docs: record v0.4.52 release verification

Prepare Frame Control v0.4.52 candidate

docs/evidence/v0452-assets-2026-10-28.json

@@ -0,0 +1,76 @@
+{
+  "tag": "v0.4.52",
+  "releaseId": 426854020,
+  "tagNameAtAudit": "v0.4.52",
+  "draftAtAudit": true,
+  "sha256sumsSha256": "71306c21818a8842f60633540a16457e962e9ffc7fac01a547a5a2fd17f32904",
+  "assets": [
+    {
+      "name": "Frame-Control-mac-arm64.dmg",
+      "size": 177628410,
+      "sha256": "2dad765390965eaa01ab9a1737bffddcb6c8d481e4d255322e663bcdb7ad1e30",
+      "udifTrailer": "ok"
+    },
+    {
+      "name": "Frame-Control-mac-arm64.zip",
+      "size": 177451653,
+      "sha256": "abb17c3e3de2ada967d10b7e277c9f122fb731108efc6d70fed9b87e92e66106",
+      "zipCrc": "ok",
+      "members": 1673,
+      "bundleVersion": "0.4.52"
+    },
+    {
+      "name": "Frame-Control-mac-x64.dmg",
+      "size": 184701118,
+      "sha256": "1317ee7b30de46bc69a19d42d68245dbf55ca02fbc6ceee5761534ddb8706bab",
+      "udifTrailer": "ok"
+    },
+    {
+      "name": "Frame-Control-mac-x64.zip",
+      "size": 184538083,
+      "sha256": "4d0fbf1904073a7b28d0e968013bd7ca34600536538db32d00b03cf6aaf5b3b4",
+      "zipCrc": "ok",
+      "members": 1669,
+      "bundleVersion": "0.4.52"
+    },
+    {
+      "name": "Frame-Control-Setup-x64.exe",
+      "size": 151885028,
+      "sha256": "bb190c20abb2fae1878b732819ae64c214c0cfd627c3a6279b25e9d9c0517740",
+      "peMachine": 332
+    },
+    {
+      "name": "Frame-Control-win-x64.zip",
+      "size": 198840260,
+      "sha256": "ef7d248967bda011951bd703972f3a1cb00a43e484af0daf58a5f754e2f2486c",
+      "zipCrc": "ok",
+      "members": 1517
+    },
+    {
+      "name": "Frame-Control-linux-x86_64.AppImage",
+      "size": 179997222,
+      "sha256": "6241e068222a2c05f41946e94dedb1456dce25ae94d4857bcb7a4d1891feac7d",
+      "elfMachine": 62
+    },
+    {
+      "name": "Frame-Control-linux-arm64.AppImage",
+      "size": 171579364,
+      "sha256": "27da455144f8c88ba6a56d6eed90e1806c098d5f6806790089513ba77ec79f52",
+      "elfMachine": 183
+    },
+    {
+      "name": "Frame-Control-linux-amd64.deb",
+      "size": 146749772,
+      "sha256": "97425cbd4d460460b9f0574519bbf11afa1b8cc8003e1b784d6c002244da4075",
+      "debVersion": "0.4.52",
+      "architecture": "amd64"
+    },
+    {
+      "name": "Frame-Control-linux-arm64.deb",
+      "size": 133832104,
+      "sha256": "58c98ed203caca60ce022c90232c13591d11c72ff5b28c5860aa7b221ec3e918",
+      "debVersion": "0.4.52",
+      "architecture": "arm64"
+    }
+  ]
+}

