Use POSIX member paths in headset bundle on Windows

Add removable Frame Control headset panel
Add experimental Decky Loader manager for Steam Frame (#195 )
2026-10-25 10:02:21 +01:00 · 2026-10-25 03:39:53 +00:00 · 2026-10-25 03:33:58 +00:00 · 2026-10-25 03:14:42 +00:00 · 2026-10-25 02:48:37 +00:00 · 2026-10-25 02:36:30 +00:00
131 changed files with 8909 additions and 152 deletions
@@ -41,6 +41,10 @@ jobs:
          python -m py_compile $(find frame/devkit-utils -type f ! -name '*.*' ! -name LICENSE) frame/devkit-utils/devkit_utils/*.py
      - name: Server tests
        run: python -m unittest discover -s tests -v
+      - name: Linux Wireless Adapter doctor (read-only PC smoke)
+        run: |
+          python ui/frame_wireless_doctor.py --json > "$RUNNER_TEMP/linux-wireless-doctor.json"
+          python -c 'import json, os; from pathlib import Path; d=json.loads((Path(os.environ["RUNNER_TEMP"]) / "linux-wireless-doctor.json").read_text()); assert d["supported"] and d["selected"] is None and d["schema"] == 1'
      - name: App syntax
        run: node --check app/main.js && node --check app/build/make-icon.js && node --check app/build/fetch-deps.js && node --check app/preload.js && node --check app/install-link.js && node --check app/updater.js
      - name: App tests
@@ -70,6 +74,21 @@ jobs:
      - name: Server tests
        run: python -m unittest discover -s tests -v

+  # Fast, PC-only Windows query validation, without capture libraries or a headset.
+  wireless-windows:
+    runs-on: windows-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+      - name: Wireless doctor fixtures, UI and live read-only Windows inventory
+        run: python -m unittest discover -s tests -p 'test_wireless.py' -v
+
  # The iPhone app: builds for the Simulator and runs its unit tests.
  ios:
    runs-on: macos-latest
@@ -173,3 +173,24 @@ jobs:
            app/dist/*.AppImage
            app/dist/*.deb
          if-no-files-found: ignore
+
+  checksums:
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Attach SHA256SUMS after all installers upload
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh api --paginate "repos/$GH_REPO/releases?per_page=100" --jq '.[]' > releases.jsonl
+          python3 scripts/release-checksums.py --tag "$GITHUB_REF_NAME" < releases.jsonl > SHA256SUMS
+          # Find the same draft using its exact tag, or its version title if a
+          # draft edit made GitHub temporarily show an untagged-* tag name.
+          id=$(python3 scripts/release-checksums.py --tag "$GITHUB_REF_NAME" --id < releases.jsonl)
+          old=$(gh api "repos/$GH_REPO/releases/$id" --jq '.assets[] | select(.name == "SHA256SUMS") | .id')
+          for asset in $old; do gh api -X DELETE "repos/$GH_REPO/releases/assets/$asset" >/dev/null; done
+          gh api -X POST "https://uploads.github.com/repos/$GH_REPO/releases/$id/assets?name=SHA256SUMS" \
+            -H "Content-Type: text/plain" --input SHA256SUMS >/dev/null
@@ -2,6 +2,119 @@

 ## Unreleased

+- Save Steam screenshots under a separate folder for each headset, Steam
+  account and game. Equal screenshot filenames no longer overwrite one another;
+  existing files in the old flat folder are left in place.
+  [Copying guide](docs/recording.md).
+
+- Compare two explicit Windows Wireless Adapter doctor reads in local memory.
+  Highlight exact PnP instances and known state changes after a dropout;
+  incomplete inventories stay unknown. A Forget button clears the comparison.
+  No adapter setting changes or report uploads are made.
+
+- Add recovery steps to the Windows Wireless Adapter doctor for streams that
+  drop as they start and dongles that will not reconnect. Compare exact PnP IDs
+  and test one connection condition at a time. In-app disable/re-enable remains
+  deferred until an active Steam adapter instance can be identified safely.
+  [Guide and limits](docs/windows-wireless-doctor.md).
+
+- Add an explicit host window-switch button to whole-display panels: Alt-Tab
+  on Windows and Command-Tab on macOS. Single-window panels keep their own
+  source, so the button is hidden there.
+
+- Enable the in-app OBS source Start/Stop control on Windows. A control pipe
+  lets the Python relay close its SSH child on Stop, app quit or parent exit;
+  add a short [Discord guide](docs/streaming-to-discord.md).
+
+- Add a read-only wired connection doctor for a PC using the Frame's observed
+  USB-C network: show the local route, SSH port and pinned-key login result
+  without changing IP, host keys or headset settings.
+  [Usage and limits](docs/wired-connection.md).
+
+- Start the Android app catalogue without waiting for the headset's installed-app
+  list. Browsing remains available if that status request is slow or fails;
+  installation still waits for a confirmed list to avoid duplicate installs.
+
+- Verify the packaged OBS Start and Stop control with a real Frame, and record
+  37.600 seconds of headset mirror video and non-silent output audio in OBS.
+  Listening, sync and active passthrough remain unverified.
+  [Test record](docs/evidence/obs-media-source-real-2026-10-25.md).
+
+- Bundle the OBS source helper in Linux and macOS installers and add a
+  **Capture & Live** Start/Stop control. The app selects the active Frame and
+  closes its SSH stream on a headset switch or app exit. A real Frame stream
+  reached OBS with video and non-silent audio; listening and sync remain
+  unverified. [Setup and limits](docs/obs-headset-source.md).
+
+- Add a source-checkout helper that sends the Frame's SteamVR mirror and
+  default-output audio to a local OBS Media Source. A real Frame supplied a
+  4.021-second H.264/AAC stream to a Linux receiver; OBS playback and sync
+  remain unverified. [Setup and limits](docs/obs-headset-source.md).
+
+- Link emulator setup guidance from Store → Emulators. Existing Steam library
+  shortcuts and artwork cover Android apps and sideloaded titles; Android ROM
+  transfer still needs a verified per-instance workflow.
+  [Guide](docs/emulators.md).
+
+- Record the current Frame OS mirror and charge-limit checks. Active
+  passthrough in the mirror is still unknown; this build has no supported
+  user-writable 80% charge-limit control.
+  [Headset evidence](docs/evidence/round3-headset-2026-10-25.md).
+
+- Add Windows Tools → Wireless Adapter doctor: an explicit read-only PC snapshot
+  of distinct Wi-Fi Direct PnP instances, presence/link state, PC Wi-Fi and
+  reported channels/bands, with possible 2.4 GHz overlap guidance. Unknowns stay
+  visible; no adapter disable action is offered because an unused instance
+  cannot be identified reliably. No headset access or settings changes.
+  [Sources, verification and limits](docs/windows-wireless-doctor.md).
+
+- Add a Linux PC Wireless Adapter doctor in Settings and Devices, with a source
+  CLI and local JSON report. Select observed hardware without assuming Valve
+  IDs; inspect USB/interface presence, driver/module binding, udev/permissions,
+  rfkill, channel/band and network manager evidence. Missing evidence stays
+  unknown; all checks are read-only and never contact the Frame.
+  [Usage and verification limits](docs/linux-wireless-adapter-doctor.md).
+
+- Add Linux Tools → Steam desktop sharing: request `steam -pipewire` only after
+  checking Steam is not running, or open KDE Application Permissions with
+  instructions to revoke a verified Steam screen-sharing session manually. No
+  automatic permission reset, Steam restart, or headset access. Frame Control
+  Linux capture remains disabled; live portal behavior is unverified.
+  [Usage and limits](docs/steam-pipewire.md).
+
+- Use gamescope's input for the keyboard and trackpad, following the focused
+  headset panel without installing an input service. Start KDE Connect only for
+  accents and emoji, keeping queued text ordered and cancelling it on headset
+  switches. Retain intended-headset checks before starting either control and
+  prevent Unicode helper startup from deadlocking with a headset switch.
+- Keep accepted keyboard text when the Unicode queue is full: reject new batches
+  before sending their clicks or keys, and count in-flight text toward the limit.
+  Retain unsent text after helper failures/timeouts, report the error and resume
+  it with Try again. Clean up failed workers without touching a new headset's queue.
+  [Current verification and device limits](docs/evidence/pad-gamescope-2026-10-24.md).
+
+- Keep media playback running when SteamVR refuses the optional theatre dark
+  surround, including a retry after standby. Log the refusal and play without
+  the surround. Overlay teardown attempts every owned handle and always calls
+  OpenVR shutdown even if a handle fails to close.
+
+- Check the desktop server's single-instance lock before starting background
+  downloads, so a second server exits cleanly with the existing "already
+  running" message.
+
+- Recheck saved spatial layouts on SteamOS 0.5.6 / SteamVR 2.18.2 (issue #31).
+  Read-only probes expose some panel geometry, but safe restoration of
+  Steam/gamescope docking and positions remains unverified. Record exact API
+  results and a reproducible probe; saved layouts remain unavailable.
+
+- Record packaged v0.4.17 Desktop Capture succeeding on a mapped nested KDE
+  compositor on a real Frame with SteamOS 0.5.6. Headset overlay visibility was
+  not established; this is evidence, not a new fix or resolution of issue #73.
+
+- Correct the Return to Game Mode help text: Frame Control selects the switch
+  supported by the headset's SteamOS build, including `steamosctl` on current
+  Frames. The button's behavior is unchanged.
+
 - Distinguish an unreadable gamescope panel list from a confirmed empty list in
  Desktop Capture and Control (issue #73). Failed discovery now asks users to
  check SteamVR and report the exact message and SteamOS version, rather than
@@ -58,6 +58,9 @@ node --test site/test/*.test.mjs        # website feedback function

 Say what you tested, and whether you tried it on a real Steam Frame.

+To add a local feature without changing the core app, see the
+[extension guide](docs/extensions.md) and its working example.
+
 ## Blocking

 If you ignore this document twice, or spam the tracker with agent-generated
@@ -25,6 +25,8 @@ See what the headset sees, install games and Android apps, move files and text a

 <sub>Unofficial hobby project, not affiliated with Valve. Free and open source.</sub>

+[See what was tested on a real Frame, in a VM, or only in automated checks](docs/current-support-matrix.md).
+
 </div>

 ---
@@ -44,6 +46,9 @@ Live video of what the lenses show, or of the app panel in use, flat and still h
 **🔋 Battery and status**<br>
 Charge, charging watts and time left, storage, memory, temperature, Wi-Fi, and what's running.

+For PC-side USB, driver, radio and network manager evidence, use the
+[Linux Wireless Adapter doctor](docs/linux-wireless-adapter-doctor.md).
+
 For repeatable read-only battery, power-rail, temperature and fan measurements,
 use the [power and heat sampler](docs/power-and-heat.md).

@@ -73,10 +78,10 @@ Drag files onto the window to send them. Drop a game's .zip, folder or .exe to a
 <td valign="top">

 **📸 Screenshots and recordings**<br>
-Browse the shots you take in the headset and save them to your Pictures folder, or have new ones and your Steam clips copied over automatically. Record what the headset shows, with its sound, or export Steam's clips at any length, as .mp4 files in your Videos folder ([not tested on a headset yet](docs/recording.md)).
+Browse the shots you take in the headset and save them to your Pictures folder, or have new ones and your Steam clips copied over automatically. Record SteamVR's mirrored headset view, with its sound, or export Steam's clips at any length, as .mp4 files in your Videos folder. [Recording details and passthrough limits](docs/recording.md#does-record-include-passthrough).

-**⌨️ Type on the headset**<br>
-Type and point in the Frame's apps from your computer or phone, through KDE Connect, which Frame Control brings along and sets up on the Frame. Copy text to the headset's clipboard and back again. Nothing else to install, anywhere. Press T to open it.
+**⌨️ Keyboard and trackpad**<br>
+Type and point in the headset from your computer or phone, through Valve's own input path, with nothing to install. Accents and emoji use KDE Connect, which Frame Control brings along and sets up the first time you type one. Copy text to the headset's clipboard and back again. Press T to open it.

 </td>
 </tr>
@@ -127,6 +132,24 @@ Choose the operating system and processor of the computer you will use.
 | **Linux** (x64) | [AppImage](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-x86_64.AppImage) · [.deb](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-amd64.deb) | `ssh` (most desktops have it) |
 | **Linux** (arm64) | [AppImage](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.AppImage) · [.deb](https://github.com/saphid/frame-control/releases/latest/download/Frame-Control-linux-arm64.deb) | `ssh`, and `adb` for Android apps (`sudo apt install adb`) |

+### Is it safe? Check your download
+
+Starting with **v0.4.26**, get the installer and [SHA256SUMS](https://github.com/saphid/frame-control/releases/latest/download/SHA256SUMS) from the **same release**. Earlier releases do not have this file. A matching SHA-256 means your file matches that release asset. It does not prove the app is free of malware. Use the command for your downloaded file, then compare all 64 characters with its line in `SHA256SUMS`:
+
+```powershell
+# Windows PowerShell
+Get-FileHash .\Frame-Control-Setup-x64.exe -Algorithm SHA256
+```
+
+```sh
+# macOS: shasum -a 256 Frame-Control-mac-arm64.dmg
+# Linux: sha256sum Frame-Control-linux-x86_64.AppImage
+```
+
+The [source](https://github.com/saphid/frame-control) and [release build workflow](.github/workflows/release.yml) are public. The Windows installer is **not code-signed**, so SmartScreen may warn. The macOS app has only an **ad hoc signature**, not an Apple Developer ID signature; the DMG is **unsigned and not notarized**, so Gatekeeper may warn or block it. Only follow the opening steps below if you trust the download.
+
+日本語: v0.4.26 以降は公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。
+
 **Which build?** On a Mac, check Apple menu → About This Mac: the download is
 for Apple Silicon (M-series); no Intel Mac build is published. On Windows,
 check Settings → System → About → System type: the release is x64, not a native
@@ -183,8 +206,10 @@ or run it with `--appimage-extract-and-run`.

 ## Open the app

+**Optional: open at login.** In the installed desktop app, choose **Frame → Open at Login**. It is off by default. When on, a login launch starts in the tray or menu bar if that control is available; click its icon to open the window, or use its **Quit Frame Control** menu item. Closing the window keeps the app in the tray while this option is on. Turn the same menu option off to remove its OS login item. On Linux this creates or removes only Frame Control's own file in `~/.config/autostart/` (or `$XDG_CONFIG_HOME/autostart/`). If the desktop has no working tray, the window opens at login instead. A source checkout does not offer this setting.
+
 - **macOS:** open the `.dmg`, drag **Frame Control** to **Applications**, then
-  open it from Applications. For the unsigned-app warning, use the macOS steps
+  open it from Applications. For the Gatekeeper warning, use the macOS steps
  above. Allow local network access and control of Terminal when prompted.
 - **Windows:** run the installer, then open **Frame Control** from Start. For
  the portable download, extract the entire `.zip` first and run
@@ -254,15 +279,18 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Frame Control in detail](docs/frame-control.md) | Every feature, how it works, per-platform notes, building |
 | [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels |
 | [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging |
+| [SteamOS October 2026 compatibility](docs/steamos-2026-10-compat.md) | Frame OS 0.5.6 connection changes and SteamOS 3.9.5 PC host notes |
 | [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances |
 | [Import from my Quest](docs/quest-import.md) | Copy games you own off your Quest by USB; what runs, and why licence-checked games may not |
 | [My Meta library](docs/meta-library.md) | Experimental: install and test Quest games your Meta account owns, with your own token |
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
 | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
+| [Steam desktop sharing (Linux)](docs/steam-pipewire.md) | External Steam helper: launch with `-pipewire` after exiting Steam, or open KDE permissions to re-pick a screen manually; no automatic permission reset |
 | [PC in the headset](docs/pc-in-headset.md) | Experimental, Windows only, off until you turn it on: a whole PC screen as a panel in the Frame. Tested in a Windows VM; individual windows need a WGC-enabled build |
 | [Mac in the headset](docs/mac-in-headset.md) | Mac windows and screens as panels in the Frame, with laser and keyboard input |
 | [VR mods and custom songs](docs/mods.md) | UEVR for Unreal games from Frame Control (install, play in VR, remove), the per-game table, Beat Saber blockers |
+| [Decky Loader on Frame](docs/decky-frame.md) · [Frame Control in VR](docs/headset-app.md) · [Frame Control extensions](docs/extensions.md) | Experimental Decky support, a removable headset panel, and the local extension API |
 | [SSH](docs/ssh.md) · [Streaming](docs/streaming.md) · [Files](docs/file-transfer.md) · [Panels](docs/panels.md) · [Tailscale](docs/tailscale.md) | Topic notes |
 | [Frame Control for iPhone](docs/iphone.md) | The iPhone and iPad app, how it runs the server on the Frame, pairing |
 | [Recovery and OS images](docs/recovery-and-images.md) | Where to download the Frame's OS, what's inside, testing without the headset |
@@ -17,6 +17,7 @@ const REQUIRED = [
  "ui/frame_status.py",
  "scripts/frame_power_sample.py",
  "scripts/frame_power_report.py",
+  "scripts/obs-headset-source.py",
  "ui/frame_android.py",
  "frame/android/lepton-app.sh",
  "frame/openxr-compat/XrApiLayer_FRAME_compat.json",
@@ -0,0 +1,53 @@
+// Opt-in OS login item. Linux owns only its marked autostart file; an existing
+// custom entry is never overwritten or removed.
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const MARKER = "# Managed by Frame Control; use Frame > Open at Login to remove.\n";
+const FILE = "com.saphid.frame-control.desktop";
+
+function quoteExec(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, "\\$").replace(/`/g, "\\`").replace(/%/g, "%%")}"`;
+}
+
+function createLoginItem({ platform = process.platform, electronApp, env = process.env,
+                           executable = process.execPath, filesystem = fs,
+                           home = os.homedir() }) {
+  const config = env.XDG_CONFIG_HOME && path.isAbsolute(env.XDG_CONFIG_HOME)
+    ? env.XDG_CONFIG_HOME : path.join(home, ".config");
+  const file = path.join(config, "autostart", FILE);
+  const command = platform === "linux" && env.APPIMAGE && path.isAbsolute(env.APPIMAGE)
+    ? env.APPIMAGE : executable;
+  function owned() {
+    try { return filesystem.readFileSync(file, "utf8").startsWith(MARKER); }
+    catch (err) { if (err.code === "ENOENT") return false; throw err; }
+  }
+  function enabled() {
+    if (platform === "linux") return owned();
+    return !!electronApp.getLoginItemSettings().openAtLogin;
+  }
+  function set(enabledNow) {
+    if (platform !== "linux") {
+      electronApp.setLoginItemSettings({ openAtLogin: !!enabledNow, openAsHidden: !!enabledNow,
+                                        args: enabledNow ? ["--hidden"] : [] });
+      if (enabled() !== !!enabledNow) throw new Error("The operating system did not save the login item.");
+      return enabled();
+    }
+    if (enabledNow) {
+      if (filesystem.existsSync(file) && !owned()) throw new Error(`A different autostart entry already exists: ${file}`);
+      filesystem.mkdirSync(path.dirname(file), { recursive: true });
+      const body = MARKER + "[Desktop Entry]\nType=Application\nName=Frame Control\n" +
+        `Exec=${quoteExec(command)} --hidden\nTerminal=false\nX-GNOME-Autostart-enabled=true\n`;
+      const tmp = file + `.tmp-${process.pid}`;
+      try { filesystem.writeFileSync(tmp, body, { mode: 0o600 }); filesystem.renameSync(tmp, file); }
+      finally { try { filesystem.unlinkSync(tmp); } catch (err) { if (err.code !== "ENOENT") throw err; } }
+    } else if (owned()) {
+      filesystem.unlinkSync(file);
+    }
+    return enabled();
+  }
+  return { enabled, set, file };
+}
+
+module.exports = { createLoginItem, quoteExec };
@@ -1,7 +1,7 @@
 // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
 // a free loopback port and shows it in a native window. The server does all the
 // work over the `frame` SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, session, shell } = require("electron");
+const { app, BrowserWindow, Menu, Notification, Tray, clipboard, dialog, ipcMain, nativeImage, session, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -12,6 +12,7 @@ const path = require("path");
 const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link");
 const updater = require("./updater");
 const { preferenceStore } = require("./preferences");
+const { createLoginItem } = require("./login-item");
 const { createMetaSignIn } = require("./meta-signin");

 const run = promisify(execFile);
@@ -30,10 +31,12 @@ const LOG = path.join(LOG_DIR, "server.log");
 const BG = "#0d1117";
 const FRAME = process.env.FRAME_ALIAS || "frame";
 const preferences = preferenceStore(path.join(app.getPath("userData"), "client-preferences.json"));
+const loginItem = createLoginItem({ electronApp: app });

 let server = null;
 let url = null;
 let win = null;
+let tray = null;
 let quitting = false;
 let python = null;

@@ -304,6 +307,62 @@ ipcMain.handle("update:get", (e) => fromUi(e) ? publicUpdate() : null);
 ipcMain.handle("update:check", (e) => fromUi(e) ? checkForUpdate({ manual: true }).then(publicUpdate) : null);
 ipcMain.handle("update:install", (e) => { if (fromUi(e)) installUpdate(); });

+// The OBS source is local to this computer. Closing the Python relay's control
+// pipe lets it stop SSH on every platform, including Windows where SIGTERM
+// terminates Python without running its cleanup block.
+const OBS_SCRIPT = path.join(SCRIPTS, "obs-headset-source.py");
+let obsChild = null;
+let obsState = { state: "idle", alias: "", error: "" };
+function publicObs() { return { ...obsState, supported: true }; }
+function setObs(state, alias = "", error = "") {
+  obsState = { state, alias, error };
+  if (win && !win.isDestroyed()) win.webContents.send("obs:state", publicObs());
+  return publicObs();
+}
+function stopObs() {
+  if (!obsChild) return publicObs();
+  setObs("stopping", obsState.alias);
+  if (obsChild.stdin && !obsChild.stdin.writableEnded) obsChild.stdin.end();
+  return publicObs();
+}
+ipcMain.handle("obs:status", (e) => fromUi(e) ? publicObs() : null);
+ipcMain.handle("obs:start", async (e) => {
+  if (!fromUi(e)) return null;
+  if (obsChild) return publicObs();
+  const alias = activeAlias();
+  if (!ALIAS_RE.test(alias)) throw new Error("Select a valid headset first.");
+  if (!fs.existsSync(OBS_SCRIPT)) throw new Error("The OBS helper is missing; reinstall Frame Control.");
+  const env = { ...process.env, PATH: await loginPath() };
+  const executable = python || await findPython(env);
+  if (!executable) throw new Error(PYTHON_HELP);
+  // A concurrent click or a headset switch may have happened while finding Python.
+  if (obsChild) return publicObs();
+  if (alias !== activeAlias()) throw new Error("The selected headset changed; try again.");
+  const child = spawn(executable, [...PY_FLAGS, OBS_SCRIPT, "--frame", alias, "--control-stdin"],
+                      { env, stdio: ["pipe", "ignore", "pipe"], windowsHide: true });
+  obsChild = child;
+  setObs("starting", alias);
+  let output = "";
+  child.stderr.on("data", (chunk) => {
+    output = (output + chunk.toString("utf8")).slice(-2048);
+    if (obsChild === child && output.includes("Frame Control OBS stream is ready")) setObs("running", alias);
+  });
+  child.once("error", (err) => {
+    if (obsChild !== child) return;
+    obsChild = null;
+    setObs("failed", alias, `Could not start OBS source: ${err.message}`);
+  });
+  child.once("exit", (code, signal) => {
+    if (obsChild !== child) return;
+    const stopping = obsState.state === "stopping" || quitting;
+    obsChild = null;
+    setObs(stopping ? "idle" : "failed", alias,
+           stopping ? "" : `OBS source stopped (${signal || code}). ${output.trim().split("\n").pop() || "Check SteamVR and SSH."}`);
+  });
+  return publicObs();
+});
+ipcMain.handle("obs:stop", (e) => fromUi(e) ? stopObs() : null);
+
 // The page reports the headsets it knows (the server's Devices tab), so the Frame
 // menu can switch between them. Only plain names and ids go into the menu.
 const ALIAS_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
@@ -314,6 +373,7 @@ ipcMain.on("devices:changed", (e, list) => {
    .map(d => ({ id: d.id.slice(0, 80), name: String(d.name || d.alias).slice(0, 60), alias: d.alias, active: !!d.active }));
  if (JSON.stringify(next) === JSON.stringify(devices)) return;
  devices = next;
+  if (obsChild && obsState.alias !== activeAlias()) stopObs();
  buildMenu();
 });
 const activeAlias = () => (devices.find(d => d.active) || {}).alias || FRAME;
@@ -516,7 +576,60 @@ function registerScheme() {
  }
 }

