Bump Frame Control to 0.4.30 (#207 )

Co-authored-by: SAPHID <saphid@users.noreply.github.com>
Support restricted split APKs in Android backup import (#206 )
2026-10-25 09:01:43 +01:00 · 2026-10-25 05:39:30 +00:00 · 2026-10-25 05:29:21 +00:00 · 2026-10-25 05:13:12 +00:00 · 2026-10-25 04:21:10 +00:00 · 2026-10-25 04:11:01 +00:00
30 changed files with 1599 additions and 73 deletions
@@ -2,6 +2,11 @@

 ## Unreleased

+- Import a base APK with supported native-library or asset splits from a local
+  Android backup or XAPK/APKS/APKM bundle. Check package and version before
+  install; refuse resource, code and feature splits and device-variant sets.
+  This route has local fixture coverage, not a real split-game headset test.
+
 - Save Steam screenshots under a separate folder for each headset, Steam
  account and game. Equal screenshot filenames no longer overwrite one another;
  existing files in the old flat folder are left in place.
@@ -148,7 +148,7 @@ Get-FileHash .\Frame-Control-Setup-x64.exe -Algorithm SHA256

 The [source](https://github.com/saphid/frame-control) and [release build workflow](.github/workflows/release.yml) are public. The Windows installer is **not code-signed**, so SmartScreen may warn. The macOS app has only an **ad hoc signature**, not an Apple Developer ID signature; the DMG is **unsigned and not notarized**, so Gatekeeper may warn or block it. Only follow the opening steps below if you trust the download.

-日本語: v0.4.26 以降は公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。
+日本語: [5 ステップの接続ガイド](docs/connection-faq.md#日本語-5-ステップで接続)を参照してください。v0.4.26 以降は公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。

 **Which build?** On a Mac, check Apple menu → About This Mac: the download is
 for Apple Silicon (M-series); no Intel Mac build is published. On Windows,
@@ -245,6 +245,14 @@ network. Guest Wi-Fi/client isolation can prevent discovery and connections.
   check Developer Mode, the address and network isolation, then run setup again.
   For connections away from home, see [Tailscale](docs/tailscale.md).

+**Does Frame Control lower streaming lag?** No. Frame Control manages the Frame
+over SSH. SteamVR or Steam Link carries the game stream. Frame Control does not
+carry that stream, lower ping, or need the Wireless Adapter. It can connect over
+Wi-Fi, the Wireless Adapter, or USB when your computer has an SSH route to the
+Frame. The wired doctor checks only that SSH route. A data-capable USB-A-to-C
+cable has not been tested for the Frame's USB network. See the
+[connection FAQ and Japanese quick start](docs/connection-faq.md).
+
 **What it changes:** only what you click. Installs go to your user account on
 the Frame (`--user` Flatpaks, Lepton instances, Steam downloads, sideloaded
 games in `~/devkit-game`), and nothing
@@ -290,7 +298,7 @@ Frame's software fits together, all checked against a real headset and labelled
 | [PC in the headset](docs/pc-in-headset.md) | Experimental, Windows only, off until you turn it on: a whole PC screen as a panel in the Frame. Tested in a Windows VM; individual windows need a WGC-enabled build |
 | [Mac in the headset](docs/mac-in-headset.md) | Mac windows and screens as panels in the Frame, with laser and keyboard input |
 | [VR mods and custom songs](docs/mods.md) | UEVR for Unreal games from Frame Control (install, play in VR, remove), the per-game table, Beat Saber blockers |
-| [Frame Control extensions](docs/extensions.md) | Local extension API, folder format and example |
+| [Decky Loader on Frame](docs/decky-frame.md) · [Frame Control in VR](docs/headset-app.md) · [Frame Control extensions](docs/extensions.md) | Experimental Decky support, a removable headset panel, and the local extension API |
 | [SSH](docs/ssh.md) · [Streaming](docs/streaming.md) · [Files](docs/file-transfer.md) · [Panels](docs/panels.md) · [Tailscale](docs/tailscale.md) | Topic notes |
 | [Frame Control for iPhone](docs/iphone.md) | The iPhone and iPad app, how it runs the server on the Frame, pairing |
 | [Recovery and OS images](docs/recovery-and-images.md) | Where to download the Frame's OS, what's inside, testing without the headset |
@@ -1,12 +1,12 @@
 {
  "name": "frame-control",
-  "version": "0.4.26",
+  "version": "0.4.30",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "frame-control",
-      "version": "0.4.26",
+      "version": "0.4.30",
      "license": "MIT",
      "devDependencies": {
        "electron": "^44.4.5",
@@ -1,7 +1,7 @@
 {
  "name": "frame-control",
  "productName": "Frame Control",
-  "version": "0.4.26",
+  "version": "0.4.30",
  "description": "Desktop app for managing a Valve Steam Frame over SSH",
  "private": true,
  "main": "main.js",
@@ -4,7 +4,7 @@ A SideQuest backup can contain a small APK and much larger `main.…obb` and
 `patch.…obb` files. All of them belong to the same game. Installing only the APK
 can leave the game unable to start because its assets are missing.

-In **Add / Install → Import Android game** (or **Apps → Browse → Import Android game**), choose the APK and its OBB files together.
+In **Add / Install → Import Android game** (or **Apps → Browse → Import Android game**), choose the base APK, any supported splits, and its OBB files together.
 You can also drop them anywhere in the window. In the desktop app, dropping the
 APK alone finds matching OBB files beside it; dropping a folder containing the
 APK and OBBs also works. Browsers can read only the files you explicitly choose.
@@ -37,9 +37,13 @@ are discarded after use or cancellation; abandoned imports expire after an hour
 when the importer is next used, and dead-server staging folders are swept at
 startup.

-This flow handles one ordinary APK and standard OBB files for one game at a time.
-Split APKs, XAPK/APKS archives, nested Android/data folders and private save
-archives need their own import handling. PC ZIP/folder/EXE imports keep their
+This flow handles one base APK, supported native-library or asset splits, and
+standard OBB files for one game at a time. It checks the package and version in
+each split manifest before touching the headset. The existing Quest merger
+rejects resource, code and feature splits and sets with multiple device
+variants. A merged APK is re-signed; that can affect a game's licence or login.
+XAPK/APKS/APKM archives use the same checks. Nested Android/data folders and
+private save archives remain unsupported. PC ZIP/folder/EXE imports keep their
 existing route. Quest USB and Meta library imports keep their existing workflow.

 Validation covers actual APK parsing, the three-file backup layout, package
@@ -55,3 +59,5 @@ released, and the battery remained at 99%. See [device evidence](evidence/androi
 The headset was unworn; this checks transfer and persistence, not rendering,
 Resident Evil 4 gameplay, or a game that exits before data can be copied. This
 flow does not change APK compatibility or remove licence checks.
+The supported-split backup route was checked with generated local fixtures and
+existing merger tests, not a real split game on the Frame.
@@ -436,13 +436,13 @@ permissions remain unverified. They do not change APK install or launch behavior
 ## Local APK/OBB backups and Android bundles

 In **Android apps → Import Android game → Choose game files…** (or **Send to Frame**), choose one
-standalone APK and its matching `main.<version>.<package>.obb` and/or
+base APK, any supported splits, and its matching `main.<version>.<package>.obb` and/or
 `patch.<version>.<package>.obb` files together. The desktop app also discovers
 matching OBB files beside a lone selected APK. Browser uploads use only the
 files you selected. Installed apps can receive OBB-only imports.

 You can instead select **one `.xapk`, `.apks`, or `.apkm` archive** containing
-one standalone APK and optional matching OBBs. These extensions describe
+one base APK, optional supported splits and matching OBBs. These extensions describe
 containers, not a guarantee that their contents are supported. OBBs may be
 at the archive root, under `<package>/`, or under `Android/obb/<package>/`;
 one enclosing backup folder is allowed. Known manifest/icon/signature
@@ -450,7 +450,7 @@ sidecars are ignored; the APK manifest determines the package. Unknown files,
 unsafe paths, links, encrypted entries, duplicate paths (including case
 collisions), more than 4,096 entries, or more than 16 GiB unpacked are refused.
 Staging also keeps 64 MiB of free disk space. Payloads still have the regular
-one-APK/99-OBB limit. Ordinary `.zip` files keep the PC-title import route;
+100-file/99-OBB limit. Ordinary `.zip` files keep the PC-title import route;
 extract an Android ZIP yourself and select its APK/OBBs.

 The importer previews the app and files before **Import game & data**.
@@ -463,12 +463,14 @@ data setup. Uploaded and extracted staging is removed on cancellation,
 inspection failure, or job completion/failure; abandoned imports expire
 through the existing one-hour staging lifecycle. Original local files stay intact.

-**Limits:** this backup importer refuses multiple APKs, split-only APKs and
-bases marked as requiring splits. It does not select device variants or restore
-`Android/data`, private app data, saves, or entitlements. For the separate
-restricted native-library/asset split workflow see
-[Quest split APKs](quest-import.md#split-apks) and the CLI above. Resource,
-code and feature splits are not supported by that merger.
+**Limits:** this backup importer requires exactly one base APK. For split sets,
+each split must identify the same package and version, and pass the existing
+[Quest split merger](quest-import.md#split-apks). It refuses resource, code and
+feature splits and does not choose among device variants. Merging re-signs the
+APK, which can affect licences. It does not restore `Android/data`, private app
+data, saves or entitlements. These split imports have local fixture and merger
+tests, but no real split game has been installed with this backup route on the
+Frame.

 For issue #102, the RE4 report only establishes that an APK attempt failed.
 Missing OBBs are a hypothesis; the edition/build, exact files, failing step,
@@ -0,0 +1,37 @@
+# Connection and streaming lag FAQ
+
+## Does Frame Control lower my streaming lag?
+
+No. Frame Control uses SSH to manage the Frame. SteamVR or Steam Link sends the
+game stream. Frame Control does not carry the game stream. It cannot lower your
+game-stream ping or fix a stream that stops on the PC. A 40–75 ms ping in a VR
+game is not a Frame Control measurement.
+
+You do **not** need the Steam Wireless Adapter to use Frame Control. The app can
+connect over Wi-Fi, the Wireless Adapter, or USB if the computer has an SSH
+route to the Frame. Use the route that lets the app connect. To improve game
+streaming, check the SteamVR or Steam Link connection on the PC and the Frame.
+The [wired connection doctor](wired-connection.md) checks only Frame Control's
+SSH route. A successful doctor check does not prove that the game stream uses
+the cable or has low lag.
+
+## Can I use a USB-A-to-C cable?
+
+A Mac reached the Frame over a USB-C connection on the
+`10.86.200.232/29` USB network. That test used a USB-C host port. We have
+**not tested a USB-A-to-C cable** with the Frame. A data-capable USB-A-to-C
+cable might show a USB network interface on your PC, but this is unknown on
+the tested Frame OS and PC hosts. Check whether your PC shows that interface
+and whether Frame Control's wired doctor can reach the Frame at
+`10.86.200.233`. A charge-only cable cannot carry USB data. You can use Wi-Fi
+for Frame Control if the USB route does not work.
+
+## 日本語: 5 ステップで接続
+
+1. [公式リリース](https://github.com/saphid/frame-control/releases/latest)から PC の OS 用ファイルをダウンロードします。Windows は `.exe`、macOS は `.dmg`、Linux は `.AppImage` または `.deb` です。同じリリースの `SHA256SUMS` でファイルを確認してください。
+2. PC に Frame Control をインストールして起動します。Windows はスタートメニュー、macOS はアプリケーション、Linux はアプリ一覧から開きます。AppImage の場合は実行権限を付けて開きます。
+3. Frame の Steam 設定 → システムで開発者モードを有効にし、開発者設定でユーザーパスワードを設定します。Frame と PC を同じ信頼できるネットワークに接続し、Frame を起こしておきます。
+4. PC の Frame Control で **Set Up Connection…** を選びます。Frame が見つからない場合は、Frame の設定で IP アドレスを確認して入力します。macOS では **Devices & connection → + Add a headset…** からアドレスを設定できます。
+5. Frame に **Pair new host** が出たら、自分が開始した要求だけを承認します。ペアリングに失敗した場合は、PC のターミナルで開発者モードのパスワードを入力します。接続後、Frame Control に戻って状態を確認します。
+
+Frame Control は管理用の SSH 接続を使います。ゲーム映像は SteamVR / Steam Link が送ります。Frame Control を入れてもゲームの ping は下がりません。無線アダプターは必須ではありません。USB-A-to-C ケーブルで Frame の USB ネットワークが使えるかは、まだ確認できていません。
@@ -1,6 +1,6 @@
 # What we have tested

-Current for Frame Control **v0.4.26**, 25 October 2026. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.
+Current for Frame Control **v0.4.30**, 25 October 2026. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.

 | Feature | Real Frame + physical PC tested | VM only | Untested or limited | Last check and proof |
 |---|---|---|---|---|
@@ -10,13 +10,18 @@ Current for Frame Control **v0.4.26**, 25 October 2026. “Real Frame + physical
 | OBS headset source on Linux | Real Frame to OBS 30 on a Linux host; H.264 video and a synthetic 440 Hz output tone reached a saved recording | No | Real game audio, audible monitoring, perceptual A/V sync and awake headset view | 25 Oct, PR #174 head, shipped in v0.4.22: [OBS log](evidence/obs-media-source-real-2026-10-25.md) |
 | OBS headset source on Windows | No physical Windows PC test | No OBS/Frame VM end-to-end test | App Start/Stop path has automated Windows checks only | 25 Oct, v0.4.23: [Windows PR #179](https://github.com/saphid/frame-control/pull/179), [OBS guide](obs-headset-source.md) |
 | OBS headset source on macOS | No | No | Helper and OBS Media Source not tested on a Mac with a Frame | 25 Oct, v0.4.22: [OBS PR #174](https://github.com/saphid/frame-control/pull/174), [OBS guide](obs-headset-source.md) |
+| OBS headset source on a SteamOS / Steam Machine PC | No SteamOS PC or Flatpak OBS runtime test | No SteamOS host VM test | v0.4.27 AppImage launched on Ubuntu x86_64 under Xvfb; the helper sent H.264/AAC from a real Frame to a local UDP receiver. SteamOS read-only root, desktop UI and Flatpak OBS remain unverified | 25 Oct, v0.4.27: [host test](evidence/obs-steamos-host-2026-10-25.md), [OBS guide](obs-headset-source.md#steamos--steam-machine-pc-host) |
 | Wired connection doctor | No physical PC/Frame cable test of the doctor | No | Synthetic route/SSH tests; a separate Mac USB-C address observation does not test the doctor or game stream | 25 Oct, v0.4.23: [PR #178](https://github.com/saphid/frame-control/pull/178), [wired guide](wired-connection.md) |
 | Windows Wireless Adapter doctor | No physical Steam Wireless Adapter/dropout test | Windows 11 VM ran read-only checks without the adapter or WLAN | Adapter identification, dropouts and recovery on hardware | 24–25 Oct, v0.4.20–0.4.25: [VM log](evidence/windows-wireless-2026-10-24.md), [doctor guide](windows-wireless-doctor.md), [comparison PR #184](https://github.com/saphid/frame-control/pull/184) |
 | Linux Wireless Adapter doctor | No Steam Wireless Adapter hardware test | No | Read-only Linux host checks and mocked adapter states; no adapter-specific hardware observation | 24 Oct, v0.4.20: [PR #165](https://github.com/saphid/frame-control/pull/165), [doctor guide](linux-wireless-adapter-doctor.md) |
 | Switch PC windows | No physical Windows PC test | No real VM-to-Frame Alt+Tab check recorded | Explicit chord is covered by tests; actual window focus, keyboard layouts and controller interaction are unverified | 25 Oct, v0.4.24: [PR #181](https://github.com/saphid/frame-control/pull/181), [PC guide](pc-in-headset.md) |
 | Keyboard and trackpad from Frame Control | A Linux PC sent a click and ASCII keys to a temporary focused window on the real Frame | No | Worn-headset interaction, Unicode delivery and pixel-accurate pointing | 24 Oct, v0.4.19: [received-event log](evidence/pad-gamescope-2026-10-24.md), [PR #66](https://github.com/saphid/frame-control/pull/66) |
 | Backup and restore after reset | Same-headset backup, no-op save restore and Return to Game Mode checks | No | Restore **after a factory reset**, replacement restore and Android data restore have not been tested on a headset. No headset reset was done | 24 Oct, v0.4.17: [backup guide](backup-and-recovery.md), [Return to Game Mode log](evidence/return-game-mode-packaged-2026-10-24.json) |
+| Android game backup import | F-Droid Basic APK with synthetic main and patch OBBs installed, transferred and read back on a real Frame | No | v0.4.30 restricted split-APK backup route has generated-fixture and existing merger tests only; no real split game or RE4 gameplay test | 20 Oct OBB headset check; 25 Oct, v0.4.30 split fixtures: [OBB device evidence](evidence/android-import/device.json), [split PR #206](https://github.com/saphid/frame-control/pull/206), [guide](android-backups.md) |
 | Passthrough in recordings | No active-passthrough mirror check | No | Standby frame was uniform; whether visible room pixels enter `/dev/video99` is **unknown**. Raw cameras are never captured by Frame Control | 25 Oct, v0.4.21: [headset log](evidence/round3-headset-2026-10-25.md), [recording guide](recording.md#does-record-include-passthrough) |
 | Open at login | No Frame needed; Linux autostart file toggled on a physical Linux host with an isolated config directory | No | A full login session and physical Windows/macOS host login have not been checked; OS API calls were unit tested | 25 Oct, v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
+| Local Frame Control extensions | Example panel displayed live Frame status in a browser preview; the real Frame served a read-only example in the experimental headset panel | No | No wearer-visible extension view; third-party extensions and physical Windows/macOS extension folders untested | 25 Oct, v0.4.29: [PR #194](https://github.com/saphid/frame-control/pull/194), [PR #201](https://github.com/saphid/frame-control/pull/201), [extension guide](extensions.md) |
+| Experimental Frame Control SteamVR panel | Real Frame OS 0.5.6 installed its user service, registered an overlay, served authenticated live status and a read-only extension, saved a screenshot and short MP4, and removed owned resources | No | Headset was unworn in standby: overlay reported `not_visible`, stereo capture was dark; wearer-visible pixels and controller input are unverified | 25 Oct, v0.4.29: [PR #198](https://github.com/saphid/frame-control/pull/198), [PR #201](https://github.com/saphid/frame-control/pull/201), [panel guide](headset-app.md) |
+| Experimental Decky Loader manager | Real Frame OS 0.5.6 ARM64 user-service install, status, update and remove completed; ProtonDB Badges loaded in Decky backend and Steam shared UI registry | No | Decky and plugin UI in the VR shell, wearer-visible badges, controller input and other plugins remain unverified | 25 Oct, v0.4.29: [PR #195](https://github.com/saphid/frame-control/pull/195), [PR #202](https://github.com/saphid/frame-control/pull/202), [headset findings](decky-frame.md) |

