.equal(window.SuspendResumeStore.InitiateSleep,undefined);
@@ -283,6 +287,46 @@ for(const invalid of [null,{apps:[],gameIds:[10]},
  assert.throws(()=>window.__library(invalid),/Invalid Steam/);
  assert.equal(window.appStore.allApps[0].display_name,'Plugin-local patch');
 }
+const running={artwork:[[10,'https://shared.steamstatic.com/steam/apps/10/library.jpg',[]]],apps:[snapshot.apps[0]],runningIds:[10],mainAppId:10,events:[],cursor:0,lifetimeAvailable:true};
+const lifetimes=[];
+const lifetimeHandle=window.SteamClient.GameSessions.RegisterForAppLifetimeNotifications(event=>{
+  lifetimes.push({...event,running:Array.from(window.DFL.Router.RunningApps,app=>app.appid)});
+});
+window.__running(running);await Promise.resolve();
+assert.equal(lifetimes.length,0); // Initial snapshots are not launch events.
+assert.equal(window.SteamUIStore.FrameyRunningAvailable,true);
+assert.equal(window.DFL.Router.MainRunningApp.display_name,'Game Ten');
+assert.equal(window.appStore.GetVerticalCapsuleURLForApp({appid:10}),'https://shared.steamstatic.com/steam/apps/10/library.jpg');
+assert.equal(window.appStore.GetCustomVerticalCapsuleURLs({appid:10}).length,0);
+assert.equal(window.DFL.Router.RunningApps,window.SteamUIStore.RunningApps);
+window.DFL.Router.MainRunningApp.display_name='Detached';
+assert.equal(running.apps[0][1],'Game Ten');
+const launch={...running,events:[{sequence:1,unAppID:10,bRunning:true}],cursor:1};
+window.__running(launch);await Promise.resolve();
+assert.equal(lifetimes.length,1);assert.deepEqual(lifetimes[0].running,[10]);
+window.__running(launch);await Promise.resolve();assert.equal(lifetimes.length,1);
+for(const invalid of [null,{...running,runningIds:[99]}, {...running,mainAppId:99},
+  {...running,runningIds:[10,10]}, {...running,artwork:[[10,'file:///private',[]]]}, {...running,cursor:-1},
+  {...running,events:[{sequence:1,unAppID:10,bRunning:'yes'}],cursor:1}]){
+  assert.throws(()=>window.__running(invalid),/Invalid Steam/);
+  assert.equal(window.DFL.Router.RunningApps.length,1);
+}
+const exited={...running,artwork:[],apps:[],runningIds:[],mainAppId:null,
+  events:[{sequence:2,unAppID:10,bRunning:false}],cursor:2};
+window.__running(exited);await Promise.resolve();
+assert.deepEqual(lifetimes[1].running,[]);assert.equal(lifetimes[1].bRunning,false);
+lifetimeHandle.unregister();lifetimeHandle();
+window.__running({...launch,cursor:3,events:[{sequence:3,unAppID:10,bRunning:true}]});
+await Promise.resolve();assert.equal(lifetimes.length,2);
+// A failed live read clears stale running context without inventing an exit.
+const refresh=window.__refreshRunning();
+const runningRequest=messages.at(-1);assert.equal(runningRequest.type,'framey:running');
+listeners.find(l=>l.type==='message').handler({source:parent,data:{type:'framey:reply',id:runningRequest.id,error:'offline'}});
+await refresh;
+assert.equal(window.SteamUIStore.FrameyRunningAvailable,false);
+assert.equal(window.DFL.Router.RunningApps.length,0);
+assert.equal(window.DFL.Router.MainRunningApp,undefined);
+assert.equal(lifetimes.length,2);
 for(const register of [window.SteamClient.System.UI.RegisterForSystemKeyEvents,
  window.SteamClient.Apps.RegisterForGameActionUserRequest]){
  const dispose=register(()=>eventCount++);assert.equal(dispose.unregister,dispose);dispose();
@@ -359,3 +403,13 @@ assert.throws(()=>api.addEventListener('bad event',callback),/Invalid Decky even
 assert.throws(()=>api.addEventListener('tick',null),/Invalid Decky event/);
 listeners.find(x=>x.type==='unload').handler();
 assert.equal(messages.at(-1).type,'framey:events:close');
+const finalRefresh=window.__refreshRunning();
+assert.equal(window.__refreshRunning(),finalRefresh,'Running reads must not overlap');
+const finalRequest=messages.at(-1);
+listeners.find(x=>x.type==='pagehide').handler();
+assert.equal(messages.at(-1).type,'framey:running:close');
+onMessage({source:parent,data:{type:'framey:reply',id:finalRequest.id,result:launch}});
+await finalRefresh;
+assert.equal(window.SteamUIStore.FrameyRunningAvailable,false,'Closed panels ignore late snapshots');
+const messageCount=messages.length;
+await window.__refreshRunning();assert.equal(messages.length,messageCount);
@@ -19,7 +19,7 @@ const parent=vm.createContext({document:{getElementById:el,createElement:()=>({}
  window:{addEventListener:(type,fn)=>parentListeners.push({type,fn})},
  setTimeout(){},setInterval(){},fetch(){throw Error('No network expected');},console});
 vm.runInContext(parentSource,parent);
-vm.runInContext('deckyState={plugins:[{storeId:14}]};openFrameyPanel(14,"Steam Status")',parent);
+vm.runInContext('deckyState={running:true,plugins:[{storeId:14,sha256:"a",version:"1"}]};openFrameyPanel(14,"Steam Status")',parent);
 let session=vm.runInContext('frameySession',parent);
 const firstURL=new URL(el('frameyFrame').src,'http://127.0.0.1');
 const onParent=parentListeners.find(x=>x.type==='message').fn;
@@ -15,7 +15,7 @@ const context=vm.createContext({document:{getElementById:el,createElement:()=>({
  setTimeout(){},setInterval(){},console,
  fetch:(path,options)=>new Promise(resolve=>requests.push({path,body:JSON.parse(options.body),resolve}))});
 vm.runInContext(source,context);
-vm.runInContext('deckyState={plugins:[{storeId:96}]};openFrameyPanel(96,"Timer")',context);
+vm.runInContext('deckyState={running:true,plugins:[{storeId:96,sha256:"'+'a'.repeat(64)+'",version:"1"}]};openFrameyPanel(96,"Timer")',context);
 let session=vm.runInContext('frameySession',context);
 const onMessage=listeners.find(x=>x.type==='message').fn;
 const send=(data,origin=frame)=>onMessage({source:origin,data});
@@ -28,6 +28,7 @@ const first=send(subscription);
 assert.equal(requests.length,1);
 assert.equal(requests[0].path,'/api/framey/events');
 assert.equal(requests[0].body.id,96);
+assert.equal(requests[0].body.receipt,'a'.repeat(64));
 assert.equal(requests[0].body.session,session);
 // WindowProxy survives navigation: stale same-plugin replies need a session check.
 vm.runInContext('openFrameyPanel(96,"Timer")',context);
@@ -35,6 +36,7 @@ const secondSession=vm.runInContext('frameySession',context);
 assert.notEqual(secondSession,session);
 assert.equal(requests[1].body.events.length,0); // Closes only the original subscription.
 assert.equal(requests[1].body.session,session);
+assert.equal(requests[1].body.receipt,'a'.repeat(64));
 requests[0].resolve({ok:true,json:async()=>({events:[{event:'tick',args:[42]}],cursor:1})});
 await first;assert.equal(replies.length,0);
 await send({type:'framey:call',id:2,session,method:'cancel_timer',args:[]});
@@ -59,6 +61,7 @@ await send(steamRead,{});
 assert.equal(requests.length,initialCount);
 const read=send(steamRead);
 assert.equal(requests.at(-1).path,'/api/framey/steam');assert.equal(requests.at(-1).body.id,96);
+assert.equal(requests.at(-1).body.receipt,'a'.repeat(64));
 requests.at(-1).resolve({ok:true,json:async()=>({result:'AU'})});
 await read;assert.equal(replies.at(-1).result,'AU');
 const staleRead=send({...steamRead,id:11});
@@ -66,3 +69,30 @@ vm.runInContext('openFrameyPanel(96,"Timer")',context);
 const priorReplies=replies.length;
 requests.at(-1).resolve({ok:true,json:async()=>({result:'AU'})});
 await staleRead;assert.equal(replies.length,priorReplies);
+
+// Running reads are tied to the current iframe and session, with no method path.
+session=vm.runInContext('frameySession',context);
+const running={type:'framey:running',id:20,session,args:[0]};
+const beforeRunning=requests.length;
+for(const change of [{session:'old'},{args:[-1]},{args:[true]},{args:[0,'extra']}])
+  await send({...running,...change});
+await send(running,{});assert.equal(requests.length,beforeRunning);
+const pendingRunning=send(running);
+assert.equal(requests.at(-1).path,'/api/framey/running');
+assert.equal(requests.at(-1).body.active,true);
+assert.equal(requests.at(-1).body.receipt,'a'.repeat(64));
+const oldRunning=requests.at(-1);
+vm.runInContext('openFrameyPanel(96,"Timer")',context);
+assert.equal(requests.at(-1).body.active,false);
+assert.equal(requests.at(-1).body.receipt,'a'.repeat(64));
+assert.equal(requests.at(-1).body.session,session);
+const beforeStaleReply=replies.length;
+oldRunning.resolve({ok:true,json:async()=>({result:{apps:[],events:[],cursor:0}})});
+await pendingRunning;assert.equal(replies.length,beforeStaleReply);
+session=vm.runInContext('frameySession',context);
+const finalRunning=send({...running,id:21,session});
+requests.at(-1).resolve({ok:true,json:async()=>({result:{apps:[],events:[],cursor:0}})});
+await finalRunning;
+await send({type:'framey:running:close',session});
+assert.equal(requests.at(-1).body.receipt,'a'.repeat(64));
+assert.equal(requests.at(-1).body.active,false);
@@ -0,0 +1,56 @@
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import vm from 'node:vm';
+
+// Real Frame getter source and unregister-handle shape were probed over SSH.
+// Nonempty rows and launch/exit notifications here are explicit test fixtures.
+const source=readFileSync(new URL('../../ui/framey-running.js',import.meta.url),'utf8');
+const listeners=new Set(),timers=new Map();let now=1000,nextTimer=0;
+const api={RegisterForAppLifetimeNotifications(listener){
+  listeners.add(listener);return {unregister:()=>listeners.delete(listener)};
+}};
+const app={appid:10,display_name:'Test game',sort_as:'test',app_type:1,gameid:'10',
+  minutes_playtime_forever:30,minutes_playtime_last_two_weeks:5,rt_last_time_played:123,
+  private_path:'PRIVATE',owner:'PRIVATE'};
+const window={SteamClient:{GameSessions:api},SteamUIStore:{RunningApps:[app],MainRunningApp:app}};
+window.appStore={GetVerticalCapsuleURLForApp:()=> 'https://shared.steamstatic.com/steam/apps/10/library.jpg?t=123',
+  GetCustomVerticalCapsuleURLs:()=>['file:///PRIVATE/path','https://example.com/PRIVATE','https://shared.steamstatic.com/steam/apps/10/custom.jpg']};
+const context=vm.createContext({window,URL,Date:{now:()=>now},
+  setInterval:fn=>{timers.set(++nextTimer,fn);return nextTimer;},clearInterval:id=>timers.delete(id)});
+const poll=(session='one',pluginId=13,active=true,cursor=0)=>
+  JSON.parse(JSON.stringify(vm.runInContext(source,context)({session,pluginId,active,cursor})));
+const emit=event=>{for(const listener of listeners)listener(event);};
+let data=poll();
+assert.deepEqual(data.apps,[[10,'Test game','test',1,'10',30,5,123]]);
+assert.deepEqual(data.artwork,[[10,'https://shared.steamstatic.com/steam/apps/10/library.jpg',['https://shared.steamstatic.com/steam/apps/10/custom.jpg']]]);
+assert.deepEqual(data.runningIds,[10]);assert.equal(data.mainAppId,10);
+assert.equal(data.lifetimeAvailable,true);assert.deepEqual(data.events,[]);
+assert.equal(listeners.size,1);
+// A nonempty snapshot does not invent a game launch notification.
+assert.equal(data.cursor,0);assert.deepEqual(poll().events,[]);
+emit({unAppID:10,bRunning:true,private_token:'PRIVATE'});
+assert.deepEqual(poll().events,[{sequence:1,unAppID:10,bRunning:true}]);
+assert.deepEqual(poll('one',13,true,1).events,[]);
+assert.equal(poll().events.length,1); // Retry a dropped HTTP response.
+assert.equal(listeners.size,1); // Polls never duplicate registration.
+poll('two',37);assert.equal(listeners.size,2);
+assert.throws(()=>poll('one',37),/another plugin/);
+for(const event of [{unAppID:'10',bRunning:true},{unAppID:10,bRunning:1},
+  {unAppID:NaN,bRunning:true},{unAppID:-1,bRunning:false}])emit(event);
+assert.equal(poll().cursor,1);
+for(let n=0;n<100;n++)emit({unAppID:10,bRunning:!!(n%2)});
+assert.equal(poll().events.length,64);
+assert.equal(poll().cursor,101);
+window.SteamUIStore.RunningApps=[];window.SteamUIStore.MainRunningApp=undefined;
+assert.deepEqual(poll().runningIds,[]);assert.equal(poll().mainAppId,null);
+assert.equal(poll().cursor,101); // Reading a closed game invents no exit event.
+assert.equal(poll('one',13,false),null);assert.equal(listeners.size,1);
+now+=16000;for(const timer of [...timers.values()])timer();
+assert.equal(listeners.size,0);assert.equal(timers.size,0);
+poll();assert.equal(listeners.size,1);
+window.SteamClient.GameSessions={...api};poll();assert.equal(listeners.size,1);
+poll('one',13,false);assert.equal(listeners.size,0);
+window.SteamUIStore.RunningApps=Array(65).fill(app);
+assert.throws(()=>poll(),/Too many/);assert.equal(listeners.size,0);
+window.SteamUIStore=undefined;
+assert.throws(()=>poll(),/unavailable/);assert.equal(listeners.size,0);
@@ -68,6 +68,7 @@ ctx.mockApi=async path => path==='/api/decky' ?
 vm.runInContext('api=mockApi',ctx);
 await vm.runInContext('refreshDecky()',ctx);
 assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,false);
+assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Open panel').disabled,true);
 el('deckySearch').value='';el('deckyStoreFilter').value='all';
 vm.runInContext('showDeckyStore()',ctx);
 assert.equal(el('deckyStoreList').children[1].children[1].disabled,true);
@@ -97,6 +98,7 @@ await vm.runInContext('deckyChange("install",{id:2,name:"Plugin 2",sha256:"a".re
 assert.equal(changes,1);
 assert.equal(session.has('frameyPluginJob'),true);
 assert.equal(el('deckyJobCheck').hidden,false);
+assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Open panel').disabled,true);
 assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,true);
 assert.equal(el('deckyStoreList').children[1].children[1].disabled,true);
 await vm.runInContext('deckyChange("remove",{id:2,name:"Plugin 2"})',ctx);
@@ -111,6 +113,7 @@ ctx.mockApi=async path => {
 vm.runInContext('api=mockApi',ctx);
 await vm.runInContext('checkDeckyJob()',ctx);
 assert.equal(session.has('frameyPluginJob'),false);
+assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Open panel').disabled,false);
 assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,false);
 assert.equal(el('deckyStoreList').children[1].children[1].disabled,false);