-function createWindow() {
+function showWindow() {
+  if (!win) return createWindow(true);
+  if (win.isMinimized()) win.restore();
+  win.show();
+  win.focus();
+}
+
+function ensureTray() {
+  if (tray) return true;
+  try {
+    const icon = nativeImage.createFromPath(path.join(__dirname, "build", "icon.png"));
+    if (icon.isEmpty()) return false;
+    tray = new Tray(icon);
+    // Some Linux desktops accept the Tray object but expose no status icon.
+    // Keep a visible login window rather than hiding the only way back in.
+    if (process.platform === "linux") {
+      const bounds = tray.getBounds();
+      if (!bounds.width || !bounds.height) { tray.destroy(); tray = null; return false; }
+    }
+    tray.setToolTip("Frame Control");
+    tray.on("click", showWindow);
+    updateTrayMenu();
+    return true;
+  } catch {
+    if (tray) { try { tray.destroy(); } catch {} tray = null; }
+    return false;
+  }
+}
+
+function updateTrayMenu() {
+  if (!tray) return;
+  tray.setContextMenu(Menu.buildFromTemplate([
+    { label: "Open Frame Control", click: showWindow },
+    { label: "Open at Login", type: "checkbox", checked: loginItem.enabled(), click: toggleLoginItem },
+    { type: "separator" },
+    { label: "Quit Frame Control", click: () => app.quit() },
+  ]));
+}
+
+function toggleLoginItem() {
+  try {
+    const on = loginItem.set(!loginItem.enabled());
+    if (on) ensureTray();
+    else if (tray) { tray.destroy(); tray = null; }
+    buildMenu();
+    updateTrayMenu();
+  } catch (err) {
+    dialog.showErrorBox("Open at Login", String(err.message || err));
+    buildMenu();
+    updateTrayMenu();
+  }
+}
+
+function createWindow(showOnReady = !process.argv.includes("--hidden") || !tray) {
  win = new BrowserWindow({
    width: 1400, height: 950, minWidth: 760, minHeight: 560,
    title: "Frame Control", backgroundColor: BG, show: false,
@@ -525,7 +638,10 @@ function createWindow() {
    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true, backgroundThrottling: false,
                      preload: path.join(__dirname, "preload.js") },
  });
-  win.once("ready-to-show", () => win.show());
+  win.once("ready-to-show", () => { if (showOnReady) win.show(); });
+  win.on("close", (event) => {
+    if (!quitting && tray && loginItem.enabled()) { event.preventDefault(); win.hide(); }
+  });
  if (CHROME_CSS) win.webContents.on("did-finish-load", () => win.webContents.insertCSS(CHROME_CSS));
  // External links open in the default browser; the app never navigates away.
  win.webContents.setWindowOpenHandler(({ url: target }) => {
@@ -579,6 +695,8 @@ function buildMenu() {
      label: "Frame",
      submenu: [
        { label: "Set Up Connection…", click: () => setUpConnection() },
+        { label: "Open at Login", type: "checkbox", checked: loginItem.enabled(),
+          enabled: app.isPackaged, click: toggleLoginItem },
        { label: IS_MAC ? "Open SSH in Terminal" : "Open SSH in a Terminal", click: openSsh },
        { type: "separator" },
        ...(devices.length > 1 ? [{
@@ -627,7 +745,7 @@ if (!app.requestSingleInstanceLock()) {
  app.on("open-url", (e, link) => { e.preventDefault(); openInstallLink(link); });
  // Windows and Linux start a second instance with the link as an argument.
  app.on("second-instance", (_e, argv) => {
-    if (win) { if (win.isMinimized()) win.restore(); win.focus(); }
+    if (!argv.includes("--hidden")) showWindow();
    const link = linkFromArgv(argv);
    if (link) openInstallLink(link);
  });
@@ -635,12 +753,41 @@ if (!app.requestSingleInstanceLock()) {
  if (firstLink) openInstallLink(firstLink);
  app.whenReady().then(() => {
    registerScheme();
+    if (loginItem.enabled()) ensureTray();
    buildMenu();
    createWindow();
    scheduleUpdateChecks();
  });
-  app.on("activate", () => { if (!win) createWindow(); });
+  app.on("activate", showWindow);
  app.on("window-all-closed", () => app.quit());
-  app.on("before-quit", () => { quitting = true; stopServer(); });
-  process.on("exit", stopServer);
+  let obsQuitWaiting = false;
+  let obsQuitReady = false;
+  app.on("before-quit", (event) => {
+    quitting = true;
+    stopServer();
+    if (!obsChild || obsQuitReady) return;
+    event.preventDefault();
+    if (obsQuitWaiting) return;
+    obsQuitWaiting = true;
+    const child = obsChild;
+    let timer;
+    child.once("close", () => {
+      clearTimeout(timer);
+      obsQuitReady = true;
+      app.quit();
+    });
+    stopObs();
+    timer = setTimeout(() => {
+      if (child.exitCode === null) {
+        if (IS_WIN) {
+          // Only the helper and its SSH child: never enumerate unrelated SSH jobs.
+          spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"],
+                { stdio: "ignore", windowsHide: true, detached: true }).unref();
+        } else child.kill("SIGKILL");
+      }
+      obsQuitReady = true;
+      app.quit();
+    }, 8000);
+  });
+  process.on("exit", () => { stopObs(); stopServer(); });
 }
@@ -1,12 +1,12 @@
 {
  "name": "frame-control",
-  "version": "0.4.17",
+  "version": "0.4.26",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "frame-control",
-      "version": "0.4.17",
+      "version": "0.4.26",
      "license": "MIT",
      "devDependencies": {
        "electron": "^44.4.5",
@@ -1,7 +1,7 @@
 {
  "name": "frame-control",
  "productName": "Frame Control",
-  "version": "0.4.17",
+  "version": "0.4.26",
  "description": "Desktop app for managing a Valve Steam Frame over SSH",
  "private": true,
  "main": "main.js",
@@ -40,6 +40,7 @@
      "install-link.js",
      "updater.js",
      "preferences.js",
+      "login-item.js",
      "meta-signin.js",
      "package.json",
      "build/icon.png"
@@ -69,6 +70,7 @@
        "to": "scripts",
        "filter": [
          "*.sh",
+          "obs-headset-source.py",
          "frame_power_sample.py",
          "frame_power_report.py"
        ]
@@ -21,6 +21,15 @@ contextBridge.exposeInMainWorld("frameApp", {
  writeImage: (bytes) => ipcRenderer.invoke("clipboard:writeImage", bytes),
  setUpConnection: () => ipcRenderer.invoke("connection:setup"),
  restartServer: () => ipcRenderer.invoke("server:restart"),  // the "couldn't start" page's Try Again
+  obs: {
+    status: () => ipcRenderer.invoke("obs:status"),
+    start: () => ipcRenderer.invoke("obs:start"),
+    stop: () => ipcRenderer.invoke("obs:stop"),
+    onState: (cb) => {
+      ipcRenderer.removeAllListeners("obs:state");
+      ipcRenderer.on("obs:state", (_e, state) => cb(state));
+    },
+  },
  // The Frame menu's headset switcher: the page tells it the headsets, and hears picks.
  devicesChanged: (list) => ipcRenderer.send("devices:changed", list),
  onUseDevice: (cb) => {
@@ -0,0 +1,57 @@
+const { test } = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { createLoginItem } = require("../login-item");
+
+test("Linux login toggle creates and removes only its own desktop entry", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "frame-login-test-"));
+  try {
+    const login = createLoginItem({ platform: "linux", env: { XDG_CONFIG_HOME: root },
+                                    executable: "/opt/Frame Control/frame-control" });
+    assert.equal(login.enabled(), false);
+    assert.equal(login.set(true), true);
+    const body = fs.readFileSync(login.file, "utf8");
+    assert.match(body, /^# Managed by Frame Control;/);
+    assert.match(body, /Exec="\/opt\/Frame Control\/frame-control" --hidden/);
+    assert.equal(fs.statSync(login.file).mode & 0o777, 0o600);
+    assert.equal(login.set(false), false);
+    assert.equal(fs.existsSync(login.file), false);
+    fs.mkdirSync(path.dirname(login.file), { recursive: true });
+    fs.writeFileSync(login.file, "[Desktop Entry]\nName=My custom launcher\n");
+    assert.throws(() => login.set(true), /different autostart entry/);
+    assert.equal(login.set(false), false);
+    assert.match(fs.readFileSync(login.file, "utf8"), /My custom launcher/);
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+test("AppImage autostart launches the AppImage, with safe desktop escaping", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "frame-appimage-test-"));
+  try {
+    const login = createLoginItem({ platform: "linux", env: { XDG_CONFIG_HOME: root,
+                                    APPIMAGE: '/home/user/Frame Control 100%.AppImage' },
+                                    executable: "/tmp/.mount_extracted/AppRun" });
+    login.set(true);
+    assert.match(fs.readFileSync(login.file, "utf8"), /Exec="\/home\/user\/Frame Control 100%%\.AppImage" --hidden/);
+    login.set(false);
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+});
+
+for (const platform of ["win32", "darwin"]) {
+  test(`${platform} login toggle uses the OS API and starts hidden`, () => {
+    let openAtLogin = false;
+    const calls = [];
+    const electronApp = {
+      getLoginItemSettings: () => ({ openAtLogin }),
+      setLoginItemSettings: opts => { calls.push(opts); openAtLogin = opts.openAtLogin; },
+    };
+    const login = createLoginItem({ platform, electronApp });
+    assert.equal(login.enabled(), false);
+    assert.equal(login.set(true), true);
+    assert.deepEqual(calls.at(-1).args, ["--hidden"]);
+    assert.equal(calls.at(-1).openAsHidden, true);
+    assert.equal(login.set(false), false);
+    assert.deepEqual(calls.at(-1).args, []);
+  });
+}
@@ -25,8 +25,28 @@ tested in another full Plasma session under a three-minute rollback timer.
 `ui/frame_backup.py session` reported Desktop Mode despite gamescope, and
 `ui/frame_backup.py game-mode` invoked the same guarded Return function used by
 the button. Game Mode became active and a second call made no switch. Battery
-remained at 99%; the timer and lock were removed. The literal desktop button
-was not clicked in this test, and older SteamOS builds remain fixture-tested.
+remained at 99%; the timer and lock were removed. That test used the production
+CLI rather than clicking the desktop button.
+
+Later on 2026-10-24, the published **v0.4.17 Linux x86_64 AppImage** passed the
+literal packaged-button check on the same Frame/build. With the shared lock and
+a verified three-minute rollback timer, the headset entered full Plasma Desktop
+Mode. In the packaged Electron window, **Tools → Backup & recovery → Check**
+reported Desktop Mode despite gamescope. A trusted automated pointer click on
+the visible **Return to Game Mode** button, accepting its confirmation, returned
+`switched: true` and `steamosctl switch-to-game-mode`. The systemd targets then
+confirmed Game Mode. A second confirmed button click returned `switched: false`;
+the Game Mode service invocation and SteamVR PID stayed unchanged. **Check**
+then reported Game Mode and disabled Return. The test app/server and virtual
+display were stopped; the timer and shared lock were removed. Steam and SteamVR remained running
+at 99% battery. [Commands, responses, cleanup and limits](evidence/return-game-mode-packaged-2026-10-24.json),
+[before](evidence/return-game-mode-packaged-2026-10-24-before.png) and
+[after](evidence/return-game-mode-packaged-2026-10-24-after.png).
+
+This used the unchanged extracted AppImage payload with its bundled Python on
+Xvfb (`--no-sandbox --disable-gpu`), following the packaged Export test in #156.
+FUSE mounting, desktop integration, hardware rendering and the view inside a
+worn headset were not checked. Older SteamOS builds remain fixture-tested.

 ## Back up

@@ -9,6 +9,11 @@ only control the Frame has is a vendor charger attribute that Valve's own
 charging daemon also manages. Research as of 2026-10-23, confirmed with the
 read-only checks below on a Frame running SteamOS 0.5.6 (build 20261015.6141207):