 Release notes must preserve these limits until a newer recorded check changes them. When a feature is retested, add its date, exact app/Frame version, host type and proof here. The older [v0.3.1 matrix](support-matrix.html) is a historical snapshot and does not describe current coverage.
@@ -0,0 +1,131 @@
+# Decky Loader on Steam Frame
+
+**Status, 2026-10-25:** Decky Loader 3.3.0's ARM64 backend starts on Frame OS
+0.5.6 and injects into Steam's shared CEF context. Its Decky tab registers in
+JavaScript. A usable plugin menu in the Frame's VR shell has **not** been
+verified. Frame Control therefore labels its user-service manager experimental.
+ProtonDB Badges loaded in the backend and Gamepad UI plugin registry, but its
+VR user interface has not been seen or used.
+
+## What was checked on the real headset
+
+The headset was SteamOS `0.5.6`, `VARIANT_ID=vr`, build `20261022.6153909`,
+`aarch64` (SteamOS 3.9.x family). SSH reached it through the existing `frame`
+alias. `/` was mounted read-write as Btrfs; no root filesystem change was
+needed. `systemctl --user` was running. The Steam client launched with
+`-cef-enable-debugging`, `-vrgamepadui`, and `-steamdeck`; its web helper served
+CEF remote debugging on `127.0.0.1:8080`. The usual
+`.cef-enable-remote-debugging` marker was absent, yet debugging was active.
+
+CEF listed a `SharedJSContext` target at `steamloopback.host/routes/library/home`
+and a separate `SteamVR` target for the VR overlay. The Decky 3.3.0 ARM64
+binary started from `/tmp` as the normal user: port `127.0.0.1:1337` answered
+HTTP 200, the log reported `Loading Decky frontend!`, and CEF showed
+`window.deckyHasLoaded === true` and one registered Decky tab in
+`SharedJSContext`. The `SteamVR` target had neither that global nor a Decky tab;
+its current body text did not contain Decky. The Steam web helper had
+`--disable-quick-menu`. This is evidence of backend and shared-context
+injection, not proof of an accessible Decky plugin menu inside VR. A QAM
+interaction in the headset and a plugin UI test remain necessary.
+
+Frame Control's per-user manager was then exercised on the real Frame:
+**install → status → update → status → remove → status**. The service became
+active, the binary matched Decky's published SHA-256, and removal left no
+service, binary or listening port 1337. Decky's already injected JavaScript
+remained in Steam's running web helper until that helper was restarted. After a
+web helper restart, both `deckyHasLoaded` and the tab hook were absent. All
+temporary trial files and the test's empty managed data folder were removed.
+
+## ProtonDB Badges compatibility test
+
+The [ProtonDB Badges v1.1.0 release](https://github.com/OMGDuke/protondb-decky/releases/tag/v1.1.0)
+was tested on the same Frame OS build. It is a popular, passive Decky plugin
+(133 GitHub stars at test time) that adds badges to game pages. The published
+archive SHA-256 was
+`b4c72ff0ffe60b1a14abafe75a62f644cbb6689f398a753a1905c281151d9173`.
+Its six archive entries had no links or path traversal, and its manifest declared
+`flags: []` and `api_version: 2`. The release contains a frontend bundle and
+no backend `main.py`; its source backend only manages its own settings.
+
+The test copied the archive into Frame Control's managed Decky plugin folder,
+then installed the official Decky 3.3.0 ARM64 binary as a user service. Decky's
+log said `Plugin ProtonDB Badges is passive` and `Loaded ProtonDB Badges`.
+`DeckyPluginLoader.plugins` in Steam's `SharedJSContext` contained
+`ProtonDB Badges`; `deckyHasLoaded` was true there. The separate `SteamVR`
+CEF target had no Decky globals or plugin text, and SteamVR listed no Decky
+overlay. The headset was in standby, so no in-headset plugin page or badge
+interaction was verified. The backend's unauthenticated root URL returned
+HTTP 403, as expected.
+
+The test removed the managed Decky service and binary, the test plugin folder,
+and its shared-device lock. The service was no longer running, the plugin list
+was empty, the binary and unit were gone, and port 1337 was closed. Decky's
+already injected frontend may remain in the running Steam web helper until
+Steam normally restarts; the test did not restart Steam or SteamVR.
+
+## Why the official Decky installer is not used
+
+The current [Decky installer](https://github.com/SteamDeckHomebrew/decky-installer/blob/e42a3c828de90673959b4de26cf5c5d2c7830554/cli/install_release.sh)
+selects `PluginLoader-arm64` on `aarch64`, creates `~/homebrew/plugins`, writes
+the CEF marker, installs `/etc/systemd/system/plugin_loader.service`, and uses
+`sudo systemctl` to enable a **root** service. Its
+[uninstaller](https://github.com/SteamDeckHomebrew/decky-installer/blob/e42a3c828de90673959b4de26cf5c5d2c7830554/cli/uninstall.sh)
+also uses sudo. These scripts do not call `steamos-readonly`, but they do write
+under `/etc`; their root service has broad control over the headset. The
+current [Decky loader](https://github.com/SteamDeckHomebrew/decky-loader/blob/00cd202872b85868071b041c8f1b34e734147195/backend/decky_loader/injector.py)
+targets Steam's shared Gamepad UI CEF page, injects a frontend served on port
+1337, and patches the standard Quick Access Menu. On Frame, Steam supplies
+the CEF target, while visible VR shell integration is unresolved.
+
+Frame Control downloads only Decky's official latest ARM64 release, requires
+its published SHA-256 digest, and checks the ELF architecture. It installs a
+**user** service named `frame-control-decky.service` in
+`~/.config/systemd/user`, with the binary and plugin folder under
+`~/.local/share/frame-control/decky`. It never asks for a sudo password, edits
+`/etc`, or changes CEF flags. Decky warns that running without root is not
+officially supported. Plugins that require root, assume `~/homebrew`, or rely
+on Steam Deck hardware may fail even if the loader runs. Frame Control lists
+plugins already present in its managed folder and the upstream `~/homebrew`
+folder; it does not install plugins while their Frame UI and compatibility
+are unverified.
+
+The latest tested release was
+[Decky 3.3.0](https://github.com/SteamDeckHomebrew/decky-loader/releases/tag/v3.3.0),
+`PluginLoader-arm64` SHA-256
+`8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6`.
+This digest comes from that release's GitHub API asset metadata; it detects a
+download mismatch, but is not an independent signature.
+
+## Opt in and remove
+
+In Frame Control, open **Tools → Decky Loader on Frame**, read the experimental
+notice, check the acknowledgement box, and choose **Install**. **Update**
+downloads and verifies the latest ARM64 release again. **Remove managed
+Decky** disables and removes only Frame Control's user service and binary.
+It preserves plugin files and settings so unrelated user data is not deleted.
+Restart Steam or the headset to clear the frontend already injected into its
+current web helper process. No action wipes the headset.
+
+Manual removal if Frame Control is unavailable:
+
+```sh
+ssh frame 'systemctl --user disable --now frame-control-decky.service; rm -f ~/.config/systemd/user/frame-control-decky.service ~/.local/share/frame-control/decky/PluginLoader ~/.local/share/frame-control/decky/.frame-control/receipt.json; systemctl --user daemon-reload; systemctl --user reset-failed frame-control-decky.service'
+```
+
+That command intentionally keeps `~/.local/share/frame-control/decky/plugins`
+and `settings`. Check those folders before deleting them yourself. An upstream
+Decky installation is separate; use its own installer to remove it. Frame
+Control refuses to install alongside an upstream system service.
+
+## Next compatibility test
+
+In the headset, open Steam's VR dashboard and look for Decky's plugin tab or
+Quick Access Menu after an opt-in install. If none appears, inspect whether
+the VR shell exposes a different menu component and whether Decky's frontend
+can target it without patching Steam globally. Confirm the plugin's visible
+UI, controller interaction, and persistence across a normal Steam restart.
+Until those checks pass,
+Frame Control should not describe Decky plugins as usable in VR yet. A worn
+headset check is needed for both the Decky menu and the Frame Control SteamVR
+panel; only then can their controller interaction and plugin presentation be
+confirmed.
@@ -0,0 +1,32 @@
+# SteamOS PC OBS host feasibility check, 2026-10-25 UTC
+
+The available x86_64 host, lxso2, runs Ubuntu 24.04.3. It has no `flatpak`
+command, OBS installation, SteamOS 3.9.5 VM or physical Steam Machine. This
+check therefore does **not** verify that Frame Control or Flatpak OBS runs on
+a SteamOS desktop or a read-only-root PC host.
+
+The downloaded v0.4.27 Linux x86_64 AppImage matched GitHub's SHA-256 digest
+`42d774653c69b193c3d577743c32b8fe8dfeee7ea1f8cdf7369902962d647b83`.
+With `APPIMAGE_EXTRACT_AND_RUN=1`, it launched under Xvfb using an isolated
+profile and its bundled server returned HTTP 200. FUSE mounting, physical
+display rendering and SteamOS-specific dependencies were not tested.
+
+The v0.4.27 tagged OBS helper then ran against the real Frame under the shared
+`/tmp/frame-test.lock`. Frame OS was 0.5.6 and SteamVR activity level was 3
+(standby). A receiver bound to `127.0.0.1:15099` on lxso2 accepted 497
+MPEG-TS packets, 93,436 bytes. Every datagram had complete 188-byte packets
+with sync bytes. `ffprobe` found H.264 video and AAC audio. Closing the
+helper's control pipe made it exit 0; no owned remote stream process remained.
+Battery read 100% Full before and after, and the owned lock was released. The
+temporary `.ts` file was removed. This proves the local UDP sender path on an
+Ubuntu host; it does not prove Flatpak OBS could receive it on SteamOS.
+
+The public
+[OBS Flatpak manifest](https://github.com/flathub/com.obsproject.Studio/blob/master/com.obsproject.Studio.json)
+lists `--share=network`, which permits use of the host network. We read that
+manifest but did not install or run the Flatpak. A future check needs a real
+SteamOS 3.9.5 desktop host or VM with Flatpak OBS: launch the AppImage without
+root changes, start the source, record from the Media Source at
+`udp://127.0.0.1:15099`, verify video and audible game audio, then stop and
+confirm cleanup. The standby test cannot establish real game audio, A/V sync
+or active passthrough in the mirror.
@@ -16,8 +16,12 @@ and **Open Headset Glance**. The folder is normally:
 - Windows: `%APPDATA%\Frame Control\extensions`

 To remove it, close the panel and delete only its `headset-glance` folder. The
-extension is local to this computer; the iPhone app reads the folder on the
-Frame, where its server runs.
+desktop app reads the folder on its computer. The iPhone app and the opt-in
+[SteamVR headset panel](headset-app.md) read the folder on the Frame. To use an
+extension in VR, copy its folder to
+`steamos@frame:~/.local/share/frame-control/extensions/`, then select
+**Extensions → Refresh extensions → Open** in the headset panel. The iframe,
+read-only bridge and asset rules are the same there.

 ## Make an extension

@@ -0,0 +1,84 @@
+# Frame Control in the headset
+
+**Experimental, Frame OS 0.5.6.** Tools → Frame Control in VR installs a local
+panel in SteamVR's dashboard. It is a way to reach Frame Control while wearing
+the headset, independent of Decky's Quick Access Menu. The panel starts only
+after you opt in; its server binds to `127.0.0.1` and it uses a normal user
+service. No `sudo`, root filesystem change, or Steam client patch is needed.
+
+The companion copies its bundled UI over the existing trusted SSH connection.
+On the Frame, `frame-control-headset.service` runs a loopback server and one
+Chromium app window on gamescope. The window receives a dedicated `STEAM_GAME`
+id, so SteamVR registers `valve.steam.desktopgame.2001947813` as a dashboard
+panel. **Show in SteamVR** requests that dashboard tab; the wearer can select
+it again from SteamVR's dashboard. Closing the panel stops its browser and
+server. The service is not enabled at boot.
+
+The page shows battery, free home storage and SteamVR status. It can request
+SteamVR's main Game Mode dashboard, list and force quit a running game after an
+unsaved-progress confirmation, save an OpenVR screenshot to
+`~/Pictures/FrameControl`, and record the SteamVR mirror to
+`~/Videos/FrameControl`. Recordings have a 20-minute limit and use a separate
+work folder from desktop Frame Control's recorder; they may have no audio if
+the monitor source is unavailable. Captures made in standby can be dark.
+
+The page also discovers extensions from
+`~/.local/share/frame-control/extensions` and opens them in sandboxed iframes.
+It offers the version 1 read-only `capabilities` and `status` bridge from
+[the extension guide](extensions.md). Installing an extension still means
+copying its folder to the Frame; the panel does not download third-party code.
+
+The per-run UI key is passed in the URL fragment, removed from the address bar after load,
+and sent in the `X-Frame-UI` header. The key is absent from the HTTP request
+line and server log. The usual host/origin and anti-framing checks still apply.
+
+## Real Frame test, 2026-10-25
+
+On Frame OS 0.5.6, build `20261022.6153909`, the opt-in install started the
+user service, served `/headset`, read live `/api/status` from the browser, and
+registered a mapped Chromium window with SteamVR under the dedicated overlay
+key. The server rejected a request with the wrong UI key. A read-only status
+probe reported the user service running and the overlay registered.
+
+The unworn headset was in standby (`activity_level` 3). SteamVR reported the
+new overlay as `not_visible` even after `ShowDashboard`. An OpenVR stereo
+screenshot was a uniform dark frame. The documented temporary wake attempt
+(`power.turnOffScreensTimeout` 5 → 3600, `--handlewakeup`, `ShowDashboard`)
+still left the overlay `not_visible`; the setting was restored to 5 and the
+dashboard hidden. The X window's `xwd` image was black too. These observations
+prove panel creation and page/API execution, **not wearer-visible pixels or
+laser/controller input**. A worn-headset check is still required before
+describing the panel as visually verified.
+
+The test then removed the managed service and app bundle. Its unit became
+inactive, port 47813 closed, the SteamVR overlay disappeared, and the Frame's
+battery was 100%. Steam and SteamVR were left running. The browser profile and
+extensions folder were deliberately kept.
+
+A second test on the same build installed the expanded panel with the
+`headset-glance` example extension. The headset's authenticated loopback API
+returned live status (99% battery), discovered and served the extension, and
+listed no running games. The Game Mode dashboard request succeeded; an invalid
+force-quit app ID was rejected with HTTP 400. Screenshot and recording actions
+saved a PNG and a 3.6 MB MP4 in the headset user's folders. The recording
+reported an audio source. The per-run UI key was absent from the server log.
+After another wake and dashboard request, SteamVR still reported the panel
+`not_visible`. No wearer-visible screenshot or controller interaction was
+obtained. The test removed its example extension and captured media, then
+uninstalled the service. The unit, port, bundle and overlay were absent after
+removal; Steam and SteamVR remained running.
+
+## Remove
+
+Use **Tools → Frame Control in VR → Remove**. If the companion is unavailable,
+run:
+
+```sh
+ssh frame 'systemctl --user stop frame-control-headset.service; rm -f ~/.config/systemd/user/frame-control-headset.service; systemctl --user daemon-reload; rm -rf ~/.local/share/frame-control/headset/bundle; rm -f ~/.local/share/frame-control/headset/receipt.json ~/.local/share/frame-control/headset/server.log'
+```
+
+That command removes only Frame Control's managed panel code. The Chromium
+profile remains in `~/.local/share/frame-control/headset/profile` so local
+extension data is not discarded. Inspect and delete that folder separately if
+you no longer want it. Third-party extensions are in
+`~/.local/share/frame-control/extensions` and are never removed by this tool.
@@ -56,6 +56,42 @@ The [follow-up Linux/Frame transport check](evidence/obs-followup-2026-10-25.md)
 measured packet continuity and a short MP4 recording on the current SteamOS
 build. The headset was still in standby.