@@ -196,3 +199,48 @@ await staleFailure;
 assert.match(el('deckyInstalled').children[0].children[0].textContent,/Current/);
 assert.doesNotMatch(el('deckyState').textContent,/offline/);
 assert.equal(el('deckyStoreList').children[0].children[1].disabled,false);
+
+// A panel must not keep an old frontend after the installed receipt changes.
+let installedHash='a'.repeat(64);
+ctx.mockApi=async path => {
+  assert.equal(path,'/api/decky');
+  return {managed:true,running:true,plugins:[{storeId:2,name:'Plugin 2',version:'1.0',sha256:installedHash}]};
+};
+vm.runInContext('api=mockApi',ctx);
+await vm.runInContext('refreshDecky()',ctx);
+vm.runInContext('openFrameyPanel(2,"Plugin 2")',ctx);
+assert.equal(el('frameyPanel').hidden,false);
+await vm.runInContext('refreshDecky()',ctx);
+assert.equal(el('frameyPanel').hidden,false,'unchanged receipt keeps the current panel');
+installedHash='b'.repeat(64);
+await vm.runInContext('refreshDecky()',ctx);
+assert.equal(el('frameyPanel').hidden,true);
+assert.equal(el('frameyFrame').src,undefined);
+assert.match(el('deckyState').textContent,/old plugin panel was closed/);
+
+// The panel closes before updating its own backend, and stale Open handlers
+// cannot recreate it while a job is active.
+vm.runInContext('openFrameyPanel(2,"Plugin 2")',ctx);
+assert.equal(el('frameyPanel').hidden,false);
+ctx.mockApi=async (path,body) => {
+  if(path==='/api/decky/plugin'){
+    assert.equal(el('frameyPanel').hidden,true);
+    vm.runInContext('openFrameyPanel(2,"Plugin 2")',ctx);
+    assert.equal(el('frameyPanel').hidden,true);
+    return {job:'job-update'};
+  }
+  if(path.startsWith('/api/job'))return {done:true,message:'Updated Plugin 2'};
+  if(path==='/api/decky')return {managed:true,running:true,
+    plugins:[{storeId:2,name:'Plugin 2',version:'2.0',sha256:'c'.repeat(64)}]};
+  throw Error(`unexpected ${path}`);
+};
+vm.runInContext('api=mockApi',ctx);
+await vm.runInContext('deckyChange("update",{id:2,name:"Plugin 2",sha256:"c".repeat(64)})',ctx);
+assert.equal(el('frameyPanel').hidden,true);
+assert.match(el('deckyJobStatus').textContent,/Old plugin panel closed; reopen it/);
+vm.runInContext('openFrameyPanel(2,"Plugin 2")',ctx);
+ctx.mockApi=async()=>{throw Error('offline');};
+vm.runInContext('api=mockApi',ctx);
+await vm.runInContext('refreshDecky()',ctx);
+assert.equal(el('frameyPanel').hidden,true);
+assert.match(el('deckyState').textContent,/panel was closed until status can be refreshed/);
@@ -440,6 +440,15 @@ sys.exit(255 if stop else 0)
 class Recording(unittest.TestCase):
    """The Recorder with the real record/finish/cleanup shell, run locally under bash."""

+    @classmethod
+    def setUpClass(cls):
+        # The Frame's Bash 5 returns >128 for a timed-out read, distinct from EOF.
+        # macOS Bash 3.2 returns 1 for both, so it would falsely simulate Stop.
+        result = subprocess.run(["bash", "-c", "(( BASH_VERSINFO[0] >= 4 ))"],
+                                capture_output=True, timeout=5)
+        if result.returncode:
+            raise unittest.SkipTest("Recording shell fixtures need Bash 4+ timeout semantics; macOS ships Bash 3.2")
+
    def setUp(self):
        self.dir = Path(tempfile.mkdtemp())
        self.addCleanup(shutil.rmtree, self.dir, ignore_errors=True)
@@ -138,6 +138,31 @@ class StoreTransaction(unittest.TestCase):
        self.assertNotEqual(result.returncode, 0)
        self.assertTrue(external.exists())

+    def test_installed_script_entrypoints_execute_without_zip_exec_bits(self):
+        data, _ = archive(extra=('Example/scripts/start.py',
+                                 b'#!/bin/sh\nprintf "Framey script: %s\\n" "$1"\n'))
+        result = self.apply('install', data)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        script = self.folder / 'scripts/start.py'
+        self.assertTrue(script.stat().st_mode & 0o100)
+        self.assertFalse(script.stat().st_mode & 0o6111 & ~0o100)
+        ran = subprocess.run([str(script), 'ready'], text=True, capture_output=True, timeout=5)
+        self.assertEqual(ran.returncode, 0, ran.stderr)
+        self.assertEqual(ran.stdout, 'Framey script: ready\n')
+        self.assertFalse((self.folder / 'plugin.json').stat().st_mode & 0o111)
+        self.assertFalse((self.folder / 'dist/index.js').stat().st_mode & 0o111)
+
+    def test_declared_executable_is_owner_only_without_privilege_bits(self):
+        info = zipfile.ZipInfo('Example/bin/entrypoint')
+        info.create_system = 3
+        info.external_attr = 0o104777 << 16
+        data, _ = archive(extra=(info, b'entrypoint payload'))
+        result = self.apply('install', data)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        executable = self.folder / 'bin/entrypoint'
+        self.assertEqual(executable.stat().st_mode & 0o6111, 0o100)
+        self.assertEqual(executable.read_bytes(), b'entrypoint payload')
+
    def test_remove_while_service_is_stopped_does_not_restart_it(self):
        data, _ = archive()
        self.assertEqual(self.apply('install', data).returncode, 0)
@@ -18,11 +18,61 @@ import framey_panel
 import frame_headset
 import server

+RECEIPT = 'a' * 64
+

 class Panel(unittest.TestCase):
+    def test_running_queue_and_host_contract(self):
+        result = subprocess.run(['node', str(Path(__file__).parent/'page/framey_running.mjs')],
+                                capture_output=True, text=True, timeout=10)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_running_bridge_is_installed_scoped_bounded_and_headset_only(self):
+        def fake_ssh(command, stdin, **_):
+            self.assertEqual(command, 'python3 -')
+            compile(stdin, '<running read>', 'exec')
+            self.assertIn('RegisterForAppLifetimeNotifications', stdin)
+            self.assertIn('262144', stdin)
+            self.assertNotIn('__FRAMEY_STEAM_', stdin)
+            return '{"result":{"apps":[],"events":[],"cursor":0}}'
+        with patch.object(framey_panel.frame_decky, 'status', return_value={'plugins':[{'storeId':13,'sha256':'a'*64}]}):
+            self.assertEqual(framey_panel.poll_running(fake_ssh,13,'test-1',True,receipt='a'*64)['result']['cursor'],0)
+            for plugin_id,session,active,cursor in [(True,'test',True,0),(0,'test',True,0),
+                    (14,'test',True,0),(13,'bad session',True,0),(13,'test',1,0),
+                    (13,'test',True,True),(13,'test',True,-1),(13,'test',True,2**53)]:
+                with self.subTest(args=(plugin_id,session,active,cursor)):
+                    with self.assertRaises(framey_panel.PanelError):
+                        framey_panel.poll_running(lambda *a,**k:self.fail('Unexpected SSH'),
+                                                  plugin_id,session,active,cursor,receipt='a'*64)
+        with patch.object(server, 'HEADSET_RUNTIME', False), patch.dict(server.os.environ, {'FRAME_E2E_CONTAINER':'0'}):
+            with self.assertRaises(server.Failure):
+                server.framey_running_action({'id':13,'session':'test','active':True})
+        with patch.object(server, 'HEADSET_RUNTIME', True), patch.object(framey_panel, 'poll_running',return_value={'result':None}) as poll:
+            self.assertEqual(server.framey_running_action({'id':13,'session':'test','active':False,'receipt':'a'*64}),{'result':None})
+            poll.assert_called_once_with(server.ssh,13,'test',False,0,'a'*64)
+
+    def test_running_rejects_stale_or_missing_receipt_after_plugin_replacement(self):
+        installed = {'storeId':13,'sha256':'a'*64}
+        def safe_ssh(command, stdin, **_):
+            self.assertEqual(command,'python3 -')
+            compile(stdin,'<running read>','exec')
+            return '{"result":null}'
+        with patch.object(framey_panel.frame_decky,'status',side_effect=lambda _: {'plugins':[installed]}):
+            framey_panel.poll_running(safe_ssh,13,'old-panel',True,receipt='a'*64)
+            installed['sha256'] = 'b'*64  # Another manager replaces the installed plugin.
+            for active in (True,False):
+                for receipt in (None,'','bad','a'*64):
+                    with self.subTest(active=active,receipt=receipt):
+                        with self.assertRaisesRegex(framey_panel.PanelError,'receipt|changed'):
+                            framey_panel.poll_running(lambda *a,**k:self.fail('Stale running request reached CEF'),
+                                                      13,'old-panel',active,receipt=receipt)
+            # A reopened panel uses the new receipt for both polling and cleanup.
+            framey_panel.poll_running(safe_ssh,13,'new-panel',True,receipt='b'*64)
+            framey_panel.poll_running(safe_ssh,13,'new-panel',False,receipt='b'*64)
+
    def test_steam_reads_are_allowlisted_and_installed_only(self):
        with patch.object(framey_panel.frame_decky, 'status', return_value={
-                'plugins':[{'storeId':81,'name':'IsThereAnyDeal for Deck'}]}):
+                'plugins':[{'storeId':81,'name':'IsThereAnyDeal for Deck','sha256':RECEIPT}]}):
            for method, expression in framey_panel.STEAM_READS.items():
                def fake_ssh(command, stdin, **_):
                    self.assertEqual(command, 'python3 -')
@@ -30,13 +80,16 @@ class Panel(unittest.TestCase):
                    self.assertIn(expression.replace('\n', r'\n'), stdin)
                    self.assertNotIn('__FRAMEY_STEAM_READ__', stdin)
                    return '{"result":"actual read"}'
-                self.assertEqual(framey_panel.read_steam(fake_ssh,81,method)['result'], 'actual read')
+                self.assertEqual(framey_panel.read_steam(fake_ssh,81,method,RECEIPT)['result'], 'actual read')
            for plugin_id, method in [(True,'GetIPCountry'), (0,'GetIPCountry'),
                    (82,'GetIPCountry'), (81,'ShutdownPC'), (81,'User.GetIPCountry'),
                    (81,[]), (81,'GetIPCountry();alert(1)')]:
                with self.subTest(plugin_id=plugin_id, method=method):
                    with self.assertRaises(framey_panel.PanelError):
-                        framey_panel.read_steam(lambda *a,**k:self.fail('Unexpected SSH'),plugin_id,method)
+                        framey_panel.read_steam(lambda *a,**k:self.fail('Unexpected SSH'),plugin_id,method,RECEIPT)
+            with self.assertRaisesRegex(framey_panel.PanelError, 'changed'):
+                framey_panel.read_steam(lambda *a,**k:self.fail('Stale read reached SSH'),
+                                        81,'GetIPCountry','b'*64)