+Rechecked read-only on build `20261022.6153909` on 2026-10-25: the
+`BatteryChargeLimit1` interface still returned `UnknownInterface`, no
+`charge_control_*` sysfs attribute existed, and the vendor charging switches
+were root-owned mode `644`. See [Round 3 headset evidence](evidence/round3-headset-2026-10-25.md).
+
 - `steamosctl get-max-charge-level` fails with `UnknownInterface: ...BatteryChargeLimit1`.
 - `/usr/share/steamos-manager/devices/` has `[battery_charge_limit]` only for
  the Steam Deck, ROG Ally, ROG Xbox Ally and MSI Claw, not the Frame.
@@ -0,0 +1,22 @@
+# What we have tested
+
+Current for Frame Control **v0.4.26**, 25 October 2026. “Real Frame + physical PC” means an actual headset and a non-virtual computer. “VM only” means a Windows virtual machine, sometimes connected to the real Frame. A CI test or a simulated device is **not** a physical hardware test. The date/version column is the last relevant check, not a promise that every new release was retested on that platform. See each link for the exact procedure and limits.
+
+| Feature | Real Frame + physical PC tested | VM only | Untested or limited | Last check and proof |
+|---|---|---|---|---|
+| Windows desktop in the headset | No physical Windows PC test | Windows 11 VM sent a whole desktop to a real Frame; this used an intermediate fix, not the final native DLL | Physical GPU, capture and controller input; individual windows unavailable in bundled DXGI build | 24 Oct, v0.4.10 installer + candidate fix: [VM log](evidence/windows-vm-2026-10-24.md), [PC guide](pc-in-headset.md) |
+| Linux desktop in the headset | No | No | Native Linux PC capture is disabled; lxso2 lacked a desktop portal and PipeWire session. The separate Steam `-pipewire` helper is not Frame Control's PC capture | 24 Oct, v0.4.17: [host audit](evidence/linux-pc-host-lxso2-2026-10-24.md), [Steam helper PR #163](https://github.com/saphid/frame-control/pull/163) |
+| Mac desktop in the headset | A physical Mac sent its screen/window to a real Frame | No | Current v0.4.26 Mac installer and worn-headset controller input have not been repeated | 28 Sep, pre-v0.4 / Frame OS 0.4.1: [Mac guide and measurement](streaming.md#b-show-the-macs-desktop-inside-the-frame) |
+| OBS headset source on Linux | Real Frame to OBS 30 on a Linux host; H.264 video and a synthetic 440 Hz output tone reached a saved recording | No | Real game audio, audible monitoring, perceptual A/V sync and awake headset view | 25 Oct, PR #174 head, shipped in v0.4.22: [OBS log](evidence/obs-media-source-real-2026-10-25.md) |
+| OBS headset source on Windows | No physical Windows PC test | No OBS/Frame VM end-to-end test | App Start/Stop path has automated Windows checks only | 25 Oct, v0.4.23: [Windows PR #179](https://github.com/saphid/frame-control/pull/179), [OBS guide](obs-headset-source.md) |
+| OBS headset source on macOS | No | No | Helper and OBS Media Source not tested on a Mac with a Frame | 25 Oct, v0.4.22: [OBS PR #174](https://github.com/saphid/frame-control/pull/174), [OBS guide](obs-headset-source.md) |
+| Wired connection doctor | No physical PC/Frame cable test of the doctor | No | Synthetic route/SSH tests; a separate Mac USB-C address observation does not test the doctor or game stream | 25 Oct, v0.4.23: [PR #178](https://github.com/saphid/frame-control/pull/178), [wired guide](wired-connection.md) |
+| Windows Wireless Adapter doctor | No physical Steam Wireless Adapter/dropout test | Windows 11 VM ran read-only checks without the adapter or WLAN | Adapter identification, dropouts and recovery on hardware | 24–25 Oct, v0.4.20–0.4.25: [VM log](evidence/windows-wireless-2026-10-24.md), [doctor guide](windows-wireless-doctor.md), [comparison PR #184](https://github.com/saphid/frame-control/pull/184) |
+| Linux Wireless Adapter doctor | No Steam Wireless Adapter hardware test | No | Read-only Linux host checks and mocked adapter states; no adapter-specific hardware observation | 24 Oct, v0.4.20: [PR #165](https://github.com/saphid/frame-control/pull/165), [doctor guide](linux-wireless-adapter-doctor.md) |
+| Switch PC windows | No physical Windows PC test | No real VM-to-Frame Alt+Tab check recorded | Explicit chord is covered by tests; actual window focus, keyboard layouts and controller interaction are unverified | 25 Oct, v0.4.24: [PR #181](https://github.com/saphid/frame-control/pull/181), [PC guide](pc-in-headset.md) |
+| Keyboard and trackpad from Frame Control | A Linux PC sent a click and ASCII keys to a temporary focused window on the real Frame | No | Worn-headset interaction, Unicode delivery and pixel-accurate pointing | 24 Oct, v0.4.19: [received-event log](evidence/pad-gamescope-2026-10-24.md), [PR #66](https://github.com/saphid/frame-control/pull/66) |
+| Backup and restore after reset | Same-headset backup, no-op save restore and Return to Game Mode checks | No | Restore **after a factory reset**, replacement restore and Android data restore have not been tested on a headset. No headset reset was done | 24 Oct, v0.4.17: [backup guide](backup-and-recovery.md), [Return to Game Mode log](evidence/return-game-mode-packaged-2026-10-24.json) |
+| Passthrough in recordings | No active-passthrough mirror check | No | Standby frame was uniform; whether visible room pixels enter `/dev/video99` is **unknown**. Raw cameras are never captured by Frame Control | 25 Oct, v0.4.21: [headset log](evidence/round3-headset-2026-10-25.md), [recording guide](recording.md#does-record-include-passthrough) |
+| Open at login | No Frame needed; Linux autostart file toggled on a physical Linux host with an isolated config directory | No | A full login session and physical Windows/macOS host login have not been checked; OS API calls were unit tested | 25 Oct, v0.4.26: [PR #189](https://github.com/saphid/frame-control/pull/189) |
+
+Release notes must preserve these limits until a newer recorded check changes them. When a feature is retested, add its date, exact app/Frame version, host type and proof here. The older [v0.3.1 matrix](support-matrix.html) is a historical snapshot and does not describe current coverage.
@@ -0,0 +1,99 @@
+# Decky Loader on Steam Frame
+
+**Status, 2026-10-25:** Decky Loader 3.3.0's ARM64 backend starts on Frame OS
+0.5.6 and injects into Steam's shared CEF context. Its Decky tab registers in
+JavaScript. A usable plugin menu in the Frame's VR shell has **not** been
+verified. Frame Control therefore labels its user-service manager experimental.
+No individual Decky plugin has been tested on the headset.
+
+## What was checked on the real headset
+
+The headset was SteamOS `0.5.6`, `VARIANT_ID=vr`, build `20261022.6153909`,
+`aarch64` (SteamOS 3.9.x family). SSH reached it through the existing `frame`
+alias. `/` was mounted read-write as Btrfs; no root filesystem change was
+needed. `systemctl --user` was running. The Steam client launched with
+`-cef-enable-debugging`, `-vrgamepadui`, and `-steamdeck`; its web helper served
+CEF remote debugging on `127.0.0.1:8080`. The usual
+`.cef-enable-remote-debugging` marker was absent, yet debugging was active.
+
+CEF listed a `SharedJSContext` target at `steamloopback.host/routes/library/home`
+and a separate `SteamVR` target for the VR overlay. The Decky 3.3.0 ARM64
+binary started from `/tmp` as the normal user: port `127.0.0.1:1337` answered
+HTTP 200, the log reported `Loading Decky frontend!`, and CEF showed
+`window.deckyHasLoaded === true` and one registered Decky tab in
+`SharedJSContext`. The `SteamVR` target had neither that global nor a Decky tab;
+its current body text did not contain Decky. The Steam web helper had
+`--disable-quick-menu`. This is evidence of backend and shared-context
+injection, not proof of an accessible Decky plugin menu inside VR. A QAM
+interaction in the headset and a plugin UI test remain necessary.
+
+Frame Control's per-user manager was then exercised on the real Frame:
+**install → status → update → status → remove → status**. The service became
+active, the binary matched Decky's published SHA-256, and removal left no
+service, binary or listening port 1337. Decky's already injected JavaScript
+remained in Steam's running web helper until that helper was restarted. After a
+web helper restart, both `deckyHasLoaded` and the tab hook were absent. All
+temporary trial files and the test's empty managed data folder were removed.
+
+## Why the official Decky installer is not used
+
+The current [Decky installer](https://github.com/SteamDeckHomebrew/decky-installer/blob/e42a3c828de90673959b4de26cf5c5d2c7830554/cli/install_release.sh)
+selects `PluginLoader-arm64` on `aarch64`, creates `~/homebrew/plugins`, writes
+the CEF marker, installs `/etc/systemd/system/plugin_loader.service`, and uses
+`sudo systemctl` to enable a **root** service. Its
+[uninstaller](https://github.com/SteamDeckHomebrew/decky-installer/blob/e42a3c828de90673959b4de26cf5c5d2c7830554/cli/uninstall.sh)
+also uses sudo. These scripts do not call `steamos-readonly`, but they do write
+under `/etc`; their root service has broad control over the headset. The
+current [Decky loader](https://github.com/SteamDeckHomebrew/decky-loader/blob/00cd202872b85868071b041c8f1b34e734147195/backend/decky_loader/injector.py)
+targets Steam's shared Gamepad UI CEF page, injects a frontend served on port
+1337, and patches the standard Quick Access Menu. On Frame, Steam supplies
+the CEF target, while visible VR shell integration is unresolved.
+
+Frame Control downloads only Decky's official latest ARM64 release, requires
+its published SHA-256 digest, and checks the ELF architecture. It installs a
+**user** service named `frame-control-decky.service` in
+`~/.config/systemd/user`, with the binary and plugin folder under
+`~/.local/share/frame-control/decky`. It never asks for a sudo password, edits
+`/etc`, or changes CEF flags. Decky warns that running without root is not
+officially supported. Plugins that require root, assume `~/homebrew`, or rely
+on Steam Deck hardware may fail even if the loader runs. Frame Control lists
+plugins already present in its managed folder and the upstream `~/homebrew`
+folder; it does not install plugins while their Frame UI and compatibility
+are unverified.
+
+The latest tested release was
+[Decky 3.3.0](https://github.com/SteamDeckHomebrew/decky-loader/releases/tag/v3.3.0),
+`PluginLoader-arm64` SHA-256
+`8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6`.
+This digest comes from that release's GitHub API asset metadata; it detects a
+download mismatch, but is not an independent signature.
+
+## Opt in and remove
+
+In Frame Control, open **Tools → Decky Loader on Frame**, read the experimental
+notice, check the acknowledgement box, and choose **Install**. **Update**
+downloads and verifies the latest ARM64 release again. **Remove managed
+Decky** disables and removes only Frame Control's user service and binary.
+It preserves plugin files and settings so unrelated user data is not deleted.
+Restart Steam or the headset to clear the frontend already injected into its
+current web helper process. No action wipes the headset.
+
+Manual removal if Frame Control is unavailable:
+
+```sh
+ssh frame 'systemctl --user disable --now frame-control-decky.service; rm -f ~/.config/systemd/user/frame-control-decky.service ~/.local/share/frame-control/decky/PluginLoader ~/.local/share/frame-control/decky/.frame-control/receipt.json; systemctl --user daemon-reload; systemctl --user reset-failed frame-control-decky.service'
+```
+
+That command intentionally keeps `~/.local/share/frame-control/decky/plugins`
+and `settings`. Check those folders before deleting them yourself. An upstream
+Decky installation is separate; use its own installer to remove it. Frame
+Control refuses to install alongside an upstream system service.
+
+## Next compatibility test
+
+In the headset, open Steam's VR dashboard and look for Decky's plugin tab or
+Quick Access Menu after an opt-in install. If none appears, inspect whether
+the VR shell exposes a different menu component and whether Decky's frontend
+can target it without patching Steam globally. Then test one harmless plugin's
+install, visible UI, restart persistence and removal. Until those checks pass,
+Frame Control should not describe Decky plugins as supported on the Frame.
@@ -0,0 +1,54 @@
+# Emulators and your own games
+
+Frame Control's **Store → Emulators** lists Android emulators from its open
+app sources. Pick an app, read its compatibility result, and install it. An
+installed Android app gets its own Steam library shortcut and artwork; **Add
+artwork** in its library menu can fill missing images later. The artwork
+workflow also covers native Linux and Windows titles added through **Send to
+Frame**. An optional SteamGridDB key under **Settings → Library artwork**
+can supply exact-title community images; source images and generated art are
+fallbacks. See [VR APKs → In the Steam library](vr-apks.md#in-the-steam-library)
+for the limits and tested behavior.
+
+## Set up an emulator
+
+1. In **Store → Emulators**, choose an emulator that supports the console and
+   file format you want. Check its compatibility result before installing;
+   an app listed in the store is not automatically verified on the Frame.
+2. Launch the new shortcut from Steam. Open the emulator's own settings to
+   choose a gamepad layout, core or system, and game folder. These controls
+   differ by emulator; Frame Control does not change them.
+3. Use game files you own and any firmware that emulator's instructions
+   require. Frame Control does not provide ROMs or firmware.
+
+**Android apps run in separate Lepton instances.** Copying a ROM to the
+Frame's Linux `~/Downloads` through **Send to Frame** does not automatically
+put it in an Android app's `/sdcard/Download`. A one-click ROM transfer is
+deferred until an emulator and its file picker can be tested end to end on a
+real Frame. An app's own import or sync feature may be enough. Advanced users
+can use [Lepton's per-instance ADB port](apks.md)
+to copy into that instance, after confirming the correct container and port.
+Do not assume that port 5555 is the emulator: it is Lepton Development, while
+installed apps receive their own ports.
+
+For a native Linux emulator that can read the Frame's home directory, use
+**Send to Frame → Copy to ~/Downloads instead** for your files, then open them
+from the emulator. Whether a particular emulator has a Frame-compatible ARM64
+build, correct controller mapping and readable storage must be checked for
+that app. **Linux apps** in Frame Control lists Flatpak options; a Windows or
+native game archive can instead be added through
+[Send to Frame](sideloading.md#using-it), which registers a Steam title and
+artwork. Each ROM is usually opened *inside* its emulator; Frame Control does
+not create one Steam shortcut per ROM.
+
+## If something does not appear
+
+- Check that the emulator is running and is the same app instance to which
+  you sent the file. Android instances do not share `/sdcard` storage.
+- Check the emulator's supported extension and whether it expects an archive
+  or an extracted file. Some systems need firmware before games appear.
+- For an empty Steam tile, use **Add artwork** in the installed app or
+  sideloaded title menu. This changes artwork, not emulator data or ROMs.
+
+The Frame's microSD/USB path into Android apps remains unverified without an
+inserted medium and an app readback test; see [issue #169](https://github.com/saphid/frame-control/issues/169).
@@ -0,0 +1,206 @@
+{
+  "date_utc": "2026-10-24",
+  "base_commit": "de931bc",
+  "issue": 73,
+  "result": "Packaged Desktop Capture passed for a mapped nested KDE compositor on the real Frame; wearer-visible overlay condition was not established. Do not close #73 from this test.",
+  "package": {
+    "tag": "v0.4.17",
+    "asset": "Frame-Control-linux-x86_64.AppImage",
+    "sha256": "b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d",
+    "release_digest_matched": true,
+    "panel_helper_matches_base": true,
+    "unmodified_payload": true,
+    "host": "lxso2",
+    "display": "Xvfb :139",
+    "flags": [
+      "--no-sandbox",
+      "--disable-gpu"
+    ],
+    "private_profile_and_data": true,
+    "telemetry_and_update_checks_disabled": true
+  },
+  "preflight": {
+    "steamos_version": "0.5.6",
+    "build_id": "20261015.6141207",
+    "battery_percent": 99,
+    "battery_status": "Not charging",
+    "game_mode": true,
+    "full_plasma_session": false,
+    "nested_desktop_running": false,
+    "nested_runtime_present": false,
+    "lock_present": false,
+    "steam_pid": 297826,
+    "vrserver_pid": 297506,
+    "vrcompositor_pid": 297620,
+    "gamescope_service_invocation": "e8c1085b3bbd4e79a323b3e4a9bc6355",
+    "focusable_windows": [],
+    "focused_windows": []
+  },
+  "session": {
+    "started_utc": "2026-10-24T09:43:48Z",
+    "lock_acquired": true,
+    "launch": [
+      "systemd-run",
+      "--user",
+      "--unit=fc-issue73-desktop-20261024",
+      "--collect",
+      "--property=RuntimeMaxSec=180s",
+      "--property=TimeoutStopSec=15s",
+      "--property=KillMode=control-group",
+      "--setenv=DISPLAY=:0",
+      "--setenv=XDG_RUNTIME_DIR=/run/user/1000",
+      "--setenv=DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus",
+      "--setenv=XDG_SESSION_TYPE=x11",
+      "--setenv=XDG_CURRENT_DESKTOP=gamescope",
+      "/usr/bin/steamos-nested-desktop"
+    ],
+    "response": "Running as unit: fc-issue73-desktop-20261024.service; invocation ID: 92cff1e57c794212997d46c0a68877ec\n"
+  },
+  "discovery": {
+    "focus": 62914560,
+    "focus_display": ":0",
+    "panels": [
+      {
+        "window": 62914560,
+        "display": ":0",
+        "name": "KDE Wayland Compositor - Press right control key to grab input",
+        "x": 0,
+        "y": 0,
+        "width": 1920,
+        "height": 1080,
+        "app": 0,
+        "focused": true
+      }
+    ]
+  },
+  "window_evidence": {
+    "xwininfo_map_state": "IsViewable",
+    "width": 1920,
+    "height": 1080,
+    "focused_after_show_request": true,
+    "steamvr_overlay_key": "valve.steam.desktopgame.0",
+    "steamvr_overlay_visibility_after_show_request": "not_visible"
+  },
+  "capture": {
+    "repeat_utc": "2026-10-24T09:44:47.323Z",
+    "route": "/api/screenshot?view=panel&window=62914560&display=%3A0",
+    "http": 200,
+    "content_type": "image/png",
+    "content_length": 1209980,
+    "source_header": "panel",
+    "decoded": {
+      "width": 1920,
+      "height": 1080,
+      "source": "panel",
+      "selected": {
+        "window": 62914560,
+        "display": ":0",
+        "name": "KDE Wayland Compositor - Press right control key to grab input",
+        "x": 0,
+        "y": 0,
+        "width": 1920,
+        "height": 1080,
+        "app": 0,
+        "focused": true
+      },
+      "stamp": "9:44:48 AM",
+      "badge": "Desktop \u00b7 KDE Wayland Compositor - Press right control key to grab input"
+    },
+    "canvas_png_bytes": 2011278,
+    "first_capture_pixel_statistics": {
+      "width": 1920,
+      "height": 1080,
+      "min": 2.3333333333333335,
+      "max": 255,
+      "hidden": false
+    },
+    "first_capture_click_event": {
+      "isTrusted": true,
+      "utc": "2026-10-24T09:44:12.738Z"
+    },
+    "actions": "Two Playwright locator.click() actions on the visible #shotBtn in the actual packaged Electron window; first click recorded isTrusted=true. No direct screenshot API invocation by harness."
+  },
+  "device_cleanup": {
+    "utc": "2026-10-24T09:45:33Z",
+    "before_stop": {
+      "exit": 0,
+      "out": "MainPID=300739\nControlGroup=/user.slice/user-1000.slice/user@1000.service/app.slice/fc-issue73-desktop-20261024.service\nActiveState=active\n",
+      "err": ""
+    },
+    "hide_dashboard": {
+      "exit": 0,
+      "out": "HideDashboard",
+      "err": ""
+    },
+    "stop_owned_unit": {
+      "exit": 0,
+      "out": "",
+      "err": ""
+    },
+    "after_stop": {
+      "exit": 0,
+      "out": "MainPID=0\nLoadState=not-found\nActiveState=inactive\n",
+      "err": ""
+    },
+    "desktop_processes": {
+      "exit": 1,
+      "out": "",
+      "err": ""
+    },
+    "nested_runtime_exists": false,
+    "session": {
+      "exit": 0,
+      "out": "Id=gamescope-session.target\nActiveState=active\nInvocationID=a2fee8ebf55c42c7b546390d14cd985c\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nInvocationID=\n\nId=gamescope-session.service\nActiveState=active\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n",
+      "err": ""
+    },
+    "steam": {
+      "exit": 0,
+      "out": "297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n",
+      "err": ""
+    },
+    "steamvr": {
+      "exit": 0,
+      "out": "297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n297620 /opt/steamvr/bin/linuxarm64/vrcompositor\n",
+      "err": ""
+    },
+    "xprops": {
+      "exit": 0,
+      "out": "GAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = \nGAMESCOPE_FOCUSED_WINDOW(CARDINAL) = \n",
+      "err": ""
+    },
+    "battery": {
+      "capacity": "99",
+      "status": "Not charging"
+    },
+    "owned_lock_released": true
+  },
+  "host_cleanup": {
+    "electron": {
+      "pid": 1578431,
+      "exists_after": false
+    },
+    "xvfb": {
+      "pid": 1578428,
+      "exists_after": false
+    },
+    "x_socket_absent": true
+  },
+  "delayed_final_readback": "2026-10-24T09:46:39Z\nshared-lock-absent\nLoadState=not-found\nActiveState=inactive\nId=gamescope-session.target\nActiveState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n297620 /opt/steamvr/bin/linuxarm64/vrcompositor\nnested-runtime-absent\n100\nFull\nGAMESCOPE_FOCUSABLE_WINDOWS(CARDINAL) = \nGAMESCOPE_FOCUSED_WINDOW(CARDINAL) = \n",
+  "validation": {
+    "focused_panel_suite": "42 tests passed in 14.805s (test_touch.py), including production-page Node behavior tests",
+    "website": "2 tests passed (node --test site/test/*.test.mjs)",
+    "node_panels": "Passed independently (node tests/page/desk_panels.mjs)",
+    "metadata_and_links": "JSON parsed; result/cleanup assertions and relative evidence/streaming/testing links passed",
+    "diff": "git diff --check passed"
+  },
+  "limits": [
+    "SteamVR continued reporting not_visible after ShowDashboard, despite mapped X window and confirmed focus. No worn-headset visual assessment; does not establish the reporter's visible-overlay condition.",
+    "SteamOS 0.5.6 only; reporter used 0.4.5 with unknown Frame Control version and no reproduction steps.",
+    "Nested desktop launched with SteamOS steamos-nested-desktop from a bounded transient user unit using Steam display/session variables; not launched through a wearer's Steam UI.",
+    "Extracted unchanged AppImage on a virtual X display with Chromium sandbox and GPU disabled; no FUSE, physical monitor or hardware-rendering test.",
+    "No Live video, Control input or full Desktop Mode test.",
+    "Nested-desktop journal included gamescope WSI/Vulkan-hook warnings. No warning was dismissed; captured compositor pixels were nonblank.",
+    "Initial CDP response.body() yielded zero bytes despite successful image decode. Repeat verified Content-Length, fresh decoded image, panel selection and PNG export from canvas; the initial raw-body size is not treated as capture failure or proof.",
+    "No private desktop pixels, issue screenshot or raw desktop journal committed."
+  ]
+}
@@ -0,0 +1,100 @@
+# Packaged Desktop Capture, 2026-10-24
+
+Base: `de931bc`. Package: Linux x86_64 **v0.4.17**. Device: real Frame,
+SteamOS **0.5.6**, BUILD_ID **20261015.6141207**. Host: lxso2.
+[Sanitized state and response evidence](desktop-capture-packaged-2026-10-24.json).
+
+## Result and issue boundary
+
+The packaged app discovered the nested KDE compositor and both automated
+Desktop **Capture** button clicks succeeded. The repeat returned HTTP 200,
+`Content-Type: image/png`, `X-Capture-Source: panel`, and Content-Length
+1,209,980. The app decoded a fresh, nonblank 1920×1080 image and displayed
+the Desktop panel badge. No further product failure was reproduced or fixed.
+
+This does **not** establish the full visible-desktop condition in
+[#73](https://github.com/saphid/frame-control/issues/73). `xwininfo` reported
+the desktop window `IsViewable`, and gamescope confirmed focus after
+`vrcmd --showdashboard valve.steam.desktopgame.0`. However, SteamVR still
+reported that overlay `not_visible`. There was no worn-headset visual check.
+The observation proves capture of a mapped nested compositor, not its visible
+presentation to a wearer. Do not close #73 from this evidence.
+
+The issue screenshot shows a desktop panel in the headset view while Desktop
+Capture logs “no app panel is open in the headset.” The reporter used SteamOS
+0.4.5, gave no Frame Control version or reproduction steps, and has not replied
+to the maintainer's 0.4.3 update request. The duplicate page function was already
+fixed; [PR #152](https://github.com/saphid/frame-control/pull/152) subsequently
+improved unknown-state diagnostics. Its [earlier investigation](panel-discovery-2026-10-24.md)
+was blocked from starting a desktop by another task's lock. This run adds a
+current-package capture observation, without reproducing the older failure.
+
+## Procedure
+
+1. Read-only preflight found Game Mode active, full Plasma inactive, Steam and
+   SteamVR running, battery 99%, no nested desktop/runtime and no test lock.
+2. Compared the retained AppImage's SHA-256 with the live v0.4.17 release asset
+   digest: `b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d`.
+   Extracted an independent copy; `cmp` confirmed its `frame_touch.py` matches
+   the base checkout. No payload was edited.
+3. Started the package's own AppRun, bundled server and Python on Xvfb `:139`
+   with private config/cache/data/profile, telemetry and update checks disabled,
+   and `--no-sandbox --disable-gpu`. Used the existing authorized `ssh frame`
+   identity. T3 preview opened the package server page but does not attach to
+   the existing Electron window. The literal Electron button test used the
+   same Playwright-over-loopback-CDP workflow as the earlier packaged tests.
+4. Acquired `/tmp/frame-test.lock` with atomic `mkdir` and wrote an owner marker.
+   Rechecked no nested runtime or Plasma was present. Started SteamOS's
+   `/usr/bin/steamos-nested-desktop` in the owned transient user unit
+   `fc-issue73-desktop-20261024.service`, using Steam's display/session variables.
+   `RuntimeMaxSec=180s`, `TimeoutStopSec=15s` and `KillMode=control-group` bounded
+   the session. This launches a desktop panel inside Game Mode; no full Desktop
+   Mode switch was sent.
+5. In the actual packaged Electron window, navigated Tools → Capture & Live →
+   Desktop and clicked Capture with `locator.click()`. The first click event
+   recorded `isTrusted=true`. The page selected the KDE compositor on `:0`;
+   the production screenshot path used window `62914560`. Requested the desktop
+   dashboard, read back focus/visibility, and clicked Capture again. Recorded
+   response metadata, fresh decoded image dimensions and canvas pixel range.
+   No direct screenshot API call was substituted for these button clicks.
+6. Ran the packaged `frame_touch.py panels` read-only over SSH to retain its
+   exact discovery result: one focused KDE compositor panel, app ID 0, 1920×1080,
+   display `:0`, with no diagnostic `why` field.
+
+## Cleanup and limits
+
+The owned desktop session ran **09:43:48–09:45:33 UTC** (105 seconds). Hid the
+dashboard to restore its initial hidden state, stopped only the owned unit,
+and verified it was unloaded/inactive with MainPID 0. No Plasma/KWin desktop
+process or nested runtime remained; gamescope's focusable/focused lists were
+empty again. Released only this task's lock, after checking its owner marker.
+
+Delayed readback at **09:46:39 UTC** confirmed the lock absent, Game Mode active,
+full Plasma inactive and the original Steam, vrserver and vrcompositor PIDs
+still running. The Game Mode service invocation was unchanged. Battery was
+99% at cleanup and 100%/Full on the delayed check. Closed both owned preview
+tabs, Electron and Xvfb; their processes and X socket were gone. No test server
+remained. No reboot, installation, security/global setting change or full
+Desktop Mode transition was performed.
+
+The nested desktop journal included gamescope WSI/Vulkan-hook warnings. No
+warning was dismissed. Capture produced nonblank compositor pixels, but this
+run does not assess their usability to a wearer. Private image files stayed
+outside the repository; only state and response metadata are published.
+
+The initial CDP `response.body()` read yielded zero bytes despite successful
+decoding in the page. The repeat verified the PNG Content-Length, fresh image
+dimensions/source/selection and a 2,011,278-byte PNG exported from the canvas.
+The initial raw-body measurement is a harness limitation, not evidence of a
+product capture failure. No Live video, Control input, physical monitor, FUSE
+mounting or hardware rendering was tested. Older SteamOS and other packages
+remain outside this observation.
+
+## Offline verification
+
+`python3 -m unittest discover -s tests -p test_touch.py -v`: **42 tests passed**,
+including the production page's Node panel behavior tests, duplicate-function
+guard, absent versus empty panel diagnostics, alternate displays, capture/input
+target validation and discovery deadlines. JSON parsing and `git diff --check`
+were also checked. No new regression test was added because this is an
+evidence-only change with no reproduced product defect.
@@ -0,0 +1,142 @@
+# Media surround hardening: 2026-10-24
+
+PR [#51](https://github.com/saphid/frame-control/pull/51), branch
+`theatre-media-surround-hardening`, merged main `2ded4c5` without rebasing.
+Both fixes remain necessary on that main: an optional-surround error escapes
+`play()`, and a non-`RuntimeError` during overlay teardown skips the remaining
+handles and OpenVR shutdown.
+
+## Offline checks
+
+- Focused media suite: **23 tests passed** on Linux / Python 3.12.3.
+- Final full suite: **1,381 tests, OK (15 skipped)** in 145.384 s with
+  `PYTHONFAULTHANDLER=1 python3 -m unittest discover -s tests -v`.
+  The service-regression module passed **33 tests**. Player/server compilation
+  and `git diff --check` passed. Current macOS/Windows validation is left to CI.
+- The startup/upload, creation/setup, deferred-surround refusal and teardown
+  regression tests were also run with main's player implementation: they
+  failed as expected (six errors across subtests). The screen-refusal test
+  passed, confirming that actual screen failures still propagate.
+- The historical macOS failure was job
+  [109239733717](https://github.com/saphid/frame-control/actions/runs/36516462623/job/109239733717),
+  on `dac9dbc`, Python 3.12: 619 tests, three failures in artwork resolver
+  tests (`test_resolver_slot_released_when_thread_cannot_start`,
+  `test_timed_out_lookups_are_capped`,
+  `test_url_fetch_refuses_private_hosts_and_honours_deadline`). Media tests
+  passed. Late DNS workers retained semaphore slots; the first failed
+  assertion could also leak acquired slots into later tests.
+- Main already contains `8051687`'s wait-for-idle and unconditional slot
+  cleanup, preserved by `d546568`. The current artwork module passed all
+  **40 tests** locally. No additional artwork changes were needed.
+- The first full run completed **1,380 tests, 15 skipped**, with one failure:
+  `test_a_second_server_is_refused_until_the_first_exits` observed SIGSEGV
+  (`-11`) instead of exit 1. All 41 server tests passed on a focused rerun.
+  Main started daemon index/TLS workers before refusing a second server;
+  its existing shutdown notes document a race with OpenSSL interpreter exit.
+  This crash mechanism is inferred; the first run did not retain a native
+  fault trace. The subprocess assertion now retains stderr for diagnosis.
+  A deterministic regression now checks that rejection starts no listener,
+  cleanup sweep or background workers. It failed before moving the ownership
+  check ahead of startup work and passed afterwards.
+
+The surround retry now logs a refusal before discarding that cosmetic work.
+Creation, setup and first-upload failures also allow the screen to play;
+standby remains retryable, and screen errors remain fatal. Teardown tests
+exercise OpenVR errors, unexpected exceptions and a late `InterruptedError`,
+checking that all handles are attempted and shutdown runs.
+
+## Earlier blocked real Frame attempt
+
+Read-only SSH preflight: SteamOS **0.5.6**, BUILD_ID **20261015.6141207**;
+SteamVR server PID **297506**, compositor PID **297620**; existing media
+service `inactive/dead`, MainPID 0; battery **99%**, fuel gauge `Not charging`,
+charger `Full`. The shared lock was absent at preflight.
+
+The subsequent atomic `mkdir /tmp/frame-test.lock` failed with
+`FileExistsError(17, 'File exists')`: another session acquired it in between.
+The probe stopped before uploading files, launching media, creating overlays,
+or changing any state. The foreign lock was neither modified nor released.
+All generated fixtures remained on the computer and were then removed; no
+headset cleanup was necessary. Steam/SteamVR and the prior player state were
+left alone.
+
+## Follow-up real Frame smoke at the exact PR head
+
+**Passed, 2026-10-24 10:35:02–10:35:23 UTC**, with byte-identical media modules
+from **`5d551a81658d9ff14f49285c28609d506cbc20aa`**. This later run resolves
+the earlier lack of fresh playback evidence. No production code changed.
+The headset was unworn. SteamOS **0.5.6**, BUILD_ID **20261015.6141207**,
+SteamVR **2.18.2**; battery **100%, Full** before and after.
+
+Read-only preflight found Game Mode (`XDG_CURRENT_DESKTOP=gamescope`,
+`start-gamescope` running, no `plasmashell`), Steam/SteamVR running, no media
+overlays, and the installed media service inactive/not loaded. The test then
+acquired `/tmp/frame-test.lock` with atomic `mkdir`; it did not take over a
+foreign lock. Under the lock, those safety conditions were checked again.
+
+Only generated media and the PR's four unchanged modules were uploaded, under
+the test-owned, uid-1000 directory
+`/tmp/pr51-5d551a8-4c0976a52564-utfbk_m0/`. The clip was a **12 s, 30 fps,
+960×540 half-SBS H.264** MP4 with solid red/cyan eye images and **silent AAC**.
+It was generated with FFmpeg's `color`, `hstack` and `anullsrc` sources; no
+personal or external media was used.
+
+The exact `frame_media_remote.run()` Play/status/Stop path was exercised by
+importing its unmodified module and changing only its in-memory `ROOT`,
+`RUNTIME`, `STATUS` and `UNIT` constants to the isolated test locations and
+`frame-control-media-pr51-5d551a8-4c0976a52564.service`. The real
+`frame_media_player.py` ran unchanged with `--layout auto --theatre`, using
+`h264_v4l2m2m` and Pulse output. This checks the player and its systemd lifecycle;
+it does **not** reverify the HTTP/UI upload or runtime installer, nor the
+literal production unit name. The installed media runtime, log, status and
+library were preserved.
+
+- First Play: `starting` → `playing` → **`ended`**, **360 frames**, **160 dropped**,
+  **12.0397 s**, `running=false`. The drops were the normal unworn/standby
+  `SetOverlayRaw` retry path; no fault was forced. At 60 frames, dropped was 0.
+  `vrcmd --overlays` listed `framecontrol.media.surround` as **1×1 visible**
+  and `framecontrol.media.screen` as **visible**. These are SteamVR metadata,
+  not a wearer or eye-capture verification.
+- After EOF: unit **inactive/dead, not-found, MainPID 0**, no test player or
+  decoder, and neither owned overlay remained. Stop after EOF succeeded and
+  retained `ended`.
+- Second Play reached `playing`, 60 frames, 0 dropped. Explicit Stop returned
+  **`stopped`, 72 frames, 0 dropped, `running=false`**. Again the unit was
+  inactive/dead/not-found with MainPID 0, no player/decoder and no owned overlays.
+- The test unit's `ExecStart` and cgroup identified the unique temporary
+  runtime. First-run player/decoder PIDs were **309650/309655**; second-run
+  PIDs were **309805/309810**. Stop controlled only this dedicated test unit.
+  Its player log was empty; no surround refusal or teardown error was logged.
+
+### Uploaded SHA-256 values
+
+```text
+generated_SBS.mp4      1b39cac1d3b092b89657250c817019b68e87a474976ccd44aeb38e8eee44ffca
+frame_media.py         001e3158f4c3931794846b21f1e4cb553349d9326b4db1454a01976d446ad97a
+frame_media_player.py  86b0a140ebff857c2819c74d3ac45d1897735c585d44c7360ad6f18c2ecf2645
+frame_media_remote.py  b60386eb192d32594358246a4e665474c543600f2c564c2efd554ef38d7a631d
+frame_splat.py         f35750926f1149c41b95617a302012406d355c0dfdd4530438b0c42ee6d55daa
+```
+
+### Cleanup and limits
+
+The temporary directory, including its fixture, code, bytecode, status and log,
+was removed only after verifying that its player and decoder had exited. The
+transient unit was collected. The test released only its own lock after cleanup.
+All installed media runtime file hashes, including `player.log` and
+`status.json`, were unchanged. The installed `frame-control-media.service`
+remained inactive/not loaded. Steam **297826**, vrserver **297506**,
+vrcompositor **297620**, vrdashboard **297721**, and start-gamescope **296997**
+kept the same PIDs. The pre-existing overlay key/dimension/visibility/type
+inventory matched the final inventory, and all dashboard main panels remained
+`not_visible`. No dashboard command, wake request, global setting, reboot or
+Steam/SteamVR stop was issued.
+
+Cosmetic surround refusal and exceptional teardown remain **fake-tested**;
+no real refusal or teardown fault was induced. This short unworn-headset
+smoke does not verify appearance, eye isolation, comfort, audible sound/lip
+sync (the AAC was silent), sustained display performance, or the issue #28
+report of laggy 1080p video. It does not cover new H.265, photo or splat cases.
+Historical checks remain in the earlier PR #51 description and
+[media playback notes](../vr-video.md). The PR remains draft and unmerged
+for parent review and CI.
@@ -0,0 +1,58 @@
+# OBS relay and MP4 follow-up, 25 October 2026 UTC
+
+This check used a Linux x86-64 host (`lxso2`) and the real Frame running
+SteamOS 0.5.6, build `20261022.6153909`. The host reached `ssh frame`. Before
+device work, the task atomically acquired `/tmp/frame-test.lock`, wrote its
+owner marker, and after cleanup removed only that marker and its lock. Battery
+was 99–100%; SteamVR 2.18.2 reported `activity_level: 3` (standby). Steam and
+SteamVR were left running. No passthrough session or game was started.
+
+The production `scripts/obs-headset-source.py` relay reached its first local
+UDP packet in 0.65–1.15 seconds across several runs. A 12-second wall-clock
+capture of its MPEG-TS packets contained 325 H.264 frames at 1280×720,
+spanning 10.83 seconds of video timestamps: 30.0 fps. All 324 adjacent frame
+intervals were 33.333–33.334 ms, with none over 50 ms. The 826 captured TS
+packets had zero sync-byte, transport-error-indicator, or per-PID continuity
+errors. Six final TS packets arrived after the receiver's 12-second cutoff and
+were not included in those counts. Static standby pixels cannot establish
+whether a moving game would drop frames.
+
+After the fix, the `--height 1080 --fps 60 --no-audio` fallback reached its
+first packet in 0.597 seconds. An eight-second wall-clock capture contained
+447 H.264 frames at 1920×1080 over 7.45 seconds of video timestamps: 60.0 fps.
+All frame intervals were 16.666–16.667 ms, none over 25 ms, and its 756 TS
+packets had zero continuity or transport-error-indicator errors. It had no
+audio stream, as requested. The helper exited 0 on Stop, and the owned lock
+was released.
+
+The stream also contained 48 kHz stereo AAC. A 440 Hz synthetic tone played
+through the Frame's default speaker output with real-time pacing appeared in
+the capture for about 0.89 seconds; decoded audio had a -21.0 dB peak. This
+proves an audio signal reached the output monitor and OBS transport. It does
+not prove audible monitoring, real game audio, or audio/video sync: there was
+no simultaneous visible marker to compare with the tone.
+
+The production MP4 recording commands were run separately for six seconds,
+then Stop, remux, and copy to the host completed. Stop returned after 7.27
+seconds from Start, including six seconds of recording; the remote ffmpeg
+exited 0. The copied 36,929-byte MP4 contained 188 H.264 frames at 1920×1080
+and 30 fps (6.266 seconds), plus 281 AAC packets (5.994 seconds). One decoded
+frame at two seconds had a single color, RGB `(22, 27, 53)`, across all
+2,073,600 pixels. The test's remote files were removed; the host copy stayed
+under `/tmp` for inspection.
+
+The relay previously returned an error when the app deliberately closed its
+control pipe, because its SSH child commonly exits 255 after termination.
+The same test reproduced this (`helper_exit: 1`) on the real Frame. The follow-up
+fix recognizes deliberate Stop and adds bounded startup and stall timeouts,
+with fake-SSH regression tests. A new locked real-Frame check after the fix
+received its first 1,316-byte UDP datagram in 0.697 seconds and returned
+`helper_exit_after_stop: 0` after closing the app control pipe. The longer
+transport and MP4 measurements above were taken before the code change; the
+fix does not alter codecs or capture commands.
+
+Prior [OBS 30 Media Source evidence](obs-media-source-real-2026-10-25.md)
+records a real Frame stream in OBS on Linux. This follow-up measured the relay
+with an FFmpeg receiver; OBS itself was not relaunched. Windows and macOS
+application paths, wearer-visible image latency, real game sound, audible
+playback, perceptual A/V sync, and active passthrough pixels remain unverified.
@@ -0,0 +1,48 @@
+# OBS Media Source on a real Frame, 2026-10-25 AEDT
+
+The Linux x86_64 AppImage from PR #174's exact head `69fff152` had SHA-256
+`4902ac80b77fbf98ec918db29df9cf9260b8abd6763a5b5055572335869f038a`.
+Its extracted resources passed `app/build/check-resources.js`, including the
+OBS helper, and the app launched under Xvfb with an isolated profile and a
+dummy SSH alias. Its bundled server served the page with HTTP 200.
+
+For the device test, the PC was lxso2. The real Frame was reached as `ssh frame`
+under an atomically acquired `/tmp/frame-test.lock`. Battery read 100% Full
+before and after. SteamVR 2.18.2 reported `activity_level: 3` (standby). The
+mirror service and `/dev/video99` were active. The test cleaned its temporary
+remote WAV and released only its own lock.
+
+OBS 30.0.2 ran in a disposable Ubuntu 24.04 container on lxso2, with Xvfb and
+host loopback networking. A Media Source opened `udp://127.0.0.1:15099` with
+input format `mpegts`. A synthetic pattern and tone first verified the OBS
+scene: its saved 43.733-second MKV had H.264 video and AAC audio with a
+`-17.9 dB` audio peak. The real Frame test then ran the helper from the
+extracted AppImage resources **before** OBS opened the source, so OBS joined
+an ongoing stream. OBS's saved 37.600-second MKV had H.264 video and AAC audio.
+The standby mirror appeared in decoded frames by five seconds. A 440 Hz tone
+played briefly to the Frame's default PulseAudio output appeared in the OBS
+audio recording at seconds 20–21; decoded audio peaked at `-34.4 dB`. A
+separate direct recording of `@DEFAULT_MONITOR@` during the same type of tone
+peaked at `-34.5 dB`. These measurements verify non-silent headset output
+audio passed through the helper and OBS into the saved recording.
+
+The first OBS attempt opened its Media Source well before the Frame sent
+packets. Its output had a silent AAC track until the mirror appeared late.
+Starting the helper before OBS fixed this in the second run. The setup guide
+now recommends starting the source in Frame Control before adding or activating
+the OBS Media Source.
+
+The exact-head AppImage was then launched on an isolated Xvfb display and
+profile with the real `frame` alias. In **Tools → Capture & Live**, clicking
+**Start OBS source** changed the UI to **Stop OBS source** and showed
+`udp://127.0.0.1:15099` after the first stream packet. The packaged Python
+helper was running with `--frame frame`. Clicking **Stop OBS source** returned
+the UI to **Start OBS source**; the helper and its remote `/dev/video99` ffmpeg
+process were gone. The app exited through **File → Quit**. Battery again read
+100% Full, and the owned lock was released.
+
+**Limits:** Nobody listened to OBS audio monitoring or the Frame speakers.
+Audio/video sync was not measured. The headset was unworn and in standby, so
+this test does not answer whether active passthrough pixels appear in the
+mirror. The OBS MKVs were temporary local test artifacts and are not included
+in the repository.
@@ -0,0 +1,178 @@
+# Keyboard and trackpad through gamescope, 2026-10-24
+
+PR: [#66](https://github.com/saphid/frame-control/pull/66), `pad-gamescope`.
+Parent/main: v0.4.18 commit `0da1fe5`. Merge commit: `1737366`, with parents
+`cba23fb` (the existing PR) and `0da1fe5` (main). No history was rewritten.
+
+## Merge and implementation
+
+Both `/api/input` (keyboard/trackpad) and `/api/touch` (live-view Control)
+start and poll the gamescope helper. KDE Connect starts only when Unicode
+typing needs it. The existing ordered, bounded queue and switch cancellation
+remain in place; cross-service typing order is an estimate, not an application
+acknowledgement.
+
+The merge keeps main's intended-device validation and work reservation before
+a GET starts an input helper, immutable SSH routes, launch generations and
+serialized writes. Switching headsets also stops the power report and resets
+both input agents and queued typing before publishing the new route. The page
+keeps main's Tools sections, clipboard controls and single instances of the
+keyboard/trackpad and VR tools, with the PR's gamescope help text.
+
+The start/status regression tests now exercise the gamescope helper for both
+endpoints. An explicit `/api/input` test checks that start and poll use that
+helper without starting KDE Connect. Existing stale/missing-headset and
+route-reservation tests remain active.
+
+## Real Frame: focused click and ASCII keys received
+
+Host: lxso2, `ssh frame`. SteamOS **0.5.6**, BUILD_ID **20261015.6141207**,
+SteamVR **2.18.2**. At **11:05 UTC**, Game Mode was active, full Plasma was
+inactive, Steam and SteamVR were running, battery was **99%**, and gamescope's
+focusable/focused window lists were empty. The shared test lock was absent.
+Existing X11 tools and libX11 were available; Tk could not load its library.
+
+At **11:09:23 UTC**, an initial read-only preflight saw no focused window
+but activity level **0** (idle), rather than the required **3** (standby), and
+aborted before lock acquisition or input. At **11:09:57 UTC**, another task
+held the shared lock with a focused panel; that lock and panel were left alone.
+
+At **11:20:22 UTC**, read-only checks found the lock absent, no focused or
+focusable windows, activity **3** and battery **98%**. The bounded probe ran at
+**11:20:37 UTC** against implementation commit `5641d3c`:
+
+1. Rechecked empty focus and standby, acquired `/tmp/frame-test.lock` with
+   atomic `mkdir`, wrote a unique owner marker and rechecked both conditions.
+2. Created only a disposable 640×400 X11 event-recorder window on `:0`, tagged
+   with test app ID `2000999066`. It had a 45-second alarm and closed on stdin
+   EOF. No existing application, full desktop or dashboard was started.
+3. Waited for gamescope to report that exact window (`62914561`) focused.
+   Started the production server's `TouchAgent` over SSH; it reported ready.
+4. Called production `server.remote_touch` for positioning, then
+   `server.remote_input` with a left click, `Frame66` and the Enter key button.
+   Both responses reported `sent: true`. More importantly, the **window itself
+   recorded ButtonPress/Release (button 1), the ASCII key events in order and
+   Return**. `XLookupString` decoded exactly `Frame66\r`. The events were
+   delivered through gamescope's EIS socket, not fabricated with XSendEvent.
+5. Closed the helper by EOF and waited for exit, closed the recorder, checked
+   empty focus and standby, then removed only the owner-matching test lock.
+
+[State and received events](pad-gamescope-2026-10-24/readback.json) and the
+[probe](pad-gamescope-2026-10-24/probe.py)/[X11 recorder](pad-gamescope-2026-10-24/recorder.py)
+are retained. The archived scripts use checkout-relative source paths; the
+recorded run used the same harness from `/tmp`. Motion records omit an unused
+field that only has meaning for key/button events.
+
+Delayed readback at **11:21:46 UTC** confirmed no test lock or recorder process,
+empty focused/focusable lists, Game Mode active, full Plasma inactive, activity
+3 and battery 98%. The original Steam and vrserver PIDs were unchanged. No
+install, security/global setting change, dashboard/session switch, reset or
+reboot was performed. No headset helper or owned lock remained.
+
+This establishes **focused-panel click and ASCII key delivery on `:0`**.
+It does not establish wearer-visible presentation, Unicode delivery or GUI
+interaction. The absolute-position setup reached the recorder's edge
+(639,399), rather than its centre; pixel-accurate absolute pointing is **not**
+proved by this small-window probe. The trackpad click and typed keys still
+arrived in the owned focused window. The original PR's earlier acceptance-only
+observations remain historical; this observation adds actual window events.
+
+## Offline checks and remaining limits
+
+- `python3 -m unittest discover -s tests -p test_input.py -v`: **58 passed**.
+- `python3 -m unittest discover -s tests -p test_touch.py -v`: **43 passed**.
+- `python3 -m unittest discover -s tests -p test_service_regressions.py -v`:
+  **34 passed**.
+- `python3 -m unittest discover -s tests -v`: **1,403 ran, OK, 15 skipped**
+  (Linux x86_64, Python 3.12; 150.825 seconds).
+- Full fake-Frame e2e in task-specific Docker project `frame-control-pr66`:
+  **47 passed** after the lock fix (192.270 seconds). Both task containers,
+  their network and all three volumes were removed afterward. The run emitted
+  an unclosed test-socket ResourceWarning; the suite returned OK.
+- Node page suites: `ctrl_gestures.mjs`, `pad_queue.mjs`, `desk_panels.mjs`
+  passed, using the production page functions.
+- `node --test app/test/*.test.js`: **3 test files passed**.
+- `node --test site/test/*.test.mjs`: **2 test files passed**.
+- Python compilation, desktop/site JavaScript syntax and `git diff --check`
+  passed. Fake-Frame e2e and exact-head CI results are recorded in the PR after completion.
+
+The first full regression run executed 1,401 tests and found two tests still
+expecting `/api/input` to start the old KDE Connect helper. They were updated
+to the intended gamescope route. The final full run includes the lazy-KDE
+regression above and the lock-order regression below. The initial restricted-sandbox input run could not open
+loopback sockets; the focused rerun with managed network access passed.
+
+Review of the merged code then found a lock inversion: the Unicode worker
+held the pad-send lock while `InputAgent.start()` acquired the route lock,
+whereas a headset switch held the route lock before resetting the pad. A
+bounded subprocess regression reproduced the deadlock with the real
+`InputAgent.send/start` methods and an offline launch stub. Unicode delivery
+and resets now take the route lock before the pad lock; the route lock is
+reentrant so an agent can capture its route inside that reservation. The new
+regression passed after the fix, as did all **58 focused input tests** and
+the **1,403-test full suite** (15 skipped). The local fake-Frame suite also
+passed **47 tests after this fix**. Exact-head CI results are recorded in the PR.
+
+Remaining device work requires an idle, available Frame and the shared lock:
+verify Unicode in a real text field, ordering under real typing load and
+precise absolute pointing for small panels. Worn-headset presentation,
+packaged Electron pointer lock and Windows GUI execution remain separate
+checks. Automated Windows/macOS CI does not establish those interactions.
+
+
+## Review round 2: queue saturation and failure recovery
+
+The coordinator identified silent eviction in both `_queue_for_kde()` and the
+worker's retry path. Both sliced the oldest accepted events off at 200 entries,
+even though the page had already received `sent: true` and discarded its copy.
+
+Admission now serializes concurrent requests, checks capacity before any pointer
+or keyboard send, and returns `sent: false, state: waiting` if the whole batch
+will not fit. Text stays in the bounded queue while in flight, and is removed
+only after the helper accepts it. Rejected mixed batches send no clicks; retrying
+them cannot duplicate clicks already sent by this server. The page polls until
+it can retry. Pointer input stays usable while accepted text is pending.
+
+The old worker also left its worker marker and one-hour timing sentinel behind
+if `send()` raised. Failure/timeout handling now retains unsent text, clears the
+worker/timing state and exposes an error through input status. The page polls
+accepted text without requiring another keypress. **Try again** explicitly
+restarts the retained queue. Thread-start failures follow the same retention
+rule. A stale worker's exception cannot change the new route's state.
+
+The proposed send-to-enqueue headset-switch race was not reachable through the
+normal HTTP switch path: `Handler.do_POST()` reserves `working(meant)` across
+both operations; `devices_post()` shares `_work_lock` and refuses a moving
+operation while work is active. Connector configuration/reconnect paths defer
+changed headsets while work runs. A production-handler regression attempts a
+switch at both send and enqueue and passes even on the previous implementation.
+No separate connector change was needed. Atomic queue admission now uses the
+existing route-before-pad lock order as well, because starting either input
+agent can capture its route synchronously.
+
+Three deterministic saturation regressions fail on `215db7b` and pass with the
+fix: capacity during the typing delay, capacity during an unsuccessful-send
+retry, and two concurrent producers competing for the last slots. They check
+exact accepted event sequences, reject a mixed click/text batch before its
+pointer effects, and verify delivery exactly once after retry. Additional tests
+cover explicit recovery after timeout, helper errors, send exceptions and
+thread-start failure, stale-worker isolation, HTTP status/start behavior, and
+the production page's polling/error behavior.
+
+No new active headset test was performed: this change affects host queue
+admission/recovery and status handling, not Frame event translation or injection.
+The earlier real click/ASCII evidence remains scoped to its recorded commit.
+Real Unicode, packaged Electron pointer lock, Windows GUI, wearer-visible
+presentation and precise small-window absolute positioning remain unverified.
+`sent: true` means accepted by this server, not application delivery. The queue
+is in memory; switching headsets cancels it and server exit loses it. A transport
+failure after a partial write can still make delivery ambiguous; this is not an
+end-to-end exactly-once protocol.
+
+Round 2 local verification: **141 focused input/touch/service tests passed**
+(62 input, 43 touch, 36 service; 20.061 seconds), and **1,409 server tests ran, OK, 15 skipped**
+(Linux x86_64, Python 3.12, 153.198 seconds). All three production-page Node
+suites passed; app tests passed (3 files), site tests passed (2 files), Python
+compilation and `git diff --check` passed. The existing skipped tests require
+zsh, macOS/Swift or built native PC libraries. Current-head CI is tracked in
+PR #66; the previous 47-test local fake-Frame run above is historical.
@@ -0,0 +1,129 @@
+"""Active real-Frame evidence probe: aborts unless idle, then owns the shared lock.
+
+Run manually on an authorised host: python3 docs/evidence/pad-gamescope-2026-10-24/probe.py
+The recorded run used /tmp paths; archived paths are relative to this checkout.
+"""
+import base64
+import datetime
+import json
+import os
+from pathlib import Path
+import queue
+import shlex
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import uuid
+
+ROOT = Path(__file__).resolve().parents[3]
+data = tempfile.TemporaryDirectory(prefix='pr66-live-')
+os.environ.update(FRAME_CONTROL_DATA_DIR=data.name, FRAME_CONTROL_TELEMETRY='0', FRAME_PRIVATE_SSH='1')
+sys.path.insert(0, str(ROOT / 'ui'))
+import server
+
+SSH = ['ssh', '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', 'frame']
+owner = 'pr66-' + uuid.uuid4().hex
+result = {'time': datetime.datetime.now(datetime.timezone.utc).isoformat(), 'owner': owner,
+          'base': '0da1fe5', 'route': 'production server.remote_input -> TouchAgent SSH -> frame_touch.py -> gamescope EIS',
+          'events': []}
+recorder = None
+locked = False
+rows = queue.Queue()
+
+def ssh(cmd):
+    return subprocess.run([*SSH, cmd], capture_output=True, text=True, timeout=15, check=True).stdout
+
+def focus():
+    return json.loads(server.ssh('python3 - focus', stdin=(ROOT/'ui/frame_touch.py').read_text(), timeout=15))
+
+def activity():
+    return json.loads(ssh('/opt/steamvr/bin/linuxarm64/vrcmd --stats'))[0]['activity_level']
+
+def read_rows():
+    for raw in recorder.stdout:
+        rows.put(json.loads(raw))
+
+def collect(seconds):
+    end = time.monotonic() + seconds
+    while time.monotonic() < end:
+        try:
+            result['events'].append(rows.get(timeout=max(0.01, end-time.monotonic())))
+        except queue.Empty:
+            break
+
+try:
+    result['initial_focus'] = focus()
+    result['initial_activity'] = activity()
+    assert not result['initial_focus'].get('window'), 'existing focused panel; do not interrupt'
+    assert result['initial_activity'] == 3, 'headset is not in standby'
+    ssh('mkdir /tmp/frame-test.lock && printf %s ' + shlex.quote(owner) + ' > /tmp/frame-test.lock/owner')
+    locked = True
+    result['lock_acquired'] = True
+    assert not focus().get('window') and activity() == 3, 'session changed during lock acquisition'
+    code = base64.b64encode(Path(__file__).with_name('recorder.py').read_bytes()).decode()
+    command = 'python3 -u -c ' + shlex.quote("import base64;exec(compile(base64.b64decode('" + code + "'),'pr66-recorder','exec'))")
+    recorder = subprocess.Popen([*SSH, command], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE, text=True)
+    threading.Thread(target=read_rows, daemon=True).start()
+    initial = rows.get(timeout=8)
+    result['recorder'] = initial