docs/evidence/v0452-release-2026-10-28.md

@@ -0,0 +1,70 @@
+# v0.4.52 tagged release verification, 28 October 2026
+
+The annotated `v0.4.52` tag dereferences to merged main commit
+`ac04407bcc799e9e88ce31c3f602020e9f3b1cee`. Its tree
+`864fde2ec006afe00eb886279af9361a6e3b657e` exactly matches reviewed
+[candidate PR #375](https://github.com/saphid/frame-control/pull/375) head
+`432b29f9618d1e300abdf8437a2bd8360d54cffb`. The candidate's locked
+source smoke and cleanup are recorded in [its evidence](v0452-candidate-2026-10-28.md).
+
+## Exact commit and tagged build gates
+
+- [Main checks](https://github.com/saphid/frame-control/actions/runs/40714882563)
+  passed on the tag commit: all seven jobs on the first attempt, including
+  e2e, iOS, Windows, macOS, Linux and the aggregate check.
+- [Native Decky runtime](https://github.com/saphid/frame-control/actions/runs/40714882617)
+  passed on the tag commit: both published Decky 3.3.0 AMD64 and ARM64 jobs
+  on the first attempt.
+- The [exact-tag release workflow](https://github.com/saphid/frame-control/actions/runs/40717151326)
+  passed all six jobs on the first attempt: draft, Linux, Windows, Intel Mac,
+  Apple Silicon Mac and checksums. No tagged job failed, was cancelled,
+  skipped or overridden.
+
+Before publication, the unpublished draft held exactly ten installers and
+`SHA256SUMS`. Every installer was independently downloaded by GitHub asset
+ID. Each downloaded size and SHA-256 matched the asset metadata; the
+downloaded `SHA256SUMS` matched all ten entries byte for byte. Its SHA-256 was
+`71306c21818a8842f60633540a16457e962e9ffc7fac01a547a5a2fd17f32904`.
+The [sanitized asset audit](v0452-assets-2026-10-28.json) records all ten
+names, sizes, hashes and package checks. It checked both Mac ZIP CRCs and
+bundle version `0.4.52`, both DMG UDIF trailers, Windows ZIP CRC and PE
+installer header, both AppImage ELF architectures, and both DEB version and
+architecture fields.
+
+The independently downloaded Linux x86_64 AppImage had SHA-256
+`6241e068222a2c05f41946e94dedb1456dce25ae94d4857bcb7a4d1891feac7d`.
+It launched under isolated Xvfb with a temporary profile, telemetry and
+update checks disabled. Its bundled server returned HTTP 200 with
+`FrameControl/1` and stopped after app exit. No physical Mac or Windows
+launch of these exact installers was performed.
+
+## Real Frame and publication
+
+The [candidate evidence](v0452-candidate-2026-10-28.md) records a unique-lock
+real Frame smoke on the version-bumped source: **12 passed, one optional
+x86_64 launch skipped, zero failed**. Steam Linux Runtime 4 was absent, so
+no x86_64 launch is claimed. A separate fresh-lock audit found no reserved
+smoke title files, metadata or owned processes; both locks were released.
+SteamVR activity was 3 (standby), proximity raw 2.3125 and battery 100%.
+There was no wearer confirmation, wake command or worn interaction test.
+The private smoke result's SHA-256 is
+`42ea66740d001cc097ce9e871be6b01be1a10f184ab4480019b0a306851cfc57`.
+
+`scripts/publish-release.sh --dry-run v0.4.52` passed exact-main, native
+runtime and tagged release jobs, all ten installer hashes, regenerated
+`SHA256SUMS`, draft notes and update-manifest checks. Its local log had
+SHA-256 `d4264b5ad3106387b63d3fc800f558c912ff36b546ea83d792a5a0e8a4949cc6`.
+The real publisher repeated those gates, attached `update.json`, and published
+[v0.4.52](https://github.com/saphid/frame-control/releases/tag/v0.4.52) at
+**15:52:29 UTC**. GitHub's latest-release API returned `draft=false`, ten
+installers, `SHA256SUMS` and `update.json`. A fresh public latest-download of
+`update.json` reported version `0.4.52`, the correct release page, ten
+names, sizes and hashes matching the independent downloads, and the explicit
+limit that no person wore the headset. The public manifest's SHA-256 was
+`486bafc8ae4f1feed0f3a1db28b5034498eed78af2a11083be48175489e6d461`.
+
+The exact-version Decky catalog is **6 works / 54 partial / 45 broken /
+11 N/A**. Network Sentinel and Battery Tracker remain **partial**. Their
+real managed ARM64 operation and wearer-visible behavior are unverified.
+Worn VR visibility and physical-controller interaction also remain
+unverified. The separate hourly worn check remains enabled.