    def test_steam_read_response_limit_and_socket_cleanup(self):
        from types import SimpleNamespace
@@ -86,19 +139,19 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
            self.assertEqual(json.loads(ast.literal_eval(assignment.value.args[0]))['args'],args)
            return '{"result":null}'
        with patch.object(framey_panel.frame_decky,'status',return_value={
-                'plugins':[{'storeId':53,'name':'Shotty'}]}):
+                'plugins':[{'storeId':53,'name':'Shotty','sha256':RECEIPT}]}):
            self.assertEqual(framey_panel.call_method(fake_ssh,
-                53,'set_id_map_fronend',args,True),{'result':None})
+                53,'set_id_map_fronend',args,True,RECEIPT),{'result':None})
        with self.assertRaisesRegex(framey_panel.PanelError,'too large'):
            framey_panel.call_method(lambda *a,**k:self.fail('Unexpected SSH'),
-                53,'set_id_map_fronend',[{'allapps':'x'*(256*1024)}],True)
+                53,'set_id_map_fronend',[{'allapps':'x'*(256*1024)}],True,RECEIPT)

    def test_steam_reads_have_the_headset_service_boundary(self):
        with patch.object(server,'HEADSET_RUNTIME',False), patch.dict(server.os.environ,{'FRAME_E2E_CONTAINER':'0'}):
            with self.assertRaises(server.Failure):server.framey_steam_action({'id':81,'method':'GetIPCountry'})
        with patch.object(server,'HEADSET_RUNTIME',True), patch.object(framey_panel,'read_steam',return_value={'result':'AU'}) as read:
-            self.assertEqual(server.framey_steam_action({'id':81,'method':'GetIPCountry'}),{'result':'AU'})
-            read.assert_called_once_with(server.ssh,81,'GetIPCountry')
+            self.assertEqual(server.framey_steam_action({'id':81,'method':'GetIPCountry','receipt':RECEIPT}),{'result':'AU'})
+            read.assert_called_once_with(server.ssh,81,'GetIPCountry',RECEIPT)

    def test_decky_event_queue_scope_bounds_expiry_and_reconnect(self):
        for name in ('framey_events.mjs', 'framey_event_parent.mjs'):
@@ -117,8 +170,11 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
            self.assertIn('loader/plugin_event', stdin)
            return json.dumps({'events':[{'event':'timer:tick', 'args':[42]}], 'cursor':6})
        with patch.object(framey_panel.frame_decky, 'status', return_value={
-            'plugins':[{'storeId':96,'name':'Simple Timer'}]}):
-            self.assertEqual(framey_panel.poll_events(fake_ssh, 96, 'test-123.45', ['timer:tick'], 5)['cursor'], 6)
+            'plugins':[{'storeId':96,'name':'Simple Timer','sha256':RECEIPT}]}):
+            self.assertEqual(framey_panel.poll_events(fake_ssh, 96, 'test-123.45', ['timer:tick'], 5, RECEIPT)['cursor'], 6)
+            with self.assertRaisesRegex(framey_panel.PanelError, 'changed'):
+                framey_panel.poll_events(lambda *a,**k:self.fail('Stale poll reached SSH'),
+                                         96,'test-123.45',['timer:tick'],5,'b'*64)
            for plugin_id, session, events, cursor in [
                (True,'test',['tick'],0), (96,'bad session',['tick'],0),
                (96,'test',['a']*33,0), (96,'test',['bad event'],0),
@@ -129,7 +185,7 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
                with self.subTest(plugin_id=plugin_id, session=session, events=events, cursor=cursor):
                    with self.assertRaises(framey_panel.PanelError):
                        framey_panel.poll_events(lambda *a, **k:self.fail('Unexpected SSH'),
-                                                plugin_id, session, events, cursor)
+                                                plugin_id, session, events, cursor, RECEIPT)

    def test_event_action_has_same_headset_boundary_as_methods(self):
        with patch.object(server, 'HEADSET_RUNTIME', False), patch.dict(server.os.environ, {'FRAME_E2E_CONTAINER':'0'}):
@@ -137,8 +193,8 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
                server.framey_events_action({'id':96,'session':'test','events':['tick']})
        with patch.object(server, 'HEADSET_RUNTIME', True), \
             patch.object(framey_panel, 'poll_events', return_value={'events':[], 'cursor':0}) as poll:
-            self.assertEqual(server.framey_events_action({'id':96,'session':'test','events':['tick']})['events'], [])
-            poll.assert_called_once_with(server.ssh, 96, 'test', ['tick'], 0)
+            self.assertEqual(server.framey_events_action({'id':96,'session':'test','events':['tick'],'receipt':RECEIPT})['events'], [])
+            poll.assert_called_once_with(server.ssh, 96, 'test', ['tick'], 0, RECEIPT)

    def test_opaque_origin_plugin_cache_is_scoped_and_bounded(self):
        result = subprocess.run(['node', str(Path(__file__).parent/'page/framey_cache.mjs')],
@@ -220,12 +276,12 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
            self.assertIn('loader/call_legacy_plugin_method', stdin)
            return json.dumps({'result':{'success':True, 'result':'dark'}})
        with patch.object(framey_panel.frame_decky, 'status', return_value={
-            'plugins':[{'storeId':14,'name':'Legacy'}]}):
-            self.assertEqual(framey_panel.call_method(fake_ssh, 14, 'read_setting', [{'key':'mode'}], True),
+            'plugins':[{'storeId':14,'name':'Legacy','sha256':RECEIPT}]}):
+            self.assertEqual(framey_panel.call_method(fake_ssh, 14, 'read_setting', [{'key':'mode'}], True, RECEIPT),
                             {'result':{'success':True, 'result':'dark'}})
            for args, legacy in [([],True), ([[]],True), ([{},{}],True), ([{}],'true')]:
                with self.assertRaises(framey_panel.PanelError):
-                    framey_panel.call_method(fake_ssh, 14, 'read_setting', args, legacy)
+                    framey_panel.call_method(fake_ssh, 14, 'read_setting', args, legacy, RECEIPT)

    def test_unsupported_root_symlink_and_unmanaged_are_refused(self):
        manifest = self.folder/'plugin.json'
@@ -255,11 +311,15 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
            self.assertNotIn('__FRAMEY_METHOD_PAYLOAD__',stdin)
            return json.dumps({'result':{'theme':'dark'}})
        with patch.object(framey_panel.frame_decky, 'status', return_value={
-            'plugins':[{'storeId':14,'name':'ProtonDB Badges'}]}):
-            self.assertEqual(framey_panel.call_method(fake_ssh,14,'get_setting',['theme','dark']),
+            'plugins':[{'storeId':14,'name':'ProtonDB Badges','sha256':RECEIPT}]}):
+            self.assertEqual(framey_panel.call_method(fake_ssh,14,'get_setting',['theme','dark'],receipt=RECEIPT),
                             {'result':{'theme':'dark'}})
-            with self.assertRaises(framey_panel.PanelError): framey_panel.call_method(fake_ssh,15,'get_setting',[])
-            with self.assertRaises(framey_panel.PanelError): framey_panel.call_method(fake_ssh,14,'x;alert(1)',[])
+            with self.assertRaises(framey_panel.PanelError): framey_panel.call_method(fake_ssh,15,'get_setting',[],receipt=RECEIPT)
+            with self.assertRaises(framey_panel.PanelError): framey_panel.call_method(fake_ssh,14,'x;alert(1)',[],receipt=RECEIPT)
+            for stale in (None, 'b' * 64, 'invalid'):
+                with self.subTest(stale=stale), self.assertRaisesRegex(framey_panel.PanelError, 'receipt|changed'):
+                    framey_panel.call_method(lambda *a, **k:self.fail('Stale receipt reached SSH'),
+                                             14,'get_setting',[],receipt=stale)
        compile(framey_panel.METHOD_SCRIPT.replace('__FRAMEY_METHOD_PAYLOAD__',repr('{}')), '<remote method>', 'exec')

    def test_headset_bundle_contains_runtime_and_licenses(self):
@@ -269,7 +329,7 @@ assert.throws(()=>eval(EXPRESSION),/library is unavailable/);
        with tarfile.open(fileobj=io.BytesIO(gzip.decompress(packed))) as archive:
            names = set(archive.getnames())
        self.assertTrue({'ui/framey_panel.py','ui/framey-host.js',
-                         'ui/framey-events.js',
+                         'ui/framey-events.js','ui/framey-running.js',
                         'ui/vendor/react-18.3.1.min.js','ui/vendor/react-dom-18.3.1.min.js',
                         'ui/vendor/REACT-LICENSE.txt','ui/vendor/REACT-DOM-LICENSE.txt'} <= names)