+    assert initial.get('ready'), initial
+    window = initial['window']
+    for _ in range(20):
+        current = focus()
+        if current.get('window') == window:
+            break
+        time.sleep(0.2)
+    result['focused_panel'] = current
+    assert current.get('window') == window and current.get('display') == ':0', 'owned panel did not obtain focus; no input sent'
+    server.remote_input({})
+    for _ in range(50):
+        if server._touch.status.get('state') in ('ready', 'error'):
+            break
+        time.sleep(0.1)
+    result['agent_status'] = dict(server._touch.status)
+    assert result['agent_status'].get('state') == 'ready', result['agent_status']
+    target = {'window': window, 'display': ':0'}
+    assert focus().get('window') == window and activity() == 3
+    result['position_response'] = server.remote_touch({'events': [dict(target, fx=0.5, fy=0.5)]})
+    time.sleep(0.2)
+    assert focus().get('window') == window and activity() == 3
+    result['pad_response'] = server.remote_input({'events': [{'singleclick': True}, {'key': 'Frame66'}, {'specialKey': 12}]})
+    collect(2)
+    received = result['events']
+    result['received_text'] = ''.join(e.get('text', '') for e in received if e.get('type') == 2)
+    result['click_received'] = any(e.get('type') == 4 and e.get('code') == 1 and e.get('window') == window for e in received)
+    result['release_received'] = any(e.get('type') == 5 and e.get('code') == 1 and e.get('window') == window for e in received)
+    result['passed'] = result['click_received'] and result['release_received'] and result['received_text'] == 'Frame66\r'
+    assert result['passed'], 'event recorder did not observe expected click and keys'
+except Exception as e:
+    result['error'] = str(e)
+finally:
+    proc = server._touch.proc
+    server.reset_pad_route()
+    if proc:
+        try:
+            proc.wait(timeout=8)
+            result['input_helper_exited'] = True
+        except subprocess.TimeoutExpired:
+            proc.terminate()
+            proc.wait(timeout=5)
+            result['input_helper_terminated'] = True
+    if recorder:
+        recorder.stdin.close()
+        recorder.wait(timeout=8)
+        collect(0.2)
+        result['recorder_exit'] = recorder.returncode
+        result['recorder_stderr'] = recorder.stderr.read()[-1000:]
+    if locked:
+        result['final_focus'] = focus()
+        result['final_activity'] = activity()
+        ssh('test "$(cat /tmp/frame-test.lock/owner)" = ' + shlex.quote(owner)
+            + ' && rm /tmp/frame-test.lock/owner && rmdir /tmp/frame-test.lock')
+        result['owned_lock_released'] = True
+    Path('/tmp/pr66-live.json').write_text(json.dumps(result, indent=2) + '\n')
+    print(json.dumps(result, indent=2))
+    data.cleanup()
+sys.exit(0 if result.get('passed') else 1)
@@ -0,0 +1,280 @@
+{
+  "time": "2026-10-24T11:20:37.392607+00:00",
+  "owner": "pr66-7c2a8e8851f449bcb0bb6a040be94d99",
+  "base": "0da1fe5",
+  "route": "production server.remote_input -> TouchAgent SSH -> frame_touch.py -> gamescope EIS",
+  "events": [
+    {
+      "type": 6,
+      "window": 62914561,
+      "x": 320,
+      "y": 200,
+      "synthetic": false
+    },
+    {
+      "type": 6,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "synthetic": false
+    },
+    {
+      "type": 4,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 1,
+      "synthetic": false
+    },
+    {
+      "type": 5,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 1,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 50,
+      "synthetic": false,
+      "text": "",
+      "keysym": 65505
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 41,
+      "synthetic": false,
+      "text": "F",
+      "keysym": 70
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 41,
+      "synthetic": false
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 50,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 27,
+      "synthetic": false,
+      "text": "r",
+      "keysym": 114
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 27,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 38,
+      "synthetic": false,
+      "text": "a",
+      "keysym": 97
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 38,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 58,
+      "synthetic": false,
+      "text": "m",
+      "keysym": 109
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 58,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 26,
+      "synthetic": false,
+      "text": "e",
+      "keysym": 101
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 26,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false,
+      "text": "6",
+      "keysym": 54
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false,
+      "text": "6",
+      "keysym": 54
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 15,
+      "synthetic": false
+    },
+    {
+      "type": 2,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 36,
+      "synthetic": false,
+      "text": "\r",
+      "keysym": 65293
+    },
+    {
+      "type": 3,
+      "window": 62914561,
+      "x": 639,
+      "y": 399,
+      "code": 36,
+      "synthetic": false
+    },
+    {
+      "cleaned": true
+    }
+  ],
+  "initial_focus": {
+    "window": null
+  },
+  "initial_activity": 3,
+  "lock_acquired": true,
+  "recorder": {
+    "ready": true,
+    "window": 62914561,
+    "pid": 317210,
+    "display": ":0",
+    "appid": 2000999066
+  },
+  "focused_panel": {
+    "window": 62914561,
+    "display": ":0",
+    "name": "Frame Control PR66 disposable input probe",
+    "x": 0,
+    "y": 0,
+    "width": 640,
+    "height": 400,
+    "root": [
+      1920,
+      1080
+    ],
+    "app": 2000999066
+  },
+  "agent_status": {
+    "state": "ready",
+    "focus": 62914561
+  },
+  "position_response": {
+    "state": "ready",
+    "focus": 62914561,
+    "sent": true
+  },
+  "pad_response": {
+    "state": "ready",
+    "focus": 62914561,
+    "sent": true
+  },
+  "received_text": "Frame66\r",
+  "click_received": true,
+  "release_received": true,
+  "passed": true,
+  "input_helper_exited": true,
+  "recorder_exit": 0,
+  "recorder_stderr": "",
+  "final_focus": {
+    "window": null
+  },
+  "final_activity": 3,
+  "owned_lock_released": true,
+  "implementation_commit": "5641d3c316dfe225321f7233840cc83ff8c3f527",
+  "device": {
+    "steamos": "0.5.6",
+    "build_id": "20261015.6141207",
+    "steamvr": "2.18.2",
+    "battery_before": 98,
+    "battery_after": 98
+  },
+  "delayed_cleanup": {
+    "time": "2026-10-24T11:21:46Z",
+    "shared_lock_absent": true,
+    "owned_recorder_absent": true,
+    "game_mode": "active",
+    "full_plasma": "inactive",
+    "steam_pid": 297826,
+    "vrserver_pid": 297506,
+    "focusable_windows": [],
+    "focused_windows": [],
+    "activity_level": 3
+  },
+  "limits": [
+    "No wearer or packaged Electron/GUI interaction",
+    "ASCII only; Unicode and cross-service ordering not tested on device",
+    "The positioning setup reached the recorder edge (639,399); pixel-accurate absolute targeting is not established by this probe"
+  ]
+}
@@ -0,0 +1,82 @@
+"""Disposable X11 event recorder used for the PR #66 focused-input observation."""
+import ctypes as C
+import json
+import os
+import select
+import signal
+import time
+
+X = C.CDLL('libX11.so.6')
+P, U = C.c_void_p, C.c_ulong
+for name, restype, args in [
+    ('XOpenDisplay', P, [C.c_char_p]), ('XDefaultRootWindow', U, [P]),
+    ('XCreateSimpleWindow', U, [P, U, C.c_int, C.c_int, C.c_uint, C.c_uint, C.c_uint, U, U]),
+    ('XInternAtom', U, [P, C.c_char_p, C.c_int]),
+    ('XChangeProperty', C.c_int, [P, U, U, U, C.c_int, C.c_int, P, C.c_int]),
+    ('XStoreName', C.c_int, [P, U, C.c_char_p]),
+    ('XSelectInput', C.c_int, [P, U, C.c_long]), ('XMapWindow', C.c_int, [P, U]),
+    ('XFlush', C.c_int, [P]), ('XPending', C.c_int, [P]),
+    ('XConnectionNumber', C.c_int, [P]), ('XNextEvent', C.c_int, [P, P]),
+    ('XLookupString', C.c_int, [P, P, C.c_int, P, P]),
+    ('XDestroyWindow', C.c_int, [P, U]), ('XCloseDisplay', C.c_int, [P]),
+]:
+    fn = getattr(X, name)
+    fn.restype, fn.argtypes = restype, args
+
+class InputEvent(C.Structure):
+    _fields_ = [('type', C.c_int), ('serial', U), ('send_event', C.c_int),
+               ('display', P), ('window', U), ('root', U), ('subwindow', U),
+               ('time', U), ('x', C.c_int), ('y', C.c_int), ('x_root', C.c_int),
+               ('y_root', C.c_int), ('state', C.c_uint), ('code', C.c_uint),
+               ('same_screen', C.c_int)]
+
+class Event(C.Union):
+    _fields_ = [('type', C.c_int), ('input', InputEvent), ('pad', C.c_long * 24)]
+
+def say(**row):
+    print(json.dumps(row), flush=True)
+
+def end(*_):
+    raise TimeoutError('probe ended')
+
+signal.signal(signal.SIGTERM, end)
+signal.signal(signal.SIGALRM, end)
+signal.alarm(45)
+d = X.XOpenDisplay(b':0')
+assert d, 'X display unavailable'
+w = 0
+try:
+    w = X.XCreateSimpleWindow(d, X.XDefaultRootWindow(d), 0, 0, 640, 400, 0, 0, 0x224466)
+    for name, value in [(b'STEAM_GAME', 2000999066), (b'_NET_WM_PID', os.getpid())]:
+        val = U(value)
+        X.XChangeProperty(d, w, X.XInternAtom(d, name, 0), 6, 32, 0, C.byref(val), 1)
+    X.XStoreName(d, w, b'Frame Control PR66 disposable input probe')
+    X.XSelectInput(d, w, 1 | 2 | 4 | 8 | 64 | 32768 | 2097152)
+    X.XMapWindow(d, w)
+    X.XFlush(d)
+    say(ready=True, window=w, pid=os.getpid(), display=':0', appid=2000999066)
+    while True:
+        while X.XPending(d):
+            event = Event()
+            X.XNextEvent(d, C.byref(event))
+            if event.type in (2, 3, 4, 5, 6):
+                e = event.input
+                row = dict(type=event.type, window=e.window, x=e.x, y=e.y,
+                           synthetic=bool(e.send_event))
+                if event.type != 6:
+                    row['code'] = e.code
+                if event.type == 2:
+                    buf, keysym = C.create_string_buffer(32), U()
+                    n = X.XLookupString(C.byref(e), buf, 32, C.byref(keysym), None)
+                    row.update(text=buf.raw[:n].decode('utf-8', 'replace'), keysym=keysym.value)
+                say(**row)
+        ready, _, _ = select.select([0, X.XConnectionNumber(d)], [], [], 0.2)
+        if 0 in ready and not os.read(0, 1024):
+            break
+except TimeoutError:
+    pass
+finally:
+    if w:
+        X.XDestroyWindow(d, w)
+    X.XCloseDisplay(d)
+    say(cleaned=True)
@@ -0,0 +1,168 @@
+# Saved panel layouts: feasibility recheck, 2026-10-24
+
+Issue: [#31](https://github.com/saphid/frame-control/issues/31). Base: main
+`5b47cd3`. This investigation covers spatial save/restore for existing
+Steam/gamescope panels without another overlay application.
+
+## Decision and user behavior
+
+Keep saved layouts unavailable. The current Frame exposes some geometry,
+including a standing-space coordinate transform, but this investigation did
+not establish a complete dock-state snapshot or a controlled restore path for
+these panels. The existing companion/headset switcher still lists panels and
+requests focus; users arrange them with SteamVR's dashboard controls. No layout
+file, new control, overlay application or background service is added.
+
+This is a limit of the investigated route, not proof that every native
+implementation is impossible. In particular, failure of
+`GetOverlayTransformAbsolute` does **not** mean all pose readback is denied.
+
+## Device and read-only results
+
+SteamOS **0.5.6**, BUILD_ID **20261015.6141207**; `vrcmd --version`:
+**2.18.2**. `gamescope-session.service` was active and
+`plasma-workspace.target` inactive: Game Mode. gamescope used the OpenVR backend
+and `--virtual-connector-strategy PerAppId`. Battery was 99%, Not charging,
+before the probe and 100%, Full, afterwards.
+
+The [exact probe](panel-layout-2026-10-24/probe.py) loads only
+`FnTable:IVROverlay_028` from the shipped
+`/opt/steamvr/bin/linuxarm64/libopenvr_api.so`. It uses application type 3
+(`VRApplication_Background`, avoiding runtime startup) and shuts down its own
+OpenVR connection in `finally`. Initialization and interface acquisition both
+returned 0. It calls getters only, with no image capture or input injection.
+
+[Raw result](panel-layout-2026-10-24/readback.json):
+
+| Getter | `valve.steam.desktopgame.0` | `valve.steam.gamepadui.main` |
+|---|---|---|
+| FindOverlay | 0, Success | 0, Success |
+| Rendering process | `gamescope-wl` | `gamescope-wl` |
+| Width | 0; 2.6700000763 m | 0; 2.6670000553 m |
+| Curvature | 0; 0 | 0; 0 |
+| Transform type | 0; 5, DashboardTab | 0; 5, DashboardTab |
+| Absolute transform | 18, WrongTransformType | 18, WrongTransformType |
+| Tracked-device-relative transform | 18, WrongTransformType | 18, WrongTransformType |
+| Coordinate transform, center, standing origin | 0; identity matrix | 0; scaled/translated matrix |
+| Coordinate transform, center, seated origin | 23, RequestFailed | 23, RequestFailed |
+| Coordinate transform, center, raw origin | 23, RequestFailed | 23, RequestFailed |
+
+The dashboard and both panels were reported hidden; neither panel was active.
+The standing-space matrix is the transform for the overlay point `(0.5, 0.5)`;
+it does not identify World/Dashboard/Theater/controller docking or recreate a
+dashboard frame. The Steam panel's basis has scale about 0.369. Treat neither
+that scaled matrix nor the hidden Gamescope panel's identity as a validated
+physical placement to feed to an absolute-transform setter. Visible placement,
+matrix freshness and correspondence to dashboard size were not checked by a
+wearer.
+
+## API and dashboard boundary
+
+The ABI and result names were checked against Valve's
+[OpenVR v2.12.14 C header](https://github.com/ValveSoftware/openvr/blob/v2.12.14/headers/openvr_capi.h)
+and [C++ interface comments](https://github.com/ValveSoftware/openvr/blob/v2.12.14/headers/openvr.h).
+That header declares `IVROverlay_028`; its SHA-256 is
+`d58a2b149e434b2b8ee25cb4253ca6157feed8092f621e78ecfed6846d35d3e4`.
+The absolute getter is explicitly limited to absolute transforms. The
+coordinate getter returns the 3D transform for a 2D overlay point. Public
+`IVROverlay_028` has no getter/setter pair for dashboard dock location or frame
+scene-graph state. The probe fails closed if that exact interface is absent.
+
+Read-only inspection of the shipped dashboard
+`/opt/steamvr/resources/webinterface/dashboard/chunk~8012d0c89.js`
+(SHA-256 `937ec62c67a481f030a416099ceb98b0fe2a702aea5a0705601c6c40d4969f6d`)
+found:
+
+- `dockLocation` reads an internal `_getDockLocation(frameID)` store;
+  `SetDockLocation` updates that store or sends a VRLink request.
+- `m_mapLastRelativeTransformForDockLocation` keeps per-location transforms.
+  World initialization requests a dashboard scene-graph transform through
+  `requestSGTransform`, then updates the component's `xfTransform`.
+- The `vrcmd_dock_overlay` handler accepts `dashboard`, `lefthand`, `righthand`,
+  `theater` and `world`. It selects the frame associated with the supplied key,
+  **falls back to the active frame if no match exists**, sets dock location and
+  may switch frame. This is not an exact pose restore or a readback response.
+
+Those are observations of shipped internal code, not proof that Frame Control
+can safely access its state through a supported external API. No dashboard
+JavaScript was injected, private store edited or VRLink command sent. The
+active-frame fallback is an additional reason not to experiment with docking
+commands on a stale key.
+
+The [2026-09-28 probe](../panels.md#saved-spatial-layouts-blocked-on-the-current-panel-route)
+on SteamOS 0.4.1 / SteamVR 2.18.1 recorded an absolute setter returning
+12 (`PermissionDenied`) on a temporary, test-owned gamescope panel. That setter
+result is **historical**, not a new test on 2.18.2. The newer read-only results
+above neither overturn nor reverify it.
+
+## Commands, safety and cleanup
+
+Read-only inspection used `ssh frame` with `BatchMode=yes` and
+`ConnectTimeout=10`, `cat /etc/os-release`, battery sysfs reads,
+`systemctl --user is-active gamescope-session.service plasma-workspace.target`,
+process inspection, and `vrcmd --version`, `--help`, `--overlays`. An initial
+`--listoverlays` attempt returned `Unknown command`; `--overlays` is the actual
+enumeration command. Dashboard sources were read/copied to local `/tmp` for
+inspection. No files were installed on the Frame.
+
+Run the retained probe from the repository root, following
+[the shared-device rules](../testing.md#headset-smoke-test). Stop if the lock is
+occupied or battery is at/below 20%; never remove another task's lock:
+
+```sh
+ssh -o BatchMode=yes -o ConnectTimeout=10 frame \
+  'set -eu; mkdir /tmp/frame-test.lock || exit 3; trap "rmdir /tmp/frame-test.lock" EXIT; timeout 25 python3 -' \
+  < docs/evidence/panel-layout-2026-10-24/probe.py
+```
+
+This command acquired the lock, completed with exit 0 and released it. A
+subsequent check confirmed the lock absent, Game Mode active, and Steam,
+`vrserver` and `vrcompositor` running. The probe's only headset filesystem
+change was creating/removing that shared lock. Its Python source ran from
+stdin. There were no test panels, installs, profiles or services to remove.
+
+No mutation test was essential: without verified dock/relative-frame readback,
+there was no exact original layout and bounded rollback to justify changing a
+panel. Existing user panels were never focused, shown, hidden, resized, moved
+or docked. No global settings, security, passwords, runtime processes or modes
+were changed; no reboot or reset occurred.
+
+## Validation and remaining gaps
+
+Existing `tests/test_panels.py` covers main-panel enumeration, hidden panels,
+focus revalidation, unavailable-runtime errors and HTTP authentication/Host/
+Origin guards. `tests/test_page_scripts.py` checks the production page's shared
+JavaScript scope. These offline checks do not prove spatial placement. The
+retained probe is evidence tooling, not a new product API; no fake layout
+backend or layout tests claiming device support were added.
+
+Validation passed:
+
+```sh
+python3 -m unittest discover -s tests -p test_panels.py -v       # 8 passed
+python3 -m unittest discover -s tests -p test_page_scripts.py -v # 5 passed
+python3 -m py_compile docs/evidence/panel-layout-2026-10-24/probe.py
+python3 -m json.tool docs/evidence/panel-layout-2026-10-24/readback.json
+git diff --check
+```
+
+The initial panel-suite attempt hit sandbox socket restrictions in four HTTP
+tests; rerunning with loopback sockets permitted passed all eight. No real
+headset connection is used by those tests. The full suite and fake Frame were
+not run for this evidence-only change.
+
+Before shipping layouts, a native route still needs proof of dock state and
+relative-frame readback, authorized restore on an owned test panel with exact
+rollback, and correspondence between saved size/pose and visible placement.
+It also needs stable source identity and a fresh capture-permission/ticket
+flow when reopening viewers. Reconnect, panel recreation, reboot recovery,
+Steam-launched gameplay, controller docking and worn-headset input were not
+tested here. The existing Frame Control-owned media renderer is not proof that
+Steam/gamescope panels can be restored. No third-party overlay app was used.
+
+## Announcement
+
+We rechecked saved panel layouts on SteamOS 0.5.6. SteamVR exposes some panel
+geometry, but we have not verified safe restoration of Steam's panel positions
+and docking. Saved layouts remain unavailable; use SteamVR's dashboard to
+arrange panels. The panel switcher continues to list and show open panels.
@@ -0,0 +1,89 @@
+"""Read-only issue #31 probe; pipe to `ssh frame 'timeout 25 python3 -'`.
+
+Acquire /tmp/frame-test.lock first per docs/testing.md. No overlay is created,
+focused, docked or changed. Background init (3) does not start SteamVR.
+ABI: ValveSoftware/openvr v2.12.14 headers/openvr_capi.h, IVROverlay_028.
+"""
+import ctypes as C
+import json
+from pathlib import Path
+
+H = C.c_uint64
+Matrix = C.c_float * 12
+
+
+class Vector2(C.Structure):
+    _fields_ = [('v', C.c_float * 2)]
+
+
+def probe():
+    vr = C.CDLL('/opt/steamvr/bin/linuxarm64/libopenvr_api.so')
+    vr.VR_InitInternal2.argtypes = [C.POINTER(C.c_int), C.c_int, C.c_char_p]
+    vr.VR_InitInternal2.restype = C.c_uint32
+    vr.VR_GetGenericInterface.argtypes = [C.c_char_p, C.POINTER(C.c_int)]
+    vr.VR_GetGenericInterface.restype = C.c_void_p
+    vr.VR_ShutdownInternal.argtypes = []
+    vr.VR_ShutdownInternal.restype = None
+    err = C.c_int()
+    vr.VR_InitInternal2(C.byref(err), 3, None)
+    report = {'init_error': err.value, 'interface': 'IVROverlay_028', 'panels': []}
+    if err.value:
+        return report
+    try:
+        ptr = vr.VR_GetGenericInterface(b'FnTable:IVROverlay_028', C.byref(err))
+        report['interface_error'] = err.value
+        if err.value or not ptr:
+            return report
+        table = C.cast(ptr, C.POINTER(C.c_void_p))
+
+        def function(slot, result, *args):
+            return C.CFUNCTYPE(result, *args)(table[slot])
+
+        def read(slot, handle, output_type):
+            output = output_type()
+            rc = function(slot, C.c_int, H, C.POINTER(output_type))(handle, C.byref(output))
+            return {'rc': rc, 'value': output.value if rc == 0 else None}
+
+        report['dashboard_visible'] = function(68, C.c_bool)()
+        for key in ('valve.steam.desktopgame.0', 'valve.steam.gamepadui.main'):
+            row = {'key': key}
+            report['panels'].append(row)
+            handle = H()
+            row['find_rc'] = function(0, C.c_int, C.c_char_p, C.POINTER(H))(
+                key.encode(), C.byref(handle))
+            if row['find_rc']:
+                continue
+            pid = function(10, C.c_uint32, H)(handle)
+            row['rendering_pid'] = pid
+            try:
+                row['rendering_comm'] = Path('/proc/%d/comm' % pid).read_text().strip()
+            except OSError:
+                row['rendering_comm'] = None
+            row['visible'] = function(45, C.c_bool, H)(handle)
+            row['active_dashboard'] = function(69, C.c_bool, H)(handle)
+            row['width_m'] = read(23, handle, C.c_float)
+            row['curvature'] = read(25, handle, C.c_float)
+            row['transform_type'] = read(32, handle, C.c_int)
+            for name, slot, scalar in (('absolute', 34, C.c_int),
+                                       ('tracked_device_relative', 36, C.c_uint32)):
+                origin = scalar()
+                matrix = Matrix()
+                rc = function(slot, C.c_int, H, C.POINTER(scalar), C.POINTER(Matrix))(
+                    handle, C.byref(origin), C.byref(matrix))
+                row[name] = {'rc': rc, 'origin_or_device': origin.value if rc == 0 else None,
+                             'matrix': list(matrix) if rc == 0 else None}
+            row['coordinate_transforms'] = []
+            for origin in (0, 1, 2):  # seated, standing, raw/uncalibrated
+                matrix = Matrix()
+                rc = function(46, C.c_int, H, C.c_int, Vector2, C.POINTER(Matrix))(
+                    handle, origin, Vector2((.5, .5)), C.byref(matrix))
+                row['coordinate_transforms'].append({
+                    'tracking_origin': origin, 'coordinates': [.5, .5], 'rc': rc,
+                    'matrix': list(matrix) if rc == 0 else None})
+        return report
+    finally:
+        vr.VR_ShutdownInternal()
+
+
+if __name__ == '__main__':
+    print(json.dumps(probe(), indent=2, allow_nan=False))
@@ -0,0 +1,152 @@
+{
+  "init_error": 0,
+  "interface": "IVROverlay_028",
+  "panels": [
+    {
+      "key": "valve.steam.desktopgame.0",
+      "find_rc": 0,
+      "rendering_pid": 297037,
+      "rendering_comm": "gamescope-wl",
+      "visible": false,
+      "active_dashboard": false,
+      "width_m": {
+        "rc": 0,
+        "value": 2.6700000762939453
+      },
+      "curvature": {
+        "rc": 0,
+        "value": 0.0
+      },
+      "transform_type": {
+        "rc": 0,
+        "value": 5
+      },
+      "absolute": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "tracked_device_relative": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "coordinate_transforms": [
+        {
+          "tracking_origin": 0,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        },
+        {
+          "tracking_origin": 1,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 0,
+          "matrix": [
+            1.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            1.0,
+            0.0,
+            0.0,
+            0.0,
+            0.0,
+            1.0,
+            0.0
+          ]
+        },
+        {
+          "tracking_origin": 2,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        }
+      ]
+    },
+    {
+      "key": "valve.steam.gamepadui.main",
+      "find_rc": 0,
+      "rendering_pid": 297037,
+      "rendering_comm": "gamescope-wl",
+      "visible": false,
+      "active_dashboard": false,
+      "width_m": {
+        "rc": 0,
+        "value": 2.6670000553131104
+      },
+      "curvature": {
+        "rc": 0,
+        "value": 0.0
+      },
+      "transform_type": {
+        "rc": 0,
+        "value": 5
+      },
+      "absolute": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "tracked_device_relative": {
+        "rc": 18,
+        "origin_or_device": null,
+        "matrix": null
+      },
+      "coordinate_transforms": [
+        {
+          "tracking_origin": 0,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        },
+        {
+          "tracking_origin": 1,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 0,
+          "matrix": [
+            0.3689989447593689,
+            0.0,
+            0.0008894503116607666,
+            -0.5048462152481079,
+            0.0,
+            0.36899998784065247,
+            0.0,
+            1.2510287761688232,
+            -0.0008894503116607666,
+            0.0,
+            0.3689989447593689,
+            -1.1726053953170776
+          ]
+        },
+        {
+          "tracking_origin": 2,
+          "coordinates": [
+            0.5,
+            0.5
+          ],
+          "rc": 23,
+          "matrix": null
+        }
+      ]
+    }
+  ],
+  "interface_error": 0,
+  "dashboard_visible": false
+}
@@ -0,0 +1,226 @@
+{
+  "date_utc": "2026-10-24T09:27:25.354Z",
+  "result": "PASS: literal packaged desktop Return to Game Mode button switched the real Frame from full Plasma; a repeat visible click made no second switch",
+  "documentation_base_commit": "71288d8980040c14f777f0e417f41f7105eaaac4",
+  "host": "lxso2",
+  "steamos_version": "0.5.6",
+  "steamos_build": "20261015.6141207",
+  "prior_evidence": [
+    "https://github.com/saphid/frame-control/issues/142",
+    "https://github.com/saphid/frame-control/pull/143",
+    "https://github.com/saphid/frame-control/pull/156"
+  ],
+  "package": {
+    "tag": "v0.4.17",
+    "asset": "Frame-Control-linux-x86_64.AppImage",
+    "url": "https://github.com/saphid/frame-control/releases/download/v0.4.17/Frame-Control-linux-x86_64.AppImage",
+    "sha256": "b1b8eb82bf73a227b2cd36e8f0ef3a2ebdf7967c5853efb08a9634f38227015d",
+    "verification": "sha256sum matched the live release asset digest. Independently extracted the retained asset into a new private test directory. cmp confirmed bundled frame_backup.py and frame_backup_remote.py equal the checkout versions. No source or payload was changed.",
+    "launch": "--appimage-extract, then squashfs-root/AppRun --no-sandbox --disable-gpu --remote-debugging-port=49372 --remote-debugging-address=127.0.0.1 --user-data-dir=/tmp/frame-return-button-20261024/electron-profile --window-size=1400,950",
+    "display": "Xvfb :138 -screen 0 1440x1000x24 -nolisten tcp; Electron content screenshot 1400x923",
+    "isolation": "Private XDG_CONFIG_HOME, XDG_CACHE_HOME, FRAME_CONTROL_DATA_DIR and Electron profile; FRAME_CONTROL_TELEMETRY=0 and FRAME_CONTROL_NO_UPDATE_CHECK=1. Existing authorized ssh frame identity retained; bundled server and Python used."
+  },
+  "preflight": {
+    "read_only_first": true,
+    "initial_mode": "gamescope-session.target=active; plasma-workspace-wayland.target=inactive",
+    "initial_battery_percent": 99,
+    "initial_battery_status": "Not charging; charger Full",
+    "steam_and_steamvr_running": true,
+    "running_steam_apps": [],
+    "default_login_mode": "game",
+    "lock": "mkdir /tmp/frame-test.lock succeeded atomically; no foreign lock was removed. Initial harmless probe attempt released its own lock, then a fresh atomic acquisition covered both full-session attempts."
+  },
+  "rollback": {
+    "unit": "fc-return-button-rollback-20261024",
+    "probe": "systemd-run --user --unit=fc-return-button-probe-20261024 --on-active=2s --timer-property=AccuracySec=1s --property=Type=oneshot --property=RemainAfterExit=yes /usr/bin/true",
+    "probe_execution": "Result=success\nExecMainStartTimestamp=Sat 2026-10-24 20:27:07 AEDT\nExecMainExitTimestamp=Sat 2026-10-24 20:27:07 AEDT\nExecMainCode=1\nExecMainStatus=0\n",
+    "arm": "systemd-run --user --unit=fc-return-button-rollback-20261024 --on-active=180s --timer-property=AccuracySec=1s /bin/sh -c <guarded command>",
+    "guarded_command": "if [ \"$(systemctl --user is-active gamescope-session.target)\" != active ]; then exec /usr/bin/steamosctl switch-to-game-mode; fi",
+    "verified_before_desktop": "TimersMonotonic={ OnActiveUSec=3min ; next_elapse=1d 21h 53min 49.130174s }\nNextElapseUSecMonotonic=1d 21h 53min 49.130174s\nBindsTo=\nPartOf=\nActiveState=active\nExecStart={ path=/bin/sh ; argv[]=/bin/sh -c if [ \"$(systemctl --user is-active gamescope-session.target)\" != active ]; then exec /usr/bin/steamosctl switch-to-game-mode; fi ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ; code=(null) ; status=0/0 }\nBindsTo=\nPartOf=\n",
+    "user_manager_linger": "yes",
+    "desktop_entry": "ssh frame steamosctl switch-to-desktop-mode",
+    "first_click_utc": "2026-10-24T09:27:27.037Z",
+    "cancelled_before_deadline": true,
+    "fired": false,
+    "limit": "The benign transient timer was observed executing. The actual rollback timer configuration was read back, then cancelled after the UI restored Game Mode; its recovery action was not deliberately allowed to fire."
+  },
+  "ui": {
+    "navigation": "Clicked nav Tools, Backup & recovery, and Check in the actual packaged Electron window. Initial Game Mode disabled Return. After full Plasma entry, Check enabled it.",
+    "automation": "Playwright connected to the packaged Electron instance over local CDP and used locator.click() on the visible button; accepted the native JavaScript confirm dialog. No Return API/CLI or production handler was directly invoked by the test. T3 preview was inspected separately and closed; it cannot control this Electron window.",
+    "clicks": [
+      {
+        "isTrusted": true,
+        "utc": "2026-10-24T09:27:27.037Z"
+      },
+      {
+        "isTrusted": true,
+        "utc": "2026-10-24T09:27:32.942Z"
+      }
+    ],
+    "button_bounds_css_pixels": {
+      "x": 47,
+      "y": 709.59375,
+      "width": 156.203125,
+      "height": 44
+    },
+    "confirmation_dialogs": [
+      {
+        "type": "confirm",
+        "message": "Return the headset to Game Mode?\n\nThis closes the desktop and any apps open in it, then starts Steam's Game Mode.",
+        "utc": "2026-10-24T09:27:27.042Z"
+      },
+      {
+        "type": "confirm",
+        "message": "Return the headset to Game Mode?\n\nThis closes the desktop and any apps open in it, then starts Steam's Game Mode.",
+        "utc": "2026-10-24T09:27:32.943Z"
+      }
+    ],
+    "desktop_check": {
+      "http": 200,
+      "body": {
+        "mode": "desktop",
+        "gamescope": true,
+        "plasma": true,
+        "nested_desktop": false,
+        "configured": "gamescope-wayland.desktop",
+        "config_file": "/etc/sddm.conf.d/steamos.conf",
+        "selector": "steamosctl",
+        "session_targets": {
+          "gamescope-session.target": "inactive",
+          "plasma-workspace-wayland.target": "active"
+        },
+        "mode_source": "session-targets"
+      }
+    },
+    "return_responses": [
+      {
+        "http": 200,
+        "body": {
+          "message": "Asked the headset to return to Game Mode; it restarts its session in a few seconds",
+          "state": {
+            "mode": "desktop",
+            "gamescope": true,
+            "plasma": true,
+            "nested_desktop": false,
+            "configured": "gamescope-wayland.desktop",
+            "config_file": "/etc/sddm.conf.d/steamos.conf",
+            "selector": "steamosctl",
+            "session_targets": {
+              "gamescope-session.target": "inactive",
+              "plasma-workspace-wayland.target": "active"
+            },
+            "mode_source": "session-targets"
+          },
+          "switched": true,
+          "command": "steamosctl switch-to-game-mode"
+        },
+        "utc": "2026-10-24T09:27:27.316Z"
+      },
+      {
+        "http": 200,
+        "body": {
+          "message": "The headset is already in Game Mode. The desktop you see is a panel: close it from the Steam dashboard.",
+          "state": {
+            "mode": "game",
+            "gamescope": true,
+            "plasma": false,
+            "nested_desktop": false,
+            "configured": "gamescope-wayland.desktop",
+            "config_file": "/etc/sddm.conf.d/steamos.conf",
+            "selector": "steamosctl",
+            "session_targets": {
+              "gamescope-session.target": "active",
+              "plasma-workspace-wayland.target": "inactive"
+            },
+            "mode_source": "session-targets"
+          },
+          "switched": false
+        },
+        "utc": "2026-10-24T09:27:33.126Z"
+      }
+    ],
+    "final_check": {
+      "http": 200,
+      "body": {
+        "mode": "game",
+        "gamescope": true,
+        "plasma": false,
+        "nested_desktop": false,
+        "configured": "gamescope-wayland.desktop",
+        "config_file": "/etc/sddm.conf.d/steamos.conf",
+        "selector": "steamosctl",
+        "session_targets": {
+          "gamescope-session.target": "active",
+          "plasma-workspace-wayland.target": "inactive"
+        },
+        "mode_source": "session-targets"
+      }
+    },
+    "final_return_disabled": true,
+    "final_text": "Game Mode: the headset is running normally. A desktop you see is a panel; close it from the Steam dashboard.",
+    "screenshots": [
+      "return-game-mode-packaged-2026-10-24-before.png",
+      "return-game-mode-packaged-2026-10-24-after.png"
+    ],
+    "screenshot_scope": "Cropped to the session controls and repeat-action notification; host identity, connection address and backup folder excluded."
+  },
+  "systemd_verification": {
+    "command": "ssh frame systemctl --user show gamescope-session.target plasma-workspace-wayland.target -p Id -p ActiveState -p SubState; ssh frame systemctl --user show gamescope-session.service -p InvocationID",
+    "before": "Id=gamescope-session.target\nActiveState=inactive\nSubState=dead\n\nId=plasma-workspace-wayland.target\nActiveState=active\nSubState=active\nInvocationID=892b843dbe1a4d2ba91b93057bd38463\n295589 /home/steamos/.local/share/Steam/steamrtarm64/steam -silent -vrdisable -deckard\n295066 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-294978\n",
+    "after_first_click": "Id=gamescope-session.target\nActiveState=active\nSubState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nSubState=dead\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n",
+    "after_repeat_click": "Id=gamescope-session.target\nActiveState=active\nSubState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nSubState=dead\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\n297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297942 /home/steamos/.local/share/Steam/steamrtarm64/steam -child-update-ui -child-update-ui-socket 8 -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n",
+    "repeat_did_not_restart_game_mode": true,
+    "unchanged_game_service_invocation": "e8c1085b3bbd4e79a323b3e4a9bc6355",
+    "unchanged_steamvr_pid": 297506,
+    "delayed_final_readback_utc": "2026-10-24T09:28:05Z"
+  },
+  "cleanup": {
+    "complete": true,
+    "final_readback": "2026-10-24T09:28:05Z\nId=gamescope-session.target\nActiveState=active\n\nId=plasma-workspace-wayland.target\nActiveState=inactive\nInvocationID=e8c1085b3bbd4e79a323b3e4a9bc6355\nNEXT LEFT LAST PASSED UNIT ACTIVATES\n\n0 timers listed.\nId=fc-return-button-rollback-20261024.timer\nLoadState=not-found\nActiveState=inactive\n\nId=fc-return-button-rollback-20261024.service\nLoadState=not-found\nActiveState=inactive\n\nId=fc-return-button-probe-20261024.timer\nLoadState=not-found\nActiveState=inactive\n\nId=fc-return-button-probe-20261024.service\nLoadState=not-found\nActiveState=inactive\n297826 /home/steamos/.local/share/Steam/steamrtarm64/steam -cef-enable-debugging -deckard -gamepadui -steamdeck -steamos3 -vrgamepadui\n297506 /opt/steamvr/bin/linuxarm64/vrserver -waitformonitor -ipccontrolfilepath /tmp/SteamVR-IPCControlFile-297420\n99\nCharging\ngame\n",
+    "owned_lock_release_exit": 0,
+    "owned_lock_absent": true,
+    "host_processes": {
+      "xvfb": {
+        "pid": 1562020,
+        "exists": false,
+        "cmd": null,
+        "state": null
+      },
+      "electron": {
+        "pid": 1562023,
+        "exists": false,
+        "cmd": null,
+        "state": null
+      },
+      "x_socket_absent": true
+    },
+    "remaining_test_servers": [],
+    "battery_final_percent": 99,
+    "battery_final_status": "Charging",
+    "battery_range_observed_percent": [
+      99,
+      100
+    ],
+    "game_mode_steam_steamvr_running": true,
+    "default_login_mode_after": "game",
+    "headset_installs_or_global_settings_changed": false,
+    "rebooted": false,
+    "notes": "Stopping the timer succeeded. systemctl stop also named its never-started, unloaded service and returned 5; explicit readback confirms both rollback and probe timer/service units are not-found/inactive. No further switch was sent."
+  },
+  "attempts_and_harness_limits": [
+    "Initial harmless timer probe was garbage-collected before its exit metadata could be read. No Desktop Mode switch was attempted. Repeated with RemainAfterExit=yes and verified successful execution.",
+    "First full Plasma attempt clicked the visible packaged Return button and got HTTP 200 / switched=true. The harness then treated absent pgrep matches during the expected session restart as a fatal error. Independent readback confirmed Game Mode and SteamVR had returned. Rollback remained armed until that readback, then was cancelled. This incomplete attempt was not counted as the final pass.",
+    "Final full Plasma attempt tolerated transiently absent Steam/SteamVR while polling systemd targets, passed both trusted visible clicks, and completed the final Check. Stopping the unused rollback service returned unit-not-loaded; explicit subsequent readback verified all four owned probe/rollback units not-found/inactive and zero timers. Cleanup was completed before releasing our lock."
+  ],
+  "limits": [
+    "Unchanged AppImage payload ran after extraction on a virtual X desktop with Chromium sandbox and GPU disabled. FUSE mounting, desktop integration and hardware rendering were not tested.",
+    "Automated trusted pointer clicks in a visible Electron window; no physical-monitor human click or worn-headset visual/interaction assessment.",
+    "Verified only SteamOS 0.5.6 build 20261015.6141207 and the Linux x86_64 v0.4.17 package; older selectors/builds and other desktop platforms remain covered only by their existing tests.",
+    "No release, tag, application code, passwords or security/global settings changed."
+  ],
+  "validation": {
+    "focused_suite": "python3 -m unittest discover -s tests -p test_backup.py -v: 28 tests passed in 2.479s",
+    "json": "python3 -m json.tool: passed",
+    "diff": "git diff --check: passed"
+  }
+}
@@ -0,0 +1,19 @@
+# Round 3 headset checks, 25 October 2026
+
+These checks used the real Frame after the device hold ended. SteamOS was
+0.5.6, build `20261022.6153909`. Each device session acquired
+`/tmp/frame-test.lock` atomically and released only its own lock. The battery
+read 100% and Full in the first check and after the OBS session; Steam and
+SteamVR were left running.
+
+| Question | Observation | Conclusion |
+|---|---|---|
+| Does active passthrough appear in SteamVR's `/dev/video99` mirror? | The mirror service was active. One 1920×1080 RGB frame read from `/dev/video99` had a single pixel value, `(24, 28, 53)`, throughout. The headset was unworn; no active passthrough session or wearer-visible room view was established. Frame Control has no verified remote passthrough toggle. The temporary frame was removed. | **Still unknown.** A uniform standby frame cannot answer whether SteamVR composites active passthrough into its mirror. No headset setting was changed. |
+| Can Frame Control prompt when a headset text box opens? | No desktop `plasmashell` process was running during this check. There is no verified cross-app focus event from SteamVR, Lepton and the nested desktop; KDE Connect's `keyboardstate` packet describes keyboard support, not a focused text field. | **Not built.** A prompt triggered by an unverified signal would be misleading. The existing **Type on the headset** control remains available. |
+| Does reverse clipboard exist? | Frame Control already has **Copy the headset's clipboard here**. Its earlier real Frame test used a temporary nested desktop and confirmed that text copied through Klipper reached a Linux PC clipboard. No desktop panel was open during this session, so it was not rerun here. | **Shipped and previously verified**, text only. Windows/macOS backends and arbitrary headset apps remain unverified on a real Frame. |
+| Is an 80% charge limit available and writable? | `steamosctl get-max-charge-level` returned `UnknownInterface: ...BatteryChargeLimit1`. No `charge_control_*` attribute was found under `/sys/class/power_supply`. Only `pm8550b-charger/charging_pause` and `charging_enable` were present, each mode `644`, owner `root:root`. | **No supported user-writable control.** No battery attribute was written. |
+
+The separate OBS transport check on the same build sent the mirror and the
+default-output monitor to a Linux PC. A 4.021-second temporary capture had
+H.264 video and AAC audio according to `ffprobe`. It was removed; OBS itself
+and audible playback were not tested. See the OBS source PR and guide.
@@ -0,0 +1,25 @@
+# Screenshot Save on a real Frame, 25 October 2026
+
+After PR #192 merged, Frame Control's production `list_shots()` and
+`save_shots()` paths were run from lxso2 against the real Frame. The test held
+the shared `/tmp/frame-test.lock` with an owner marker and removed only its own
+lock. A separate locked check earlier in this round found SteamVR at activity
+level 3 (standby). No new screenshot was created.
+
+- The Frame listed seven existing Steam screenshots.
+- One existing screenshot was copied to a temporary folder on the PC. Its
+  local size matched the reported remote size: **294,885 bytes**. The new
+  destination had four components below the temporary root: headset, Steam
+  account, game ID and filename.
+- Saving the same screenshot a second time returned zero new copies. A fresh
+  list then marked that screenshot as saved.
+- The temporary PC folder and its private image were removed at the end. The
+  source screenshot on the Frame was only read. Battery was **100% Full**
+  before and after.
+
+This verifies one real screenshot transfer and the repeat-save behavior. It
+does **not** reproduce two different real screenshots with the same filename;
+the account/game/headset collision case is covered by the fake-source test in
+`tests/test_shot_copy.py`. Windows and macOS physical-PC saves were not tested.
+Active passthrough in the recording mirror remains unknown because the Frame
+was in standby.
@@ -0,0 +1,22 @@
+# SteamOS 0.5.6 compatibility check, 25 October 2026
+
+The real Frame was accessed **after** the 00:00 AEDT hold, under a separately
+acquired `/tmp/frame-test.lock`. The coordinator had finished its v0.4.19 smoke
+test and released its lock first. This check took place approximately 00:04–
+00:08 AEDT (13:04–13:08 UTC). A device clock reading in the first snapshot was
+**00:04:58 AEDT**. The one temporary capture was removed and our lock was
+released. Steam and SteamVR were left running.
+
+| Check | Observation |
+|---|---|
+| OS | `VERSION_ID=0.5.6`, `VARIANT_ID=vr`, `BUILD_ID=20261022.6153909` |
+| Update channel | `atomupd-manager tracked-branch` returned `beta`; tracked variant `vr`; update status `idle`. `atomupd-manager status` and `check` returned D-Bus `AccessDenied` to the normal user. No root, update, or channel change was attempted. |
+| Discovery | `frame.local` and a sample `frame-0000.local` name were unresolved from the Linux host. Avahi was active on the Frame, but `/etc/avahi/avahi-daemon.conf` has `publish-addresses=no`. The configured `ssh frame` alias worked. The host reached the Frame over Tailscale, so a local-subnet scan and same-LAN cached-IP reconnection were not exercised. |
+| Script fallback | `steamos-session-select` was present and `holo-session-select` absent. The installed devkit utilities contained `steamos-prepare-upload` and `steamos-delete`; their `holo-*` replacements were absent. No session switch, install, or delete command was run. |
+| Battery and memory | Frame Control's `ui/frame_status.py` returned a system battery at 98%, Charging, with its source under `/sys/class/power_supply/max1720x_bat_7-36`; memory was 16,422,952,960 bytes total and 11,256,848,384 bytes available. The battery was 97% at the initial raw sysfs check and 98% at the final check while charging. |
+| Recording source | The user `steamvr-v4l2cam.service` and `/dev/video99` were present. A single frame from that device was black while the unworn headset was in standby. Frame Control's MP4 path reads that same SteamVR `system.HeadsetView` mirror and never opens a passthrough camera. Active passthrough inclusion in the mirror remains unverified. The sample image was not retained or published. |
+| Dominant eye | Neither standard `steamvr.vrsettings` path checked had a readable dominant-eye setting. No source or effect on the mirror was verified; Frame Control does not attach dominant-eye metadata. |
+
+This was a bounded compatibility check, not a rerun of the coordinator's
+13-step smoke test. The coordinator reported that smoke passed on this same
+build, with battery 95% to 96% while charging and cleanup complete.
@@ -0,0 +1,74 @@
+# Windows Wireless Adapter doctor verification, 24 October 2026
+
+PC-only implementation and verification. No Frame was contacted, before or
+after 13:00 UTC. No adapters or security settings were changed. This evidence
+does not establish a physical Steam wireless adapter fix or RF interference.
+
+## Windows VM
+
+An existing local Windows 11 VM (build 26200), Python 3.12.14 from the installed
+Frame Control bundle, ran the isolated suite from a task-specific Downloads
+folder:
+
+```powershell
+& 'C:\Users\frame\AppData\Local\Programs\Frame Control\resources\python\python.exe' -m unittest discover -s tests -p test_wireless.py -v
+```
+
+Result: **15 tests, OK, one skipped** (Node absent). This includes the real
+read-only PowerShell inventory and authenticated HTTP handler tests. The app's
+connector was never started. Existing test SSH credentials were used only for
+the Windows VM; no credentials were copied into the repository.
+
+- [Exact test output](windows-wireless-tests-2026-10-24.txt).
+- [Sanitized live inventory](windows-wireless-summary-2026-10-24.json): two
+  virtual-machine network devices, with PnP/presence/adapter/route sources
+  available. WLAN unavailable; channels/bands remained null. All PnP IDs,
+  device names and interface names were removed from this artifact.
+- The guest clock was approximately seven hours ahead of the host. `observedAt`
+  is retained as returned by Windows, not used to establish test timing.
+
+The first probe used a list of requested default prefixes. A missing IPv6
+route caused PowerShell to throw away available IPv4 data. The final query
+filters `Get-NetRoute` results instead, and the rerun above confirms routes
+are available. No network configuration was changed to make the query work.
+
+## Browser UI and local tests
+
+Production `ui/index.html` ran against a loopback-only synthetic API fixture,
+with no connector and no headset transport. Opening/revisiting the tool caused
+no wireless query; an explicit click rendered two distinct Wi-Fi Direct PnP
+instances and a 2.4 GHz PC interface while the headset state was offline.
+Unknown virtual-adapter channels, non-present/disabled status, and unconfirmed
+interference remained visible. Checked at 1280 and 640 CSS pixels without
+horizontal overflow.
+
+![Production browser UI with explicitly labelled synthetic Windows readings](windows-wireless-synthetic-2026-10-24.png)
+
+The screenshot uses synthetic readings, not the VM's two Ethernet interfaces.
+The yellow synthetic-data label was added by the browser fixture for this
+capture; it is not product UI.
+
+Local commands:
+
+```sh
+python3 -m unittest discover -s tests -p 'test_wireless.py' -v
+node tests/wireless.cjs
+python3 -m unittest discover -s tests -v
+python3 -m py_compile ui/*.py
+node --check /tmp/wireless-index-scripts.js
+```
+
+The targeted suite passed 15 tests with the live Windows-only test skipped;
+the direct Node run passed all four UI tests. The complete server suite passed
+1,423 tests with 16 skips before the additional missing-metadata test; a final
+complete run and Windows CI results are recorded in the PR. The syntax check
+used inline scripts extracted from the production HTML.
+
+## What remains unverified
+
+No physical Steam dongle, Razer headset, live Wi-Fi Direct session, channel
+reading from real wireless hardware, dropout reproduction or recovery action.
+The English netsh parser is fixture-tested; localised or denied readings remain
+unknown. Windows CI validates query execution on hosted virtual hardware.
+There is no adapter disable action because the available evidence cannot
+reliably identify a safe extra instance.
@@ -0,0 +1,40 @@
+{
+  "platform": "Windows-11-10.0.26200-SP0",
+  "python": "3.12.14",
+  "state": "partial",
+  "sources": {
+    "pnp": "ok",
+    "present": "ok",
+    "adapters": "ok",
+    "routes": "ok",
+    "wlan": "unavailable"
+  },
+  "observedAt": "2026-10-24T19:15:45.946191+00:00",
+  "deviceCount": 2,
+  "devicesWithoutIdentifiers": [
+    {
+      "present": true,
+      "pnpStatus": "OK",
+      "problemCode": 0,
+      "operational": 6,
+      "media": 0,
+      "defaultRoute": false,
+      "wifi": false,
+      "hardware": false,
+      "channel": null,
+      "band": null
+    },
+    {
+      "present": true,
+      "pnpStatus": "OK",
+      "problemCode": 0,
+      "operational": 1,
+      "media": 1,
+      "defaultRoute": true,
+      "wifi": false,
+      "hardware": true,
+      "channel": null,
+      "band": null
+    }
+  ]
+}
@@ -0,0 +1,24 @@
+test_ambiguous_adapter_join_never_selects_the_first_match (test_wireless.Inventory.test_ambiguous_adapter_join_never_selects_the_first_match) ... ok
+test_channels_require_exact_guid_and_band_is_never_guessed (test_wireless.Inventory.test_channels_require_exact_guid_and_band_is_never_guessed) ... ok
+test_counts_unique_pnp_ids_not_rows_or_suffix_order (test_wireless.Inventory.test_counts_unique_pnp_ids_not_rows_or_suffix_order) ... ok
+test_distinct_instances_presence_disabled_and_activity_are_separate (test_wireless.Inventory.test_distinct_instances_presence_disabled_and_activity_are_separate) ... ok
+test_friendly_name_is_only_a_candidate_and_other_duplicate_names_are_not_direct (test_wireless.Inventory.test_friendly_name_is_only_a_candidate_and_other_duplicate_names_are_not_direct) ... ok
+test_missing_interface_metadata_and_invalid_guids_stay_unknown (test_wireless.Inventory.test_missing_interface_metadata_and_invalid_guids_stay_unknown) ... ok
+test_missing_sources_are_unknown_and_adapter_fallback_is_retained (test_wireless.Inventory.test_missing_sources_are_unknown_and_adapter_fallback_is_retained) ... ok
+test_raw_ssid_mac_and_errors_are_not_returned (test_wireless.Inventory.test_raw_ssid_mac_and_errors_are_not_returned) ... ok
+test_concurrent_requests_do_not_spawn_more_probes (test_wireless.Probe.test_concurrent_requests_do_not_spawn_more_probes) ... ok
+test_failure_timeout_and_invalid_output_are_explicit_and_release_lock (test_wireless.Probe.test_failure_timeout_and_invalid_output_are_explicit_and_release_lock) ... ok
+test_http_is_authenticated_pc_only_and_never_calls_ssh (test_wireless.Probe.test_http_is_authenticated_pc_only_and_never_calls_ssh) ... GET "GET /api/host/wireless HTTP/1.1" 403 -
+GET "GET /api/host/wireless HTTP/1.1" 400 -
+GET "GET /api/host/wireless HTTP/1.1" 200 -
+ok
+test_live_windows_inventory (test_wireless.Probe.test_live_windows_inventory) ... ok
+test_non_windows_starts_nothing (test_wireless.Probe.test_non_windows_starts_nothing) ... ok
+test_static_noninteractive_local_command_and_timeout (test_wireless.Probe.test_static_noninteractive_local_command_and_timeout) ... ok
+test_ui_behavior (test_wireless.Probe.test_ui_behavior) ... skipped 'Node required'
+
+----------------------------------------------------------------------
+Ran 15 tests in 8.139s
+
+OK (skipped=1)
+Windows wireless smoke: partial {'pnp': 'ok', 'present': 'ok', 'adapters': 'ok', 'routes': 'ok', 'wlan': 'unavailable'} devices= 2
@@ -0,0 +1,69 @@
+# Frame Control extensions
+
+Extensions add a local panel to Frame Control's Tools page. They are plain HTML,
+CSS and JavaScript. Frame Control discovers them from its per-user data folder;
+there is no build step, server process, or headset installation. Open an extension
+to run it. Closing it unloads its page.
+
+## Install the example
+
+Copy [`examples/extensions/headset-glance`](../examples/extensions/headset-glance)
+to the `extensions` folder shown on Tools → Extensions, then select **Refresh**
+and **Open Headset Glance**. The folder is normally:
+
+- Linux: `~/.local/share/frame-control/extensions`
+- macOS: `~/Library/Application Support/Frame Control/extensions`
+- Windows: `%APPDATA%\Frame Control\extensions`
+
+To remove it, close the panel and delete only its `headset-glance` folder. The
+extension is local to this computer; the iPhone app reads the folder on the
+Frame, where its server runs.
+
+## Make an extension
+
+Create `extensions/your-id/manifest.json` and `index.html`. IDs use lowercase
+letters, digits and hyphens, start with a letter, and are at most 40 characters.
+The manifest ID must match the folder name:
+
+```json
+{
+  "id": "your-id",
+  "name": "Your feature",
+  "version": "1.0.0",
+  "description": "What the panel does.",
+  "entry": "index.html"
+}
+```
+
+Put JavaScript in a separate `.js` file. Supported assets are HTML, JS, CSS,
+JSON, PNG, JPEG, GIF, WebP and SVG, all in the extension's top-level folder.
+Nested paths and symlinks are not served. No file may exceed 5 MiB. The panel
+uses an iframe with `sandbox="allow-scripts"`; its code has an opaque origin,
+cannot call Frame Control's HTTP API directly, and cannot navigate the app's
+top-level window. Content Security Policy restricts scripts, images, and
+`fetch` requests, but an extension can still navigate its own iframe to an
+external site. Treat third-party extensions as untrusted code and review them
+before installation.
+
+The version 1 bridge uses `postMessage`. Send a request to `parent` and match
+the numeric `id` in the reply. The [example JavaScript](../examples/extensions/headset-glance/main.js)
+shows a complete client:
+
+```js
+parent.postMessage({type: 'frame-control:request', id: 1, action: 'status'}, '*');
+// Reply: {type: 'frame-control:response', id: 1, value: {...}}
+```
+
+Supported actions:
+
+| Action | Value |
+| --- | --- |
+| `capabilities` | `{apiVersion: 1, actions: ['capabilities', 'status']}` |
+| `status` | `{connected, os: {version, build}, battery: {percent}, steamvr}` |
+
+`status` is the app's latest successful status snapshot. When that reading fails,
+`connected` is false and its fields are empty. No write actions are currently exposed. Future APIs
+should use explicit, narrow actions and keep the iframe isolated. A third-party
+extension is code you choose to run locally: inspect its files before copying
+them into the folder. A Decky plugin is a separate Steam client plugin and does
+not use this API.
@@ -58,6 +58,11 @@ counts them while they run.
  restore chosen parts after a factory reset, and **Return to Game Mode** when
  the headset is stuck in Desktop Mode. Sign-in files and keys are never copied.
  Not tested on a headset yet. See [backup-and-recovery.md](backup-and-recovery.md).
+- **Wireless Adapter doctor** (Windows, Tools → This PC): explicitly read local
+  PnP instances, presence/link states and available channel/band readings;
+  explain possible Wi-Fi Direct duplicates and 2.4 GHz audio overlap. No headset
+  access, automatic changes or disable button. See
+  [Windows wireless diagnosis](windows-wireless-doctor.md).
 - **Battery** with charging state: charge rate in watts, time to full or empty,
  charger type and wattage (for example USB-C PD 20 W), and battery temperature.
 - **Status**: storage, memory, temperature, Wi-Fi, uptime, and whether SteamVR,
@@ -79,7 +84,11 @@ counts them while they run.
 - **Volume** and mute (`wpctl`).
 - **Android apps**: search about 4,500 F-Droid apps rated for the Frame, install
  one with a click as its own Lepton instance (it keeps its data and shows in the
-  Steam library), then launch, stop, test or remove it. **Report an APK** records
+  Steam library), then launch, stop, test or remove it.
+  The catalogue can load while the installed-app list is still being read. If
+  that read fails, browsing remains available, but installation waits for a
+  confirmed list so Frame Control does not make a duplicate app instance.
+  **Report an APK** records
  whether any APK worked (F-Droid or not: pick a file, type a package, or use an
  installed app). Your reports are saved on your computer and change the verdicts
  you see. With **Share compatibility results** on (Privacy & updates), they also
@@ -8,13 +8,15 @@ installed; the desktop app does not bundle this command.

 ```sh
 scripts/frame-doctor.sh
-scripts/frame-doctor.sh --alias bedroom --lan frame.local
+scripts/frame-doctor.sh --alias bedroom --lan 192.168.1.40
 scripts/frame-doctor.sh --alias frame --lan 192.168.1.40
 ```