+## SteamOS / Steam Machine PC host
+
+Use **Desktop Mode** on the SteamOS PC. Download the Linux x86_64 AppImage to
+your home folder. Make it executable and open it there; SteamOS has a
+read-only system root, so these steps do not use `apt` or change `/usr`:
+
+```sh
+chmod +x ~/Downloads/Frame-Control-linux-x86_64.AppImage
+~/Downloads/Frame-Control-linux-x86_64.AppImage
+```
+
+If AppImage mounting reports a FUSE error, try
+`APPIMAGE_EXTRACT_AND_RUN=1 ~/Downloads/Frame-Control-linux-x86_64.AppImage`.
+This extracts to writable temporary space and needs enough free disk space.
+Set up the Frame's SSH connection in Frame Control, then use **Start OBS
+source** before you add or activate OBS's Media Source. Install OBS as the
+`com.obsproject.Studio` Flatpak through Discover or your normal user Flatpak
+setup. In that OBS Media Source, clear **Local File**, set **Input** to
+`udp://127.0.0.1:15099`, and set **Input Format** to `mpegts`. Make a short
+recording and check both picture and sound before a stream. Use **Stop OBS
+source** in Frame Control when done.
+
+The OBS Flatpak's published manifest includes `--share=network`, which is
+needed for its local UDP receiver. Check your installed permissions with
+`flatpak info --show-permissions com.obsproject.Studio` if OBS receives no
+packets. Frame Control's helper sends to loopback on this PC; it does not
+require an open LAN port or an OBS plugin. The PC does not need a system
+`ffmpeg` package for the helper; encoding runs on the Frame.
+
+**Test limit:** The v0.4.27 AppImage launched on an Ubuntu 24.04 x86_64 host
+under Xvfb. Its helper sent H.264 and AAC from a real Frame to a local UDP
+receiver on that host. No SteamOS 3.9.5 PC, Steam Machine, Flatpak OBS runtime,
+read-only-root host, or physical display was available for this check. The
+SteamOS steps and Flatpak receiver therefore remain **untested on SteamOS**.
+See the [test record](evidence/obs-steamos-host-2026-10-25.md).
+
 ## Known issue: game audio in OBS

 A Frame owner [reported](https://x.com/AzizahStellazio/status/2114147449468293171)
@@ -1,10 +1,29 @@
 # Open questions and on-device checks

-Research as of 2026-09-25, eight days after the Frame's retail release
-(2026-09-18). Most first-party detail comes from Valve's Steamworks developer
-pages. Searches of Reddit and the Steam forums turned up **almost no
-end-user reports** about SSH, desktop streaming, or macOS. Treat that as
-"not documented yet", not "doesn't work".
+The September sections below record early checks after the Frame's retail
+release (2026-09-18). They are a historical test log, not a current setup
+guide. For current connection steps, see [SteamOS October 2026
+compatibility](steamos-2026-10-compat.md). For the charge-limit result, see
+[charge-limit.md](charge-limit.md).
+
+## Current Frame OS 0.5.6 status (2026-10-25)
+
+- `frame.local` no longer resolves on the checked 0.5.6 beta build
+  (`20261022.6153909`). Avahi was active but did not publish addresses. The
+  configured Tailscale SSH alias worked. Frame Control can use a saved IP on
+  the same network after verifying the pinned SSH key, or a manual IP/SSH
+  alias. Same-LAN fallback scanning was **not** tested on this Tailscale route.
+  See the [live compatibility check](evidence/steamos-compat-live-2026-10-25.md).
+- Read-only checks on that build found no SteamOS Manager
+  `BatteryChargeLimit1` interface or `charge_control_*` attribute. The vendor
+  charging switches are root-owned and managed by Valve's charger service.
+  No charging control was written. An 80% limit is **not supported** by Frame
+  Control; see [charge-limit.md](charge-limit.md) and the
+  [headset check](evidence/round3-headset-2026-10-25.md).
+- Active passthrough in the recording mirror remains **unknown**: the only
+  captured mirror frame was uniform while the headset was unworn in standby.
+  A worn, active passthrough check is still needed; see the
+  [headset check](evidence/round3-headset-2026-10-25.md).

 ## Verified on device (2026-09-25)

@@ -14,7 +33,9 @@ build 20260922.6101926, kernel 6.18, aarch64):
 - **1–2.** Developer Mode + Set User Password gave working SSH with no terminal
  steps. `sshd` is enabled and active. The user is `steamos` (in `wheel`) and
  the hostname is `frame`.
- **3.** `frame.local` resolves from the Mac; `avahi-daemon` is active.
+- **3.** `frame.local` resolved from the Mac on the September build;
+  `avahi-daemon` was active. This result does not apply to the checked 0.5.6
+  beta build; see the current status above.
 - **5.** `/etc/ssh/sshd_config` has `Include /etc/ssh/sshd_config.d/*.conf`.
  The existing drop-ins are `20-systemd-userdb.conf` and `99-archlinux.conf`, so
  `01-frame-keys-only.conf` would sort first as intended. (`--harden` itself
@@ -148,9 +169,9 @@ check in the headset:
 Can an 80% charge limit be set over SSH or adb? **Not safely yet.** SteamOS
 Manager's `BatteryChargeLimit1` (the interface Steam's own setting uses) has
 no backend in the Frame's device config, and the battery node is a
-`max1720x` fuel gauge with no `charge_control_end_threshold`. Research and
-read-only headset checks are in [charge-limit.md](charge-limit.md). Not tested
-on a headset.
+`max1720x` fuel gauge with no `charge_control_end_threshold`. Read-only checks
+on the real Frame confirmed this on 0.5.6 beta; no charge setting was written.
+See [charge-limit.md](charge-limit.md).

 ## Unconfirmed claims made in these docs

@@ -25,3 +25,19 @@ uses the cable. The Wireless Adapter and Steam streaming can follow a different
 path. No cable is attached to the Linux test host, so this exact UI has only
 synthetic route/SSH tests. Windows and Linux physical USB-C behavior, and a
 fresh wired readback on the current Frame OS, remain unverified.
+
+## If SSH works but the game stream stops
+
+If the stream fails on USB, Wi-Fi and the Wireless Adapter, but this doctor
+reports a working SSH route, check SteamVR on the **PC**. Frame Control's
+`frame.local` reconnect only restores its headset management connection. It
+does not restart PC SteamVR or repair the game stream. On a Windows or Linux
+PC, save your work and close the VR game. Exit SteamVR from Steam on that PC,
+then start it again. This can show whether a PC SteamVR session is stuck; it
+does not fix the cause of repeated drops. SteamVR on macOS is not a supported
+PC streaming host.
+
+Frame Control has no verified cross-platform command that safely stops only
+the intended PC SteamVR session. A forced restart could close a running game
+and lose unsaved progress. For that reason the app gives manual steps and does
+not add a one-click restart button.
@@ -16,6 +16,7 @@ sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'ui'))
 import frame_android_import as backup
 import server
 from apk_fixtures import apk, manifest
+from test_quest import apk_bytes

 PKG = 'com.Armature.VR4'
 META = {'package': PKG, 'label': PKG, 'version': '', 'version_code': 210,
@@ -66,6 +67,41 @@ class BackupTests(unittest.TestCase):
        with self.assertRaisesRegex(backup.android.FrameError, 'unique names'):
            backup.inspect([str(self.apk), str(self.obb[0]), str(duplicate)])

+    def test_supported_split_set_uses_manifest_base_and_existing_merge_path(self):
+        base = self.root / 'not-named-base.apk'
+        base.write_bytes(apk_bytes(PKG, split_required=True, version_code=210))
+        split = self.root / 'arm64.apk'
+        split.write_bytes(apk_bytes(PKG, split='config.arm64_v8a', version_code=210,
+                                    files={'lib/arm64-v8a/libgame.so': b'game'}))
+        plan = backup.inspect([str(split), str(base)])
+        self.assertEqual(plan['apk'], base)
+        self.assertEqual(plan['splits'], [split])
+        self.assertEqual(backup.public(plan)['splits'], ['arm64.apk'])
+        with patch.object(backup.quest, '_running', return_value=False), \
+                patch.object(backup.android, 'read_meta', return_value=None), \
+                patch.object(backup.android, 'install', return_value=META) as install:
+            backup.install(plan)
+        self.assertEqual(install.call_args.kwargs['splits'], [str(split)])
+
+    def test_split_mismatch_and_unsupported_resource_fail_before_frame_access(self):
+        base = self.root / 'base.apk'
+        base.write_bytes(apk_bytes(PKG, split_required=True, version_code=210))
+        split = self.root / 'split.apk'
+        with patch.object(backup.android, 'ssh') as ssh:
+            split.write_bytes(apk_bytes(PKG, split='config.arm64_v8a', version_code=211,
+                                        files={'lib/arm64-v8a/libgame.so': b'game'}))
+            with self.assertRaisesRegex(backup.android.FrameError, 'version cannot be verified'):
+                backup.inspect([str(base), str(split)])
+            split.write_bytes(apk_bytes(PKG, split='config.xxhdpi', version_code=210,
+                                        files={'res/drawable/icon.png': b'png'}))
+            with self.assertRaisesRegex(backup.android.FrameError, 'screen-density or language resources'):
+                backup.inspect([str(base), str(split)])
+            split.write_bytes(apk_bytes(PKG, split='config.x86_64', version_code=210,
+                                        files={'lib/x86_64/libgame.so': b'game'}))
+            with self.assertRaisesRegex(backup.android.FrameError, 'another device'):
+                backup.inspect([str(base), str(split)])
+        ssh.assert_not_called()
+
    def test_obb_only_repairs_existing_game_and_requests_apk_when_not_installed(self):
        with patch.object(backup.android, 'read_meta', return_value=None):
            with self.assertRaisesRegex(backup.android.FrameError, 'Add its APK'):
@@ -204,6 +240,21 @@ class BundleTests(unittest.TestCase):
                self.assertTrue(all(not Path(p).exists() for p in folders))
                self.assertTrue(source.exists())

+    def test_bundle_with_supported_split_uses_same_preview_and_cleanup(self):
+        source = self.bundle({
+            'base.apk': apk_bytes(PKG, split_required=True, version_code=210),
+            'config.arm64.apk': apk_bytes(PKG, split='config.arm64_v8a', version_code=210,
+                                          files={'lib/arm64-v8a/libgame.so': b'game'}),
+        }, suffix='.apks')
+        with patch.object(backup.android, 'ssh') as ssh:
+            read = server.android_backup({'action': 'inspect', 'paths': [str(source)]})
+        ssh.assert_not_called()
+        self.assertEqual(read['plan']['apk'], 'base.apk')
+        self.assertEqual(read['plan']['splits'], ['config.arm64.apk'])
+        folders = list(server._android_backups[read['token']]['dirs'])
+        server.android_backup({'action': 'discard', 'token': read['token']})
+        self.assertTrue(all(not Path(p).exists() for p in folders))
+
    def test_browser_upload_bundle_is_staged_and_removed_with_extraction(self):
        source = self.bundle()
        token = server.android_backup({'action': 'begin'})['token']
@@ -221,7 +272,7 @@ class BundleTests(unittest.TestCase):

    def test_reject_layouts_before_any_headset_access_and_cleanup_failed_stage(self):
        cases = [
-            ({'base.apk': self.apk.read_bytes(), 'split.apk': self.apk.read_bytes()}, 'Split APK'),
+            ({'base.apk': self.apk.read_bytes(), 'split.apk': self.apk.read_bytes()}, 'exactly one base'),
            ({'base.apk': self.apk.read_bytes(), f'Android/data/{PKG}/save': b'private'}, 'restore'),
            ({'base.apk': self.apk.read_bytes(), 'main.1.org.other.game.obb': b'wrong'}, 'does not belong'),
            ({'base.apk': self.apk.read_bytes(), '../outside.obb': b'bad'}, 'unsafe'),
@@ -229,7 +280,7 @@ class BundleTests(unittest.TestCase):
            ({'base.apk': self.apk.read_bytes(), 'CON.apk': b'bad'}, 'unsafe'),
            ({'base.apk': self.apk.read_bytes(), 'other.exe': b'bad'}, 'Unsupported'),
            ({'base.apk': self.apk.read_bytes(), 'BASE.apk': b'bad'}, 'duplicate'),
-            ({'manifest.json': b'{}'}, 'standalone APK'),
+            ({'manifest.json': b'{}'}, 'base APK'),
        ]
        for entries, message in cases:
            with self.subTest(message=message), patch.object(backup.android, 'ssh') as ssh:
@@ -277,7 +328,8 @@ class BundleTests(unittest.TestCase):
                                    ('x' * len('isSplitRequired')).encode('utf-16-le'))
            self.apk.write_bytes(apk({'AndroidManifest.xml': data}))
            with self.subTest(attrs=attrs):
-                with self.assertRaisesRegex(backup.android.FrameError, 'needs split APKs'):
+                message = 'exactly one base' if attrs.get('split') else 'needs split APKs'
+                with self.assertRaisesRegex(backup.android.FrameError, message):
                    backup.inspect([str(self.apk)])