@@ -76,6 +76,8 @@ class NativeContracts(unittest.TestCase):
            frameworks = str(Path(developer) / "Platforms/MacOSX.platform/Developer/Library/Frameworks")
            libraries = str(Path(developer) / "Platforms/MacOSX.platform/Developer/usr/lib")
            shared = str(Path(developer).parent / "SharedFrameworks")
+            if not (Path(frameworks) / "XCTest.framework").is_dir():
+                self.skipTest("Foundation XCTest contracts need full Xcode; Command Line Tools lack XCTest")
            result = subprocess.run(["swiftc", "-I", libraries, "-L", libraries, "-F", frameworks, "-Xlinker", "-rpath", "-Xlinker", frameworks,
                                     "-Xlinker", "-rpath", "-Xlinker", libraries,
                                     "-Xlinker", "-rpath", "-Xlinker", shared,
@@ -131,14 +131,14 @@ class ObsSourceTests(unittest.TestCase):
            wrapper = ("import importlib.util; "
                       f"s=importlib.util.spec_from_file_location('obs', {str(SCRIPT)!r}); "
                       "o=importlib.util.module_from_spec(s);s.loader.exec_module(o); "
-                       "o.STARTUP_TIMEOUT=o.STREAM_STALL=o.CHILD_STOP_TIMEOUT=0.15; "
+                       "o.STARTUP_TIMEOUT=5; o.STREAM_STALL=o.CHILD_STOP_TIMEOUT=0.15; "
                       "o.main(['--frame','fake-frame','--control-stdin'])")
            env = {**os.environ, 'PATH': str(directory) + os.pathsep + os.environ.get('PATH', '')}
            process = subprocess.Popen([sys.executable, '-c', wrapper], stdin=subprocess.PIPE,
                                       stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, env=env)
            try:
                # Keep stdin OPEN: real Electron does this until the helper exits.
-                self.assertEqual(process.wait(timeout=4), 1)
+                self.assertEqual(process.wait(timeout=10), 1)
                error = process.stderr.read().decode(errors='replace')
                self.assertIn('video stopped', error)
                self.assertNotIn('Fatal Python error', error)
@@ -209,6 +209,7 @@ class ObsSourceTests(unittest.TestCase):
        for mode in ('startup', 'stream'):
            with self.subTest(mode=mode), tempfile.TemporaryDirectory() as folder:
                directory = Path(folder)
+                ready = directory / 'ready'
                fake = directory / 'ssh'
                fake.write_text("#!/usr/bin/env python3\n"
                                "import os, signal, sys, time\n"
@@ -219,12 +220,29 @@ class ObsSourceTests(unittest.TestCase):
                                "if os.environ['FAKE_SSH_MODE'] == 'stream':\n"
                                "    sys.stdout.buffer.write(b'G' * 1316)\n"
                                "    sys.stdout.buffer.flush()\n"
+                                "open(os.environ['FAKE_SSH_READY'], 'w').close()\n"
                                "while True: time.sleep(1)\n")
                fake.chmod(0o755)
                stopped = directory / 'stopped'
                env = {'PATH': str(directory) + os.pathsep + os.environ.get('PATH', ''),
-                       'FAKE_SSH_STOPPED': str(stopped), 'FAKE_SSH_MODE': mode}
+                       'FAKE_SSH_STOPPED': str(stopped), 'FAKE_SSH_MODE': mode,
+                       'FAKE_SSH_READY': str(ready)}
+                real_popen = subprocess.Popen
+
+                def start_ready(*args, **kwargs):
+                    proc = real_popen(*args, **kwargs)
+                    # Start the short watchdog clock after the stand-in installed
+                    # its handler, independent of native interpreter launch time.
+                    end = time.monotonic() + 5
+                    while not ready.exists() and proc.poll() is None and time.monotonic() < end:
+                        time.sleep(0.01)
+                    if not ready.exists():
+                        obs.stop_child(proc)
+                        self.fail('Stand-in SSH did not finish startup')
+                    return proc
+
                with mock.patch.dict(os.environ, env), \
+                     mock.patch.object(obs.subprocess, 'Popen', side_effect=start_ready), \
                     mock.patch.object(obs, 'STARTUP_TIMEOUT', 0.3), \
                     mock.patch.object(obs, 'STREAM_STALL', 0.3):
                    with self.assertRaisesRegex(RuntimeError, 'no OBS video' if mode == 'startup' else 'video stopped'):
@@ -529,9 +529,10 @@ class PanelsAsAFreshProcess(unittest.TestCase):
        self.assertNotIn("why", out)