 Use only addresses belonging to your intended headset. The command tries the
 existing `frame` SSH alias first (Tailscale if setup configured it that way),
-then `frame.local`, then USB-C at `10.86.200.233`. `--alias`, `--lan` and `--usb`
+then an optional `--lan` address, then USB-C at `10.86.200.233`. SteamOS 0.5.6
+stopped publishing mDNS names, so use a known IP for `--lan` if `.local` no longer
+resolves. `--alias`, `--lan` and `--usb`
 override those defaults. It reports the successful path without printing its
 address. It neither discovers other devices nor enables Tailscale.

@@ -0,0 +1,58 @@
+# Frame Control in the headset
+
+**Experimental, Frame OS 0.5.6.** Tools → Frame Control in VR installs a local
+panel in SteamVR's dashboard. It is a way to reach Frame Control while wearing
+the headset, independent of Decky's Quick Access Menu. The panel starts only
+after you opt in; its server binds to `127.0.0.1` and it uses a normal user
+service. No `sudo`, root filesystem change, or Steam client patch is needed.
+
+The companion copies its bundled UI over the existing trusted SSH connection.
+On the Frame, `frame-control-headset.service` runs a loopback server and one
+Chromium app window on gamescope. The window receives a dedicated `STEAM_GAME`
+id, so SteamVR registers `valve.steam.desktopgame.2001947813` as a dashboard
+panel. **Show in SteamVR** requests that dashboard tab; the wearer can select
+it again from SteamVR's dashboard. Closing the panel stops its browser and
+server. The service is not enabled at boot.
+
+The page shows battery, free home storage and SteamVR status. Its per-run UI
+key is passed in the URL fragment, removed from the address bar after load,
+and sent in the `X-Frame-UI` header. The key is absent from the HTTP request
+line and server log. The usual host/origin and anti-framing checks still apply.
+
+## Real Frame test, 2026-10-25
+
+On Frame OS 0.5.6, build `20261022.6153909`, the opt-in install started the
+user service, served `/headset`, read live `/api/status` from the browser, and
+registered a mapped Chromium window with SteamVR under the dedicated overlay
+key. The server rejected a request with the wrong UI key. A read-only status
+probe reported the user service running and the overlay registered.
+
+The unworn headset was in standby (`activity_level` 3). SteamVR reported the
+new overlay as `not_visible` even after `ShowDashboard`. An OpenVR stereo
+screenshot was a uniform dark frame. The documented temporary wake attempt
+(`power.turnOffScreensTimeout` 5 → 3600, `--handlewakeup`, `ShowDashboard`)
+still left the overlay `not_visible`; the setting was restored to 5 and the
+dashboard hidden. The X window's `xwd` image was black too. These observations
+prove panel creation and page/API execution, **not wearer-visible pixels or
+laser/controller input**. A worn-headset check is still required before
+describing the panel as visually verified.
+
+The test then removed the managed service and app bundle. Its unit became
+inactive, port 47813 closed, the SteamVR overlay disappeared, and the Frame's
+battery was 100%. Steam and SteamVR were left running. The browser profile and
+extensions folder were deliberately kept.
+
+## Remove
+
+Use **Tools → Frame Control in VR → Remove**. If the companion is unavailable,
+run:
+
+```sh
+ssh frame 'systemctl --user stop frame-control-headset.service; rm -f ~/.config/systemd/user/frame-control-headset.service; systemctl --user daemon-reload; rm -rf ~/.local/share/frame-control/headset/bundle; rm -f ~/.local/share/frame-control/headset/receipt.json ~/.local/share/frame-control/headset/server.log'
+```
+
+That command removes only Frame Control's managed panel code. The Chromium
+profile remains in `~/.local/share/frame-control/headset/profile` so local
+extension data is not discarded. Inspect and delete that folder separately if
+you no longer want it. Third-party extensions are in
+`~/.local/share/frame-control/extensions` and are never removed by this tool.
@@ -0,0 +1,118 @@
+# Linux Wireless Adapter doctor
+
+![Linux PC doctor before any checks run, with explicit hardware selection and read-only limits](img/linux-wireless-doctor.png)
+
+On the **Linux PC**, open **Settings → Linux Wireless Adapter doctor**, or
+**Devices & connection → Linux Wireless Adapter doctor**. It works without a
+connected headset. Choose **Read PC device inventory**, select the intended
+USB device or wireless interface, then **Check selected device**. Nothing runs
+until requested. Re-read the inventory after reconnecting a device.
+
+From a source checkout, the same collector is available without starting the
+app or its headset connection workers:
+
+```sh
+python3 ui/frame_wireless_doctor.py
+python3 ui/frame_wireless_doctor.py --device net:wlan0
+python3 ui/frame_wireless_doctor.py --device usb:1-2 --json > adapter-report.json
+```
+
+Use a selector actually listed on your PC. No device is selected automatically.
+All USB devices are included, including hubs and devices without a network
+interface. A product label, observed VID/PID, or a single available interface
+**does not identify Valve's adapter**. There is no trusted adapter ID table in
+this feature. Compare inventory before and after reconnecting the intended
+adapter when safe. For a USB device exposing multiple wireless interfaces,
+select the specific interface for radio/manager evidence.
+
+## Evidence and limits
+
+- **Presence and binding:** `/sys/bus/usb/devices` and `/sys/class/net` correlate
+  USB ancestry, wireless interfaces, driver links and module links. An absent
+  interface does not establish which driver should be installed. A missing
+  module link may mean a built-in driver. A bound driver does not prove Steam
+  streaming support.
+- **Permissions and udev:** `udevadm info --query=property` supplies a small
+  allowlist of driver, ID and tag fields. If available, the report includes USB
+  node mode, owner/group IDs and the current user's read/write access. Direct
+  USB access is not necessarily required by kernel networking; a restrictive
+  node alone is not diagnosed as the cause. No udev rules are installed or run.
+- **Radio blocks:** read-only WLAN rfkill sysfs entries are matched to the
+  selected interface's PHY name. An unrelated block cannot establish that
+  this adapter is blocked. Unavailable or unmatched entries remain unknown.
+- **Channel/band:** `iw dev IFACE info` provides the current channel and
+  frequency where reported; `iw phy PHY info` supplies enabled frequencies.
+  An idle interface may have no current channel. These observations do not
+  establish the channel used by a Steam streaming session, supported regions,
+  or the correct regulatory setting.
+- **Network managers:** visible `/proc/*/comm` process names show
+  NetworkManager, iwd and wpa_supplicant. `nmcli` reads only the selected
+  interface's general state, managed flag and driver. NetworkManager can use
+  iwd or wpa_supplicant as its backend, so coexistence is not itself a conflict.
+  If both backends are visible, the report suggests checking who owns this
+  exact interface. It does not claim a confirmed conflict or stop services.
+  Restricted process visibility and unverified backend ownership are explicit.
+
+Every command uses fixed read-only arguments, no shell, closed stdin and a
+three-second timeout. Optional tools are not installed automatically. Missing
+tools, denied reads, disappearing devices, and restricted VM/container hardware
+visibility remain unknown. A successful report is a snapshot, not a hardware
+health certificate. CLI exit 0 means collection is supported, not that the
+adapter works; unsupported platforms/headset-local mode return 2, as does an
+invalid/stale selector. JSON has schema version 1.
+
+The doctor never uses SSH, scans nearby Wi-Fi networks, opens a connection to
+the Frame, escalates privileges, loads drivers, changes security settings,
+changes channels, unblocks radios, changes network settings, or restarts
+services. Run it as your ordinary user, never with sudo. The app hides the
+entry on macOS, Windows and phone sessions; its API refuses collection in
+headset-local (`FRAME_LOCAL=1`) mode. The source CLI is intended only for the PC.
+
+Reports stay local unless you explicitly save, copy or share them. Exported
+fields include observed USB IDs/product labels, interface names, driver names
+and permission metadata. USB serials, Wi-Fi names, MAC/IP address fields,
+credentials, process arguments and raw command output are not exported. Review
+the report before posting it: hardware labels and local paths can identify
+parts of your setup.
+
+## Motivation and shipped comparison
+
+[The 23 October 2026 complaint](https://x.com/ExpressGinga81/status/2113457683143741720)
+says the Wi-Fi dongle does not work on Ubuntu/Kubuntu 26.04 while SteamVR works
+under Wayland. It supplies **no adapter VID/PID, driver, logs or established
+cause**. This feature helps gather that missing evidence; it does not claim to
+fix that complaint or certify Ubuntu/Kubuntu 26.04 support.
+
+Shipped **v0.4.18** has local network/gateway discovery in `frame_network.py`
+and headset connection management, but no local USB/driver/rfkill adapter
+report or adapter diagnostic UI. The existing `frame-doctor.sh` diagnoses the
+headset through SSH and is a different tool. This doctor never calls it.
+General SteamOS 3.9.5 / Frame OS 0.5.6 compatibility and OS backend transition
+notes are covered separately in
+[`docs/steamos-2026-10-compat.md`](https://github.com/saphid/frame-control/blob/9c7110c1f48d160b0fb3c3b9f658d4937bd2032d/docs/steamos-2026-10-compat.md)
+([PR #164](https://github.com/saphid/frame-control/pull/164)). Existing PC
+route/SSID diagnostics use NetworkManager's `nmcli` with an `iwgetid` SSID
+fallback, independently of whether NetworkManager uses wpa_supplicant (SteamOS
+3.9.5 new installs) or iwd (upgrades). This doctor reads actual PC evidence and
+does not infer a conflict, hardware identity or fix from those OS defaults.
+There is no adapter-specific device observation in that compatibility work.
+
+## Verification
+
+```sh
+python3 -m unittest discover -s tests -p test_wireless_doctor.py -v
+python3 -m unittest discover -s tests
+```
+
+Tests use an explicitly synthetic USB `1234:5678`, sysfs trees, command replies
+and loopback HTTP. They cover an unbound USB device, module binding, multiple
+interfaces, PHY-matched and unrelated rfkill entries, channel parsing, manager
+coexistence, missing/denied commands, stale/injected selectors, export field
+filtering, authentication and refusal to probe in headset-local mode. The
+HTTP tests instantiate the handler without starting headset workers.
+
+Linux host collection was exercised on kernel `6.8.0-139-generic`: an existing
+PC interface was visible with its `iwlwifi` binding and unblocked PHY; `iw` and
+`nmcli` were absent and reported as unavailable. This is **not a physical Steam
+Frame Wireless Adapter test**, an Ubuntu/Kubuntu 26.04 test, or a headset test.
+No Frame access is part of this work.
@@ -7,6 +7,12 @@ the Mac's own keyboard. Find it under **Tools → Mac in the headset** (macOS
 only). On Windows there's an experimental port,
 [PC in the headset](pc-in-headset.md).