    def test_bundle_install_uses_existing_queue_and_cleans_after_failure(self):
@@ -0,0 +1,94 @@
+"""Decky release validation and the removable user-service transaction."""
+import sandbox  # noqa: F401
+import hashlib
+import io
+import json
+import os
+import secrets
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / 'ui'))
+import frame_decky
+
+
+def arm_binary(fill=b'A'):
+    data = bytearray(b'\x7fELF' + fill * 2044)
+    data[18:20] = (183).to_bytes(2, 'little')
+    return bytes(data)
+
+
+class DeckyRelease(unittest.TestCase):
+    def test_official_arm_release_digest_is_checked(self):
+        data = arm_binary()
+        digest = hashlib.sha256(data).hexdigest()
+        url = f'https://github.com/{frame_decky.REPO}/releases/download/v3.3.0/PluginLoader-arm64'
+        info = {'tag_name':'v3.3.0', 'assets':[{'name':'PluginLoader-arm64', 'size':len(data),
+                'digest':'sha256:'+digest, 'browser_download_url':url}]}
+        with patch.object(frame_decky.urllib.request, 'urlopen', side_effect=[io.BytesIO(json.dumps(info).encode()), io.BytesIO(data)]):
+            self.assertEqual(frame_decky.release_binary(), ('v3.3.0', digest, data))
+        info['assets'][0]['digest'] = 'sha256:' + '0'*64
+        with patch.object(frame_decky.urllib.request, 'urlopen', side_effect=[io.BytesIO(json.dumps(info).encode()), io.BytesIO(data)]):
+            with self.assertRaisesRegex(ValueError, 'digest'):
+                frame_decky.release_binary()
+
+    def test_install_rejects_incompatible_headset_before_download(self):
+        state = {'arch':'x86_64','variant':'vr','cef':True,'managed':False,'upstreamInstall':False}
+        with patch.object(frame_decky, 'release_binary') as download:
+            with self.assertRaisesRegex(ValueError, 'Steam Frame'):
+                frame_decky.change(lambda *a, **k: json.dumps(state), 'install')
+            download.assert_not_called()
+
+
+@unittest.skipIf(os.name == 'nt', 'remote service script runs on Linux')
+class DeckyServiceScript(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        home = Path(self.tmp.name)
+        fake = home / 'systemctl'
+        fake.write_text('#!/bin/sh\nif [ "$FRAME_DECKY_TEST_FAIL" = "1" ] && [ "$2" = "enable" ]; then echo blocked >&2; exit 1; fi\nexit 0\n')
+        fake.chmod(0o700)
+        self.env = {**os.environ, 'HOME': self.tmp.name, 'PATH': self.tmp.name + os.pathsep + os.environ['PATH']}
+        self.base = home / '.local/share/frame-control/decky'
+
+    def apply(self, action, data=None, version='v3.3.0', fail=False):
+        token = secrets.token_hex(12)
+        stage = Path('/tmp/frame-control-decky-' + token)
+        if data is not None:
+            stage.write_bytes(data)
+        digest = hashlib.sha256(data or b'').hexdigest()
+        env = {**self.env, 'FRAME_DECKY_TEST_FAIL': '1' if fail else '0'}
+        try:
+            return subprocess.run([sys.executable, '-', action, token, digest, version],
+                                  input=frame_decky.APPLY, capture_output=True, text=True, env=env, timeout=15)
+        finally:
+            stage.unlink(missing_ok=True)
+
+    def test_install_update_rollback_and_remove(self):
+        first = arm_binary(b'A')
+        result = self.apply('install', first)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual((self.base / 'PluginLoader').read_bytes(), first)
+        receipt = self.base / '.frame-control/receipt.json'
+        self.assertEqual(json.loads(receipt.read_text())['version'], 'v3.3.0')
+        self.assertTrue((Path(self.tmp.name) / '.config/systemd/user/frame-control-decky.service').is_file())
+
+        second = arm_binary(b'B')
+        result = self.apply('update', second, version='v3.3.1', fail=True)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual((self.base / 'PluginLoader').read_bytes(), first)
+        self.assertEqual(json.loads(receipt.read_text())['version'], 'v3.3.0')
+
+        result = self.apply('update', second, version='v3.3.1')
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual((self.base / 'PluginLoader').read_bytes(), second)
+        result = self.apply('remove')
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse((self.base / 'PluginLoader').exists())
+        self.assertFalse(receipt.exists())
+        self.assertTrue((self.base / 'plugins').is_dir())
@@ -0,0 +1,65 @@
+"""Headset panel packaging, ownership checks and window targeting."""
+import sandbox  # noqa: F401
+import io
+import json
+import os
+from pathlib import Path
+import secrets
+import subprocess
+import sys
+import tarfile
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'ui'))
+import frame_headset
+import frame_headset_runtime
+
+
+class HeadsetBundle(unittest.TestCase):
+    def test_bundle_is_deterministic_and_contains_the_local_ui(self):
+        first = frame_headset.bundle()
+        self.assertEqual(first, frame_headset.bundle())
+        with tarfile.open(fileobj=io.BytesIO(first), mode='r:gz') as archive:
+            names = set(archive.getnames())
+        self.assertIn('ui/headset.html', names)
+        self.assertIn('ui/frame_headset_runtime.py', names)
+        self.assertIn('ui/server.py', names)
+        self.assertFalse(any('\\' in name for name in names))
+        self.assertFalse(any('__pycache__' in name for name in names))
+
+    def test_incompatible_device_is_rejected_before_upload(self):
+        state = {'arch': 'x86_64', 'variant': 'vr'}
+        calls = []
+        def ssh(*args, **kwargs):
+            calls.append(args)
+            return json.dumps(state)
+        with patch.object(frame_headset, 'bundle') as bundle:
+            with self.assertRaisesRegex(ValueError, 'Steam Frame'):
+                frame_headset.change(ssh, 'install')
+            bundle.assert_not_called()
+        self.assertEqual(len(calls), 1)
+
+    @unittest.skipIf(os.name == 'nt', 'remote script runs on Linux')
+    def test_unowned_install_is_never_removed(self):
+        with tempfile.TemporaryDirectory() as home:
+            token = secrets.token_hex(12)
+            result = subprocess.run([sys.executable, '-', 'remove', token, 'none'],
+                                    input=frame_headset.APPLY, text=True, capture_output=True,
+                                    env={**os.environ, 'HOME': home}, timeout=5)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn('No Frame Control managed', result.stderr)
+
+
+class HeadsetWindow(unittest.TestCase):
+    def test_uses_only_its_marker_title(self):
+        tree = ' 0x101 "Other panel"\n 0xabc "Frame Control VR [fc-headset]"\n'
+        with patch.object(frame_headset_runtime, 'command', return_value=tree):
+            self.assertEqual(frame_headset_runtime.panel_window(), '0xabc')
+        with patch.object(frame_headset_runtime, 'command', return_value=' 0x101 "Other panel"'):
+            self.assertIsNone(frame_headset_runtime.panel_window())
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -0,0 +1,47 @@
+"""Local headset actions keep writes scoped to the opt-in VR server."""
+import sandbox  # noqa: F401
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import Mock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'ui'))
+import frame_clips
+import server
+
+
+class HeadsetActions(unittest.TestCase):
+    def test_quick_actions_are_unavailable_outside_headset_runtime(self):
+        with patch.object(server, 'HEADSET_RUNTIME', False):
+            with self.assertRaisesRegex(server.Failure, 'local VR panel'):
+                server.headset_quick({'action':'game-mode'})
+
+    def test_game_mode_targets_steamvr_main_dashboard(self):
+        with patch.object(server, 'HEADSET_RUNTIME', True), patch.object(server.frame_panels, 'focus') as focus:
+            response = server.headset_quick({'action':'game-mode'})
+        focus.assert_called_once_with('valve.steam.gamepadui.main')
+        self.assertIn('Game Mode', response['message'])
+
+    def test_screenshot_is_saved_only_in_user_pictures(self):
+        with tempfile.TemporaryDirectory() as home, patch.object(server.Path, 'home', return_value=Path(home)), \
+                patch.object(server, 'HEADSET_RUNTIME', True), patch.object(server, 'headset_view', return_value=b'PNG data'):
+            result = server.headset_quick({'action':'screenshot'})
+            file = Path(result['file'])
+            self.assertEqual(file.parent, Path(home) / 'Pictures/FrameControl')
+            self.assertEqual(file.read_bytes(), b'PNG data')
+            if os.name != 'nt':  # Windows reports emulated mode bits for user files.
+                self.assertEqual(file.stat().st_mode & 0o777, 0o600)
+
+    def test_local_recording_uses_separate_work_folder(self):
+        recorder = frame_clips.Recorder(Mock(), Mock(), Mock(), Mock(),
+                                        work='.cache/frame-control/headset-video',
+                                        destination_label='~/Videos/FrameControl')
+        self.assertIn('headset-video', frame_clips.probe_command(recorder.work))
+        self.assertIn('headset-video', frame_clips.record_command('rec-20261025-030000', False, work=recorder.work))
+        self.assertNotIn('headset-video', frame_clips.probe_command())
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -9,7 +9,7 @@ import subprocess
 import unittest

 ROOT = pathlib.Path(__file__).resolve().parents[1]
-STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadSteamPipewire', 'loadPanels', 'loadPanelSwitcher', 'loadExtensions', 'loadBackups', 'loadStorage', 'loadPower', 'loadTitles', 'showAndroidTab',
+STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadSteamPipewire', 'loadPanels', 'loadPanelSwitcher', 'loadExtensions', 'loadDecky', 'loadHeadsetPanel', 'loadBackups', 'loadStorage', 'loadPower', 'loadTitles', 'showAndroidTab',
         'loadAndroid', 'loadDisplays', 'setGameSource', 'requestAnimationFrame']

 RUN = r'''
@@ -121,6 +121,19 @@ class ServerGuards(unittest.TestCase):
        finally:
            shutil.rmtree(folder)

+    def test_decky_write_requires_experimental_acknowledgement(self):
+        code, body = self.post('/api/decky', {'action': 'install'})
+        self.assertEqual(code, 400)
+        self.assertIn('experimental', body['error'])
+
+    def test_headset_page_and_install_acknowledgement(self):
+        code, _, body = self.request('GET', '/headset')
+        self.assertEqual(code, 200)
+        self.assertIn(b'Frame Control VR [fc-headset]', body)
+        code, body = self.post('/api/headset', {'action': 'install'})
+        self.assertEqual(code, 400)
+        self.assertIn('opt-in', body['error'])
+
    def test_foreign_host_rejected(self):
        # DNS rebinding: a hostile name pointed at 127.0.0.1.
        for path in ("/", "/api/status"):
@@ -131,10 +131,30 @@ def unpack_bundle(path, root):
        raise android.FrameError('Could not read Android bundle: ' + str(error)) from error
    paths = [str(local) for local, _, _, _ in entries]
    if not any(Path(p).suffix.lower() == '.apk' for p in paths):
-        raise android.FrameError('Android bundles must contain one standalone APK and optional OBB files.')
+        raise android.FrameError('Android bundles must contain a base APK and optional supported splits or OBB files.')
    return paths


+def _apk_identity(path):
+    """Use the manifest, not the filename, to identify a base or split APK."""
+    try:
+        with zipfile.ZipFile(path) as archive:
+            elements = frame_apk.manifest_elements(
+                frame_apk._read(archive, 'AndroidManifest.xml', frame_apk.MAX_MANIFEST))
+        attrs = next((attrs for tag, attrs in elements if tag == 'manifest'), {})
+        package = (attrs.get('package') or (None, None, None))[2]
+        split = (attrs.get('split') or (None, None, None))[2]
+        code = (attrs.get('versionCode') or (None, None, None))[1]
+        major = (attrs.get('versionCodeMajor') or (None, 0, None))[1]
+        if not package or not android.PKG_RE.fullmatch(package):
+            raise android.FrameError(f'{path.name}: no valid package in APK manifest')
+        return package, split, (major, code) if code is not None else None
+    except (zipfile.BadZipFile, frame_apk.ApkError, OSError, UnicodeError,
+            ValueError, RuntimeError, EOFError, zlib.error, struct.error,
+            IndexError) as error:
+        raise android.FrameError(f'Could not read APK manifest in {path.name}: {error}') from error
+
+
 def _check_standalone(path):
    try:
        with zipfile.ZipFile(path) as archive:
@@ -168,19 +188,41 @@ def inspect(paths, discover=False):
        if path.suffix.lower() not in ('.apk', '.obb') or not path.is_file() or path.stat().st_size == 0:
            raise android.FrameError(f'{path.name}: choose a nonempty APK or .obb game-data file.')
    apks = [p for p in files if p.suffix.lower() == '.apk']
-    if len(apks) > 1:
-        raise android.FrameError('Choose one game at a time. Split APK backups are not supported by this importer.')
-    apk = apks[0] if apks else None
+    apk, splits = None, []
+    if apks:
+        identities = [(p, *_apk_identity(p)) for p in apks]
+        bases = [p for p, _, split, _ in identities if not split]
+        if len(bases) != 1:
+            raise android.FrameError('Choose one game at a time: exactly one base APK is required.')
+        apk = bases[0]
+        package, version = next((pkg, code) for p, pkg, _, code in identities if p == apk)
+        split_names = set()
+        for path, pkg, split, code in identities:
+            if path == apk:
+                continue
+            if pkg != package or split in split_names:
+                raise android.FrameError('Split APKs must have the same package and distinct split names.')
+            if version is None or code is None or code != version:
+                raise android.FrameError('Split APK version cannot be verified against the base APK.')
+            split_names.add(split)
+            splits.append(path)
    if apk:
-        _check_standalone(apk)
+        if not splits:
+            _check_standalone(apk)
        info = android.apk_info(str(apk))
-        try:
-            android.check_installable(info)
-        except android.FrameError as error:
-            error.apk = {'package': info['package'], 'version_code': info.get('version_code'),
-                         'blocker': str(error)}
-            raise
-        checked = quest.inspect(info['package'], str(apk))
+        if not splits:
+            try:
+                android.check_installable(info)
+            except android.FrameError as error:
+                error.apk = {'package': info['package'], 'version_code': info.get('version_code'),
+                             'blocker': str(error)}
+                raise
+        if splits:
+            added = android.split_entries(str(apk), [str(p) for p in splits])
+            if any(name.startswith('lib/') and not name.startswith('lib/arm64-v8a/') for name in added):
+                raise android.FrameError('This split set includes native libraries for another device. '
+                                         'Choose only the arm64-v8a split for the Frame.')
+        checked = quest.inspect(info['package'], str(apk), [str(p) for p in splits])
        pkg = checked['package']
        if discover and len(files) == 1:
            files.extend(p for p in sorted(apk.parent.iterdir())
@@ -213,13 +255,14 @@ def inspect(paths, discover=False):
        if not path.is_file() or not path.stat().st_size or path.name in names:
            raise android.FrameError(f'{path.name}: game-data files must be nonempty and have unique names.')
        names.add(path.name)
-    return {'apk': apk, 'obb': obb, 'checked': checked,
+    return {'apk': apk, 'splits': splits, 'obb': obb, 'checked': checked,
            'signatures': {str(p): (p.stat().st_size, p.stat().st_mtime_ns) for p in [*apks, *obb]}}


 def public(plan):
    checked = plan['checked']
    return {**checked, 'apk': plan['apk'].name if plan['apk'] else None,
+            'splits': [p.name for p in plan['splits']],
            'obb': [{'name': p.name, 'size': p.stat().st_size} for p in plan['obb']],
            'size': sum(size for size, _ in plan['signatures'].values())}

@@ -243,7 +286,8 @@ def install(plan, display='auto', progress=None):
            quest._check_downgrade(android.read_meta(pkg), checked, False)
            report('Installing the game app', 15)
            meta = android.install(str(plan['apk']), source=plan['apk'].name,
-                                   flatscreen=None if display == 'auto' else display == 'flat')
+                                   flatscreen=None if display == 'auto' else display == 'flat',
+                                   splits=[str(p) for p in plan['splits']])
        else:
            meta = android._meta_or_fail(pkg)
        if not plan['obb']:
@@ -77,7 +77,7 @@ def recording_name(now=None):
    return time.strftime("rec-%Y%m%d-%H%M%S", time.localtime(now))


-def probe_command():
+def probe_command(work=WORK):
    """Checks before a recording, run on the Frame: prints audio=1 or audio=0.

    One recording runs at a time, so anything left in the folder is from one that was
@@ -85,7 +85,7 @@ def probe_command():
    return (f"set -u; export XDG_RUNTIME_DIR=${{XDG_RUNTIME_DIR:-/run/user/$(id -u)}}; "
            f"[ -e {STREAM_DEVICE} ] || {{ echo 'No headset view device ({STREAM_DEVICE}). Is SteamVR running?' >&2; exit 3; }}; "
            f"command -v ffmpeg >/dev/null || {{ echo 'ffmpeg is missing on the Frame' >&2; exit 3; }}; "
-            f"d=\"$HOME/{WORK}\"; mkdir -p \"$d\" && rm -f \"$d\"/rec-*; "
+            f"d=\"$HOME/{work}\"; mkdir -p \"$d\" && rm -f \"$d\"/rec-*; "
            f"free=$(df -Pk \"$d\" | awk 'NR==2 {{print $4}}'); "
            f"[ \"${{free:-0}}\" -ge {NEED_KB} ] || {{ echo 'Not enough free space on the Frame to record: "
            f"it needs {NEED_KB // 1024 // 1024 + 1} GB' >&2; exit 4; }}; "
@@ -93,7 +93,7 @@ def probe_command():
            f">/dev/null 2>&1; then echo audio=1; else echo audio=0; fi")


-def record_command(name, audio, max_seconds=MAX_SECONDS):
+def record_command(name, audio, max_seconds=MAX_SECONDS, work=WORK):
    """The recording, run on the Frame through `bash -c`.

    ffmpeg runs in the background while the shell watches its stdin, which is the SSH
@@ -118,7 +118,7 @@ def record_command(name, audio, max_seconds=MAX_SECONDS):
        codecs += f" -af aresample=async=1 -c:a aac -b:a {AUDIO_RATE}k"
    # ffmpeg's stdin is a FIFO the shell holds open on fd 3 (opening it waits for both
    # ends, so ffmpeg is started first); it's unlinked once both ends are open.
-    script = (f"export XDG_RUNTIME_DIR=${{XDG_RUNTIME_DIR:-/run/user/$(id -u)}}; d=\"$HOME/{WORK}\"; "
+    script = (f"export XDG_RUNTIME_DIR=${{XDG_RUNTIME_DIR:-/run/user/$(id -u)}}; d=\"$HOME/{work}\"; "
              f"trap '' PIPE; c=\"$d/{name}.ctl\"; rm -f \"$c\"; mkfifo \"$c\" || exit 1; "
              f"ffmpeg -hide_banner -loglevel error -y {inputs} {maps} {codecs} -t {max_seconds} "
              f"\"$d/{name}.mkv\" <\"$c\" >/dev/null 2>\"$d/{name}.log\" & p=$!; "
@@ -131,20 +131,20 @@ def record_command(name, audio, max_seconds=MAX_SECONDS):
    return "bash -c " + shlex.quote(script)


-def finish_command(name):
+def finish_command(name, work=WORK):
    """After the recording: make the .mp4 the computer gets (no re-encode), on the Frame."""
    if not REC_NAME.fullmatch(name):
        raise ValueError(f"bad recording name {name!r}")
-    return (f"cd \"$HOME/{WORK}\" || exit 1; "
+    return (f"cd \"$HOME/{work}\" || exit 1; "
            f"[ -s {name}.mkv ] || {{ tail -c 2000 {name}.log >&2 2>/dev/null; echo 'The recording is empty' >&2; exit 1; }}; "
            f"ffmpeg -hide_banner -loglevel error -nostdin -y -i {name}.mkv -map 0 -c copy -movflags +faststart {name}.mp4 "
            f"&& rm -f {name}.mkv && wc -c < {name}.mp4")


-def cleanup_command(name):
+def cleanup_command(name, work=WORK):
    if not REC_NAME.fullmatch(name):
        raise ValueError(f"bad recording name {name!r}")
-    return f"rm -f \"$HOME/{WORK}/{name}\".*"
+    return f"rm -f \"$HOME/{work}/{name}\".*"


 class Recorder:
@@ -158,10 +158,12 @@ class Recorder:
      release(proc) forgets a channel once it has closed
    """

-    def __init__(self, open_channel, run, fetch, start_thread, release=lambda proc: None, folder=None):
+    def __init__(self, open_channel, run, fetch, start_thread, release=lambda proc: None, folder=None,
+                 work=WORK, destination_label='~/Videos/SteamFrame'):
        self.open_channel, self.run, self.fetch = open_channel, run, fetch
        self.start_thread, self.release = start_thread, release
        self.folder = Path(folder) if folder else VIDEOS_DIR
+        self.work, self.destination_label = work, destination_label
        self._lock = threading.Lock()
        self._state = {"state": "idle"}
        self._proc = None
@@ -179,11 +181,12 @@ class Recorder:
                raise ClipError("Already recording, or still saving the last recording", 409)
            self._state = {"state": "starting"}
        try:
-            out = self.run(probe_command(), 30)
+            out = self.run(probe_command() if self.work == WORK else probe_command(self.work), 30)
            audio = "audio=1" in out
            name = recording_name()
            errors = tempfile.TemporaryFile()
-            proc = self.open_channel(record_command(name, audio), errors)
+            proc = self.open_channel(record_command(name, audio) if self.work == WORK else
+                                     record_command(name, audio, work=self.work), errors)
            lines = _line_reader(proc.stdout)
            first = _next_line(lines, 20)
            if first != "started":
@@ -222,6 +225,18 @@ class Recorder:
        _close(proc.stdin)  # the shell on the Frame sees EOF and stops ffmpeg
        return {"state": "stopping", "message": "Stopping the recording…"}