    def test_slow_x_tools_stay_inside_the_servers_timeout(self):
-        # Review of #83: X tools answering in 4.6 s each would take well over the server's
-        # 20 s; one deadline for the run (PANELS_DEADLINE, 12 s) returns in time, saying why.
-        out, took = self.run_panels(4.6)
+        # Several 3 s calls exceed the whole-run deadline before a panel is complete.
+        # Keep clear of each tool's 5 s timeout, including process startup on Intel Macs.
+        # One deadline (12 s) must return inside the server's 20 s timeout, saying why.
+        out, took = self.run_panels(3)
        self.assertLess(took, 15, out)
        self.assertEqual(out["panels"], [])
        self.assertIn("took too long", out["why"])
@@ -192,6 +192,12 @@ class Probe(unittest.TestCase):
    @unittest.skipUnless(wireless.frame_host.WINDOWS, 'Live read-only Windows inventory runs on Windows CI')
    def test_live_windows_inventory(self):
        r = wireless.diagnose()
+        # Shared Windows runners can spend the entire probe budget starting
+        # PowerShell. Retry only that transient timeout; a second failure must
+        # still fail this live inventory gate.
+        if (r['state'] == 'unavailable' and
+                r.get('message') == 'Windows wireless inventory timed out. No settings were changed.'):
+            r = wireless.diagnose()
        self.assertIn(r['state'], ('ok', 'partial'), r)
        self.assertEqual(r['sources']['adapters'], 'ok', r['sources'])
        self.assertTrue(r['devices'], 'Windows runner should expose at least its virtual network interface')
@@ -177,6 +177,16 @@ try:
                seen.add(f.filename)
            stage.mkdir(mode=0o700)
            z.extractall(stage)
+            # zipfile drops execute bits. Legacy plugins also publish shebang
+            # entrypoints as 0644 because Decky's installer chmods recursively.
+            # Grant only owner execute for scripts or declared executables;
+            # never restore archive privilege/write bits or mark other data executable.
+            for member in files:
+                if member.is_dir(): continue
+                entry=stage/member.filename
+                with entry.open('rb') as source: script=source.read(2)==b'#!'
+                if script or (member.external_attr>>16)&0o111:
+                    entry.chmod(entry.stat().st_mode|0o100)
            unpacked=stage/folder
            if not unpacked.is_dir(): raise RuntimeError('Missing plugin folder')
            # Recheck under the transaction lock. Another store operation may
@@ -1,6 +1,6 @@
 {
  "schemaVersion": 1,
-  "checkedAtUtc": "2026-10-25T23:19:48.854504+00:00",
+  "checkedAtUtc": "2026-10-26T06:10:58.537029+00:00",
  "source": "https://plugins.deckbrew.xyz/plugins",
  "hostCommit": "779f9c5",
  "method": "Exact SHA-256 verified archives. All frontends attempted in opaque-iframe Chromium for 1.2 s with backend calls and network denied; ready means initializer only. Backend calls were denied in the baseline browser audit. Scoped live backend follow-ups are recorded separately in docs/framey-compatibility.md.",
@@ -580,7 +580,7 @@
        "https://github.com/wynn1212/SDH-PauseGames.git"
      ],
      "status": "partial",
-      "reason": "Settings render locally with inert system-key subscriptions and empty detached Steam context. Live-game discovery, process pause/resume and suspend integration are unsupported/unverified; no backend actions ran.",
+      "reason": "Settings and running-game list initialize in local Chromium with an explicit synthetic game; live Frame empty-list reads and lifetime registration/cleanup passed. Process pause/resume, automatic pausing and suspend integration remain unverified/unsupported; backend writes were denied.",
      "blockInstall": false,
      "verification": [
        "static archive",
@@ -613,6 +613,11 @@
        "sha256": "4aefdfb0ef25dea9c6d9fd037731c8b99ee8a1be966c2f7d5b0602112ef29f62",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -1006,7 +1011,7 @@
        "https://github.com/popsUlfr/SDH-Notebook.git"
      ],
      "status": "works",
-      "reason": "Default notebook drawing, save and reopen verified in Chromium with real Decky 3.3.0 ARM64, including backend restart. Per-game auto-selection and background artwork unavailable; worn-VR input unverified.",
+      "reason": "Default notebook drawing, save and reopen verified in Chromium with real Decky 3.3.0 ARM64, including backend restart. Running-game context is now supplied; per-game selection was attempted with a synthetic game and backend calls denied. Real per-game selection, background artwork and worn-VR input remain unverified.",
      "blockInstall": false,
      "verification": [
        "static archive",
@@ -1080,6 +1085,11 @@
          "existingNotesTouched": false
        },
        "method": "local Chromium + real Frame SSH; private actual Decky 3.3.0 ARM64 service"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -2870,8 +2880,8 @@
        "https://github.com/andrewburgess/steamdeck-discord-status",
        "https://github.com/andrewburgess/steamdeck-discord-status.git"
      ],
-      "status": "broken",
-      "reason": "Detached app overviews are now available, but RunningApps/lifetime observations and Steam artwork helpers still lack a live mapping. Discord activity integration remains unavailable/unverified.",
+      "status": "partial",
+      "reason": "Disconnected panel renders; running-activity construction accepts a synthetic game in local Chromium. Exact official is_connected returned false in real Decky 3.3.0 ARM64. Empty live running-list reads and lifetime registration/cleanup passed. Real game transitions, Discord shortcut detection/connection/activity, local custom artwork and worn VR remain unverified/unsupported.",
      "blockInstall": false,
      "verification": [
        "static archive",
@@ -2917,6 +2927,11 @@
        "evidence": "docs/evidence/framey-library-context-2026-10-26.json",
        "mode": "real Frame read-only CEF projection; local Chromium snapshot replay; scoped actual amd64 backends",
        "frontendReady": true
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -3404,6 +3419,11 @@
        "evidence": "docs/evidence/framey-library-context-2026-10-26.json",
        "mode": "real Frame read-only CEF projection; local Chromium snapshot replay; scoped actual amd64 backends",
        "frontendReady": true
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -3985,6 +4005,11 @@
        "sha256": "71dc21ce5f9f4ee0573bd927e9b444d45dc47327888ca78ed063c7bcc57bfac1",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -4030,8 +4055,8 @@
        "https://github.com/saumya-banthia/volume-boost",
        "https://github.com/saumya-banthia/volume-boost.git"
      ],
-      "status": "partial",
-      "reason": "Real Decky 3.3.0 ARM64 default-sink reads match independent Frame pactl channel volumes; controls render locally. Sliders/numeric writes passed on an isolated amd64 virtual sink only. Real default-sink writes, boost above 100%, audible output and worn VR unverified.",
+      "status": "works",
+      "reason": "Default-sink controls pass in local Chromium through real Decky 3.3.0 ARM64: linked slider/keyboard and numeric writes, separate channels, re-link and reopen, with independent Pulse readback including 125%/150% while muted. Exact original volume/mute restored. Audible output, Bluetooth sinks and worn VR unverified.",
      "blockInstall": false,
      "verification": [
        "static archive",
@@ -4159,12 +4184,13 @@
        "https://github.com/jessebofill/DeckWebBrowser.git"
      ],
      "status": "broken",
-      "reason": "Frontend audit failed: deckyFrontendLib.getReactRoot is not a function.",
+      "reason": "The exact frontend now initializes with a null Steam React-root lookup. The browser itself still requires Steam GamepadUI CDP injection and a backend WebSocket unavailable in Framey; no working browser tab was verified.",
      "blockInstall": false,
      "verification": [
        "static archive",
        "local browser",
-        "fake-Frame"
+        "fake-Frame",
+        "focused local browser"
      ],
      "browser": {
        "id": 59,
@@ -4216,6 +4242,17 @@
        "sha256": "1192864fddc5d72550346b8dff02c21d71f0c40a06ac41c4e67bb6220d267f9d",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "focusedBrowser": {
+        "hostChange": "DFL.getReactRoot returns null without exposing a Steam tree",
+        "ready": true,
+        "error": null,
+        "methods": [
+          "set_main_tab",
+          "load"
+        ],
+        "backendAndNetwork": "denied",
+        "scope": "initializer only; no usable browser tab or real backend verified"
      }
    },
    {
@@ -4447,6 +4484,11 @@
        "sha256": "e08333859a32b0c177b8e9a7959c5eeeafe38f946578f7f1d161c721f0e05da5",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -4964,7 +5006,7 @@
        "https://github.com/your-username/PlayTime"
      ],
      "status": "partial",
-      "reason": "Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. ARM64 backend, live MobX/running-game observations and automatic recording remain unverified/unsupported.",
+      "reason": "Statistics and routed settings render with a detached real Frame library/user snapshot and actual Decky 3.3.0 amd64 backend in isolation. User selection and empty statistics reads pass. Running snapshots are now exposed, but its private MobX observation is unsupported; automatic recording and ARM64 backend remain unverified.",
      "blockInstall": false,
      "verification": [
        "static archive",
@@ -5016,6 +5058,11 @@
        "evidence": "docs/evidence/framey-library-context-2026-10-26.json",
        "mode": "real Frame read-only CEF projection; local Chromium snapshot replay; scoped actual amd64 backends",
        "frontendReady": true
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -6470,13 +6517,15 @@
        "https://github.com/ebenbruyns/junkstore",
        "https://github.com/ebenbruyns/junkstore.git"
      ],
-      "status": "broken",
-      "reason": "Local CSS lookup fixes the loading view crash. Actual Decky 3.3.0 amd64 startup/static InitActions return a script execution/JSON error; the published scripts are not executable after extraction. Store install/login/game launch and ARM64 remain unverified.",
+      "status": "partial",
+      "reason": "Executable script extraction repaired. Official Decky 3.3.0 ARM64 static menu/backend calls and local Chromium Games/Epic navigation, back and reopen pass. About still fails on missing installed-app metadata; Legendary is absent. Dependency install, login, game operations, RSS and worn VR remain unverified. Existing installs need update/reinstall.",
      "blockInstall": false,
      "verification": [
        "static archive",
        "local browser",
-        "fake-Frame"
+        "fake-Frame",
+        "isolated Linux backend",
+        "real Frame SSH"
      ],
      "browser": {
        "id": 84,
@@ -6508,6 +6557,25 @@
        "sha256": "f7ad2a0103c85bf308929b2e96ec9aeeb0d76bcc6ae97eb1e4b5f31ffba0cbb1",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "localBackend": {
+        "runtime": "Decky 3.3.0 amd64",
+        "evidence": "docs/evidence/framey-script-entrypoints-2026-10-26.json",
+        "before": "init and InitActions return inner Type:Error",
+        "after": "init Type:Success; InitActions Type:ActionSet/MainMenu"
+      },
+      "realFrame": {
+        "runtime": "Decky 3.3.0 ARM64",
+        "evidence": "docs/evidence/framey-script-entrypoints-2026-10-26.json",
+        "staticActions": [
+          "JunkStoreActions/GetContent",
+          "JunkStoreActions/GetEpicActions",
+          "MainMenu/GetContent",
+          "MainMenu/JunkStoreInit",
+          "init/InitActions"
+        ],
+        "browser": "main menu; Games/Epic static tab; back; close/reopen",
+        "remainingFailure": "About: Cannot read properties of undefined (reading 'installed'); detached app overview lacks local_per_client_data.installed"
      }
    },
    {
@@ -6920,6 +6988,11 @@
        "sha256": "2d431a89826ed5cf3fd37258373eb3b46c841c39795aa8b25f83e59f4eee87c7",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -7289,6 +7362,11 @@
        "evidence": "docs/evidence/framey-library-context-2026-10-26.json",
        "mode": "real Frame read-only CEF projection; local Chromium snapshot replay; scoped actual amd64 backends",
        "frontendReady": true
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -7719,6 +7797,11 @@
        "sha256": "49309a02fa028d26c77230cc9f70fec9bcce91d59e887bfe8f9d3e42f8a19139",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -7906,6 +7989,11 @@
        "sha256": "b6c514d147cc46bad5331ca9da36628eb9c330976e13735687499a4a9f17f6d4",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -8607,6 +8695,11 @@
        "sha256": "8a69f45aadce763406b5c27bfef194761006d5e01c5e8841badeb13a27dd0d88",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -8716,6 +8809,11 @@
        "sha256": "65e021ebb37d2ebfbfbe3dbc8af95aef9556cf484730362c6b26c4ecc3e62ccd",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": false
      }
    },
    {
@@ -9710,6 +9808,11 @@
        "sha256": "ec59fc8aceb4e1abe2066b3a0707ed6313cabc4421b7c17765397903e2f8fd26",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -10845,6 +10948,11 @@
        "sha256": "17d4166a9e98979df5fdb07c7eae42317acd54a453d3b82757508f971193c0fe",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -11207,6 +11315,11 @@
        "sha256": "3def99993c412b669933376b6420e44c68cd1fe9d9baf14b77a1f231242bd7e8",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -11691,6 +11804,11 @@
        "sha256": "248294b5d6b9d5a5d635ce35f4b5185ce59d4e4fd59353e24df4b29d74c2ade4",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -13228,6 +13346,11 @@
        "sha256": "33fb674993c9b2bd119f0c6118c465e379f166ec1539c8183fcf7580f1d89577",
        "archiveValidation": "accepted",
        "result": "installed-removed"
+      },
+      "runningFollowUp": {
+        "evidence": "docs/evidence/framey-running-context-2026-10-26.json",
+        "mode": "synthetic nonempty running/library replay; backend and network denied",
+        "frontendReady": true
      }
    },
    {
@@ -15,7 +15,14 @@
  // user identity or suspend state in this isolated document.
  for (const name of ['App','appStore','appInfoStore','collectionStore']) window[name] = undefined;
  window.SuspendResumeStore = Object.freeze({});
-  window.SteamUIStore = Object.freeze({RunningApps:Object.freeze([]), MainRunningApp:undefined});
+  let runningApps = Object.freeze([]), mainRunningApp, runningAvailable = false;
+  let runningArtwork = new Map();
+  const runningListeners = new Set();
+  let runningCursor = 0, runningRequest = null, runningTimer = null, runningClosed = false;
+  window.SteamUIStore = Object.freeze({
+    get RunningApps() {return runningApps;}, get MainRunningApp() {return mainRunningApp;},
+    get FrameyRunningAvailable() {return runningAvailable;},
+  });
  // Steam normally fills these token maps. Official plugins can safely use
  // their own fallback strings when the isolated panel has no Steam tokens.
  window.LocalizationManager = {m_rgLocalesToUse:[navigator.language || 'en'],
@@ -359,7 +366,10 @@
    showModal, showContextMenu:showModal,
    // Steam app, library, and store patches have no target inside this panel.
    afterPatch:noPatch, beforePatch:noPatch, replacePatch:noPatch, createReactTreePatcher:noPatch,
-    findInReactTree: () => null, findModule, findModuleChild, findModuleDetailsByExport,
+    // The isolated panel has no Steam React root. Legacy plugins can inspect
+    // this null result and keep their own controls without patching Steam UI.
+    getReactRoot: () => null, findInReactTree: () => null,
+    findModule, findModuleChild, findModuleDetailsByExport,
    findModuleByExport:(filter, minExports)=>findModuleDetailsByExport(filter,minExports)[0],
    findModuleExport:(filter, minExports)=>findModuleDetailsByExport(filter,minExports)[1],
    createModuleMapping, findAllModules:filter=>[...createModuleMapping(filter).values()],
@@ -383,8 +393,8 @@
      PlayAudioURL:()=>{throw Error('Steam UI sound playback is not supported in Framey');},
    })}),
  })}));
-  // No Steam game is attached to an isolated panel. Subscriptions have a
-  // disposable handle but emit no fabricated game, power, or input events.
+  // Unsupported subscriptions remain inert. Lifetime callbacks below relay
+  // actual Steam notifications; no power, input or launch events are invented.
  const subscription = () => {const dispose=()=>{};dispose.unregister=dispose;return dispose;};
  const register = names => Object.fromEntries(names.map(name=>[name,subscription]));
  const steamLanguage = () => {
@@ -403,7 +413,14 @@
      ...register(['RegisterForSettingsChanges'])},
    Apps:register(['RegisterForAppDetails','RegisterForGameActionTaskChange',
      'RegisterForGameActionStart','RegisterForGameActionEnd','RegisterForGameActionUserRequest']),
-    GameSessions:register(['RegisterForAppLifetimeNotifications','RegisterForScreenshotNotification']),
+    GameSessions:{...register(['RegisterForScreenshotNotification']),
+      RegisterForAppLifetimeNotifications:listener=>{
+        if (typeof listener !== 'function') throw Error('Invalid Steam lifetime listener');
+        if (runningListeners.size >= 32) throw Error('Too many Steam lifetime listeners');
+        runningListeners.add(listener);
+        const dispose=()=>runningListeners.delete(listener);
+        dispose.unregister=dispose; return dispose;
+      }},
    System:{...register(['RegisterForOnResumeFromSuspend','RegisterForOnSuspendRequest']),
      GetSystemInfo:()=>request('GetSystemInfo',[],false,'framey:steam'),
      UI:register(['RegisterForFocusChangeEvents','RegisterForSystemKeyEvents'])},
@@ -428,7 +445,9 @@
      },
    },
  };
-  DFL.Router = {...DFL.Navigation, ...window.SteamUIStore};
+  DFL.Router = {...DFL.Navigation,
+    get RunningApps() {return runningApps;}, get MainRunningApp() {return mainRunningApp;},
+  };
  DFL.DialogButton.render = () => ({type: DFL.DialogButton});
  const toaster = {toast: ({title, body, subtext, icon, logo, duration, showToast=true, onClick}={}) => {
    const data = {title, body, subtext, icon, logo};
@@ -541,14 +560,9 @@
    },
    fetchNoCors: () => Promise.reject(Error('Decky proxy fetch is unavailable in Framey')),
  };
-  function setLibrarySnapshot(snapshot) {
-    // These are detached plugin-local values. Patching an overview or its Map
-    // must never mutate Steam's library. Live MobX observations are unsupported.
-    if (!snapshot || !Array.isArray(snapshot.apps) || snapshot.apps.length > 10000 ||
-        !Array.isArray(snapshot.gameIds) || snapshot.gameIds.length > 10000 ||
-        (snapshot.steamId != null && (typeof snapshot.steamId !== 'string' || !/^\d{17}$/.test(snapshot.steamId))))
-      throw Error('Invalid Steam library snapshot');
-    const apps = snapshot.apps.map(row => {
+  function projectApps(rows, limit) {
+    if (!Array.isArray(rows) || rows.length > limit) throw Error('Invalid Steam app overview');
+    return rows.map(row => {
      if (!Array.isArray(row) || row.length !== 8 || !Number.isSafeInteger(row[0]) || row[0] <= 0 ||
          typeof row[1] !== 'string' || row[1].length > 2048 ||
          (row[2] != null && typeof row[2] !== 'string') || !Number.isSafeInteger(row[3]) ||
@@ -560,16 +574,90 @@
      return {appid,display_name,sort_as,app_type,gameid,
        minutes_playtime_forever,minutes_playtime_last_two_weeks,rt_last_time_played};
    });
+  }
+  function setLibrarySnapshot(snapshot) {
+    // These are detached plugin-local values. Patching an overview or its Map
+    // must never mutate Steam's library. Live MobX observations are unsupported.
+    if (!snapshot || !Array.isArray(snapshot.apps) || snapshot.apps.length > 10000 ||
+        !Array.isArray(snapshot.gameIds) || snapshot.gameIds.length > 10000 ||
+        (snapshot.steamId != null && (typeof snapshot.steamId !== 'string' || !/^\d{17}$/.test(snapshot.steamId))))
+      throw Error('Invalid Steam library snapshot');
+    const apps = projectApps(snapshot.apps, 10000);
    const map = new Map(apps.map(app=>[app.appid,app]));
    if (map.size !== apps.length || snapshot.gameIds.some(id=>!Number.isSafeInteger(id) || !map.has(id)))
      throw Error('Invalid Steam game collection');
    window.appStore = {allApps:apps, m_mapApps:map,
      GetAppOverviewByAppID:id=>map.get(Number(id)),
      GetAppOverviewByGameID:id=>apps.find(app=>app.gameid === String(id)),
+      GetVerticalCapsuleURLForApp:app=>runningArtwork.get(Number(app?.appid))?.[0] || '',
+      GetCustomVerticalCapsuleURLs:app=>[...(runningArtwork.get(Number(app?.appid))?.[1] || [])],
    };
    window.collectionStore = {allGamesCollection:{allApps:snapshot.gameIds.map(id=>map.get(id))}};
    window.App = snapshot.steamId ? {m_CurrentUser:{strSteamID:snapshot.steamId}} : undefined;
  }
+  function setRunningSnapshot(data) {
+    if (!data || !Array.isArray(data.runningIds) || data.runningIds.length > 64 ||
+        !Array.isArray(data.events) || data.events.length > 64 ||
+        !Array.isArray(data.artwork) || data.artwork.length > 65 ||
+        !Number.isSafeInteger(data.cursor) || data.cursor < 0 || typeof data.lifetimeAvailable !== 'boolean')
+      throw Error('Invalid Steam running snapshot');
+    const apps = projectApps(data.apps, 65), map = new Map(apps.map(app=>[app.appid,app]));
+    if (map.size !== apps.length || new Set(data.runningIds).size !== data.runningIds.length ||
+        data.runningIds.some(id=>!Number.isSafeInteger(id) || !map.has(id)) ||
+        (data.mainAppId !== null && (!Number.isSafeInteger(data.mainAppId) || !map.has(data.mainAppId))))
+      throw Error('Invalid Steam running apps');
+    let sequence = 0;
+    const publicArt = value => typeof value === 'string' && value.length <= 2048 &&
+      /^https:\/\/(?:[a-z0-9-]+\.)*steamstatic\.com\/steam\/apps\/[^?#\s\\]+$/.test(value);
+    const artwork = new Map();
+    for (const row of data.artwork) {
+      if (!Array.isArray(row) || row.length !== 3 || !map.has(row[0]) || artwork.has(row[0]) ||
+          (row[1] !== null && !publicArt(row[1])) || !Array.isArray(row[2]) || row[2].length > 8 ||
+          row[2].some(url=>!publicArt(url))) throw Error('Invalid Steam public artwork');
+      artwork.set(row[0],[row[1],[...row[2]]]);
+    }
+    for (const event of data.events) {
+      if (!Number.isSafeInteger(event?.sequence) || event.sequence <= sequence || event.sequence > data.cursor ||
+          !Number.isSafeInteger(event.unAppID) || event.unAppID <= 0 || typeof event.bRunning !== 'boolean')
+        throw Error('Invalid Steam lifetime event');
+      sequence = event.sequence;
+    }
+    // Update detached stores before callbacks read Router.RunningApps.
+    runningApps = Object.freeze(data.runningIds.map(id=>map.get(id)));
+    mainRunningApp = data.mainAppId === null ? undefined : map.get(data.mainAppId);
+    runningAvailable = true;
+    runningArtwork = artwork;
+    if (window.appStore) for (const app of apps) {
+      const existing = window.appStore.m_mapApps.get(app.appid);
+      if (existing) Object.assign(existing,app);
+      else {window.appStore.m_mapApps.set(app.appid,app);window.appStore.allApps.push(app);}
+    }
+    const previous = runningCursor;
+    runningCursor = data.cursor;
+    for (const event of data.events) if (event.sequence > previous)
+      for (const listener of runningListeners)
+        Promise.resolve().then(()=>runningListeners.has(listener) && listener({unAppID:event.unAppID,bRunning:event.bRunning}))
+          .catch(failure=>console.warn('Steam lifetime listener failed',failure.message));
+  }
+  function refreshRunning() {
+    if (runningClosed) return Promise.resolve();
+    if (runningRequest) return runningRequest;
+    runningRequest = request('running',[runningCursor],false,'framey:running')
+      .then(data=>{if (!runningClosed) setRunningSnapshot(data);})
+      .catch(failure=>{
+        runningAvailable = false;
+        runningApps = Object.freeze([]); mainRunningApp = undefined; runningArtwork = new Map();
+        console.warn('Framey Steam running context unavailable',failure.message);
+      }).finally(()=>{
+        runningRequest = null;
+        if (!runningClosed) runningTimer = setTimeout(refreshRunning,2000);
+      });
+    return runningRequest;
+  }
+  addEventListener('pagehide',()=>{
+    runningClosed = true; clearTimeout(runningTimer); runningListeners.clear();
+    parent.postMessage({type:'framey:running:close',session:cacheSession},'*');
+  });
  async function start() {
    try {
      await seeded;
@@ -582,6 +670,8 @@
        try {setLibrarySnapshot(await request('GetLibrarySnapshot',[],false,'framey:steam'));}
        catch (failure) {console.warn('Framey Steam library unavailable', failure.message);}
      }
+      if (/\b(?:RunningApps|MainRunningApp|RegisterForAppLifetimeNotifications)\b/.test(bundleText))
+        await refreshRunning();
      // Old Decky builds are expressions returning the initializer, rather than
      // ES modules. A module wrapper preserves the sandbox and avoids eval.
      const legacy = /^\s*\(function\s*\(/.test(bundleText);
@@ -0,0 +1,68 @@
+/* Fixed, read-only projection executed in Steam CEF. No plugin source runs here. */
+(function(payload) {
+  const api = window.SteamClient?.GameSessions;
+  let bridge = window.__frameyRunningBridgeV1;
+  if (bridge && bridge.api !== api) {
+    for (const key of [...bridge.sessions.keys()]) bridge.remove(key);
+    bridge = null;
+  }
+  if (!bridge) {
+    const sessions = new Map();
+    const remove = key => {
+      const item = sessions.get(key);
+      item?.handle?.unregister();
+      sessions.delete(key);
+      if (!sessions.size) {clearInterval(bridge.timer); bridge.timer = null;}
+    };
+    bridge = window.__frameyRunningBridgeV1 = {api, sessions, remove, timer:null};
+  }
+  let item = bridge.sessions.get(payload.session);
+  if (item && item.pluginId !== payload.pluginId) throw Error('Framey running session belongs to another plugin');
+  if (!payload.active) {bridge.remove(payload.session); return null;}
+  const store = window.SteamUIStore;
+  if (!Array.isArray(store?.RunningApps)) throw Error('Steam running apps are unavailable');
+  const apps = store.RunningApps;
+  if (apps.length > 64) throw Error('Too many running Steam apps');
+  const main = store.MainRunningApp;
+  const project = app => [app.appid, app.display_name, app.sort_as, app.app_type, String(app.gameid),
+    app.minutes_playtime_forever, app.minutes_playtime_last_two_weeks, app.rt_last_time_played];
+  // Include a selected main app even if Steam's list changes between the reads.
+  const rows = apps.map(project);
+  if (main && !apps.some(app => app.appid === main.appid)) rows.push(project(main));
+  const publicArt = value => {
+    if (typeof value !== 'string' || value.length > 2048) return null;
+    try {
+      const url = new URL(value);
+      if (url.protocol !== 'https:' || url.username || url.password || url.port ||
+          !/(^|\.)steamstatic\.com$/.test(url.hostname) || !url.pathname.startsWith('/steam/apps/')) return null;
+      return url.origin + url.pathname; // Never copy local artwork paths or query data.
+    } catch (_) {return null;}
+  };
+  const artwork = [...apps, ...(main && !apps.some(app=>app.appid === main.appid) ? [main] : [])].map(app => {
+    const art = window.appStore;
+    const vertical = publicArt(art?.GetVerticalCapsuleURLForApp?.(app));
+    const custom = art?.GetCustomVerticalCapsuleURLs?.(app);
+    return [app.appid, vertical, Array.isArray(custom) ? custom.slice(0,8).map(publicArt).filter(Boolean) : []];
+  });
+  if (!item) {
+    if (bridge.sessions.size >= 4) throw Error('Too many Framey running sessions');
+    item = {pluginId:payload.pluginId, queue:[], sequence:0, touched:Date.now(), handle:null};
+    if (typeof api?.RegisterForAppLifetimeNotifications === 'function') {
+      item.handle = api.RegisterForAppLifetimeNotifications(event => {
+        // This queue contains actual Steam notifications, never snapshot diffs.
+        if (!Number.isSafeInteger(event?.unAppID) || event.unAppID <= 0 || typeof event.bRunning !== 'boolean') return;
+        item.queue.push({sequence:++item.sequence, unAppID:event.unAppID, bRunning:event.bRunning});
+        if (item.queue.length > 64) item.queue.shift();
+      });
+    }
+    bridge.sessions.set(payload.session, item);
+    if (!bridge.timer) bridge.timer = setInterval(() => {
+      for (const [key, state] of bridge.sessions)
+        if (Date.now() - state.touched > 15000) bridge.remove(key);
+    }, 5000);
+  }
+  item.touched = Date.now();
+  return {apps:rows, artwork, runningIds:apps.map(app => app.appid), mainAppId:main?.appid ?? null,
+    events:item.queue.filter(event => event.sequence > payload.cursor), cursor:item.sequence,
+    lifetimeAvailable:!!item.handle};
+})
@@ -11,6 +11,7 @@ import frame_decky
 METHOD = re.compile(r'[A-Za-z][A-Za-z0-9_]{0,63}\Z')
 EVENT = re.compile(r'[A-Za-z0-9_:/.-]{1,128}\Z')
 SESSION = re.compile(r'[A-Za-z0-9_.-]{1,100}\Z')
+RECEIPT = re.compile(r'[0-9a-f]{64}\Z')
 MODULE_PATH = re.compile(r'[A-Za-z0-9_-]+(?:/[A-Za-z0-9_-]+)*/[A-Za-z0-9_.-]+\.js\Z|index\.js\Z')
 PLUGINS = Path.home()/'.local/share/frame-control/decky/plugins'