+On a **whole Mac display** panel, click **Switch Mac app (⌘Tab)** to send one
+Command-Tab chord to the Mac. The button is absent from single-window panels;
+those already keep their own source. It requires the same Mac Accessibility
+permission as other viewer keyboard input. The chord and button have automated
+checks, but a worn-headset click has not been verified.
+
 The confidence labels are the same as in [ssh.md](ssh.md).

 ## Why this design
@@ -0,0 +1,74 @@
+# Headset view in OBS
+
+Frame Control can send SteamVR's headset mirror and the Frame's output audio to
+OBS on a Windows, Linux or macOS computer. The helper uses the same `/dev/video99` video
+source and default-output monitor as **Capture & Live → Record**. It sends a
+local MPEG-TS stream; no port is opened to the LAN or internet.
+
+1. Connect to the Frame and start SteamVR. OBS runs on the computer; the Frame
+   already has `ffmpeg`.
+2. In the **Frame Control desktop app**, open **Capture & Live** and click
+   **Start OBS source**. Keep Frame Control open; **Stop OBS source**, switching
+   headsets, or quitting the app closes its SSH stream. It uses the selected
+   headset and the app's bundled helper.
+3. In OBS, add a **Media Source**, clear **Local File**, set **Input** to
+   `udp://127.0.0.1:15099`, and set **Input Format** to `mpegts`. The source
+   carries video and AAC audio. Use OBS's audio mixer to choose monitoring and
+   recording levels.
+
+From a source checkout, you can instead install `python3` on the computer and
+run:
+
+   ```sh
+   python3 scripts/obs-headset-source.py
+   ```
+
+Ctrl+C stops the checkout helper. The app closes a control pipe when you click
+Stop or quit; the helper then closes its SSH child, including on Windows. On
+Windows, install Python 3 and OpenSSH Client if Frame Control cannot find them.
+The Windows app Start/Stop path still needs a physical Windows/Frame test.
+If no first packet arrives within 20 seconds, or an active stream sends no
+packet for 10 seconds, the helper closes SSH and shows an error instead of
+leaving **Start OBS source** waiting or a frozen source running indefinitely.
+
+To share the OBS view in a call, see the short
+[Discord setup guide](streaming-to-discord.md).
+
+`--height 1080 --fps 60` increases quality and Frame CPU use. The default is
+720p30. `--port 15100` selects another loopback port; use the same port in
+OBS. If the Frame's PulseAudio monitor cannot be read, the helper exits with
+an error. Use `--no-audio` only when a silent view is useful. To inspect the
+stream without OBS, run `ffprobe -v error -show_streams
+udp://127.0.0.1:15099` in a second terminal while the helper is running.
+
+This is the composited, undistorted one-eye **SteamVR mirror**, not a raw
+passthrough camera feed. The mirror may be blank when the headset is idle or
+unworn. Whether active passthrough pixels appear in it is still unverified.
+The helper does not send a microphone. It is designed for one local OBS
+receiver. **Verified 2026-10-25:** the helper bundled in the Linux AppImage
+sent a real Frame stream to OBS 30's Media Source. OBS recorded 37.6 seconds
+with H.264 video and AAC audio; a brief 440 Hz tone played to the Frame's
+default output was present in the saved audio. The headset was in standby, so
+the video showed the standby mirror. Nobody listened to OBS's monitoring output,
+and audio/video sync and active passthrough remain unverified. See the
+[test evidence](evidence/obs-media-source-real-2026-10-25.md).
+The [follow-up Linux/Frame transport check](evidence/obs-followup-2026-10-25.md)
+measured packet continuity and a short MP4 recording on the current SteamOS
+build. The headset was still in standby.
+
+## Known issue: game audio in OBS
+
+A Frame owner [reported](https://x.com/AzizahStellazio/status/2114147449468293171)
+that OBS **Game Capture / Application Audio Capture** can lose game audio when
+the headset turns on. OBS support attributed this to Valve/SteamVR. Frame
+Control cannot change that game-audio routing. If it happens, use Frame
+Control's **Start OBS source** and OBS **Media Source** steps above to capture
+the headset view and its output audio. You can also try OBS **Desktop Audio
+Capture** for the computer's output, then check its meter and a short test
+recording before you stream. Do not leave two active sources for the same audio
+unless you want duplicate sound.
+
+The real Frame/OBS check above proved that a synthetic tone from the Frame's
+output reached the Media Source recording. It did **not** use a running game,
+listen to the audio, reproduce the reported Game Capture failure, or measure
+audio/video sync. Real game audio while the headset is awake remains unverified.
@@ -190,7 +190,24 @@ HTTP focus is not evidence of worn-headset laser input. Follow the

 ## Saved spatial layouts: blocked on the current panel route

-**Verified 2026-09-28**, same build, using a temporary xterm panel with
+**Rechecked 2026-10-24**, SteamOS 0.5.6, BUILD_ID `20261015.6141207`,
+SteamVR 2.18.2: a read-only probe of the existing Gamescope and Steam main
+panels still reports type 5 (`DashboardTab`), and both the absolute and
+tracked-device-relative getters return 18 (`WrongTransformType`). Width and
+curvature read successfully. **Some pose readback is available:**
+`GetTransformForOverlayCoordinates` at the panel center succeeds in standing
+space; seated and raw origins return 23 (`RequestFailed`). Both panels and the
+dashboard were hidden. That matrix snapshot does not identify docking, prove
+visible placement, or establish a restore operation. The shipped dashboard
+stores dock location and relative transforms internally; no supported external
+snapshot/restore pair was established. No setters or docking commands were run
+in this recheck. See the [exact probe, results, cleanup and remaining
+gaps](evidence/panel-layout-2026-10-24.md). Saved layouts remain unavailable.
+
+### Earlier mutation evidence (2026-09-28)
+
+**Verified 2026-09-28**, SteamOS 0.4.1, BUILD_ID `20260925.6191901`,
+SteamVR 2.18.1, using a temporary xterm panel with
 `STEAM_GAME=2000999031` and `FnTable:IVROverlay_028` from
 `/opt/steamvr/bin/linuxarm64/libopenvr_api.so`:

@@ -1,5 +1,9 @@
 # PC in the headset (Experimental)

+For Steam's own Linux Wayland desktop-sharing flow, see the separate
+[Steam desktop sharing helper](steam-pipewire.md). It does not enable this
+feature on Linux.
+
 **Tools → PC in the headset**, on Windows only. It's the Windows version of
 [Mac in the headset](mac-in-headset.md): a whole screen on your PC
 becomes its own SteamVR panel in the Frame. Individual windows are available only
@@ -9,6 +13,12 @@ whole screens. Place the panel with the dashboard's Float
 in World, Move and Size, point and click with the laser, scroll with the
 thumbstick, and type on the PC's keyboard.

+On a whole-screen panel, click **Switch PC window (Alt+Tab)** to switch the
+foreground Windows window. It sends one explicit Alt-Tab chord through the
+viewer's existing input channel. The button is absent from single-window panels
+when a WGC-enabled build supports them. A real Windows/Frame button click has
+not been verified; use the PC keyboard if focus does not move as expected.
+
 **It's experimental.** A Windows 11 VM has captured its real desktop with
 Desktop Duplication and encoded it with Media Foundation and JPEG. Physical PCs,
 hardware encoding and physical laser input remain unverified. See
@@ -1,6 +1,9 @@
 # Recording and Steam clips

-Frame Control can record what the headset shows, with its sound, and save it as
+For a live OBS Media Source with headset output audio, see
+[Headset view in OBS](obs-headset-source.md).
+
+Frame Control can record SteamVR's mirrored headset view, with its sound, and save it as
 an `.mp4` on your computer. It can also export the clips and background
 recordings from Steam's own game recording, at any length, as one `.mp4` each.
 Both are on **Tools → Capture & Live**. Everything is saved to
@@ -47,6 +50,21 @@ the Frame, converted to `.mp4` there (without re-encoding) and copied to

 Recording and **Live** can run together; both read the same device.

+### Does Record include passthrough?
+
+**Record captures SteamVR's `system.HeadsetView` mirror from `/dev/video99`.**
+Frame Control does not open the headset's passthrough cameras or add a separate
+camera layer to the MP4. If SteamVR puts passthrough into that mirror, it will
+appear in the recording; Frame Control cannot force or promise that result.
+Steam's own **Steam clips** use a separate game recording path and may differ.
+
+On 25 October 2026, the Frame was in standby. A frame captured from
+`/dev/video99` was black, as expected in standby, so this check **did not
+establish whether active passthrough appears in the mirror**. A wearer-visible
+passthrough session and its simultaneous mirror frame are still needed for a
+yes-or-no answer about passthrough pixels. See the
+[live compatibility evidence](evidence/steamos-compat-live-2026-10-25.md).
+
 ## Steam clips

 **Steam clips** lists what Steam's game recording has kept on the Frame: saved
@@ -89,6 +107,18 @@ about once a minute and copies what's new with the same code as **Save** and
 **Export**: screenshots to `~/Pictures/SteamFrame`, clips to
 `~/Videos/SteamFrame`.

+Each newly saved screenshot lives under
+`~/Pictures/SteamFrame/headset-<id>/<Steam account>/<game ID>/<filename>`.
+The headset folder uses a short hash of Frame Control's device identity.
+Steam can use the same screenshot filename for two games or accounts; these
+folders keep both originals. Existing screenshots in the old flat
+`~/Pictures/SteamFrame/<filename>` layout stay where they are. They cannot be
+matched reliably to one headset and game, so **Copy everything now** can create
+a new, correctly identified copy. It never overwrites the old file.
+One real Frame screenshot was copied through this path on 25 October 2026;
+see the [test record](evidence/screenshot-copy-2026-10-25.md). The collision
+case was tested with separate fake sources, not two real same-name screenshots.
+
 - **Only what's new.** It copies what you take after turning it on, so the
  shots and clips already on the headset don't all arrive at once. **Copy
  everything now** copies everything that isn't on this computer yet, once.
@@ -13,7 +13,9 @@ count. So a build reaches people only when you publish it, after testing it.
   ```

   `.github/workflows/release.yml` builds macOS, Windows and Linux, and
-   attaches everything to a **draft** release for that tag. Nobody is
+   attaches everything to a **draft** release for that tag. After all eight
+   installers upload, the workflow also attaches `SHA256SUMS` built from
+   GitHub's SHA-256 digests of those uploaded bytes. Nobody is
   offered a draft. Editing a draft while installers are uploading can make
   GitHub temporarily show its tag as `untagged-…`. The workflow finds that
   draft by its exact version title, restores the tag association and retries
@@ -32,7 +34,9 @@ count. So a build reaches people only when you publish it, after testing it.
   ```

   The script checks that the tag is on GitHub and that all eight installers
-   are attached, each with the SHA-256 digest GitHub records. It attaches
+   are attached, each with the SHA-256 digest GitHub records. It also checks
+   that the uploaded `SHA256SUMS` digest matches a fresh list of those eight
+   installer digests. It attaches
   `update.json` (the version, the notes, the release page and each
   installer's digest), then publishes the release and marks it latest. It
   uses only the REST API: `gh release view` can't find a draft whose
@@ -46,14 +46,14 @@ unless your router's DNS registers DHCP client names.

 ```sh
 ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_frame -N '' -C "mac->steam-frame"
-ssh-copy-id -i ~/.ssh/id_ed25519_frame.pub steamos@frame.local
+ssh-copy-id -i ~/.ssh/id_ed25519_frame.pub steamos@192.168.1.40
 ```

 `~/.ssh/config` block (managed between marker lines by the script):

 ```
 Host frame
-  HostName frame.local
+  HostName 192.168.1.40
  User steamos
  IdentityFile ~/.ssh/id_ed25519_frame
  IdentityFile ~/.ssh/id_rsa_frame_devkit
@@ -62,6 +62,10 @@ Host frame
 ```

 The script only asks for the password if the pairing below doesn't work.
+Replace the example IP with the one in the Frame's Quick Settings. SteamOS
+0.5.6 stopped publishing `.local` names; an existing SSH alias or the headset's
+current IP is more reliable. Frame Control remembers authenticated IPs per
+network and checks the saved SSH identity on reconnect.