+    def shutdown(self, timeout=30):
+        """Finish an owned recording before a headset user service exits."""
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            state = self.status()['state']
+            if state == 'recording':
+                self.stop()
+            elif state not in ('starting', 'stopping', 'saving'):
+                break
+            time.sleep(.2)
+        return self.status()
+
    def _watch(self, proc, name, audio, lines, errors):
        # Waits for ffmpeg to finish: after Stop, or at the time limit (a margin
        # past it, so a stuck channel can't hold the recording open forever).
@@ -242,14 +257,14 @@ class Recorder:
            self._state = dict(self._state, state="saving")
        try:
            self.save(name)
-            msg = f"Saved {name}.mp4 to ~/Videos/SteamFrame" + ("" if audio else " (no sound)")
+            msg = f"Saved {name}.mp4 to {self.destination_label}" + ("" if audio else " (no sound)")
            state = {"state": "saved", "file": str(self.folder / f"{name}.mp4"), "audio": audio,
                     "seconds": seconds, "message": msg}
        except Exception as e:
            state = {"state": "failed", "error": f"Couldn't save the recording: {e}"}
        finally:
            try:
-                self.run(cleanup_command(name), 20)
+                self.run(cleanup_command(name) if self.work == WORK else cleanup_command(name, self.work), 20)
            except Exception:
                pass  # the next recording's checks remove it
        with self._lock:
@@ -257,12 +272,12 @@ class Recorder:

    def save(self, name):
        """Make the .mp4 on the Frame and copy it here, never leaving a partial file in the folder."""
-        out = self.run(finish_command(name), 600)
+        out = self.run(finish_command(name) if self.work == WORK else finish_command(name, self.work), 600)
        size = int(out.strip().splitlines()[-1]) if out.strip() else 0
        _make_room(self.folder, size)
        incoming = Path(tempfile.mkdtemp(prefix=".incoming-", dir=self.folder))
        try:
-            self.fetch(f"{WORK}/{name}.mp4", incoming / f"{name}.mp4")
+            self.fetch(f"{self.work}/{name}.mp4", incoming / f"{name}.mp4")
            os.replace(incoming / f"{name}.mp4", self.folder / f"{name}.mp4")
        finally:
            shutil.rmtree(incoming, ignore_errors=True)
@@ -0,0 +1,193 @@
+"""Experimental, removable per-user Decky Loader for Steam Frame (ARM64)."""
+import hashlib
+import json
+import re
+import secrets
+import urllib.request
+
+
+REPO = "SteamDeckHomebrew/decky-loader"
+API = f"https://api.github.com/repos/{REPO}/releases/latest"
+MAX_BINARY = 80 * 1024 * 1024
+TAG = re.compile(r"v[0-9]+\.[0-9]+\.[0-9]+(?:[-.][A-Za-z0-9.-]+)?\Z")
+
+
+PROBE = r'''
+import json, os, pathlib, platform, subprocess, urllib.request
+home = pathlib.Path.home()
+managed = home / '.local/share/frame-control/decky'
+service = home / '.config/systemd/user/frame-control-decky.service'
+release = managed / '.frame-control/receipt.json'
+legacy = managed / 'settings/release.json'
+def active(name, user=False):
+    cmd = ['systemctl'] + (['--user'] if user else []) + ['is-active', name]
+    return subprocess.run(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
+def plugins(folder):
+    found = []
+    if folder.is_dir() and not folder.is_symlink():
+        for child in sorted(folder.iterdir()):
+            if child.is_symlink() or not child.is_dir(): continue
+            info = child / 'plugin.json'
+            if info.is_symlink() or not info.is_file() or info.stat().st_size > 16384: continue
+            try:
+                data = json.loads(info.read_text())
+                found.append({'folder': child.name, 'name': str(data.get('name', child.name))[:80],
+                              'author': str(data.get('author', ''))[:80]})
+            except (ValueError, OSError, UnicodeError): pass
+    return found
+os_release = {}
+for line in pathlib.Path('/etc/os-release').read_text().splitlines():
+    if '=' in line:
+        k,v = line.split('=',1); os_release[k] = v.strip('"')
+try:
+    with urllib.request.urlopen('http://127.0.0.1:8080/json/list', timeout=2) as reply:
+        targets = json.load(reply)
+    cef = any(x.get('title') == 'SharedJSContext' and 'steamloopback.host' in x.get('url','') for x in targets)
+except (OSError, ValueError): cef = False
+try:
+    metadata = json.loads((release if release.exists() else legacy).read_text())
+    version = metadata.get('version') if metadata.get('managedBy') == 'Frame Control' else None
+except (OSError, ValueError): version = None
+print(json.dumps({'arch':platform.machine(), 'frameOS':os_release.get('VERSION_ID'),
+    'variant':os_release.get('VARIANT_ID'), 'build':os_release.get('BUILD_ID'), 'cef':cef,
+    'managed':service.is_file() and version is not None, 'running':active('frame-control-decky.service', True),
+    'version':version, 'upstreamInstall':pathlib.Path('/etc/systemd/system/plugin_loader.service').exists(),
+    'plugins':plugins(managed/'plugins'), 'upstreamPlugins':plugins(home/'homebrew/plugins')}))
+'''
+
+
+APPLY = r'''
+import hashlib, json, os, pathlib, subprocess, sys
+action, token, digest, version = sys.argv[1:]
+home = pathlib.Path.home()
+base = home / '.local/share/frame-control/decky'
+service = home / '.config/systemd/user/frame-control-decky.service'
+binary = base / 'PluginLoader'
+receipt = base / '.frame-control/receipt.json'
+legacy = base / 'settings/release.json'
+stage = pathlib.Path('/tmp/frame-control-decky-' + token)
+def systemd(*args):
+    p = subprocess.run(['systemctl','--user',*args], capture_output=True, text=True, timeout=20)
+    if p.returncode: raise RuntimeError((p.stderr or p.stdout).strip() or 'systemd failed')
+def owned():
+    try: return json.loads((receipt if receipt.exists() else legacy).read_text()).get('managedBy') == 'Frame Control' and service.is_file()
+    except (OSError, ValueError): return False
+try:
+    if action == 'remove':
+        if not owned(): raise RuntimeError('No Frame Control managed Decky install to remove')
+        systemd('disable','--now','frame-control-decky.service')
+        service.unlink()
+        systemd('daemon-reload')
+        binary.unlink(missing_ok=True)
+        receipt.unlink(missing_ok=True)
+        if legacy.exists() and json.loads(legacy.read_text()).get('managedBy') == 'Frame Control': legacy.unlink()
+        print(json.dumps({'message':'Removed Frame Control managed Decky service and binary. Plugin files were kept. Restart Steam or the headset to clear its menu.'}))
+    else:
+        if action not in ('install','update'): raise RuntimeError('Invalid Decky action')
+        if (home/'homebrew/services/PluginLoader').exists() or pathlib.Path('/etc/systemd/system/plugin_loader.service').exists():
+            raise RuntimeError('An upstream Decky installation exists; remove it with its own installer first')
+        if action == 'update' and not owned(): raise RuntimeError('No Frame Control managed Decky install to update')
+        if action == 'install' and (service.exists() or receipt.exists() or legacy.exists() or binary.exists()):
+            raise RuntimeError('Decky files already exist at the managed path')
+        data = stage.read_bytes()
+        if len(data) > 80*1024*1024 or len(data) < 1024 or hashlib.sha256(data).hexdigest() != digest:
+            raise RuntimeError('Decky binary digest or size did not match')
+        if data[:4] != b'\x7fELF' or int.from_bytes(data[18:20], 'little') != 183:
+            raise RuntimeError('Decky release is not an ARM64 Linux binary')
+        base.mkdir(parents=True, exist_ok=True)
+        (base/'plugins').mkdir(exist_ok=True)
+        receipt.parent.mkdir(parents=True, exist_ok=True)
+        service.parent.mkdir(parents=True, exist_ok=True)
+        old_binary = binary.read_bytes() if binary.exists() else None
+        old_receipt = receipt.read_bytes() if receipt.exists() else legacy.read_bytes() if legacy.exists() else None
+        old_service = service.read_bytes() if service.exists() else None
+        if old_service: systemd('stop','frame-control-decky.service')
+        try:
+            next_binary = base / 'PluginLoader.next'
+            next_binary.write_bytes(data)
+            os.replace(next_binary, binary)
+            binary.chmod(0o700)
+            text = ('[Unit]\nDescription=Decky Loader (Frame Control experimental user install)\n'
+              'After=default.target\n[Service]\nType=simple\nRestart=on-failure\n'
+              'RestartSec=5\nExecStart='+str(binary)+'\n'
+              'Environment=UNPRIVILEGED_PATH='+str(base)+'\n'
+              'Environment=PRIVILEGED_PATH='+str(base)+'\n'
+              'Environment=CHOWN_PLUGIN_PATH=0\nEnvironment=LIVE_RELOAD=0\n'
+              'Environment=USE_CEF_CLOSE_WORKAROUND=0\nEnvironment=KEEP_SYSTEMD_SERVICE=1\n'
+              '[Install]\nWantedBy=default.target\n')
+            service.write_text(text)
+            receipt.write_text(json.dumps({'managedBy':'Frame Control','version':version,'sha256':digest})+'\n')
+            if legacy.exists() and json.loads(legacy.read_text()).get('managedBy') == 'Frame Control': legacy.unlink()
+            systemd('daemon-reload')
+            systemd('enable','--now','frame-control-decky.service')
+            systemd('is-active','frame-control-decky.service')
+        except Exception:
+            (base/'PluginLoader.next').unlink(missing_ok=True)
+            if old_binary is None: binary.unlink(missing_ok=True)
+            else: binary.write_bytes(old_binary); binary.chmod(0o700)
+            if old_receipt is None: receipt.unlink(missing_ok=True)
+            else: receipt.write_bytes(old_receipt)
+            if old_service is None: service.unlink(missing_ok=True)
+            else: service.write_bytes(old_service)
+            subprocess.run(['systemctl','--user','daemon-reload'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            if old_service: subprocess.run(['systemctl','--user','start','frame-control-decky.service'], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            raise
+        print(json.dumps({'message':'Decky Loader '+version+' is running as a user service. The VR menu is experimental.'}))
+finally:
+    stage.unlink(missing_ok=True)
+'''
+
+
+def status(ssh):
+    return json.loads(ssh('python3 -', stdin=PROBE, timeout=15))
+
+
+def release_binary():
+    request = urllib.request.Request(API, headers={'User-Agent': 'Frame-Control'})
+    with urllib.request.urlopen(request, timeout=20) as response:
+        info = json.load(response)
+    version = info.get('tag_name')
+    if not isinstance(version, str) or not TAG.fullmatch(version):
+        raise ValueError('Invalid Decky release version')
+    asset = next((a for a in info.get('assets', []) if a.get('name') == 'PluginLoader-arm64'), None)
+    expected_url = f'https://github.com/{REPO}/releases/download/{version}/PluginLoader-arm64'
+    if not asset or asset.get('browser_download_url') != expected_url or not isinstance(asset.get('size'), int) or not 1024 < asset['size'] <= MAX_BINARY:
+        raise ValueError('Decky release has no valid ARM64 asset')
+    digest = asset.get('digest', '')
+    if not isinstance(digest, str) or not re.fullmatch(r'sha256:[0-9a-f]{64}', digest):
+        raise ValueError('Decky release has no published SHA-256 digest')
+    with urllib.request.urlopen(urllib.request.Request(expected_url, headers={'User-Agent': 'Frame-Control'}), timeout=45) as response:
+        data = response.read(MAX_BINARY + 1)
+    if len(data) != asset['size'] or hashlib.sha256(data).hexdigest() != digest[7:]:
+        raise ValueError('Decky download did not match its published digest')
+    if data[:4] != b'\x7fELF' or int.from_bytes(data[18:20], 'little') != 183:
+        raise ValueError('Decky download is not an ARM64 Linux binary')
+    return version, digest[7:], data
+
+
+def change(ssh, action):
+    if action not in ('install', 'update', 'remove'):
+        raise ValueError('Invalid Decky action')
+    current = status(ssh)
+    if action == 'remove':
+        if not current['managed']:
+            raise ValueError('No Frame Control managed Decky install to remove')
+        return json.loads(ssh('python3 - remove none none none', stdin=APPLY, timeout=45))
+    if current['arch'] != 'aarch64' or current['variant'] != 'vr' or not current['cef']:
+        raise ValueError('Decky needs a Steam Frame with an active Steam CEF debug page')
+    if current['upstreamInstall']:
+        raise ValueError('An upstream Decky installation exists; use its own installer')
+    if action == 'install' and current['managed']:
+        raise ValueError('Decky is already installed; use Update')
+    if action == 'update' and not current['managed']:
+        raise ValueError('Decky is not installed by Frame Control')
+    version, digest, data = release_binary()
+    token = secrets.token_hex(12)
+    remote = '/tmp/frame-control-decky-' + token
+    try:
+        ssh('umask 077; cat > ' + remote, stdin=data, text=False, timeout=120)
+        result = ssh(f'python3 - {action} {token} {digest} {version}', stdin=APPLY, timeout=50)
+        return json.loads(result)
+    finally:
+        try: ssh('rm -f ' + remote, timeout=10)
+        except Exception: pass
@@ -0,0 +1,203 @@
+"""Install and control the removable SteamVR Frame Control panel on the Frame.
+
+The companion sends a deterministic app bundle over SSH. The Frame owns a user
+service and a browser profile; nothing is installed under /etc or as root.
+"""
+import gzip
+import hashlib
+import io
+import json
+from pathlib import Path
+import secrets
+import tarfile
+
+
+ROOT = Path(__file__).resolve().parent.parent
+ARCHIVE_DIRS = ('ui', 'apk-catalog', 'frame/android', 'frame/devkit-utils', 'frame/openxr-compat', 'scripts')
+MAX_ARCHIVE = 32 * 1024 * 1024
+
+
+PROBE = r'''
+import json, os, pathlib, platform, subprocess
+home = pathlib.Path.home()
+base = home / '.local/share/frame-control/headset'
+unit = home / '.config/systemd/user/frame-control-headset.service'
+try: receipt = json.loads((base/'receipt.json').read_text())
+except (OSError, ValueError): receipt = {}
+try: state = json.loads((base/'state.json').read_text())
+except (OSError, ValueError): state = {}
+release = {}
+for line in pathlib.Path('/etc/os-release').read_text().splitlines():
+    if '=' in line:
+        k, v = line.split('=', 1); release[k] = v.strip('"')
+active = subprocess.run(['systemctl','--user','is-active','frame-control-headset.service'],
+                        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
+overlay = 'valve.steam.desktopgame.2001947813'
+try:
+    p = subprocess.run(['/opt/steamvr/bin/linuxarm64/vrcmd','--overlays'],
+                       capture_output=True, text=True, timeout=5)
+    registered = p.returncode == 0 and ("'"+overlay+"'") in p.stdout
+except (OSError, subprocess.TimeoutExpired): registered = False
+print(json.dumps({'arch':platform.machine(),'variant':release.get('VARIANT_ID'),
+    'os':release.get('VERSION_ID'),'build':release.get('BUILD_ID'),
+    'managed':unit.is_file() and receipt.get('managedBy') == 'Frame Control',
+    'version':receipt.get('version'),'running':active,'overlayRegistered':registered,
+    'window':state.get('window') if active else None,
+    'extensionsFolder':str(home/'.local/share/frame-control/extensions')}))
+'''
+
+
+APPLY = r'''
+import hashlib, io, json, os, pathlib, platform, shutil, subprocess, sys, tarfile, time
+action, token, digest = sys.argv[1:]
+home = pathlib.Path.home()
+base = home / '.local/share/frame-control/headset'
+bundle = base / 'bundle'
+receipt = base / 'receipt.json'
+unit = home / '.config/systemd/user/frame-control-headset.service'
+upload = pathlib.Path('/tmp/frame-control-headset-' + token)
+stage = base / ('stage-' + token)
+old = base / ('old-' + token)
+overlay = 'valve.steam.desktopgame.2001947813'
+def systemd(*args):
+    p = subprocess.run(['systemctl','--user',*args], capture_output=True, text=True, timeout=55)
+    if p.returncode: raise RuntimeError((p.stderr or p.stdout).strip()[-400:] or 'user service failed')
+def managed():
+    try: return unit.is_file() and json.loads(receipt.read_text()).get('managedBy') == 'Frame Control'
+    except (OSError, ValueError): return False
+def show():
+    deadline = time.monotonic() + 45
+    while time.monotonic() < deadline:
+        if (base/'state.json').is_file():
+            p = subprocess.run(['/opt/steamvr/bin/linuxarm64/vrcmd','--showdashboard',overlay],
+                               capture_output=True, text=True, timeout=10)
+            if p.returncode: raise RuntimeError((p.stderr or p.stdout).strip()[-400:] or 'dashboard rejected panel')
+            return {'message':'Asked SteamVR to show Frame Control. Select its panel in the dashboard if it is hidden.',
+                    'overlay':overlay}
+        time.sleep(.25)
+    raise RuntimeError('The headset panel did not register within 45 seconds; check the user service log')
+try:
+    if action == 'remove':
+        if not managed(): raise RuntimeError('No Frame Control managed headset panel to remove')
+        systemd('stop','frame-control-headset.service')
+        unit.unlink()
+        systemd('daemon-reload')
+        shutil.rmtree(bundle)
+        receipt.unlink()
+        (base/'server.log').unlink(missing_ok=True)
+        print(json.dumps({'message':'Removed the Frame Control headset service and app bundle. Extensions and browser profile were kept.'}))
+    elif action == 'close':
+        if not managed(): raise RuntimeError('The headset panel is not installed by Frame Control')
+        systemd('stop','frame-control-headset.service')
+        print(json.dumps({'message':'Closed the Frame Control headset panel.'}))
+    elif action == 'open':
+        if not managed(): raise RuntimeError('Install the headset panel first')
+        systemd('start','frame-control-headset.service')
+        print(json.dumps(show()))
+    else:
+        if action not in ('install','update'): raise RuntimeError('Invalid headset panel action')
+        if platform.machine() != 'aarch64': raise RuntimeError('This headset panel needs the Frame ARM64 build')
+        if action == 'install' and (unit.exists() or receipt.exists() or bundle.exists()):
+            raise RuntimeError('Headset panel files already exist; no existing installation was changed')
+        if action == 'update' and not managed(): raise RuntimeError('No Frame Control managed panel to update')
+        data = upload.read_bytes()
+        if not 1024 < len(data) <= 32*1024*1024 or hashlib.sha256(data).hexdigest() != digest:
+            raise RuntimeError('Headset bundle size or digest did not match')
+        base.mkdir(parents=True, exist_ok=True, mode=0o700)
+        stage.mkdir(mode=0o700)
+        with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
+            members = archive.getmembers()
+            if not members or any(not m.isfile() or not m.name.startswith(('ui/','apk-catalog/','frame/android/',
+                   'frame/devkit-utils/','frame/openxr-compat/','scripts/')) or '..' in pathlib.PurePosixPath(m.name).parts
+                   or m.size > 8*1024*1024 for m in members):
+                raise RuntimeError('Invalid headset bundle member')
+            archive.extractall(stage, members=members, filter='data')
+        if not (stage/'ui/server.py').is_file() or not (stage/'ui/frame_headset_runtime.py').is_file():
+            raise RuntimeError('Incomplete headset bundle')
+        unit.parent.mkdir(parents=True, exist_ok=True)
+        previous_unit = unit.read_bytes() if unit.exists() else None
+        previous_receipt = receipt.read_bytes() if receipt.exists() else None
+        if action == 'update':
+            systemd('stop','frame-control-headset.service')
+            bundle.rename(old)
+        try:
+            stage.rename(bundle)
+            unit.write_text('[Unit]\nDescription=Frame Control headset panel\nAfter=gamescope-session.target steamvr.service\n'
+              '[Service]\nType=simple\nExecStart=/usr/bin/python3 -I -u '+str(bundle/'ui/frame_headset_runtime.py')+'\n'
+              'Restart=no\nKillMode=control-group\nTimeoutStopSec=45\n')
+            receipt.write_text(json.dumps({'managedBy':'Frame Control','version':digest[:16]})+'\n')
+            systemd('daemon-reload')
+            systemd('start','frame-control-headset.service')
+            result = show()
+        except Exception:
+            subprocess.run(['systemctl','--user','stop','frame-control-headset.service'],
+                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            if bundle.exists(): shutil.rmtree(bundle)
+            if old.exists(): old.rename(bundle)
+            if previous_unit is None: unit.unlink(missing_ok=True)
+            else: unit.write_bytes(previous_unit)
+            if previous_receipt is None: receipt.unlink(missing_ok=True)
+            else: receipt.write_bytes(previous_receipt)
+            subprocess.run(['systemctl','--user','daemon-reload'],
+                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            if previous_unit: subprocess.run(['systemctl','--user','start','frame-control-headset.service'],
+                                            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+            raise
+        if old.exists(): shutil.rmtree(old)
+        print(json.dumps({'message':'Installed Frame Control on the headset. '+result['message'],
+                          'version':digest[:16],'overlay':overlay}))
+finally:
+    upload.unlink(missing_ok=True)
+    if stage.exists(): shutil.rmtree(stage)
+'''
+
+
+def bundle():
+    """Pack app code shipped with the desktop app; never include user data."""
+    raw = io.BytesIO()
+    with tarfile.open(fileobj=raw, mode='w') as archive:
+        for dirname in ARCHIVE_DIRS:
+            folder = ROOT / dirname
+            if not folder.is_dir():
+                continue
+            for path in sorted(folder.rglob('*')):
+                if not path.is_file() or path.is_symlink() or '__pycache__' in path.parts:
+                    continue
+                if path.suffix not in ('.py', '.html', '.js', '.css', '.json', '.sh', '.gz', '.zst', '.so', '.txt', '.md') and path.name not in ('ssh',):
+                    continue
+                data = path.read_bytes()
+                info = tarfile.TarInfo(path.relative_to(ROOT).as_posix())
+                info.size, info.mtime, info.uid, info.gid = len(data), 0, 0, 0
+                info.mode = 0o755 if path.stat().st_mode & 0o111 else 0o644
+                archive.addfile(info, io.BytesIO(data))
+    with io.BytesIO() as out:
+        with gzip.GzipFile(fileobj=out, mode='wb', mtime=0) as gz:
+            gz.write(raw.getvalue())
+        data = out.getvalue()
+    if len(data) > MAX_ARCHIVE:
+        raise ValueError('Headset app bundle is too large')
+    return data
+
+
+def status(ssh):
+    return json.loads(ssh('python3 -', stdin=PROBE, timeout=15))
+
+
+def change(ssh, action):
+    if action not in ('install', 'update', 'open', 'close', 'remove'):
+        raise ValueError('Invalid headset panel action')
+    current = status(ssh)
+    if action in ('install', 'update', 'open') and (current['arch'] != 'aarch64' or current['variant'] != 'vr'):
+        raise ValueError('This feature needs a Steam Frame running Frame OS')
+    data = bundle() if action in ('install', 'update') else None
+    digest = hashlib.sha256(data or b'').hexdigest()
+    token = secrets.token_hex(12)
+    remote = '/tmp/frame-control-headset-' + token
+    try:
+        if data is not None:
+            ssh('umask 077; cat > ' + remote, stdin=data, text=False, timeout=120)
+        return json.loads(ssh(f'python3 - {action} {token} {digest}', stdin=APPLY, timeout=100))
+    finally:
+        if data is not None:
+            try: ssh('rm -f ' + remote, timeout=10)
+            except Exception: pass
@@ -0,0 +1,149 @@
+"""Run Frame Control's opt-in headset panel as one bounded user service.
+
+This process owns only its loopback server and Chromium profile. Steam, SteamVR,
+gamescope, other browser profiles, and the user's extensions are never stopped.
+"""
+import json
+import os
+from pathlib import Path
+import re
+import signal
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+
+
+BASE = Path.home() / '.local/share/frame-control/headset'
+PORT = 47813
+APPID = 2001947813
+OVERLAY = f'valve.steam.desktopgame.{APPID}'
+VRCMD = '/opt/steamvr/bin/linuxarm64/vrcmd'
+TITLE = '[fc-headset]'
+
+
+class RuntimeError_(RuntimeError):
+    pass
+
+
+def browser_command():
+    chrome = Path.home() / 'chromium-xr/chrome'
+    if chrome.is_file() and os.access(chrome, os.X_OK):
+        return [str(chrome)]
+    if Path('/usr/bin/chromium').is_file():
+        return ['/usr/bin/chromium']
+    if subprocess.run(['flatpak', 'info', 'org.chromium.Chromium'],
+                      stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=10).returncode == 0:
+        return ['flatpak', 'run', 'org.chromium.Chromium']
+    raise RuntimeError_('Chromium is needed on the Frame to show the headset panel')
+
+
+def command(*args):
+    result = subprocess.run(args, capture_output=True, text=True, timeout=5,
+                            env={**os.environ, 'DISPLAY': ':0', 'LC_ALL': 'C.UTF-8'})
+    if result.returncode:
+        raise RuntimeError_((result.stderr or result.stdout).strip()[-400:] or f'{args[0]} failed')
+    return result.stdout
+
+
+def panel_window():
+    for line in command('xwininfo', '-root', '-children').splitlines():
+        match = re.match(r'\s*(0x[0-9a-fA-F]+) .*\[fc-headset\]', line)
+        if match:
+            return match[1]
+    return None
+
+
+def wait_for_server(proc):
+    deadline = time.monotonic() + 15
+    while time.monotonic() < deadline and proc.poll() is None:
+        try:
+            with urllib.request.urlopen(f'http://127.0.0.1:{PORT}/headset', timeout=.5) as response:
+                if response.status == 200 and TITLE.encode() in response.read(200_000):
+                    return
+        except (OSError, urllib.error.URLError):
+            pass
+        time.sleep(.2)
+    raise RuntimeError_('The headset loopback server did not start')
+
+
+def terminate_owned(proc, timeout=5):
+    if proc and proc.poll() is None:
+        os.killpg(proc.pid, signal.SIGTERM)
+        try:
+            proc.wait(timeout=timeout)
+        except subprocess.TimeoutExpired:
+            os.killpg(proc.pid, signal.SIGKILL)
+            proc.wait()
+
+
+def serve():
+    bundle = BASE / 'bundle/ui'
+    key = os.urandom(24).hex()
+    BASE.mkdir(parents=True, exist_ok=True, mode=0o700)
+    state_file = BASE / 'state.json'
+    env = {**os.environ, 'FRAME_LOCAL': '1', 'FRAME_DEVICE': 'headset',
+           'FRAME_HEADSET_RUNTIME': '1', 'FRAME_UI_KEY': key}
+    env.pop('WAYLAND_DISPLAY', None)
+    env['DISPLAY'] = ':0'
+    env['LD_PRELOAD'] = ''  # Steam's overlay preload crashes Chromium's zygote.
+    server = browser = None
+    stopping = False
+
+    def stop(*_):
+        nonlocal stopping
+        stopping = True
+
+    signal.signal(signal.SIGTERM, stop)
+    signal.signal(signal.SIGINT, stop)
+    try:
+        command('xprop', '-root', 'GAMESCOPE_FOCUSABLE_WINDOWS')
+        with (BASE / 'server.log').open('ab') as log:
+            server = subprocess.Popen([sys.executable, '-I', '-u', '-B', str(bundle / 'server.py'),
+                                       '--port', str(PORT)], env=env, stdin=subprocess.DEVNULL,
+                                      stdout=log, stderr=subprocess.STDOUT, start_new_session=True)
+        wait_for_server(server)
+        browser = subprocess.Popen([*browser_command(), '--ozone-platform=x11',
+                                    '--user-data-dir=' + str(BASE / 'profile'),
+                                    '--no-first-run', '--no-default-browser-check',
+                                    '--password-store=basic', '--disable-session-crashed-bubble',
+                                    '--noerrdialogs', '--window-size=1200,800',
+                                    '--app=http://127.0.0.1:%d/headset#%s' % (PORT, key)],
+                                   env=env, stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                                   stderr=subprocess.DEVNULL, start_new_session=True)
+        deadline = time.monotonic() + 30
+        win = None
+        while time.monotonic() < deadline and browser.poll() is None and not stopping:
+            win = panel_window()
+            if win:
+                break
+            time.sleep(.25)
+        if not win:
+            raise RuntimeError_('The Frame Control browser window did not appear')
+        command('xprop', '-id', win, '-f', 'STEAM_GAME', '32c', '-set', 'STEAM_GAME', str(APPID))
+        deadline = time.monotonic() + 8
+        while time.monotonic() < deadline:
+            if OVERLAY in command(VRCMD, '--overlays'):
+                break
+            time.sleep(.25)
+        else:
+            raise RuntimeError_('SteamVR did not register the Frame Control panel')
+        state_file.write_text(json.dumps({'port': PORT, 'window': win, 'overlay': OVERLAY,
+                                          'started': time.time()}) + '\n')
+        state_file.chmod(0o600)
+        print('Frame Control headset panel registered as ' + OVERLAY, flush=True)
+        while not stopping and server.poll() is None and browser.poll() is None:
+            time.sleep(.5)
+    finally:
+        state_file.unlink(missing_ok=True)
+        terminate_owned(browser)
+        terminate_owned(server, timeout=35)  # allow the local recorder to finalize its MP4
+
+
+if __name__ == '__main__':
+    try:
+        serve()
+    except (OSError, RuntimeError_, subprocess.SubprocessError) as exc:
+        print(str(exc), file=sys.stderr)
+        sys.exit(1)
@@ -0,0 +1,97 @@
+<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Frame Control VR [fc-headset]</title>
+<style>
+:root{color-scheme:dark;font:22px/1.4 system-ui,sans-serif;background:#0d1925;color:#f3f7fa}
+*{box-sizing:border-box}body{margin:0;padding:30px;max-width:1280px}h1{font-size:40px;margin:0 0 6px}
+h2{font-size:29px;margin:25px 0 10px}p{margin:0 0 18px;color:#b9c9d6}.cards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px}
+.card,.block{background:#1b3042;border:1px solid #40576c;border-radius:14px;padding:20px}.card{min-height:140px}
+.label{display:block;color:#b9c9d6;font-size:19px}.value{display:block;font-size:34px;font-weight:700;margin-top:10px}
+.row{display:flex;flex-wrap:wrap;gap:10px;align-items:center}.stack{display:grid;gap:12px}
+button{font:inherit;background:#23618c;color:white;border:1px solid #72baf0;border-radius:12px;padding:13px 20px;cursor:pointer;min-height:62px}
+button:focus-visible{outline:5px solid #f8d370;outline-offset:3px}button:disabled{opacity:.55;cursor:default}
+button.secondary{background:#253c50;border-color:#617f97}button.danger{background:#78372d;border-color:#d78d79}
+small{color:#b9c9d6}#message,#actionStatus{min-height:1.5em;margin:12px 0}.game{display:flex;gap:14px;justify-content:space-between;align-items:center}
+iframe{display:block;width:100%;height:560px;background:#0d1925;border:1px solid #617f97;border-radius:12px;margin-top:14px}
+@media(max-width:720px){.cards{grid-template-columns:1fr}body{padding:18px}.game{display:block}.game button{margin-top:12px}}
+</style></head><body>
+<h1>Frame Control</h1><p>Your Frame, from inside SteamVR. Select this panel again from the dashboard after switching away.</p>
+<div class="cards">
+  <div class="card"><span class="label">Battery</span><span class="value" id="battery">…</span></div>
+  <div class="card"><span class="label">Home storage free</span><span class="value" id="storage">…</span></div>
+  <div class="card"><span class="label">SteamVR</span><span class="value" id="steamvr">…</span></div>
+</div>
+<p id="message" role="status" aria-live="polite"></p>
+<div class="row"><button id="refresh">Refresh status</button><button id="gameMode" class="secondary">Return to Game Mode</button>
+  <button id="screenshot" class="secondary">Save screenshot</button><button id="record" class="secondary">Start recording</button></div>
+<p id="actionStatus" role="status" aria-live="polite"></p>
+<h2>Running games</h2><div class="row"><button id="gamesRefresh" class="secondary">Refresh games</button></div>
+<div id="games" class="stack" style="margin-top:12px">Loading…</div>
+<h2>Extensions</h2><p>Local additions run only when opened in the isolated panel below. They can read status but cannot change headset settings through the extension API.</p>
+<div class="row"><button id="extensionsRefresh" class="secondary">Refresh extensions</button><span id="extensionsFolder"><small></small></span></div>
+<div id="extensions" class="stack" style="margin-top:12px">Loading…</div>
+<div id="extensionPanel" hidden><div class="row" style="margin-top:16px"><strong id="extensionTitle"></strong><button id="extensionClose" class="secondary">Close extension</button></div>
+  <iframe id="extensionFrame" title="Frame Control extension" sandbox="allow-scripts" referrerpolicy="no-referrer"></iframe></div>
+<script>
+const key=location.hash.slice(1)||sessionStorage.getItem('frameHeadsetKey')||'';
+if(key)sessionStorage.setItem('frameHeadsetKey',key);
+history.replaceState(null,'',location.pathname);
+const byId=id=>document.getElementById(id);
+let latestStatus=null, activeExtension=null, recordBusy=false;
+async function api(path,body){const response=await fetch(path,{method:body?'POST':'GET',
+  headers:{'X-Frame-UI':key,'Content-Type':'application/json'},body:body?JSON.stringify(body):undefined});
+  const data=await response.json();if(!response.ok)throw Error(data.error||'Frame request failed');return data;}
+async function refresh(){try{const status=latestStatus=await api('/api/status');
+  byId('battery').textContent=status.battery?.percent==null?'Unavailable':`${status.battery.percent}%`;
+  const free=status.disk?.home?.free;
+  byId('storage').textContent=Number.isFinite(free)?`${(free/1e9).toFixed(1)} GB`:'Unavailable';
+  byId('steamvr').textContent=status.services?.steamvr?'Running':'Unavailable';
+  byId('message').textContent=`Frame OS ${status.os?.version||'unknown'} · Updated ${new Date().toLocaleTimeString()}`;
+  }catch(error){latestStatus=null;byId('message').textContent=error.message;}}
+async function act(action){const button=byId(action==='game-mode'?'gameMode':'screenshot');button.disabled=true;
+  try{const result=await api('/api/headset/quick',{action});byId('actionStatus').textContent=result.message;}
+  catch(error){byId('actionStatus').textContent=error.message;}finally{button.disabled=false;}}
+async function refreshGames(){const list=byId('games');try{const data=await api('/api/running');list.replaceChildren();
+  for(const game of data.running){const row=document.createElement('div');row.className='block game';
+    const name=document.createElement('strong');name.textContent=game.name||`App ${game.appid}`;
+    const quit=document.createElement('button');quit.className='danger';quit.textContent=`Force quit ${name.textContent}`;
+    quit.onclick=async()=>{if(!confirm(`Force quit ${name.textContent}? Unsaved progress may be lost.`))return;
+      quit.disabled=true;try{const result=await api('/api/running',{action:'quit',appid:String(game.appid)});
+      byId('actionStatus').textContent=result.message||`Quit ${name.textContent}`;await refreshGames();}
+      catch(error){byId('actionStatus').textContent=error.message;quit.disabled=false;}};
+    row.append(name,quit);list.append(row);}if(!data.running.length)list.textContent='No games are running.';
+  }catch(error){list.textContent=error.message;}}
+async function refreshRecord(){try{const data=await api('/api/record');
+  byId('record').textContent=['recording','starting'].includes(data.state)?'Stop recording':'Start recording';
+  byId('record').disabled=recordBusy||['stopping','saving'].includes(data.state);
+  if(data.state==='recording')byId('actionStatus').textContent=`Recording ${Math.round(data.elapsed||0)} s${data.audio?' with sound':' without sound'}`;
+  else if(data.state==='saved'||data.state==='failed')byId('actionStatus').textContent=data.message||data.error;
+  }catch(error){byId('record').disabled=true;byId('actionStatus').textContent=error.message;}}
+async function toggleRecord(){if(recordBusy)return;recordBusy=true;byId('record').disabled=true;
+  try{const state=await api('/api/record');const action=state.state==='recording'?'stop':'start';
+    const result=await api('/api/record',{action});byId('actionStatus').textContent=result.message||result.state;}
+  catch(error){byId('actionStatus').textContent=error.message;}finally{recordBusy=false;refreshRecord();}}
+async function refreshExtensions(){const list=byId('extensions');try{const data=await api('/api/extensions');
+  byId('extensionsFolder').textContent=`Folder: ${data.folder}`;list.replaceChildren();
+  for(const ext of data.extensions){const row=document.createElement('div');row.className='block game';
+    const label=document.createElement('span');label.textContent=`${ext.name} · ${ext.description}`;
+    const open=document.createElement('button');open.textContent=`Open ${ext.name}`;open.onclick=()=>{
+      activeExtension=ext.id;byId('extensionTitle').textContent=ext.name;
+      byId('extensionFrame').src=`/extension/${encodeURIComponent(ext.id)}/index.html`;
+      byId('extensionPanel').hidden=false;byId('extensionPanel').scrollIntoView();};
+    row.append(label,open);list.append(row);}if(!data.extensions.length)list.textContent='No extensions installed.';
+  if(data.errors.length){const errors=document.createElement('p');errors.textContent=data.errors.map(x=>`${x.folder}: ${x.error}`).join('; ');list.append(errors);}
+  }catch(error){list.textContent=error.message;}}
+byId('refresh').onclick=refresh;byId('gameMode').onclick=()=>act('game-mode');byId('screenshot').onclick=()=>act('screenshot');
+byId('gamesRefresh').onclick=refreshGames;byId('record').onclick=toggleRecord;byId('extensionsRefresh').onclick=refreshExtensions;
+byId('extensionClose').onclick=()=>{activeExtension=null;byId('extensionFrame').removeAttribute('src');byId('extensionPanel').hidden=true;};
+window.addEventListener('message',event=>{if(!activeExtension||event.source!==byId('extensionFrame').contentWindow)return;
+  const request=event.data;if(!request||request.type!=='frame-control:request'||!Number.isSafeInteger(request.id))return;
+  let value;if(request.action==='capabilities')value={apiVersion:1,actions:['capabilities','status']};
+  else if(request.action==='status')value={connected:!!latestStatus,
+    os:{version:latestStatus?.os?.version||null,build:latestStatus?.os?.build||null},
+    battery:{percent:latestStatus?.battery?.percent??null},steamvr:!!latestStatus?.services?.steamvr};
+  else return;event.source.postMessage({type:'frame-control:response',id:request.id,value},'*');});
+refresh();refreshGames();refreshRecord();refreshExtensions();
+setInterval(()=>{if(!document.hidden){refresh();refreshRecord();}},15000);
+</script></body></html>
@@ -1373,7 +1373,7 @@
      <div class="store-owned" id="storeOwned">
      <section class="panel" id="androidBackup">
        <div class="shelf-head"><h2>Import Android game</h2></div>
-        <p class="sub">Have a backup? Choose the game's APK and all its .obb files together, or one XAPK/APKS/APKM bundle containing a standalone APK. Split sets and Android/data restore are not supported here.
+        <p class="sub">Have a backup? Choose the game's base APK, supported native-library or asset splits, and all its .obb files together, or one XAPK/APKS/APKM bundle. Resource, code and feature splits and Android/data restore are not supported here.
          Frame Control installs the app and puts its data in the right place.</p>
        <button class="action small" id="androidBackupChoose">Choose game files…</button>
        <input type="file" id="androidBackupInput" accept=".apk,.obb,.xapk,.apks,.apkm" multiple hidden>
@@ -1436,7 +1436,7 @@