@@ -139,7 +140,18 @@ finally: page.sock.close()
 '''


-def call_method(ssh, plugin_id, method, args, legacy=False):
+def _current_plugin(ssh, plugin_id, receipt):
+    if not isinstance(receipt, str) or not RECEIPT.fullmatch(receipt):
+        raise PanelError('Reopen the plugin panel to refresh its store receipt')
+    found = [p for p in frame_decky.status(ssh)['plugins'] if p.get('storeId') == plugin_id]
+    if len(found) != 1:
+        raise PanelError('The plugin is not managed by the Frame Control Decky store')
+    if found[0].get('sha256') != receipt:
+        raise PanelError('The plugin changed; close and reopen its panel')
+    return found[0]
+
+
+def call_method(ssh, plugin_id, method, args, legacy=False, receipt=None):
    if type(plugin_id) is not int or plugin_id <= 0:
        raise PanelError('Choose an installed Decky store plugin')
    if not isinstance(method, str) or not METHOD.fullmatch(method):
@@ -148,10 +160,8 @@ def call_method(ssh, plugin_id, method, args, legacy=False):
        raise PanelError('Plugin method arguments are too large')
    if type(legacy) is not bool or (legacy and (len(args) != 1 or not isinstance(args[0], dict))):
        raise PanelError('Legacy plugin methods need one keyword argument object')
-    found = [p for p in frame_decky.status(ssh)['plugins'] if p.get('storeId') == plugin_id]
-    if len(found) != 1:
-        raise PanelError('The plugin is not managed by the Frame Control Decky store')
-    payload = {'name':found[0]['name'], 'method':method, 'args':args, 'legacy':legacy}
+    plugin = _current_plugin(ssh, plugin_id, receipt)
+    payload = {'name':plugin['name'], 'method':method, 'args':args, 'legacy':legacy}
    # Library-sized arguments can exceed the OS limit for a single SSH command
    # argument. Send them as a quoted Python literal on stdin instead.
    script = METHOD_SCRIPT.replace('__FRAMEY_METHOD_PAYLOAD__', repr(json.dumps(payload)))
@@ -192,15 +202,13 @@ finally: page.sock.close()
 '''


-def read_steam(ssh, plugin_id, method):
+def read_steam(ssh, plugin_id, method, receipt=None):
    """Read one explicitly supported Steam API for an installed store panel."""
    if type(plugin_id) is not int or plugin_id <= 0:
        raise PanelError('Choose an installed Decky store plugin')
    if not isinstance(method, str) or method not in STEAM_READS:
        raise PanelError('This Steam API is unavailable in Framey')
-    found = [p for p in frame_decky.status(ssh)['plugins'] if p.get('storeId') == plugin_id]
-    if len(found) != 1:
-        raise PanelError('The plugin is not managed by the Frame Control Decky store')
+    _current_plugin(ssh, plugin_id, receipt)
    expression = '(async()=>await ' + STEAM_READS[method] + ')()'
    script = STEAM_READ_SCRIPT.replace('__FRAMEY_STEAM_READ__', repr(expression)).replace(
        '__FRAMEY_STEAM_LIMIT__', str(2*1024*1024 if method == 'GetLibrarySnapshot' else 256*1024))
@@ -219,7 +227,7 @@ finally: page.sock.close()
 '''