 ## Password-free pairing (SteamOS devkit service)

@@ -0,0 +1,92 @@
+# Steam desktop sharing on a Linux PC
+
+**Tools → Steam desktop sharing** helps with Steam's own `steam -pipewire`
+desktop-in-headset flow on a local Wayland PC. It needs no Frame connection.
+It is separate from Frame Control's [PC in the headset](pc-in-headset.md),
+which remains disabled on Linux. Steam and the desktop portal own the capture,
+screen picker and headset flow; this helper does not provide a stream.
+
+## Launch Steam with PipeWire
+
+Save your game and use **Steam → Exit** first. Then click **Launch Steam with
+PipeWire**. Frame Control checks this user's local processes, finds `steam` on
+PATH, and requests `steam -pipewire`. This flag applies to that launch only.
+No Steam settings, login files or startup entries are changed. An existing
+Steam session is never stopped, signalled or silently switched.
+
+If Steam or a Steam launcher/helper is running, the button explains that Steam
+must be exited first. If the process inventory cannot be read, it refuses to
+launch. It also refuses root, SSH, headless, X11 and Flatpak-sandboxed Frame
+Control sessions. Run Frame Control as your normal user in the local Wayland
+desktop with its session bus.
+
+For a Flatpak-only Steam install without a `steam` command on PATH, the helper
+provides a manual command instead of choosing an installation for you. After
+exiting Steam, run `flatpak run com.valvesoftware.Steam -pipewire` in a local
+terminal. Flatpak Steam processes are included in the existing-session check.
+
+A successful request is **not confirmation of a picker or stream**. Steam may
+exit or fail after the initial check, and another launcher can race the local
+process check. Do not start Steam elsewhere at the same time. If nothing opens,
+run the command yourself in a terminal to see Steam's error.
+
+## Reset screen-share choice
+
+Click **Reset screen-share choice…** to request KDE's **Application Permissions**
+page. This button does **not** revoke anything or report a completed reset.
+Frame Control cannot reliably map a Steam runtime display name to a
+Steam-specific portal grant or restore token across backends. It never reads,
+edits or clears the portal permission store or Steam tokens.
+
+On KDE:
+
+1. Open **System Settings → Applications → Application Permissions** if the
+   button cannot open it.
+2. Find the entry for Steam. The Ubuntu 26.04 KDE report showed **Steam Linux
+   Runtime 3.0**. That display name alone is not proof that every session there
+   is safe to remove; verify the session belongs to your Steam desktop share.
+3. Under **Screen sharing**, choose **Manage 1 Session** (the count may differ).
+4. Choose **Revoke** for that verified session only. **Do not use Revoke All**
+   or change another application's grants. If ownership is ambiguous, stop.
+5. Retry Steam's desktop sharing flow. The reporter saw the portal picker again
+   after revoking that session. Results can differ by Steam and portal version.
+
+The reported entry sometimes appeared intermittently. If it is missing, do not
+clear other entries or the whole portal store. Check again when Steam's sharing
+session is present. If **Application Permissions** itself is missing on
+Ubuntu/Kubuntu, check your distribution's `kde-config-flatpak` package: the
+reporter needed that package and a reboot before the page appeared. Frame
+Control does not install packages, reboot, request root or change security
+settings. Older KDE modules may lack this page; other desktops receive guidance
+only, with no automatic reset or guessed permission target.
+
+The launcher uses `kcmshell6 --list` to verify the exact module, then
+`kcmshell6 kcm_app-permissions`. It does not substitute the older Flatpak-only
+page. A request to open the page does not prove that a window became visible.
+
+## Evidence and limits
+
+- User-supplied report and screenshot description:
+  [ExpressGinga81's thread and replies](https://x.com/ExpressGinga81/status/2113242533530911058).
+  The report describes Ubuntu 26.04 KDE, the initial picker appearing once,
+  the Steam Linux Runtime 3.0 entry, and Revoke making the picker reappear.
+  This is reported behavior, not a live test performed for this feature.
+- KDE upstream [`flatpak-kcm`](https://github.com/KDE/flatpak-kcm):
+  `CMakeLists.txt` and `kcm_app-permissions.json` identify Application
+  Permissions; `ui/SessionList.qml` distinguishes Revoke from Revoke All.
+- Automated tests mock Steam, processes and KDE commands. HTTP tests verify
+  request guards, no actions on GET, and no headset work. Existing CI discovers
+  these tests on Linux, macOS and Windows; they do not need a desktop portal.
+- lxso2 has no interactive Wayland/PipeWire portal for a chooser test.
+  **No live chooser, revoke, Steam launch or headset display is verified here.**
+  No Frame access was performed for this task, including during the hold before
+  2026-10-24 13:00 UTC. The helper never invokes SSH or Frame controls.
+
+## Announcement
+
+Linux Wayland users can now find **Steam desktop sharing** under Tools to
+request Steam with `-pipewire` after exiting Steam, or open KDE's Application
+Permissions to revoke only a verified Steam screen-sharing session and try the
+picker again. Frame Control does not clear permissions automatically. This is
+help for Steam's own desktop-sharing flow; Frame Control's Linux capture
+feature remains disabled. Live picker behavior still needs desktop validation.
@@ -0,0 +1,67 @@
+# SteamOS October 2026 compatibility
+
+SteamOS 3.9.5 is the **PC host / Steam Machine** update. It is not the Frame
+headset OS. The headset release discussed here is **SteamOS 0.5.6 beta**.
+
+## Finding and connecting to the headset
+
+SteamOS 0.5.6 stopped publishing mDNS names, including `frame.local`. Existing
+addresses in Frame Control still work if they resolve, and the app tries all
+saved addresses. After an authenticated connection through a `.local` name,
+Frame Control also remembers the numeric IP on that network. If the name stops
+resolving, it tries that IP and checks the same pinned SSH identity before using
+it. The IP is never reused automatically on a different network.
+
+In **Devices**, **Find on this network** checks the SteamOS devkit advertisement,
+known IPs and the local IPv4 `/24`. It offers scan results only when their SSH
+key matches the headset's saved key. The scan is bounded to a private subnet;
+it cannot find a headset across a router or on another subnet. Enter the IP
+shown in the headset's Quick Settings in the address field in those cases.
+For initial pairing, **Set Up Connection** accepts a manual IP and reuses an
+existing `~/.ssh/config` `HostName` before trying mDNS. A configured SSH alias
+continues to work. Frame doctor no longer assumes `frame.local`: supply
+`--lan <IP>` when a separate LAN route is needed.
+
+## SteamOS script names
+
+Session switching already prefers `holo-session-select` over
+`steamos-session-select`, after the Frame's `steamosctl` control. Desktop
+process detection accepts `holo-nested-desktop` and its old name. The sideload
+helper prefers `holo-prepare-upload` and `holo-delete` if a future devkit
+provides them, falling back to the vendored `steamos-*` scripts. The devkit
+service name `_steamos-devkit._tcp` is a protocol identifier, so it is not
+renamed.
+
+## SteamOS 3.9.5 Linux PC hosts
+
+NetworkManager's `nmcli` supplies the active SSID and route diagnostics; the
+SSID reader falls back to `iwgetid`. Neither depends on whether NetworkManager
+uses wpa_supplicant (new installs) or iwd (upgraded installs). The current code
+does not manage either backend or the Steam Frame Wireless Adapter. An adapter
+doctor belongs in its own PC host feature.
+
+## Android APKs and telemetry
+
+The 0.5.6 Desktop Mode **Add to Steam** action for `.apk` files is another way
+to make a Steam library entry. Frame Control already creates a non-Steam
+shortcut for every installed APK through the running Steam client's API, with
+its own persistent Lepton instance and artwork. It does not edit
+`shortcuts.vdf` or require a Steam restart, so no extra shortcut option is
+needed in its install flow.
+
+The battery reader selects a system battery by power-supply `type` and `scope`
+and reads standard sysfs fields. The memory reader uses `/proc/meminfo`.
+Neither relies on the performance overlay's labels or hard-coded SteamOS
+paths. SteamOS 0.5.6's improved overlay reporting does not establish a sysfs
+path change. A live check on build `20261022.6153909` confirmed that Frame
+Control's existing readers return battery and memory values. The dominant-eye
+setting is not read yet; recording metadata must not claim an eye until its
+source and effect on `/dev/video99` are verified. The same check found the
+`beta` update branch, but the normal user could not query update availability
+through Atomupd; no update was applied. See the
+[live evidence](evidence/steamos-compat-live-2026-10-25.md).
+
+Sources: [SteamOS 3.9 news](https://store.steampowered.com/news/app/1675200),
+[Frame OS news](https://steamcommunity.com/app/4165890/allnews/), and the
+Frame Control implementation in `ui/frame_network.py`, `ui/frame_status.py`,
+`ui/frame_android.py`, `ui/frame_link.py` and `frame/android/steam_shortcuts.py`.
@@ -0,0 +1,20 @@
+# Share the Frame view in Discord
+
+1. Start the **OBS source** in Frame Control and add it to OBS as described in
+   [Headset view in OBS](obs-headset-source.md). Confirm that OBS shows the
+   headset mirror and that its audio meter moves before joining a call.
+2. In OBS, click **Start Virtual Camera**. In Discord's **Voice & Video**
+   settings, select **OBS Virtual Camera** as the camera, then turn it on in the
+   call. This sends the OBS scene as video.
+3. If the call needs the Frame's game sound, route OBS's monitored Media Source
+   audio to a virtual audio input installed on your computer, then select that
+   input as Discord's microphone. Keep headphones on to avoid feedback. Test
+   this in a private call first; a virtual camera alone carries no audio.
+4. Stop the OBS source in Frame Control when you finish. It closes the SSH
+   stream; OBS may keep showing its last frame until the source is hidden.
+
+Frame Control sends the Frame's **output audio**, not its microphone. Discord
+audio routing differs by computer and requires a separate virtual audio device
+if you want game sound in the call. This guide has not been verified in a real
+Discord call. The SteamVR mirror can be blank while the headset is idle, and
+active passthrough in that mirror remains unverified.
@@ -154,10 +154,31 @@ two fingers to scroll, two-finger tap to right-click) plus a text field that
 types on the Frame. On a computer, clicking the pad passes your mouse and
 keyboard through to the Frame until you press Esc (⌘ is sent as Ctrl on a Mac).

-It goes through **KDE Connect**, the first-party route (KDE makes the Frame's
-desktop): Frame Control's server runs [`ui/frame_input_agent.py`](../ui/frame_input_agent.py)
-on the Frame, which talks KDE Connect's own LAN protocol to the Frame's
-`kdeconnectd` as if it were a phone. KDE Connect does the typing and clicking.
+Since Control (below), the pad goes through **gamescope's own input socket**
+([`ui/frame_touch.py`](../ui/frame_touch.py)), so it reaches whichever panel has
+focus, Steam's own menus included, and needs nothing installed on the Frame.
+Only characters that aren't on a US keyboard (accents, emoji) go through
+**KDE Connect** as below; it starts the first time you type one. (Before
+Control, everything went through KDE Connect, which is why the notes below
+describe it in detail.)
+
+The server keyboard queue holds at most 200 events, including text being sent.
+A batch with an accent sends its whole keyboard part through KDE Connect, and
+later keys follow it there while typing is pending. If the batch will not fit,
+the server rejects it before sending any clicks or keys; the page keeps it and
+retries after polling. Accepted events are never evicted to make room. A timeout
+or helper failure retains unsent text and shows **Try again**; that button resumes
+the retained queue. The queue lives in memory and is lost if the server exits.
+Switching headsets cancels queued text and stops both input helpers before the
+new route is published. Both controls validate the intended headset before they
+start. Ordering between the two input services uses a typing-time estimate;
+neither service acknowledges when characters reach the application.
+
+[PR #66 verification on 2026-10-24](evidence/pad-gamescope-2026-10-24.md)
+records an owned focused X11 panel receiving a click and `Frame66` plus Enter
+on a real Frame with SteamOS 0.5.6, after the shared headset became available.
+The helper, window and owner-marked lock were cleaned up. This is ASCII input
+proof, not wearer-visible, Unicode or packaged Electron GUI verification.

 **Verified 2026-09-28** (SteamOS 0.4.1, build 20260925.6191901):

@@ -295,6 +316,10 @@ How (**verified 2026-09-29**, SteamOS 0.4.1, build 20260925.6191901):
  if it persists, report the exact message and SteamOS version. The confirmed
  empty-list advice is retained when the property is present but empty.
  [2026-10-24 investigation and verification limits](evidence/panel-discovery-2026-10-24.md).
+  A later [packaged v0.4.17 test on the real Frame](evidence/desktop-capture-packaged-2026-10-24.md)
+  captured a mapped, focused nested KDE compositor on SteamOS 0.5.6. SteamVR
+  still reported its overlay hidden, so that test does not establish the
+  wearer's visible-desktop condition in #73 or justify closing it.
 - Tested from the iPhone app (Simulator): a tap on the Desktop view focused a
  text box in the panel and the text field typed into it; a trackpad move went
  exactly (+40, +25).
@@ -52,6 +52,7 @@
 <body>
 <main>
  <h1>Frame Control 0.3.1: features by OS</h1>
+  <p><strong>This is a September 2026 archive.</strong> For current coverage and hardware limits, read the <a href="current-support-matrix.md">v0.4.25 support matrix</a>.</p>
  <p class="sub">Which features are built for each OS, and which were tested against a real Steam Frame
    (SteamOS 0.3.0, build 20260922.6101926). Status as of 26 September 2026, for
    <a href="https://github.com/saphid/steam-frame/pull/2">PR #2</a> (0.3.1). Every build now bundles its own
@@ -12,6 +12,16 @@ A fourth, a SteamOS VM, may come later ([issue #6](https://github.com/saphid/ste

 ## Unit tests

+The gamescope keyboard/trackpad route has focused suites in `test_input.py`,
+`test_touch.py` and `test_service_regressions.py`. They cover pad translation,
+ASCII/modifier keys, Unicode queuing/retries, stale panel targets, release
+handling, route cancellation, and intended-headset start/status guards.
+`tests/page/pad_queue.mjs` and `tests/page/ctrl_gestures.mjs` execute the page's
+real queue and gesture functions in Node. These are offline tests; their
+acknowledgements do not prove that a real application received input.
+See [the 2026-10-24 PR #66 evidence](evidence/pad-gamescope-2026-10-24.md)
+for the real focused-panel click/key observation, cleanup and remaining limits.
+
 The read-only power/heat sampler has fixture and transport tests in
 `tests/test_power_sample.py`. Run
 `python3 -m unittest discover -s tests -p test_power_sample.py -v`.
@@ -165,6 +175,14 @@ Record the build, actual interaction results, cleanup and any unworn-headset
 limits alongside screenshots or logs. These are caller responsibilities; the
 smoke script below does not acquire this shared lock itself.