  <div class="page" data-page="tools">
 <div class="workspace-heading"><div><a href="#tools" id="toolBack" class="workspace-link" hidden>← All tools</a><h1 id="toolTitle">Tools</h1><p id="toolSubtitle">Choose a task for your Frame.</p></div></div>
-<div id="toolDirectory"><section class="tool-group"><h2>Content & files</h2><div class="quick-routes"><a href="#transfer"><span>Send to Frame</span><small>Add files, APKs or your own games</small></a><a href="#media"><span>Media player</span><small>Play your own videos and media</small></a><a href="#linuxApps"><span>Linux apps</span><small>Install and manage desktop apps</small></a></div></section><section class="tool-group"><h2>Play & control</h2><div class="quick-routes"><a href="#capture"><span>Capture & Live</span><small>See and control the headset view</small></a><a href="#pad" title="Type on the headset (T)"><span>Type on the headset</span><small>Keyboard, trackpad and clipboard</small></a><a href="#panels"><span>Panel switcher</span><small>Bring an open panel into view</small></a><a href="#vrTools"><span>VR tools</span><small>Performance HUD and VR utilities</small></a><a href="#comfort"><span>Family & comfort</span><small>Session reminders and breaks</small></a><a href="#macview" id="macToolLink" hidden><span>Mac in the headset</span><small>Share Mac windows and displays</small></a><a href="#steamPipewire" id="steamPipewireLink" hidden><span>Steam desktop sharing</span><small>Linux: launch Steam or re-pick a screen</small></a><a href="#macview" id="pcToolLink" hidden><span>PC in the headset</span><small>Experimental: share this PC's screen</small></a></div></section><section class="tool-group" id="wirelessToolGroup" hidden><h2>This PC</h2><div class="quick-routes"><a href="#wireless"><span>Wireless Adapter doctor</span><small>Read-only Windows adapter and interference checks</small></a></div></section><section class="tool-group"><h2>Your Frame</h2><div class="quick-routes"><a href="#powerReport"><span>Power &amp; heat report</span><small>Read-only observation and offline downloads</small></a><a href="#storage"><span>Game storage</span><small>Free space and Steam install sizes</small></a><a href="#backup" id="backupToolLink"><span>Backup &amp; recovery</span><small>Save games and settings, restore after a reset</small></a></div><a class="workspace-link" href="#settings">Connection, display &amp; preferences →</a></section><section class="tool-group"><h2>Modding & extensions</h2><div class="quick-routes"><a href="#extensions"><span>Extensions</span><small>Add local tools to Frame Control</small></a></div></section><section class="tool-group"><h2>Assistant</h2><a class="workspace-link" href="/assistant">Open assistant &amp; AI agents →</a><p class="sub">Use your own model endpoint or review a proposed MCP action.</p></section></div>
+<div id="toolDirectory"><section class="tool-group"><h2>Content & files</h2><div class="quick-routes"><a href="#transfer"><span>Send to Frame</span><small>Add files, APKs or your own games</small></a><a href="#media"><span>Media player</span><small>Play your own videos and media</small></a><a href="#linuxApps"><span>Linux apps</span><small>Install and manage desktop apps</small></a></div></section><section class="tool-group"><h2>Play & control</h2><div class="quick-routes"><a href="#capture"><span>Capture & Live</span><small>See and control the headset view</small></a><a href="#pad" title="Type on the headset (T)"><span>Type on the headset</span><small>Keyboard, trackpad and clipboard</small></a><a href="#panels"><span>Panel switcher</span><small>Bring an open panel into view</small></a><a href="#vrTools"><span>VR tools</span><small>Performance HUD and VR utilities</small></a><a href="#comfort"><span>Family & comfort</span><small>Session reminders and breaks</small></a><a href="#macview" id="macToolLink" hidden><span>Mac in the headset</span><small>Share Mac windows and displays</small></a><a href="#steamPipewire" id="steamPipewireLink" hidden><span>Steam desktop sharing</span><small>Linux: launch Steam or re-pick a screen</small></a><a href="#macview" id="pcToolLink" hidden><span>PC in the headset</span><small>Experimental: share this PC's screen</small></a></div></section><section class="tool-group" id="wirelessToolGroup" hidden><h2>This PC</h2><div class="quick-routes"><a href="#wireless"><span>Wireless Adapter doctor</span><small>Read-only Windows adapter and interference checks</small></a></div></section><section class="tool-group"><h2>Your Frame</h2><div class="quick-routes"><a href="#powerReport"><span>Power &amp; heat report</span><small>Read-only observation and offline downloads</small></a><a href="#storage"><span>Game storage</span><small>Free space and Steam install sizes</small></a><a href="#backup" id="backupToolLink"><span>Backup &amp; recovery</span><small>Save games and settings, restore after a reset</small></a></div><a class="workspace-link" href="#settings">Connection, display &amp; preferences →</a></section><section class="tool-group"><h2>Modding & extensions</h2><div class="quick-routes"><a href="#extensions"><span>Extensions</span><small>Add local tools to Frame Control</small></a><a href="#decky"><span>Decky Loader</span><small>Experimental Steam plugin loader</small></a><a href="#headsetPanel"><span>Frame Control in VR</span><small>Open tools inside the headset</small></a></div></section><section class="tool-group"><h2>Assistant</h2><a class="workspace-link" href="/assistant">Open assistant &amp; AI agents →</a><p class="sub">Use your own model endpoint or review a proposed MCP action.</p></section></div>
  <div class="grid-3" id="toolWorkspace">
  <section class="panel" id="extensions">
    <div class="shelf-head"><h2>Extensions</h2><span class="spacer"></span><button class="small" id="extensionsRefresh">Refresh</button></div>
@@ -1448,6 +1448,23 @@
      <iframe id="extensionFrame" title="Frame Control extension" sandbox="allow-scripts" referrerpolicy="no-referrer" style="width:100%;height:440px;border:1px solid rgba(255,255,255,.12);border-radius:4px;background:#101820"></iframe>
    </div>
  </section>
+  <section class="panel" id="decky">
+    <div class="shelf-head"><h2>Decky Loader on Frame</h2><span class="spacer"></span><button class="small" id="deckyRefresh">Refresh</button></div>
+    <p class="sub">Experimental. Decky's ARM64 backend can start on Frame OS, but its plugin menu has not been verified in the VR shell. Some Decky plugins need root and will not work with this user service.</p>
+    <div id="deckyState" class="sub">Checking…</div>
+    <div id="deckyPlugins" class="hint"></div>
+    <label class="popt"><input type="checkbox" id="deckyAck"> I understand that the VR menu and individual plugins may not work. Install only if I want to test Decky.</label>
+    <div class="row" style="margin-top:10px"><button class="small action" id="deckyInstall" disabled>Install</button><button class="small" id="deckyUpdate" disabled>Update</button><button class="small danger" id="deckyRemove" disabled>Remove managed Decky</button></div>
+    <div class="hint">Install and update download Decky's official ARM64 release and verify its published SHA-256. Frame Control uses a removable user service and does not change the root filesystem. Remove keeps plugin files.</div>
+  </section>
+  <section class="panel" id="headsetPanel">
+    <div class="shelf-head"><h2>Frame Control in VR</h2><span class="spacer"></span><button class="small" id="headsetRefresh">Refresh</button></div>
+    <p class="sub">Open a Frame Control panel in SteamVR's dashboard. The panel runs on the Frame through a loopback server and an opt-in user service.</p>
+    <div id="headsetState" class="sub">Checking…</div>
+    <label class="popt"><input type="checkbox" id="headsetAck"> I want to install this local headset panel. Closing or removing it leaves SteamVR and my extensions running.</label>
+    <div class="row" style="margin-top:10px"><button class="small action" id="headsetInstall" disabled>Install &amp; open</button><button class="small" id="headsetUpdate" disabled>Update</button><button class="small" id="headsetOpen" disabled>Show in SteamVR</button><button class="small" id="headsetClose" disabled>Close</button><button class="small danger" id="headsetRemove" disabled>Remove</button></div>
+    <p class="hint">Open SteamVR's dashboard to find Frame Control. Remove stops its user service and removes its app bundle; your extension folders and browser profile stay on the Frame.</p>
+  </section>
 <section class="panel" id="wireless" hidden>
  <h2>Wireless Adapter doctor</h2>
  <p class="sub">Read-only snapshot of this Windows PC. Works without a headset connection. Nothing on the Frame is read or changed.</p>
@@ -1899,7 +1916,7 @@
 </main>
 </div>
 <div class="dropzone" id="dropzone" hidden><div><b>Drop to send to the Frame</b>
-  <span class="sub">Android backups: drop an APK with its OBB files, or one XAPK/APKS/APKM bundle (standalone APK only).
+  <span class="sub">Android backups: drop a base APK with supported splits and OBB files, or one XAPK/APKS/APKM bundle.
  Other files go to <code>~/Downloads</code>;
  a game's <code>.zip</code>, folder or <code>.exe</code> becomes a Steam library title.</span></div></div>