-def poll_events(ssh, plugin_id, session, events, cursor=0):
+def poll_events(ssh, plugin_id, session, events, cursor=0, receipt=None):
    """Read only this store-owned plugin's subscribed events; never trust its claimed name."""
    if type(plugin_id) is not int or plugin_id <= 0:
        raise PanelError('Choose an installed Decky store plugin')
@@ -230,11 +238,26 @@ def poll_events(ssh, plugin_id, session, events, cursor=0):
        raise PanelError('Invalid Decky event names')
    if type(cursor) is not int or not 0 <= cursor <= 9007199254740991:
        raise PanelError('Invalid Decky event cursor')
-    found = [p for p in frame_decky.status(ssh)['plugins'] if p.get('storeId') == plugin_id]
-    if len(found) != 1:
-        raise PanelError('The plugin is not managed by the Frame Control Decky store')
-    payload = {'name':found[0]['name'], 'session':session, 'events':events, 'cursor':cursor}
+    plugin = _current_plugin(ssh, plugin_id, receipt)
+    payload = {'name':plugin['name'], 'session':session, 'events':events, 'cursor':cursor}
    # Embed only our bundled source as a Python string; plugin data stays in JSON.
    source = Path(__file__).with_name('framey-events.js').read_text(encoding='utf-8')
    script = EVENT_SCRIPT.replace('__FRAMEY_EVENTS_SOURCE__', repr(source))
    return json.loads(ssh('python3 - ' + shlex.quote(json.dumps(payload)), stdin=script, timeout=25))
+
+
+def poll_running(ssh, plugin_id, session, active, cursor=0, receipt=None):
+    """Project running apps and actual lifetime events for one installed panel."""
+    if type(plugin_id) is not int or plugin_id <= 0:
+        raise PanelError('Choose an installed Decky store plugin')
+    if not isinstance(session, str) or not SESSION.fullmatch(session):
+        raise PanelError('Invalid Framey running session')
+    if type(active) is not bool or type(cursor) is not int or not 0 <= cursor <= 9007199254740991:
+        raise PanelError('Invalid Framey running request')
+    _current_plugin(ssh, plugin_id, receipt)
+    payload = {'pluginId':plugin_id, 'session':session, 'active':active, 'cursor':cursor}
+    source = Path(__file__).with_name('framey-running.js').read_text(encoding='utf-8')
+    expression = '(' + source + ')(' + json.dumps(payload) + ')'
+    script = STEAM_READ_SCRIPT.replace('__FRAMEY_STEAM_READ__', repr(expression)).replace(
+        '__FRAMEY_STEAM_LIMIT__', str(256*1024))
+    return json.loads(ssh('python3 -', stdin=script, timeout=25))
@@ -108,25 +108,34 @@ function compatibilityText(plugin){const c=plugin.compatibility;return c ? `${c.
 function deckyJobPending(){return !!sessionStorage.getItem('frameyPluginJob');}
 let deckyState=null, deckyStore=[], deckyStoreIndex=0, deckyStoreRequest=0,
  deckyStatusRequest=0,
-  activeFrameyId=null, frameySession=null, deckyBusy=false;
+  activeFrameyId=null, activeFrameyReceipt=null, frameySession=null, deckyBusy=false;
 async function refreshDecky(){const request=++deckyStatusRequest;try{const state=await api('/api/decky');
  if(request!==deckyStatusRequest)return;
  deckyState=state;
+  const active=(state.plugins||[]).find(p=>p.storeId===activeFrameyId);
+  const panelStale=activeFrameyId!==null&&(!state.running||!active||
+    active.sha256!==activeFrameyReceipt?.sha256||active.version!==activeFrameyReceipt?.version);
+  if(panelStale)closeFrameyPanel();
  byId('deckyState').textContent=deckyState.running?'Decky loader is running. Backend loading is not a VR menu check.':
    deckyState.managed?'Decky is stopped. You can remove a managed plugin to recover, then start Decky from Frame Control on your computer.':
    'Decky is not running. Install it from Frame Control on your computer.';
+  if(panelStale)byId('deckyState').textContent+=' The old plugin panel was closed; reopen it after refreshing.';
  const list=byId('deckyInstalled');list.replaceChildren();
  for(const plugin of deckyState.plugins||[]){const row=document.createElement('div');row.className='block';
    const name=document.createElement('strong');name.textContent=`${plugin.name} ${plugin.version||''}`;row.append(name);
    const note=document.createElement('p');note.textContent=compatibilityText(plugin);row.append(note);
    if(plugin.storeId){const open=document.createElement('button');open.className='secondary';open.textContent='Open panel';
+      open.disabled=deckyBusy||deckyJobPending()||!deckyState.running;
      open.onclick=()=>openFrameyPanel(plugin.storeId,plugin.name);row.append(open);
      const button=document.createElement('button');button.className='danger';button.textContent='Remove';
      button.disabled=deckyBusy||deckyJobPending();button.onclick=()=>deckyChange('remove',{id:plugin.storeId,name:plugin.name});row.append(button);}
    list.append(row);}if(!deckyState.plugins?.length)list.textContent='No managed plugins installed.';
  showDeckyStore();}catch(error){if(request!==deckyStatusRequest)return;
+    const panelClosed=activeFrameyId!==null;
+    if(panelClosed)closeFrameyPanel();
    deckyState=null;
    byId('deckyState').textContent=`Installed plugins unavailable: ${error.message}`;
+    if(panelClosed)byId('deckyState').textContent+=' The plugin panel was closed until status can be refreshed.';
    byId('deckyInstalled').replaceChildren();
    byId('deckyInstalled').textContent='Refresh to check installed plugins.';
    showDeckyStore();}}
@@ -191,14 +200,20 @@ async function deckyChange(action,plugin){if(deckyBusy)return;
  }
  if(!confirm(`${action} ${plugin.name}? Store plugins run code as your Frame user.`))return;
  deckyBusy=true;showDeckyStore();
-  deckyJobView(`${action} ${plugin.name}`,'Starting…',0);
+  const panelClosed=(action==='update'||action==='remove')&&activeFrameyId===plugin.id;
+  const panelNote=panelClosed?(action==='remove'?' Plugin panel closed after removal.':
+    ' Old plugin panel closed; reopen it after refreshing installed plugins.') : '';
+  if(panelClosed)closeFrameyPanel();
+  deckyJobView(`${action} ${plugin.name}`,
+    panelClosed?'Starting… Old plugin panel closed until the change finishes.':'Starting…',0);
  try{const started=await api('/api/decky/plugin',{action,id:plugin.id,
    sha256:action==='remove'?undefined:plugin.sha256,acknowledged:true});
    if(!started.job)throw Error('The server did not return a job ID');
    sessionStorage.setItem('frameyPluginJob',JSON.stringify({job:started.job,action,name:plugin.name}));
    await followDeckyJob(started.job,action,plugin.name);
    sessionStorage.removeItem('frameyPluginJob');
-  }catch(error){deckyJobView(`${action} ${plugin.name}`,`Error: ${error.message}`,null,true);}
+    if(panelNote)byId('deckyJobStatus').textContent+=panelNote;
+  }catch(error){deckyJobView(`${action} ${plugin.name}`,`Error: ${error.message}${panelNote}`,null,true);}
  finally{deckyBusy=false;await refreshDecky();}
 }
 async function checkDeckyJob(){let saved;try{saved=JSON.parse(sessionStorage.getItem('frameyPluginJob')||'null');}catch(_){saved=null;}
@@ -210,23 +225,32 @@ async function checkDeckyJob(){let saved;try{saved=JSON.parse(sessionStorage.get
  finally{deckyBusy=false;await refreshDecky();}}
 byId('deckyJobCheck').onclick=checkDeckyJob;
 function openFrameyPanel(id,name){
+  if(deckyBusy||deckyJobPending()||!deckyState?.running)return;
  const installed=(deckyState?.plugins||[]).find(p=>p.storeId===id);if(!installed)return;
  byId('frameyCompatibility').textContent=compatibilityText(installed);
  closeFrameyEvents();
-  activeFrameyId=id;frameySession=`${Date.now()}-${Math.random()}`;byId('frameyTitle').textContent=name;
+  activeFrameyId=id;activeFrameyReceipt={sha256:installed.sha256,version:installed.version};
+  frameySession=`${Date.now()}-${Math.random()}`;byId('frameyTitle').textContent=name;
  byId('frameyPanelStatus').textContent='Loading plugin panel…';
  byId('frameyFrame').src=`/framey/panel/${id}?session=${encodeURIComponent(frameySession)}#${frameySession}`;
  byId('frameyPanel').hidden=false;byId('frameyPanel').scrollIntoView();
  setTimeout(()=>{if(activeFrameyId===id&&byId('frameyPanelStatus').textContent==='Loading plugin panel…')
    byId('frameyPanelStatus').textContent='No compatible panel loaded. This plugin may need Steam UI features Framey cannot provide.';},12000);
 }
-let frameyEventsActive=false;
+let frameyEventsActive=false,frameyRunningActive=false;
 function closeFrameyEvents(){
+  if(frameyRunningActive&&activeFrameyId!==null&&frameySession)
+    api('/api/framey/running',{id:activeFrameyId,receipt:activeFrameyReceipt?.sha256,
+      session:frameySession,active:false}).catch(()=>{});
+  frameyRunningActive=false;
  if(frameyEventsActive&&activeFrameyId!==null&&frameySession)
-    api('/api/framey/events',{id:activeFrameyId,session:frameySession,events:[],cursor:0}).catch(()=>{});
+    api('/api/framey/events',{id:activeFrameyId,receipt:activeFrameyReceipt?.sha256,
+      session:frameySession,events:[],cursor:0}).catch(()=>{});
  frameyEventsActive=false;
 }
-byId('frameyClose').onclick=()=>{closeFrameyEvents();activeFrameyId=null;frameySession=null;byId('frameyFrame').removeAttribute('src');byId('frameyPanel').hidden=true;};
+function closeFrameyPanel(){closeFrameyEvents();activeFrameyId=null;activeFrameyReceipt=null;frameySession=null;
+  byId('frameyFrame').removeAttribute('src');byId('frameyPanel').hidden=true;}
+byId('frameyClose').onclick=closeFrameyPanel;
 function frameyCacheKey(id){return `framey-plugin-cache-v1:${id}`;}
 function frameyCacheRead(id){
  try{const data=JSON.parse(localStorage.getItem(frameyCacheKey(id))||'{}');
@@ -259,6 +283,25 @@ window.addEventListener('message',async event=>{
    api('/api/framey/check',{kind:'panel',pluginId:activeFrameyId}).catch(()=>{});return;}
  if(req.type==='framey:input'){api('/api/framey/check',{kind:'input'}).catch(()=>{});return;}
  if(req.type==='framey:error'){byId('frameyPanelStatus').textContent=`Plugin panel unavailable: ${String(req.message).slice(0,200)}`;return;}
+  if(req.type==='framey:running:close'){
+    if(req.session===frameySession&&frameyRunningActive){
+      frameyRunningActive=false;
+      api('/api/framey/running',{id:activeFrameyId,receipt:activeFrameyReceipt?.sha256,
+        session:frameySession,active:false}).catch(()=>{});
+    }return;
+  }
+  if(req.type==='framey:running'){
+    if(req.session!==frameySession||!Number.isSafeInteger(req.id)||req.id<1||
+      !Array.isArray(req.args)||req.args.length!==1||!Number.isSafeInteger(req.args[0])||req.args[0]<0)return;
+    const pluginId=activeFrameyId,session=frameySession,receipt=activeFrameyReceipt?.sha256,
+      reply={type:'framey:reply',id:req.id};
+    frameyRunningActive=true;
+    try{const data=await api('/api/framey/running',{id:pluginId,receipt,session,active:true,cursor:req.args[0]});reply.result=data.result;}
+    catch(error){reply.error=error.message;}
+    if(pluginId===activeFrameyId&&session===frameySession&&event.source===byId('frameyFrame').contentWindow)
+      event.source.postMessage(reply,'*');
+    return;
+  }
  if(req.type==='framey:events:close'){
    if(req.session===frameySession)closeFrameyEvents();return;
  }
@@ -267,9 +310,11 @@ window.addEventListener('message',async event=>{
      req.args.length!==2||!Array.isArray(req.args[0])||req.args[0].length>32||
      req.args[0].some(name=>typeof name!=='string'||!/^[A-Za-z0-9_:/.-]{1,128}$/.test(name))||
      !Number.isSafeInteger(req.args[1])||req.args[1]<0)return;
-    const pluginId=activeFrameyId,session=frameySession,reply={type:'framey:reply',id:req.id};
+    const pluginId=activeFrameyId,session=frameySession,receipt=activeFrameyReceipt?.sha256,
+      reply={type:'framey:reply',id:req.id};
    frameyEventsActive=req.args[0].length>0;
-    try{reply.result=await api('/api/framey/events',{id:pluginId,session,events:req.args[0],cursor:req.args[1]});}
+    try{reply.result=await api('/api/framey/events',{id:pluginId,receipt,session,
+      events:req.args[0],cursor:req.args[1]});}
    catch(error){reply.error=error.message;}
    if(pluginId===activeFrameyId&&session===frameySession&&event.source===byId('frameyFrame').contentWindow)
      event.source.postMessage(reply,'*');
@@ -278,9 +323,10 @@ window.addEventListener('message',async event=>{
  if(!['framey:call','framey:steam'].includes(req.type)||req.session!==frameySession||!Number.isSafeInteger(req.id)||req.id<1||typeof req.method!=='string'||!Array.isArray(req.args))return;
  const steamRead=req.type==='framey:steam';
  if(steamRead&&(req.args.length!==0||!['GetIPCountry','GetInstallFolders','GetSystemInfo','GetLibrarySnapshot'].includes(req.method)))return;
-  const pluginId=activeFrameyId,session=frameySession,reply={type:'framey:reply',id:req.id};
+  const pluginId=activeFrameyId,session=frameySession,receipt=activeFrameyReceipt?.sha256,
+    reply={type:'framey:reply',id:req.id};
  try{const data=await api(steamRead?'/api/framey/steam':'/api/framey/method',
-    {id:pluginId,method:req.method,args:req.args,legacy:req.legacy===true});reply.result=data.result;}
+    {id:pluginId,receipt,method:req.method,args:req.args,legacy:req.legacy===true});reply.result=data.result;}
  catch(error){reply.error=error.message;}
  if(pluginId===activeFrameyId&&session===frameySession&&event.source===byId('frameyFrame').contentWindow)event.source.postMessage(reply,'*');
 });
@@ -581,7 +581,8 @@ def framey_method_action(body):
    if not HEADSET_RUNTIME and os.environ.get('FRAME_E2E_CONTAINER') != '1':
        raise Failure('Decky plugin panels run in the headset service', 400)
    try:
-        return framey_panel.call_method(ssh, body.get('id'), body.get('method'), body.get('args'), body.get('legacy', False))
+        return framey_panel.call_method(ssh, body.get('id'), body.get('method'), body.get('args'),
+                                        body.get('legacy', False), body.get('receipt'))
    except framey_panel.PanelError as exc:
        raise Failure(str(exc), 400) from exc

