Record v0.4.44 release verification

Prepare Frame Control v0.4.44

docs/evidence/v0444-release-2026-10-26.md

@@ -0,0 +1,58 @@
+# v0.4.44 tagged release, 26 October 2026
+
+The annotated `v0.4.44` tag dereferences to main merge commit
+`37e25e62ace388ce032f47d08398c26ea8540fdb` from PR #315. The app and
+lockfile both report 0.4.44. [Post-merge main checks](https://github.com/saphid/frame-control/actions/runs/40298400256)
+passed all seven jobs, including iOS and fake Frame end-to-end tests. The
+[tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40299460805)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum
+jobs. The tagged Linux build ran the AppImage under isolated Xvfb; this does
+not verify a physical display or headset.
+
+## Frame and package gates
+
+The [candidate evidence](v0444-candidate-2026-10-26.md) records a shared-lock
+real Frame smoke on the version-bumped candidate: **12 passed / 1 optional x86
+launch skipped / 0 failed**, with owned cleanup and lock release. The x86
+launch was skipped because Steam Linux Runtime 4 is absent. The candidate
+also records an unworn sample panel exercise: synthetic OpenVR clicks moved a
+temporary scroll region down and back, while a synthetic native wheel did
+not scroll. No physical controller or wearer-visible result follows from it.
+The final candidate edit was evidence only, and the merge commit added no
+runtime changes.
+
+The draft contained ten installers and `SHA256SUMS`. Every installer had a
+GitHub SHA-256 digest. A freshly downloaded `SHA256SUMS` listed exactly those
+ten names and matching digests; its downloaded bytes matched GitHub's digest
+`072f8084d6f9f145f4a58457d10f54390b50d11288bece42f6d801a356a69b1c`.
+After the release notes were attached, `scripts/publish-release.sh --dry-run
+v0.4.44` passed the remote tag, ten installer and checksum gates.
+
+Freshly downloaded packages passed these independent checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `d1cb5c3b590a44a9c61cf1d38d546cf89a835c73bece839c639f0d2be70ff139`; launched under isolated Xvfb, bundled server returned HTTP 200 with `FrameControl/1`, and stopped on exit. The first local attempt was blocked by the sandbox; the same downloaded bytes passed outside it. |
+| Mac arm64 ZIP | SHA-256 `5a25dfea9b3c645dae7acaf660b7127e9a46a03173a69d02ef4c64b0b39a5934`; ZIP CRC valid, bundle version 0.4.44, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `fde1c48eef4e3b4be12a862d32c1154afd1a93fe1f27a32f0799365205655021`; ZIP CRC valid, bundle version 0.4.44, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `e8cae0a8d0f8b76a41ca109f5ec4bf9947ca31531a8b93ebb8e326e453602a16`; PE/Nullsoft installer format. The tagged Windows CI also checked its packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `40f1704af89b5b824bc28e93328c516306aaefb2e0f441c1866197fc953eb21f`; package version 0.4.44 and architecture arm64. |
+
+The tagged Mac and Windows packages were not launched on physical machines
+in this release gate. Earlier Intel Mac acceptance covers older bytes.
+
+## Publication and limits
+
+`scripts/publish-release.sh v0.4.44` published
+[v0.4.44](https://github.com/saphid/frame-control/releases/tag/v0.4.44) at
+2026-10-26 09:38:50 UTC. GitHub's latest-release API returned `draft=false`,
+`prerelease=false`, the expected tag, ten installers, `SHA256SUMS` and
+`update.json`. A fresh public latest-download of `update.json` reported
+version 0.4.44, the stable release page and ten hashed assets. Its notes
+retain the worn-VR limits. The exact-version official Decky catalog remains
+**4 works / 49 partial / 52 broken / 11 N/A** out of 116; Junk-Store remains
+partial.
+
+No reliable wearer confirmation was available. Official-plugin VR rendering,
+physical controller use, optical readability, audible output and VR keyboard
+remain unverified. The hourly shared-lock worn-check schedule stays enabled.