@@ -2157,6 +2174,62 @@ $('extensionClose').onclick = () => {
  $('extensionFrame').removeAttribute('src');
  $('extensionPanel').hidden = true;
 };
+let deckyInfo = null;
+async function loadDecky() {
+  try {
+    const d = deckyInfo = await api('/api/decky');
+    $('deckyState').textContent = `${d.frameOS || 'Unknown'} ${d.variant || ''} · ${d.arch} · CEF ${d.cef ? 'ready' : 'unavailable'} · ${d.managed ? `managed Decky ${d.version || ''} ${d.running ? 'running' : 'stopped'}` : d.upstreamInstall ? 'upstream Decky installation found' : 'Decky not installed'}`;
+    const plugins = [...d.plugins.map(x => `${x.name} (managed)`), ...d.upstreamPlugins.map(x => `${x.name} (upstream)`)];
+    $('deckyPlugins').textContent = plugins.length ? `Installed plugins: ${plugins.join(', ')}` : 'No Decky plugins found.';
+    deckyButtons();
+  } catch (error) { deckyInfo = null; $('deckyState').textContent = error.message; deckyButtons(); }
+}
+function deckyButtons() {
+  const ready = !!deckyInfo && deckyInfo.arch === 'aarch64' && deckyInfo.variant === 'vr' && deckyInfo.cef && !deckyInfo.upstreamInstall;
+  const ack = $('deckyAck').checked;
+  $('deckyInstall').disabled = !ack || !ready || deckyInfo.managed;
+  $('deckyUpdate').disabled = !ack || !ready || !deckyInfo.managed;
+  $('deckyRemove').disabled = !ack || !deckyInfo?.managed;
+}
+$('deckyAck').onchange = deckyButtons;
+$('deckyRefresh').onclick = loadDecky;
+for (const action of ['Install', 'Update', 'Remove']) {
+  $(`decky${action}`).onclick = async () => {
+    if (!$('deckyAck').checked || !deckyInfo) return;
+    const verb = action.toLowerCase();
+    if (verb === 'remove' && !confirm('Remove the Frame Control managed Decky service and binary? Plugin files will stay.')) return;
+    await runJob(`${action} Decky Loader`, 'decky', () => api('/api/decky', {action:verb, acknowledged:true}));
+    loadDecky();
+  };
+}
+let headsetInfo = null;
+async function loadHeadsetPanel() {
+  try {
+    const d = headsetInfo = await api('/api/headset');
+    $('headsetState').textContent = `${d.os || 'Unknown Frame OS'} · ${d.arch} · ${d.managed ? `installed ${d.version || ''}` : 'not installed'} · ${d.running ? d.overlayRegistered ? 'SteamVR panel registered' : 'service starting' : 'stopped'}`;
+  } catch (error) { headsetInfo = null; $('headsetState').textContent = error.message; }
+  headsetButtons();
+}
+function headsetButtons() {
+  const d = headsetInfo, ready = !!d && d.arch === 'aarch64' && d.variant === 'vr';
+  $('headsetInstall').disabled = !ready || !!d.managed || !$('headsetAck').checked;
+  $('headsetUpdate').disabled = !ready || !d.managed || !$('headsetAck').checked;
+  $('headsetOpen').disabled = !ready || !d.managed;
+  $('headsetClose').disabled = !d?.running;
+  $('headsetRemove').disabled = !d?.managed || !$('headsetAck').checked;
+}
+$('headsetAck').onchange = headsetButtons;
+$('headsetRefresh').onclick = loadHeadsetPanel;
+for (const action of ['Install', 'Update', 'Open', 'Close', 'Remove']) {
+  $(`headset${action}`).onclick = async () => {
+    if (!headsetInfo) return;
+    const verb = action.toLowerCase();
+    if (verb === 'remove' && !confirm('Remove the Frame Control headset user service and app bundle? Your extensions and browser profile will stay.')) return;
+    await runJob(`${action} Frame Control in VR`, 'headset-panel',
+      () => api('/api/headset', {action:verb, acknowledged:$('headsetAck').checked}));
+    loadHeadsetPanel();
+  };
+}
 window.addEventListener('message', event => {
  if (!activeExtension || event.source !== $('extensionFrame').contentWindow) return;
  const request = event.data;
@@ -3907,7 +3980,8 @@ async function importAndroidFiles(files, dev, probe = false) {
    if (!dlg.open) return true;
    const plan = read.plan;
    $("androidImportName").textContent = `${plan.label}${plan.version ? " · " + plan.version : ""}`;
-    $("androidImportFiles").innerHTML = (plan.apk ? `<div class="sub">Game app</div><div>${esc(plan.apk)}</div>`
+    $("androidImportFiles").innerHTML = (plan.apk ? `<div class="sub">Game app</div><div>${esc(plan.apk)}</div>` +
+      (plan.splits || []).map(f => `<div>${esc(f)} <span class="sub">split APK</span></div>`).join("")
      : `<div class="sub">Game app already installed</div>`) +
      `<div class="sub" style="margin-top:12px">Game data · ${plan.obb.length} file${plan.obb.length === 1 ? "" : "s"}</div>` +
      plan.obb.map(f => `<div>${esc(f.name)} <span class="sub">${gb(f.size)}</span></div>`).join("");
@@ -6141,10 +6215,10 @@ const PAGES = ["apps", "games", "tools", "settings"];
 const SECONDARY_PAGES = ["home", "capture", "devices", "control"];
 const SECTION_PAGE = {library:"games", discover:"apps", android:"apps", view:"capture", shots:"capture", device:"home",
  steamPipewire:"tools", vrTools:"tools", comfort:"tools", assistant:"tools", pad:"tools", sideloaded:"games", getgames:"games", steamStore:"games", androidLibrary:"apps", appStore:"apps", linuxApps:"apps",
-  display:"settings", androidSettings:"settings", transfer:"tools", media:"tools", artworkSettings:"settings", autoSync:"settings", power:"settings", macview:"tools", privacy:"settings", panels:"tools", storage:"tools", wireless:"tools", powerReport:"tools", backup:"tools", extensions:"tools"};
+  display:"settings", androidSettings:"settings", transfer:"tools", media:"tools", artworkSettings:"settings", autoSync:"settings", power:"settings", macview:"tools", privacy:"settings", panels:"tools", storage:"tools", wireless:"tools", powerReport:"tools", backup:"tools", extensions:"tools", decky:"tools", headsetPanel:"tools"};
 const TOOL_TITLES = {steamPipewire:"Steam desktop sharing", transfer:"Send to Frame", media:"Media player", artworkSettings:"Library artwork", autoSync:"Copy to this computer",
  pad:"Type on the headset", panels:"Panel switcher", vrTools:"VR tools", comfort:"Family & comfort", androidSettings:"App display & reports",
-  power:"Remote & power", macview:"Mac in the headset", privacy:"Privacy & updates", storage:"Game storage", wireless:"Wireless Adapter doctor", powerReport:"Power & heat report", backup:"Backup & recovery", extensions:"Extensions"};
+  power:"Remote & power", macview:"Mac in the headset", privacy:"Privacy & updates", storage:"Game storage", wireless:"Wireless Adapter doctor", powerReport:"Power & heat report", backup:"Backup & recovery", extensions:"Extensions", decky:"Decky Loader", headsetPanel:"Frame Control in VR"};
 const workspace = {source:"all", scope:"installed", apps:"installed", scroll:new Map(), key:null, hash:null, y:0};
 let page = "apps";
 // Reuse the existing live lists and form handlers in their new destinations.
@@ -6252,6 +6326,8 @@ function showPage(e) {
  if (tool === 'macview') loadMacView();
  if (tool === 'panels') loadPanelSwitcher();
  if (tool === 'extensions') loadExtensions();
+  if (tool === 'decky') loadDecky();
+  if (tool === 'headsetPanel') loadHeadsetPanel();
  if (tool === 'backup') loadBackups();
  if (tool === 'storage') loadStorage();
  if (tool === 'powerReport') loadPower();
@@ -79,6 +79,8 @@ import frame_wireless_doctor  # noqa: E402
 import frame_wired_doctor  # noqa: E402
 import frame_compat_db  # noqa: E402
 import frame_extensions  # noqa: E402
+import frame_decky  # noqa: E402
+import frame_headset  # noqa: E402

 frame_host.trust_bundled_cas()

@@ -87,6 +89,7 @@ HERE = Path(__file__).resolve().parent
 # goes to local-bin/ssh, which runs COMMAND here instead, so one code path serves
 # both. Nothing listens beyond 127.0.0.1; the phone reaches it through SSH.
 LOCAL = os.environ.get("FRAME_LOCAL") == "1"
+HEADSET_RUNTIME = LOCAL and os.environ.get("FRAME_HEADSET_RUNTIME") == "1"
 if LOCAL:
    os.environ["PATH"] = f"{HERE / 'local-bin'}{os.pathsep}{os.environ.get('PATH', '')}"
 UI_KEY = os.environ.get("FRAME_UI_KEY") or "1"
@@ -549,6 +552,25 @@ def status(_body):
    return s


+def decky(body):
+    action = body.get("action")
+    if action not in ("install", "update", "remove"):
+        raise Failure("Choose install, update, or remove", 400)
+    if body.get("acknowledged") is not True:
+        raise Failure("Confirm that Decky support on the Frame is experimental", 400)
+    return start_job("Decky Loader " + action, lambda: frame_decky.change(ssh, action))
+
+
+def headset_action(body):
+    if LOCAL:
+        raise Failure("Manage the headset panel from Frame Control on your computer", 400)
+    action = body.get("action")
+    if action not in ("install", "update", "open", "close", "remove"):
+        raise Failure("Choose install, update, open, close, or remove", 400)
+    if action in ("install", "update", "remove") and body.get("acknowledged") is not True:
+        raise Failure("Confirm the opt-in headset installation or removal", 400)
+    return start_job("Headset panel " + action, lambda: frame_headset.change(ssh, action))
+

 COMFORT_FILES = ("frame_comfort.py", "frame_status.py", "frame_steam.py")
 COMFORT_MISSING = {"comfort": "missing"}  # what COMFORT_RUN prints when the cached copy isn't complete
@@ -818,6 +840,32 @@ recorder = frame_clips.Recorder(_record_channel, lambda cmd, timeout: ssh(cmd, t
                                lambda fn: busy_thread(fn).start(), release=lambda proc: _live_tunnels.discard(proc))


+def _headset_record_run(command, timeout):
+    result = subprocess.run(['bash', '-c', command], capture_output=True, text=True,
+                            stdin=subprocess.DEVNULL, timeout=timeout)
+    if result.returncode:
+        raise frame_clips.ClipError((result.stderr or result.stdout).strip()[-600:] or 'Recording command failed')
+    return result.stdout
+
+
+def _headset_record_channel(command, stderr):
+    return subprocess.Popen(['bash', '-c', command], stdin=subprocess.PIPE,
+                            stdout=subprocess.PIPE, stderr=stderr, start_new_session=True)
+
+
+def _headset_record_fetch(relative, target):
+    source = Path.home() / relative
+    if source.parent != Path.home() / '.cache/frame-control/headset-video' or not source.is_file() or source.is_symlink():
+        raise frame_clips.ClipError('The headset recording file is missing')
+    shutil.copyfile(source, target)
+
+
+headset_recorder = frame_clips.Recorder(
+    _headset_record_channel, _headset_record_run, _headset_record_fetch,
+    lambda fn: busy_thread(fn).start(), folder=Path.home() / 'Videos/FrameControl',
+    work='.cache/frame-control/headset-video', destination_label='~/Videos/FrameControl') if HEADSET_RUNTIME else None
+
+
 def _clips_here():
    if LOCAL:
        raise Failure("Recordings are saved to a computer: use Frame Control on your computer", 400)
@@ -825,16 +873,42 @@ def _clips_here():

 def record(body):
    """{"action": "start"|"stop"}: record what the headset shows, with its sound."""
-    _clips_here()
+    if not HEADSET_RUNTIME:
+        _clips_here()
    action = body.get("action")
    if action not in ("start", "stop"):
        raise Failure("action must be start or stop", 400)
    try:
-        return recorder.start() if action == "start" else recorder.stop()
+        owned_recorder = headset_recorder if HEADSET_RUNTIME else recorder
+        return owned_recorder.start() if action == "start" else owned_recorder.stop()
    except frame_clips.ClipError as e:
        raise Failure(str(e), e.status)


+def headset_quick(body):
+    """Narrow actions for the local SteamVR panel, never exposed to the phone server."""
+    if not HEADSET_RUNTIME:
+        raise Failure('Headset quick actions require the local VR panel', 400)
+    action = body.get('action')
+    if action == 'game-mode':
+        try:
+            frame_panels.focus('valve.steam.gamepadui.main')
+        except frame_panels.PanelError as error:
+            raise Failure(str(error), 502) from error
+        return {'message':'Asked SteamVR to show the Game Mode dashboard.'}
+    if action == 'screenshot':
+        data = headset_view()
+        folder = Path.home() / 'Pictures/FrameControl'
+        folder.mkdir(parents=True, exist_ok=True, mode=0o700)
+        name = time.strftime('frame-%Y%m%d-%H%M%S-') + secrets.token_hex(3) + '.png'
+        path = folder / name
+        with os.fdopen(os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'wb') as file:
+            file.write(data)
+        return {'message': f'Saved ~/Pictures/FrameControl/{name}. A sleeping headset may capture a dark frame.',
+                'file': str(path)}
+    raise Failure('Choose Game Mode or screenshot', 400)
+
+
 def _clips_frame(args, timeout):
    return steam_frame(*args, timeout=timeout, script="frame_clips.py")

@@ -3322,6 +3396,9 @@ POST = {
    "/api/steam-pipewire": steam_pipewire_action,
    "/api/power": power_action,
    "/api/android/backup": android_backup, "/api/backup": backup_action,
+    "/api/decky": decky,
+    "/api/headset": headset_action,
+    "/api/headset/quick": headset_quick,
    "/api/vr": vr,
    "/api/comfort": comfort, "/api/media": media, "/api/agent/call": agent_call,
    "/api/agent/approval": agent_approval, "/api/assistant/chat": assistant_chat,
@@ -3505,6 +3582,9 @@ class Handler(BaseHTTPRequestHandler):
        try:
            if path in ("/", "/index.html"):
                self.send_bytes((HERE / "index.html").read_bytes(), "text/html; charset=utf-8")
+            elif path == "/headset":
+                # Dedicated, large-control UI for the opt-in SteamVR panel.
+                self.send_bytes((HERE / "headset.html").read_bytes(), "text/html; charset=utf-8")
            elif path == "/store":
                # The Android store as a headset panel (scripts/store-on-frame.sh).
                self.send_bytes((HERE / "store.html").read_bytes(), "text/html; charset=utf-8")
@@ -3522,6 +3602,12 @@ class Handler(BaseHTTPRequestHandler):
                                headers=[('Content-Disposition', f'attachment; filename="frame-power-{report_id}.{format}"')])
            elif path == "/api/extensions":
                self.send_json(frame_extensions.list_extensions())
+            elif path == "/api/decky":
+                self.send_json(frame_decky.status(ssh))
+            elif path == "/api/headset":
+                if LOCAL:
+                    raise Failure("Manage this panel from Frame Control on your computer", 400)
+                self.send_json(frame_headset.status(ssh))
            elif path.startswith("/extension/"):
                parts = path.split("/")
                if len(parts) != 4:
@@ -3683,8 +3769,9 @@ class Handler(BaseHTTPRequestHandler):
            elif path == "/api/shots/image":
                self.send_bytes(*shot_image(url.query))
            elif path == "/api/record":
-                _clips_here()
-                self.send_json(recorder.status())
+                if not HEADSET_RUNTIME:
+                    _clips_here()
+                self.send_json((headset_recorder if HEADSET_RUNTIME else recorder).status())
            elif path == "/api/clips":
                self.send_json(list_clips())
            elif path == "/api/autosync":
@@ -4012,6 +4099,8 @@ def main():
        if not frame_host.WINDOWS:
            signal.signal(signal.SIGTERM, signal.SIG_IGN)
        _power.shutdown()
+        if HEADSET_RUNTIME:
+            headset_recorder.shutdown(timeout=30)
        _stop_sync.set()
        webinstall_shutdown()
        macview.shutdown()  # close the headset's viewers before the agent goes
@@ -11,6 +11,8 @@
 <section><div class="row"><label for="alias">Your configured headset SSH alias<input id="alias" value="frame" maxlength="64" autocomplete="off"></label>
 <button id="check">Check cable connection</button></div><p id="message" role="status" aria-live="polite">No checks have run.</p></section>
 <div id="results" aria-live="polite"></div>
+<section><h2>SSH works, but the PC stream still fails?</h2>
+<p>The doctor checks Frame Control's SSH route only. If the SteamVR stream stops on USB, Wi-Fi and the Wireless Adapter, the problem may be on the PC. On a Windows or Linux PC, first save your work and close the VR game. Exit SteamVR from Steam on the PC, then start SteamVR again. Frame Control reconnecting to <code>frame.local</code> will not restart PC SteamVR. This is a manual test, not a fix for the cause of repeated drops. Frame Control does not restart PC SteamVR automatically because it cannot safely know which game and session it would stop.</p></section>
 <p class="sub">The observed USB address is 10.86.200.233 on Frame OS tested in 2026. A different OS build may use another subnet. An unknown result does not prove the cable is broken. The doctor never changes IP settings, accepts a new host key, or bypasses SSH warnings.</p>
 </main><script>
 'use strict';
Author	SHA1	Message	Date
Alex SouthwellandSAPHID	d79efb4730	Bump Frame Control to 0.4.30 (#207 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 05:39:30 +00:00
Alex SouthwellandSAPHID	95643b7ea0	Support restricted split APKs in Android backup import (#206 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 05:29:21 +00:00
Alex SouthwellandSAPHID	9dab523af9	docs: distinguish current Frame OS checks from September notes (#205 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 05:13:12 +00:00
Alex SouthwellandSAPHID	a29fac2594	Bump Frame Control to 0.4.29 (#204 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 04:21:10 +00:00
Alex SouthwellandSAPHID	6d5cb20847	Document ProtonDB Badges test on Steam Frame (#202 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 04:11:01 +00:00
Alex Southwell	987c36c5f6	Merge pull request #201 from saphid/fleet/se9k61wn4f-headset-actions Add headset quick actions and extension panels	2026-10-25 04:10:29 +00:00
Alex Southwell	649185237f	Merge pull request #198 from saphid/fleet/se9k61wn4f-headset-ui Add removable Frame Control panel for SteamVR	2026-10-25 04:09:48 +00:00
Alex SouthwellandSAPHID	5b43170fda	Bump Frame Control to 0.4.28 (#203 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:59:02 +00:00
SAPHID	0cb085dc50	Check POSIX screenshot mode only on POSIX	2026-10-25 03:56:24 +00:00
SAPHID	61db62edcf	Make headset screenshot test portable	2026-10-25 03:52:23 +00:00
SAPHID	b0a65129f1	Add headset quick actions and extension panels	2026-10-25 03:47:30 +00:00
Alex SouthwellandSAPHID	958743c79d	Docs: guide SteamOS OBS host setup with test limits (#200 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:47:21 +00:00
Alex SouthwellandSAPHID	05308932e8	Docs: distinguish PC SteamVR stream failures from SSH (#199 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:46:57 +00:00
Alex SouthwellandSAPHID	4e4853e82b	Docs: explain streaming lag and Japanese setup (#197 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:41:41 +00:00
SAPHID	d44b6121ae	Use POSIX member paths in headset bundle on Windows	2026-10-25 03:39:53 +00:00
SAPHID	af6f97ca5a	Add removable Frame Control headset panel	2026-10-25 03:33:58 +00:00
Alex SouthwellandSAPHID	3438c248d9	Bump Frame Control to 0.4.27 (#196 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:24:52 +00:00
Alex SouthwellandSAPHID	509ddbdc95	Add experimental Decky Loader manager for Steam Frame (#195 ) * Add sandboxed local Frame Control extensions * Add experimental Decky Loader manager for Steam Frame * ci: verify Decky PR against main --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:14:42 +00:00
Alex SouthwellandSAPHID	f2d293bd1a	Add local Frame Control extensions (#194 ) * Add sandboxed local Frame Control extensions * docs: clarify local extension network boundary --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 02:48:37 +00:00