@@ -590,7 +591,7 @@ def framey_steam_action(body):
    if not HEADSET_RUNTIME and os.environ.get('FRAME_E2E_CONTAINER') != '1':
        raise Failure('Decky plugin panels run in the headset service', 400)
    try:
-        return framey_panel.read_steam(ssh, body.get('id'), body.get('method'))
+        return framey_panel.read_steam(ssh, body.get('id'), body.get('method'), body.get('receipt'))
    except framey_panel.PanelError as exc:
        raise Failure(str(exc), 400) from exc

@@ -600,7 +601,17 @@ def framey_events_action(body):
        raise Failure('Decky plugin panels run in the headset service', 400)
    try:
        return framey_panel.poll_events(ssh, body.get('id'), body.get('session'),
-                                       body.get('events'), body.get('cursor', 0))
+                                       body.get('events'), body.get('cursor', 0), body.get('receipt'))
+    except framey_panel.PanelError as exc:
+        raise Failure(str(exc), 400) from exc
+
+
+def framey_running_action(body):
+    if not HEADSET_RUNTIME and os.environ.get('FRAME_E2E_CONTAINER') != '1':
+        raise Failure('Decky plugin panels run in the headset service', 400)
+    try:
+        return framey_panel.poll_running(ssh, body.get('id'), body.get('session'),
+                                        body.get('active'), body.get('cursor', 0), body.get('receipt'))
    except framey_panel.PanelError as exc:
        raise Failure(str(exc), 400) from exc

@@ -3473,6 +3484,7 @@ POST = {
    "/api/framey/method": framey_method_action,
    "/api/framey/steam": framey_steam_action,
    "/api/framey/events": framey_events_action,
+    "/api/framey/running": framey_running_action,
    "/api/framey/check": framey_check_action,
    "/api/headset": headset_action,
    "/api/headset/quick": headset_quick,
Author	SHA1	Message	Date
SAPHID	340ca88359	Record test-only main merge in v0.4.43 candidate	2026-10-26 08:10:20 +00:00
SAPHID	e62589417b	Merge remote-tracking branch 'origin/main' into release/v0.4.43	2026-10-26 08:09:54 +00:00
Alex Southwell	03b3796d8d	Merge pull request #310 from saphid/fix/windows-wireless-live-retry Retry transient Windows wireless inventory smoke timeout	2026-10-26 08:09:31 +00:00
SAPHID	93da4e466f	Prepare Frame Control v0.4.43 candidate	2026-10-26 08:05:12 +00:00
Alex Southwell	05093ea4d4	Merge pull request #309 from saphid/feat/framey-script-entrypoints fix(framey): restore executable scripts for Junk-Store	2026-10-26 08:03:32 +00:00
SAPHID	232b253e7a	Merge Web Browser compatibility into Junk-Store fix	2026-10-26 07:53:39 +00:00
Alex Southwell	de8abe32c6	Merge pull request #308 from saphid/feat/framey-web-browser Framey: handle missing Steam React root in legacy panels	2026-10-26 07:51:52 +00:00
SAPHID	42492e7879	Retry transient Windows wireless smoke timeout once	2026-10-26 07:45:31 +00:00
SAPHID	f50139fe6a	Merge main into Framey Web Browser compatibility	2026-10-26 07:34:55 +00:00
SAPHID	698a643eb7	Merge remote-tracking branch 'origin/main' into feat/framey-script-entrypoints # Conflicts: # docs/framey-compatibility.md	2026-10-26 07:34:03 +00:00
SAPHID	d0cef31656	fix(framey): restore executable plugin script entrypoints	2026-10-26 07:33:14 +00:00
Alex Southwell	4ac59f1a44	Merge pull request #307 from saphid/feat/framey-volume-boost-arm64 docs: verify Volume Boost sink controls on ARM64 Frame	2026-10-26 07:32:50 +00:00
SAPHID	c91cfff797	docs: record exact Framey unworn regression gate	2026-10-26 07:28:07 +00:00
SAPHID	d5e62f643d	Framey: tolerate missing Steam React root in legacy panels	2026-10-26 07:26:21 +00:00
Alex Southwell	f3f574666f	Merge pull request #306 from saphid/docs/v0442-release-evidence Document v0.4.42 tagged release verification	2026-10-26 07:13:01 +00:00
SAPHID	40ece4fef0	docs: verify Volume Boost sink controls on ARM64 Frame	2026-10-26 06:19:34 +00:00
Alex Southwell	f52c020310	Merge pull request #305 from saphid/docs/framey-running-postmerge-vr Document post-merge Framey running panel check	2026-10-26 06:04:36 +00:00
SAPHID	efe0c508f4	docs: record v0.4.42 tagged release verification	2026-10-26 06:03:42 +00:00
SAPHID	1af2bb45d9	docs: record post-merge Framey running panel exercise	2026-10-26 05:56:16 +00:00
Alex Southwell	daee952873	Merge pull request #304 from saphid/feat/framey-running-context Framey: bridge running-game context and Steam lifetime notifications	2026-10-26 05:53:58 +00:00
Alex Southwell	98909cb543	Merge pull request #302 from saphid/release/v0.4.42 Prepare Frame Control v0.4.42	2026-10-26 05:52:18 +00:00
SAPHID	1903153d7b	docs: record exact v0.4.42 Frame candidate gates	2026-10-26 05:43:12 +00:00
SAPHID	7172be17fc	Document running receipt guard and its verification boundary	2026-10-26 05:39:17 +00:00
SAPHID	27af46dd20	Record receipt guard in v0.4.42 candidate	2026-10-26 05:38:34 +00:00
SAPHID	761e952d8f	Merge remote-tracking branch 'origin/main' into feat/framey-running-context	2026-10-26 05:38:07 +00:00
SAPHID	0237e342d2	Bind Framey running polls and cleanup to the installed plugin receipt	2026-10-26 05:38:07 +00:00
SAPHID	33d85dff1c	Merge remote-tracking branch 'origin/main' into release/v0.4.42	2026-10-26 05:37:36 +00:00
Alex Southwell	ad57662d40	Merge pull request #301 from saphid/fix/framey-receipt-bound-api Reject stale Framey panel requests after plugin changes	2026-10-26 05:37:04 +00:00
SAPHID	5381667947	Update v0.4.42 candidate with Intel Mac evidence	2026-10-26 05:33:31 +00:00
SAPHID	7cdff4285a	Merge remote-tracking branch 'origin/main' into release/v0.4.42	2026-10-26 05:32:40 +00:00
Alex Southwell	fe1da43171	Merge pull request #303 from saphid/fleet/1vbt29ptkw Record official Intel Mac v0.4.39 acceptance and fix host tests	2026-10-26 05:31:37 +00:00
SAPHID	1c1d941a1c	Document locked unworn Framey receipt exercise	2026-10-26 05:27:46 +00:00
SAPHID	c2f94c242d	Give unworn Framey sample a content receipt	2026-10-26 05:25:48 +00:00
SAPHID	e6e42a93f0	Fix stale receipt e2e response assertion	2026-10-26 05:23:47 +00:00
SAPHID	10b196beaa	Merge remote-tracking branch 'origin/main' into feat/framey-running-context	2026-10-26 05:23:14 +00:00
SAPHID	3f74ff4bb0	Add read-only running-game context and Steam lifetime relay for Framey	2026-10-26 05:23:13 +00:00
Alex Southwell	f2f7a3f4c1	Merge current main and retain Intel acceptance evidence	2026-10-26 16:21:49 +11:00
Alex Southwell	5c4c447d2d	Test official Intel Mac v0.4.39 and fix host validation fixtures	2026-10-26 16:21:03 +11:00
SAPHID	63f1f7fb39	Prepare Frame Control v0.4.42 candidate	2026-10-26 05:20:11 +00:00
Alex Southwell	c88736c6ce	Merge pull request #300 from saphid/fix/smoke-runtime-skip Report unavailable x86 runtime as skipped in Frame smoke	2026-10-26 05:16:15 +00:00
SAPHID	fa354ce365	Bind Framey panel requests to installed plugin receipt	2026-10-26 05:16:02 +00:00
Alex Southwell	fcdd1f22f5	Merge pull request #299 from saphid/fix/framey-close-stale-panel Close stale Framey panels during plugin changes	2026-10-26 05:15:21 +00:00
Alex Southwell	d43e760aef	Merge pull request #298 from saphid/docs/v0441-release-evidence Document v0.4.41 tagged release verification	2026-10-26 05:12:14 +00:00
SAPHID	240288df65	Close stale Framey panels during plugin changes	2026-10-26 05:06:43 +00:00
SAPHID	a68c5584a9	Document v0.4.41 tagged release verification	2026-10-26 05:03:11 +00:00