+[Packaged Desktop Capture evidence, 2026-10-24](evidence/desktop-capture-packaged-2026-10-24.md)
+records v0.4.17 GUI button captures of a real mapped nested desktop on SteamOS
+0.5.6, a bounded owned user unit, and cleanup back to the original Game Mode
+state. Check X window mapping/focus and SteamVR overlay visibility separately:
+successful capture of a mapped window does not prove the desktop is visible
+to a wearer. That run's overlay stayed `not_visible`; #73 remains unverified
+for its reported visible-desktop/0.4.5 condition. Only state/log metadata is public.
+
 ```sh
 scripts/frame-smoke.sh           # needs `ssh frame` to work without a password
 scripts/frame-smoke.sh --pair    # also pairs a throwaway key: approve it in the headset
@@ -374,7 +392,11 @@ trees on the fake Frame. None of it has run on a headset.

 `tests/test_media.py` covers layout evidence and overrides, OU eye ordering,
 hardware-decoder command construction, malformed splats, stereo parallax and
-fake-Frame library/process ownership. `tests/e2e/test_media_transfer.py` checks the real
+fake-Frame library/process ownership. It also covers optional-surround refusal
+at creation, setup, first upload and retry after standby, fatal screen refusal,
+and best-effort overlay teardown with shutdown.
+Run `python3 -m unittest discover -s tests -p test_media.py -v`.
+`tests/e2e/test_media_transfer.py` checks the real
 HTTP/SSH upload and library listing without pretending the fake renders VR.
 Real decode timings and captured stereo output are recorded in
 [vr-video.md](vr-video.md). Generated media only; no external player required.
@@ -461,3 +483,19 @@ rule, which the original source-only assertion missed. Check computed wrapping,
 the complete explanation, tooltip punctuation, Refresh bounds and selection
 after **Use this headset** when changing these styles. This fixture does not
 exercise Electron integration or a real SSH identity change.
+
+
+## PC-only Windows wireless diagnosis
+
+```sh
+python3 -m unittest discover -s tests -p 'test_wireless.py' -v
+node --test tests/wireless.cjs
+```
+
+The checks workflow runs this targeted suite on Windows, including the real
+read-only PowerShell query, and the normal server suite includes it on all
+platforms. HTTP tests instantiate only a handler, never the app connector.
+Fixtures cover duplicate instance identity, unknown states, GUID matching,
+localised/denied channel data and 6 GHz ambiguity. No tests contact a real Frame.
+A Windows CI runner/VM cannot prove physical Steam dongle behaviour or audio RF
+interference. See [sources and limits](windows-wireless-doctor.md).
@@ -101,6 +101,14 @@ Stills and the theatre surround are re-sent after waking. Five minutes
 without an accepted frame is reported as an error. Headset-view captures
 taken during standby show a flat dark frame, not our screen.

+**Optional surround:** if SteamVR refuses the theatre dark surround at startup
+or on a retry after standby, playback continues without it and the player log
+records `Theatre surround unavailable`. Screen errors still fail playback.
+On exit, the player attempts to destroy every owned overlay and calls OpenVR
+shutdown even if an overlay's teardown raises an exception. Refusal and
+teardown errors are covered by fake-OpenVR tests; a real surround refusal has
+not been induced safely. See the [current hardening checks](evidence/media-surround-2026-10-24.md).
+
 ![Media panel in Frame Control while a photo plays on the Frame](img/media-ui-panel.png)

 **Verified failed route:** GStreamer 1.24.2's `playbin` selected
@@ -0,0 +1,141 @@
+# Windows Wireless Adapter doctor
+
+Open **Tools → This PC → Wireless Adapter doctor**, then choose **Read PC
+adapters**. It works without a headset connection. It only queries this Windows
+PC, with no automatic polling, changes, elevation or UAC prompt. It never
+contacts the Frame. A direct `#wireless` link on another platform explains that
+Windows is required.
+
+The snapshot shows:
+
+- Exact network PnP instance IDs, including non-present devices, with separate
+  presence, PnP status/problem code, operational state and media connection state.
+- Microsoft Wi-Fi Direct Virtual Adapter candidates and their distinct instance
+  count. `SWD\WIFIDIRECT\` is enumerator evidence; an English device-name match
+  is explicitly labelled **Name only**. A repeated row for one ID is counted once.
+- PC Wi-Fi interfaces, hardware-interface status and whether Windows has a
+  default route configured on an interface. Neither a route nor **Up** proves
+  that Steam uses that adapter. Multiple configured defaults are possible.
+- Reported channel and band, when `netsh wlan show interfaces` supplies recognised
+  English fields and an exact matching interface GUID. Missing, localised,
+  disconnected or denied readings remain **Unknown**. There is no name-based
+  channel association. A PC's router channel is not the Steam dongle's channel.
+- Possible spectrum overlap when an interface reports **2.4 GHz**, without
+  claiming interference. With no such reading, overlap stays **Unknown**:
+  unreported virtual/proprietary radios and audio dongles may still use 2.4 GHz.
+  Channel 1–14 alone does not identify a band: 6 GHz reuses low channel numbers.
+
+## Why there is no disable button
+
+[夕凪's report](https://x.com/Oo_yuunagi_oO/status/2113904070352343135)
+(24 October 2026) says extra Microsoft Wi-Fi Direct Virtual Adapter instances
+appear when their wireless adapter becomes unavailable, and disabling the newly
+appeared one *seems* to stop recurrence. This is useful owner evidence, but does
+not establish which instance would be safe to disable on another PC.
+
+Windows can legitimately create several Wi-Fi Direct virtual interfaces.
+A `#2` suffix is not a creation timestamp; non-present, down, or disconnected
+status is not proof of an unused instance. The inventory does not reliably map
+Steam's active radio/session to an expendable PnP instance. Disabling the wrong
+one could interrupt streaming, PC Wi-Fi, Mobile Hotspot or wireless displays.
+Frame Control therefore supplies evidence and guidance, with no disable,
+re-enable, driver removal or other write endpoint. It never changes security or
+location settings, requests administrator access, or bypasses execution policy.
+
+Before any manual changes, retain the exact instance IDs and compare snapshots
+before/after a drop with Steam Support. Do not disable a device based only on
+this report. A future disable feature needs a verified Steam adapter/session
+mapping, fresh protection for primary/active instances, explicit confirmation
+for one exact instance, and a tested recovery path that re-enables that same ID.
+
+## When a stream drops immediately or the adapter will not reconnect
+
+Read PC adapters **before** starting a stream, then refresh immediately after a
+drop. Compare the *exact* PnP instance IDs, presence and problem codes. Note
+whether the PC's own Wi-Fi drops too. A new `#2` name is not proof that this
+instance caused the failure. Keep the time of the drop and the two snapshots
+for Steam Support; the doctor does not save or upload them.
+
+The app shows **Changes since previous read** after the second click. It
+compares exact PnP IDs, known status fields and reported channels/bands; an
+unknown value is never treated as a state change. If the PnP source was
+unavailable in either read, it declines to compare devices. Each successful
+read becomes the baseline for the next one. **Forget previous read** clears the
+baseline and comparison; closing the app clears them too. The before/after
+comparison stays in local memory and is not uploaded or added to telemetry.
+Reported changes can reflect sequential query timing or a service recovering,
+not a fault or permission to disable any instance.
+
+To narrow a drop at stream start, try one condition at a time: wired PC
+networking instead of PC Wi-Fi, wired headphones instead of 2.4 GHz audio, and
+spacing the USB radio dongles apart. Recheck the stream after each change. The
+PC Wi-Fi channel in this report is not the Steam dongle's channel, so a matching
+or different number does not establish interference.
+
+If the adapter will not reconnect, stop the failed stream and close Steam's
+streaming session before touching its USB connection. Refresh the inventory. If
+the dongle is absent, reconnect it once at the PC, understanding that this
+interrupts any connection using it, then refresh again. If the **same exact**
+PnP instance now reports problem code 22 (disabled), review that instance in
+Windows Device Manager and its normal enable action. Do not enable or disable a
+different numbered instance by guesswork. For a missing device or another
+problem code, record the before/after ID and code for Steam Support; do not
+guess a driver or change security settings.
+
+These are user-controlled checks, not an automatic repair. We have no physical
+Steam Wireless Adapter dropout to reproduce and no verified mapping from a
+Wi-Fi Direct virtual instance to Steam's active session. An in-app disable and
+re-enable control remains deferred until that mapping and a recovery path are
+tested on real hardware.
+
+## Checking a 2.4 GHz audio conflict
+
+[Deko's report](https://x.com/DekoDrak/status/2113412044644897023)
+(22 October 2026) describes Razer wireless-headset interference and temporarily
+disabling the Steam Frame dongle. It also mentions a PC/Wi-Fi shutdown during
+Windows Update and asks whether the dongle caused it. The post does not prove
+that connection or specify a measured audio radio channel. Treat the suggested
+2.4 GHz conflict as a hypothesis, not a diagnosis of the shutdown.
+
+Try wired audio briefly, separate radio dongles with a USB extension lead, or
+compare PC Ethernet / an existing 5 or 6 GHz network. Change one thing at a time
+and record whether symptoms recur. The doctor cannot measure RF congestion,
+read an audio dongle's channel, identify a faulty driver, or prove a dropout fix.
+
+## Sources, privacy and limits
+
+The single local PowerShell process uses `Get-PnpDevice -Class Net`, its
+`-PresentOnly` variant, `Get-NetAdapter -IncludeHidden`, `Get-NetRoute` for
+IPv4/IPv6 defaults, and `netsh wlan show interfaces`. Each source reports
+availability separately. Access denial, unavailable cmdlets/services and
+unsupported features produce partial/unknown results; there is no permission
+workaround. Queries run sequentially, so even one snapshot can span a state
+change. One probe runs at a time, with a 20-second process timeout.
+
+SSIDs, MAC addresses and raw command/error output are omitted from the API/UI.
+PnP IDs and adapter/interface names can identify this PC; review before sharing.
+The tool does not send or save reports, and does not add these readings to
+telemetry or problem-report diagnostics. Copy relevant text manually if needed.
+
+The shipped basic network-identity probe (`frame_network.py`) finds a gateway,
+network name and Tailscale state. It does not inventory virtual adapters or
+check channel overlap. The new doctor is a separate, explicit PC query.
+
+## Verification
+
+`tests/test_wireless.py` checks duplicate identity, presence/disabled/link
+separation, ambiguous joins, partial sources, privacy filtering, 6 GHz/channel
+ambiguity, localisation, missing band and denied output. HTTP tests require the
+UI key, reject headset-local mode, and assert no SSH call. `tests/wireless.cjs`
+executes the production UI with boundary fixtures: navigation starts no query,
+clicks query once, unknown values and failure/retry remain visible, and PnP IDs
+and names are escaped as text.
+
+Windows CI also executes the real read-only PowerShell probe against the
+runner's network devices. That proves Windows query execution, not a physical
+Steam dongle, Wi-Fi Direct session or Razer headset. See the PR for exact CI
+results. An existing local Windows 11 VM passed 15 targeted tests (one UI test skipped
+because Node is absent), including the live query. PnP, presence, adapters and
+routes were available; WLAN was unavailable in this VM. See
+[VM evidence](evidence/windows-wireless-2026-10-24.md). No Frame was accessed; no physical
+adapter/dropout fix or RF measurements are claimed.
@@ -0,0 +1,27 @@
+# Wired connection doctor
+
+If you use a USB-C cable because the Wireless Adapter is unreliable, open
+**Devices & connection → Wired connection doctor** in the desktop app. Enter
+the headset's configured SSH alias and click **Check cable connection**. From
+a source checkout, run `python3 scripts/frame-wired-doctor.py --alias frame`.
+
+The on-demand check reads the computer's selected route to the Frame USB
+address, checks whether port 22 answers, then runs remote `true` over SSH with
+the existing pinned host key. It does not change network settings or the
+headset, accept a new key, or attempt a password. A failure is shown as unknown
+or warning; the doctor never claims a cable works from an IP address alone.
+
+The known address is `10.86.200.233` on the Frame's `10.86.200.232/29` USB
+network. A Mac with the Frame attached used `10.86.200.234/29` and completed a
+strict SSH login on 2026-09-28; see [the observed link](how-the-frame-works.md).
+If the route check says unknown, first confirm a data-capable USB-C cable, a
+visible PC network interface and a current Frame OS build. Other OS builds may
+use another subnet. If the port answers but SSH identity fails, connect using
+the normal pinned headset alias and resolve the pairing or key warning there;
+do not disable host-key checking.
+
+This checks **Frame Control's SSH route**, not whether SteamVR's game stream
+uses the cable. The Wireless Adapter and Steam streaming can follow a different
+path. No cable is attached to the Linux test host, so this exact UI has only
+synthetic route/SSH tests. Windows and Linux physical USB-C behavior, and a
+fresh wired readback on the current Frame OS, remain unverified.
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<link rel="stylesheet" href="style.css">
+<title>Headset Glance</title>
+<main>
+  <h1>Headset Glance</h1>
+  <p id="summary">Reading the headset status…</p>
+  <button id="refresh">Refresh</button>
+</main>
+<script src="main.js"></script>
+</html>
@@ -0,0 +1,29 @@
+let nextId = 0;
+const pending = new Map();
+
+window.addEventListener('message', event => {
+  if (event.source !== parent || event.data?.type !== 'frame-control:response') return;
+  const resolve = pending.get(event.data.id);
+  if (resolve) {
+    pending.delete(event.data.id);
+    resolve(event.data.value);
+  }
+});
+
+function request(action) {
+  return new Promise(resolve => {
+    const id = ++nextId;
+    pending.set(id, resolve);
+    parent.postMessage({type: 'frame-control:request', id, action}, '*');
+  });
+}
+
+async function refresh() {
+  const status = await request('status');
+  document.getElementById('summary').textContent = status.connected
+    ? `Frame OS ${status.os.version || 'unknown'} · Battery ${status.battery.percent ?? '?'}% · SteamVR ${status.steamvr ? 'running' : 'stopped'}`
+    : 'No headset status is available yet.';
+}
+
+document.getElementById('refresh').addEventListener('click', refresh);
+refresh();
@@ -0,0 +1,7 @@
+{
+  "id": "headset-glance",
+  "name": "Headset Glance",
+  "version": "1.0.0",
+  "description": "Shows a small read-only summary of the connected Steam Frame.",
+  "entry": "index.html"
+}
@@ -0,0 +1,4 @@
+body { margin: 0; background: #101820; color: #dcdedf; font: 16px system-ui, sans-serif; }
+main { padding: 24px; }
+h1 { font-size: 20px; }
+button { border: 0; border-radius: 4px; padding: 8px 14px; background: #1a9fff; color: #fff; cursor: pointer; }
@@ -73,7 +73,11 @@ discover_devkit() {
 pick_host() {
  local candidates=()
  [[ -n "$host_arg" ]] && candidates+=("$host_arg")
-  [[ -z "$host_arg" ]] && candidates+=("$FRAME_ALIAS.local" "$FRAME_ALIAS")
+  if [[ -z "$host_arg" ]]; then
+    local saved=$(ssh -G "$FRAME_ALIAS" 2>/dev/null | awk '$1 == "hostname" {print $2; exit}')
+    [[ -n "$saved" && "$saved" != "$FRAME_ALIAS" && "$saved" =~ $HOST_RE ]] && candidates+=("$saved")
+    candidates+=("$FRAME_ALIAS.local" "$FRAME_ALIAS")
+  fi
  local h
  for h in "${candidates[@]}"; do
    if reachable "$h"; then
@@ -224,6 +228,7 @@ pair_with_devkit() {
 print "==> Looking for the Steam Frame"
 if ! HOST=$(pick_host); then
  print -u2 "Could not reach the Frame on port 22 or $DEVKIT_PORT."
+  print -u2 "SteamOS 0.5.6 stopped publishing .local names; use its IP from Quick Settings."
  print -u2 "Check: Developer Mode on + user password set; same Wi-Fi; no client isolation."
  print -u2 "Then re-run with the IP from Quick Settings: scripts/connect.sh 192.168.x.y"
  exit 1
@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+"""Source-checkout entry point for the PC's read-only USB-C route checks."""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / 'ui'))
+from frame_wired_doctor import main  # noqa: E402
+
+if __name__ == '__main__':
+    raise SystemExit(main())
@@ -293,7 +293,7 @@ def load_baseline(path):
 def main(argv=None):
    parser = argparse.ArgumentParser(description='Read-only Frame setup diagnostics. Never pairs, repairs or asks for a password.')
    parser.add_argument('--alias', default='frame', help='Existing trusted SSH alias (default: frame)')
-    parser.add_argument('--lan', default='frame.local', help='LAN fallback host/IP')
+    parser.add_argument('--lan', help='Optional LAN IP or host name; SteamOS 0.5.6 no longer publishes .local names')
    parser.add_argument('--usb', default='10.86.200.233', help='USB fallback IP; use only with the intended headset connected')
    parser.add_argument('--plan', action='store_true', help='Print a read-only repair plan from recognized evidence')
    parser.add_argument('--save-report', metavar='FILE', help='Create a local JSON baseline (never overwrite an existing file)')
@@ -307,6 +307,8 @@ def main(argv=None):
            print('UNKNOWN Baseline: Cannot read a valid doctor report; no comparison performed.')
            return 2
    for value in (args.alias, args.lan, args.usb):
+        if value is None:
+            continue
        if not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._:-]{0,252}', value):
            parser.error('Use a plain alias, hostname or IP address.')
    print('Frame doctor: read-only; no passwords, pairing, repairs or raw logs. Reports are saved only with --save-report.')
@@ -327,7 +329,11 @@ def main(argv=None):
        print('UNKNOWN Baseline: SSH target configuration differs; comparison refused.')
        return 2
    source = Path(__file__).read_text()
-    for label, host in (('configured alias (Tailscale if configured)', None), ('LAN', args.lan), ('USB-C', args.usb)):
+    routes = [('configured alias (Tailscale if configured)', None)]
+    if args.lan:
+        routes.append(('LAN', args.lan))
+    routes.append(('USB-C', args.usb))
+    for label, host in routes:
        result = run(ssh_args(args.alias, host, identity) + ['python3 -B - --probe'], timeout=90, input=source)
        if result is not None and result.returncode == 0:
            try:
@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Send the Frame's SteamVR mirror and output audio to a local OBS Media Source.
+
+OBS opens udp://127.0.0.1:15099 with input format mpegts. Nothing is bound to
+the network: this process sends MPEG-TS packets to the computer's loopback.
+"""
+import argparse
+import shlex
+import signal
+import socket
+import subprocess
+import sys
+import threading
+import time
+
+
+PACKET = 188
+DATAGRAM = PACKET * 7
+STARTUP_TIMEOUT = 20
+STREAM_STALL = 10
+
+
+def remote_command(height=720, fps=30, audio=True):
+    if height not in (720, 1080) or fps not in (30, 60):
+        raise ValueError('height must be 720 or 1080; fps must be 30 or 60')
+    rate = 3 if height == 720 else 6
+    clock = '-thread_queue_size 1024 -use_wallclock_as_timestamps 1'
+    video = f'{clock} -f v4l2 -video_size 1920x1080 -i /dev/video99'
+    sound = f' {clock} -f pulse -i @DEFAULT_MONITOR@' if audio else ''
+    maps = '-map 0:v:0 -map 1:a:0' if audio else '-map 0:v:0'
+    encode = (f'-vf fps={fps},scale=-2:{height},format=yuv420p '
+              f'-c:v libx264 -preset ultrafast -tune zerolatency -g {fps * 2} -bf 0 '
+              f'-b:v {rate}M -maxrate {rate}M -bufsize {rate}M '
+              '-x264-params repeat-headers=1')
+    if audio:
+        encode += ' -af aresample=async=1 -c:a aac -b:a 160k'
+    return ("export XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}; "
+            "test -e /dev/video99 || { echo 'SteamVR mirror /dev/video99 is missing' >&2; exit 3; }; "
+            f'ffmpeg -hide_banner -loglevel warning -nostdin {video}{sound} '
+            f'{maps} {encode} -f mpegts -flush_packets 1 -')
+
+
+def relay(source, destination, on_packet=None):
+    """Preserve 188-byte MPEG-TS packet boundaries in loopback datagrams."""
+    pending = bytearray()
+    total = 0
+    while data := source.read(DATAGRAM):
+        pending.extend(data)
+        size = min(len(pending) // PACKET * PACKET, DATAGRAM)
+        if size:
+            destination.send(bytes(pending[:size]))
+            if on_packet:
+                on_packet()
+            del pending[:size]
+            total += size
+    if pending:
+        raise RuntimeError('Frame stream ended with an incomplete MPEG-TS packet')
+    return total
+
+
+def watch_control(stream, proc, stopped):
+    """A desktop app closes its pipe to stop SSH, including on Windows.
+
+    Windows TerminateProcess does not run Python's finally block. The pipe also
+    closes if the app crashes, so the SSH connection is closed in either case.
+    """
+    try:
+        stream.read(1)
+    except OSError:
+        pass
+    stopped.set()
+    if proc.poll() is None:
+        proc.terminate()
+
+
+class StreamWatchdog:
+    """Close SSH if the first packet or a later packet takes too long."""
+
+    def __init__(self, proc, startup=None, stall=None):
+        self.proc = proc
+        self.startup = STARTUP_TIMEOUT if startup is None else startup
+        self.stall = STREAM_STALL if stall is None else stall
+        self.condition = threading.Condition()
+        self.last_packet = time.monotonic()
+        self.ready = False
+        self.closed = False
+        self.reason = ''
+        self.thread = threading.Thread(target=self._watch, daemon=True)
+        self.thread.start()
+
+    def packet(self):
+        with self.condition:
+            self.ready = True
+            self.last_packet = time.monotonic()
+            self.condition.notify()
+
+    def close(self):
+        with self.condition:
+            self.closed = True
+            self.condition.notify()
+        self.thread.join(timeout=1)
+
+    def _watch(self):
+        with self.condition:
+            while not self.closed:
+                left = self.last_packet + (self.stall if self.ready else self.startup) - time.monotonic()
+                if left <= 0:
+                    self.reason = (f'The Frame sent no OBS video for {self.startup:g} seconds' if not self.ready
+                                   else f'The Frame OBS video stopped for {self.stall:g} seconds')
+                    break
+                self.condition.wait(left)
+            else:
+                return
+        if self.proc.poll() is None:
+            self.proc.terminate()
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--frame', default='frame', help='SSH host or alias (default: frame)')
+    parser.add_argument('--port', type=int, default=15099, help='local OBS UDP port (default: 15099)')
+    parser.add_argument('--height', type=int, choices=(720, 1080), default=720)
+    parser.add_argument('--fps', type=int, choices=(30, 60), default=30)
+    parser.add_argument('--no-audio', action='store_true', help='video only when the Frame audio monitor is unavailable')
+    parser.add_argument('--control-stdin', action='store_true', help=argparse.SUPPRESS)
+    args = parser.parse_args(argv)
+    if not 1024 <= args.port <= 65535:
+        parser.error('port must be between 1024 and 65535')
+    if not args.frame or args.frame.startswith('-') or any(c.isspace() for c in args.frame):
+        parser.error('frame must be one SSH host or alias')
+    command = remote_command(args.height, args.fps, not args.no_audio)
+    ssh = ['ssh', '-T', '-o', 'BatchMode=yes', args.frame, 'bash', '-lc', shlex.quote(command)]
+    target = ('127.0.0.1', args.port)
+    print(f'Sending Frame view to udp://127.0.0.1:{args.port} for OBS; press Ctrl+C to stop.', file=sys.stderr)
+    signal.signal(signal.SIGTERM, lambda *_: sys.exit(0))
+    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as udp:
+        proc = subprocess.Popen(ssh, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE)
+        stopped = threading.Event()
+        watchdog = StreamWatchdog(proc)
+        if args.control_stdin:
+            threading.Thread(target=watch_control, args=(sys.stdin.buffer, proc, stopped), daemon=True).start()
+        try:
+            amount = relay(proc.stdout, _Sender(udp, target), watchdog.packet)
+            code = proc.wait(timeout=10)
+            if stopped.is_set():
+                return 0
+            if watchdog.reason:
+                raise RuntimeError(watchdog.reason)
+            if code or not amount:
+                raise RuntimeError(f'Frame stream stopped (SSH exit {code}; {amount} bytes). '
+                                   'Check SteamVR and the audio monitor; try --no-audio if needed.')
+            return 0
+        except KeyboardInterrupt:
+            return 0
+        finally:
+            watchdog.close()
+            proc.stdout.close()
+            if proc.poll() is None:
+                proc.terminate()
+                try:
+                    proc.wait(timeout=5)
+                except subprocess.TimeoutExpired:
+                    proc.kill()
+                    proc.wait()
+
+
+class _Sender:
+    def __init__(self, sock, target):
+        self.sock, self.target = sock, target
+        self.ready = False
+
+    def send(self, data):
+        self.sock.sendto(data, self.target)
+        if not self.ready:
+            self.ready = True
+            print('Frame Control OBS stream is ready', file=sys.stderr, flush=True)
+
+
+if __name__ == '__main__':
+    try:
+        sys.exit(main())
+    except (OSError, RuntimeError) as error:
+        print(error, file=sys.stderr)
+        sys.exit(1)
@@ -70,6 +70,38 @@ print(next((a.get("digest") or "" for a in d["assets"] if a["name"]==n), "absent
 done
 [ -z "$missing" ] || { echo "not publishing: fix the assets above" >&2; exit 1; }

+# The workflow uploads this only after all eight platform builds complete.
+# Regenerate it from GitHub's installer digests and compare its own GitHub
+# digest, so a stale or partial checksum file cannot pass the release gate.
+python3 "$(dirname "$0")/release-checksums.py" < "$tmp/release.json" > "$tmp/SHA256SUMS"
+expected_sum=$(sha256sum "$tmp/SHA256SUMS" | cut -d ' ' -f 1)
+checksum_digest=$(python3 -c 'import json,sys
+d=json.load(open(sys.argv[1])); matches=[a.get("digest") for a in d["assets"] if a["name"]=="SHA256SUMS"]
+print(matches[0] if len(matches)==1 else "absent")' "$tmp/release.json")
+[ "$checksum_digest" = "sha256:$expected_sum" ] || {
+  echo "not publishing: SHA256SUMS is absent or does not match the eight installer digests" >&2; exit 1;
+}
+echo "ok       SHA256SUMS"
+
+# Every published release carries the same concrete verification instructions.
+# Keep the release's own notes, and append this section only once. The tag URL
+# is stable even while a draft temporarily has an untagged-* API name.
+python3 - "$tmp/release.json" "$(dirname "$0")/release-safety-note.md" "$tag" > "$tmp/release-with-note.json" <<'EOF'
+import json, pathlib, sys
+d = json.load(open(sys.argv[1]))
+body = (d.get("body") or "").rstrip()
+if "## Is it safe?" not in body:
+    note = pathlib.Path(sys.argv[2]).read_text(encoding="utf-8").replace("{tag}", sys.argv[3]).strip()
+    body = (body + "\n\n" if body else "") + note
+d["body"] = body
+json.dump(d, sys.stdout)
+EOF
+mv "$tmp/release-with-note.json" "$tmp/release.json"
+python3 - "$tmp/release.json" > "$tmp/release-body.txt" <<'EOF'
+import json, sys
+sys.stdout.buffer.write(json.load(open(sys.argv[1]))["body"].encode("utf-8"))
+EOF
+
 # update.json: what running copies read (app/updater.js), from github.com's
 # latest/download link rather than the rate-limited REST API.
 python3 - "$tmp/release.json" "$tag" "$page" "$expected" > "$tmp/update.json" <<'EOF'
@@ -87,6 +119,7 @@ print(" ".join(str(a["id"]) for a in d["assets"] if a["name"]=="update.json"))'
 if [ -n "$dry" ]; then
  echo "dry run: would replace update.json (old asset ids: ${old:-none}) with:"
  cat "$tmp/update.json"
+  echo "dry run: would include the Is it safe? section in the release body"
  echo "dry run: would PATCH release $id: tag_name=$tag draft=false prerelease=false make_latest=true"
  exit 0
 fi
@@ -98,6 +131,6 @@ gh api -X POST "https://uploads.github.com/repos/$repo/releases/$id/assets?name=
  -H "Content-Type: application/json" --input "$tmp/update.json" >/dev/null
 echo "ok       update.json"

-gh api -X PATCH "repos/$repo/releases/$id" -f tag_name="$tag" -F draft=false -F prerelease=false \
+gh api -X PATCH "repos/$repo/releases/$id" -f tag_name="$tag" -f body="$(cat "$tmp/release-body.txt")" -F draft=false -F prerelease=false \
  -f make_latest=true --jq '"published " + .tag_name + " at " + .html_url'
 echo "running copies will offer $tag at their next check"
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+"""Print SHA256SUMS for the eight release installers from GitHub asset metadata.
+
+GitHub computes each asset digest from its uploaded bytes. The workflow runs
+this only after all platform builds finish; publish-release.sh checks that the
+uploaded SHA256SUMS bytes still match these digests before publishing.
+"""
+import argparse
+import json
+import re
+import sys
+
+INSTALLERS = (
+    "Frame-Control-mac-arm64.dmg",
+    "Frame-Control-mac-arm64.zip",
+    "Frame-Control-Setup-x64.exe",
+    "Frame-Control-win-x64.zip",
+    "Frame-Control-linux-x86_64.AppImage",
+    "Frame-Control-linux-arm64.AppImage",
+    "Frame-Control-linux-amd64.deb",
+    "Frame-Control-linux-arm64.deb",
+)
+
+
+def find_release(lines, tag):
+    releases = [json.loads(line) for line in lines if line.strip()]
+    hits = [r for r in releases if r.get("tag_name") == tag]
+    if not hits:
+        title = re.compile(r"Frame Control " + re.escape(tag.removeprefix("v")) + r"(: .*)?")
+        hits = [r for r in releases if r.get("draft")
+                and str(r.get("tag_name") or "").startswith("untagged-")
+                and title.fullmatch(r.get("name") or "")]
+    if len(hits) != 1:
+        raise ValueError(f"expected one release for {tag}; found {len(hits)}")
+    return hits[0]
+
+
+def checksums(release):
+    assets = release.get("assets") or []
+    lines = []
+    for name in INSTALLERS:
+        matches = [a for a in assets if a.get("name") == name]
+        if len(matches) != 1:
+            raise ValueError(f"expected one asset named {name}; found {len(matches)}")
+        digest = matches[0].get("digest") or ""
+        if not re.fullmatch(r"sha256:[0-9a-fA-F]{64}", digest):
+            raise ValueError(f"missing SHA-256 digest for {name}")
+        lines.append(f"{digest[7:].lower()}  {name}")
+    return "\n".join(lines) + "\n"
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--tag", help="find exact release in JSON-lines input")
+    parser.add_argument("--id", action="store_true", help="print the selected release id")
+    args = parser.parse_args()
+    data = sys.stdin.read()
+    release = find_release(data.splitlines(), args.tag) if args.tag else json.loads(data)
+    if args.id:
+        print(int(release["id"]))
+    else:
+        # Windows text stdout changes LF to CRLF. SHA256SUMS must have the same
+        # bytes on every runner, including publish-release.sh's verification.
+        sys.stdout.buffer.write(checksums(release).encode("ascii"))
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except ValueError as exc:
+        sys.exit(str(exc))
@@ -0,0 +1,11 @@
+## Is it safe?
+
+Download only from this GitHub release. Check your installer against [SHA256SUMS](https://github.com/saphid/frame-control/releases/download/{tag}/SHA256SUMS). A matching hash proves that your file matches the file in this release. It does not prove that any program is free of malware.
+
+- Windows PowerShell: `Get-FileHash .\Frame-Control-Setup-x64.exe -Algorithm SHA256`
+- macOS Terminal: `shasum -a 256 Frame-Control-mac-arm64.dmg`
+- Linux terminal: `sha256sum Frame-Control-linux-x86_64.AppImage`
+
+Find the same filename in `SHA256SUMS` and compare all 64 hex characters. [Read the source](https://github.com/saphid/frame-control) and [see the build workflow](https://github.com/saphid/frame-control/blob/main/.github/workflows/release.yml). The Windows installer is **not code-signed**; SmartScreen may warn. The macOS app has only an **ad hoc signature**, not an Apple Developer ID signature; the DMG is **unsigned and not notarized**. Gatekeeper may warn or block it. Follow the opening steps in the README only if you trust this download.
+
+日本語: 公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。
@@ -212,7 +212,7 @@
    <div class="head">
      <span class="kicker">Download</span>
      <h2>Get Frame Control</h2>
-      <p>Choose your computer’s OS and processor, not the headset’s. Python is bundled; Linux needs <code>ssh</code>, and arm64 Linux also needs your distribution’s <code>adb</code> for Android apps. <span hidden>Version <span data-version></span>.</span> <a href="https://github.com/saphid/frame-control/releases">Release notes</a></p>
+      <p>Choose your computer’s OS and processor, not the headset’s. Python is bundled; Linux needs <code>ssh</code>, and arm64 Linux also needs your distribution’s <code>adb</code> for Android apps. <span hidden>Version <span data-version></span>.</span> <a href="https://github.com/saphid/frame-control/releases">Release notes</a> · <a href="https://github.com/saphid/frame-control/blob/main/docs/current-support-matrix.md">What we tested</a></p>
    </div>
    <div class="downloads">
      <div class="dl" id="download-mac" data-os="mac">
@@ -257,6 +257,13 @@
      <h2>Good questions</h2>
    </div>
    <div class="faq">
+      <details id="verify-download">
+        <summary>Is it safe? How do I check my download?</summary>
+        <div><p>Starting with <b>v0.4.26</b>, download Frame Control and <a href="https://github.com/saphid/frame-control/releases/latest/download/SHA256SUMS">SHA256SUMS</a> from the same GitHub release. Earlier releases do not have this file. A matching SHA-256 means your file matches that release asset. It does not prove the app is free of malware. Compare all 64 characters with the line for your filename.</p>
+        <p>Windows PowerShell: <code>Get-FileHash .\Frame-Control-Setup-x64.exe -Algorithm SHA256</code><br>macOS Terminal: <code>shasum -a 256 Frame-Control-mac-arm64.dmg</code><br>Linux terminal: <code>sha256sum Frame-Control-linux-x86_64.AppImage</code></p>
+        <p>The <a href="https://github.com/saphid/frame-control">source</a> and <a href="https://github.com/saphid/frame-control/blob/main/.github/workflows/release.yml">build workflow</a> are public. The Windows installer is not code-signed, so SmartScreen may warn. The macOS app has only an ad hoc signature, not an Apple Developer ID signature; the DMG is unsigned and not notarized, so Gatekeeper may warn or block it. Only follow the opening steps below if you trust the download.</p>
+        <p lang="ja">日本語: v0.4.26 以降は公式リリースの SHA256SUMS とファイルの SHA-256 値を照合してください。Windows は未署名、macOS は開発者 ID による署名・公証がありません。</p></div>
+      </details>
      <details id="mac-opening">
        <summary>macOS says the app is damaged or can't be checked</summary>
        <div><p>The app isn't notarized, because there's no paid Apple developer account behind it. Only for a download you trust from the releases linked above: drag it to Applications, then clear the download quarantine once in Terminal:</p>
@@ -31,7 +31,8 @@ function page(api) {

 // A request that fails, or reaches a link that had dropped, keeps its keys and releases.
 for (const [label, api] of [["request failed", async () => { throw new Error("offline"); }],
-                            ["not sent", async () => ({ state: "starting", sent: false })]]) {
+                            ["not sent", async () => ({ state: "starting", sent: false })],
+                            ["queue full", async () => ({ state: "waiting", sent: false })]]) {
  const { pad, padSend, shown } = page(api);
  padSend({ dx: 5 });  // sent and lost: a move, fine to drop
  await new Promise(r => setTimeout(r, 0));
@@ -45,4 +46,29 @@ for (const [label, api] of [["request failed", async () => { throw new Error("of
    fail(label + ": " + JSON.stringify(q));
  if (!shown.length || shown.at(-1).state === "ready") fail(label + ": state not shown");
 }
+// Acknowledged text is removed locally, but its pending status must reach padShow
+// so failures reported after acceptance are polled without another keypress.
+{
+  const { pad, padSend, shown } = page(async () => ({ state: "ready", sent: true, queued: 1 }));
+  padSend({ key: "é" });
+  await new Promise(r => setTimeout(r, 0));
+  if (pad.queue.length || shown.at(-1)?.queued !== 1) fail("accepted text is not polled");
+}
+
+// Exercise the real status/poll function: queued text leaves pointer controls
+// usable, still polls, shows an eventual error, and does not silently retry it.
+{
+  const pad = { state: "ready", queue: [] }, elements = {};
+  let poll = null;
+  const show = new Function("pad", "$", "PAD_STATES", "TOUCH", "padFlush", "devGen", "api",
+    "setTimeout", "clearTimeout", grab("padShow") + "; return padShow;")(
+    pad, id => elements[id] ||= { classList: { toggle() {} } }, {}, false, () => {}, 0,
+    async () => ({ state: "error", message: "Text is retained; try again." }),
+    fn => { poll = fn; return 1; }, () => { poll = null; });
+  show({ state: "ready", queued: 1 });
+  if (pad.state !== "ready" || !poll) fail("pending text disabled pointer or skipped poll");
+  await poll();
+  if (pad.state !== "error" || poll || !elements.padHint.textContent.includes("retained"))
+    fail("asynchronous error not surfaced");
+}
 console.log("queue rules ok");
@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import vm from 'node:vm';
+
+const root = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+const page = readFileSync(join(root, 'ui', 'mac-view.html'), 'utf8');
+const match = page.match(/function windowSwitchEvents\(hostName\) \{[\s\S]*?\n\}/);
+assert.ok(match, 'viewer exposes a bounded host-specific switch sequence');
+const events = vm.runInNewContext(`(${match[0]})`);
+for (const [host, modifier, mod] of [
+  ['mac', 'MetaLeft', 'meta'], ['windows', 'AltLeft', 'alt'],
+]) {
+  const sequence = JSON.parse(JSON.stringify(events(host)));
+  assert.deepEqual(sequence.map(x => [x.e, x.code]),
+    [['down', modifier], ['down', 'Tab'], ['up', 'Tab'], ['up', modifier]]);
+  assert.deepEqual(sequence[1].mods, [mod]);
+  assert.deepEqual(sequence[2].mods, [mod]);
+}
+assert.deepEqual(JSON.parse(JSON.stringify(events('linux'))), []);
+assert.match(page, /switchButton\.hidden = !src\.startsWith\("display:"\)/);
+console.log('window switch sequences passed');
@@ -0,0 +1,41 @@
+// Run the actual wired-doctor page script without browser or device I/O.
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import vm from 'node:vm';
+
+class Element {
+  constructor() { this.value = ''; this.disabled = false; this.textContent = ''; this.children = []; }
+  append(...nodes) { this.children.push(...nodes); }
+  prepend(...nodes) { this.children.unshift(...nodes); }
+  replaceChildren(...nodes) { this.children = nodes; }
+}
+const elements = Object.fromEntries(['back','alias','check','message','results'].map(id => [id, new Element()]));
+elements.alias.value = 'frame';
+const requests = [];
+let respond;
+const context = vm.createContext({
+  document: {getElementById: id => elements[id], createElement: () => new Element()},
+  URLSearchParams, location: {search: '?key=test-key'},
+  fetch: (url, options) => { requests.push({url, options}); return new Promise(resolve => {respond = resolve;}); },
+});
+const source = readFileSync(new URL('../../ui/wired-doctor.html', import.meta.url), 'utf8');
+vm.runInContext(source.match(/<script>([\s\S]*)<\/script>/)[1], context);
+assert.equal(requests.length, 0, 'page load must not probe the PC or Frame');
+assert.equal(elements.back.href, '/?key=test-key#devices');
+let promise = elements.check.onclick();
+assert.equal(elements.check.disabled, true);
+assert.equal(requests[0].url, '/api/host/wired?alias=frame');
+assert.equal(requests[0].options.headers['X-Frame-UI'], 'test-key');
+respond({ok: true, json: async () => ({state: 'unknown', checks: [{title: '<script>bad</script>',status: 'unknown',detail: 'No known route'}]})});
+await promise;
+assert.equal(elements.results.children.length, 1);
+assert.equal(elements.results.children[0].children[0].textContent, '<script>bad</script>', 'device text must stay plain text');
+assert.equal(elements.check.disabled, false);
+promise = elements.check.onclick();
+assert.equal(elements.results.children.length, 0, 'stale result cleared before retry');
+respond({ok: false, json: async () => ({error: 'PC route unavailable'})});
+await promise;
+assert.match(elements.message.textContent, /route unavailable/);
+assert.equal(elements.results.children.length, 0);
+assert.equal(elements.check.disabled, false);
+console.log('wired doctor UI: on-demand, escaped data, stale-result clearing and retry passed');
@@ -0,0 +1,70 @@
+// Run the real doctor page script with a minimal DOM; no browser or hardware I/O.
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import vm from 'node:vm';
+class Element {
+  constructor(tag) { this.tagName = tag.toUpperCase(); this.children = []; this.value = ''; this.hidden = false; this.disabled = false; this.textContent = ''; }
+  append(...nodes) { this.children.push(...nodes); }
+  prepend(...nodes) { this.children.unshift(...nodes); }
+  replaceChildren(...nodes) { this.children = nodes; }
+  get firstChild() { return this.children[0]; }
+  get options() { return this.children; }
+}
+const ids = ['back','inventory','diagnose','device','message','results','json','reportSection','selection','download','copy'];
+const elements = Object.fromEntries(ids.map(id => [id,new Element(id === 'device' ? 'select' : 'div')]));
+const requests = [];
+let pending;
+const context = vm.createContext({
+  document:{getElementById:id=>elements[id],createElement:tag=>new Element(tag)},
+  URLSearchParams,location:{search:'?key=test-key'},
+  fetch:(path,options)=>{ requests.push({path,options}); return new Promise(resolve=>{pending=resolve;}); },
+  navigator:{clipboard:{writeText:async()=>{throw Error('clipboard denied');}}},
+});
+const source = readFileSync(new URL('../../ui/wireless-doctor.html',import.meta.url),'utf8');
+vm.runInContext(source.match(/<script>([\s\S]*)<\/script>/)[1],context);
+assert.equal(requests.length,0,'opening the page must not probe');
+assert.equal(elements.back.href,'/?key=test-key#devices');
+const fixture = {
+  schema:1,supported:true,selected:null,
+  usb:[{id:'usb:1-2',vid:'1234',pid:'5678',product:'<img src=x onerror=alert(1)>'}],
+  interfaces:[{id:'net:wlan0',name:'wlan0',usb:'usb:1-2',driver:'synthetic'}],
+  checks:[{id:'presence',title:'Presence',status:'ok',suggestion:'Select hardware',evidence:['Synthetic evidence']}]
+};
+let promise=elements.inventory.onclick();
+assert.equal(elements.device.disabled,true,'selection must stay fixed during a read');
+assert.equal(requests[0].path,'/api/wireless-doctor');
+assert.equal(requests[0].options.headers['X-Frame-UI'],'test-key');
+pending({ok:true,json:async()=>fixture}); await promise;
+assert.equal(elements.device.value,'','no automatic hardware choice');
+assert.equal(elements.diagnose.disabled,true);
+assert.equal(elements.device.options.length,3);
+assert.match(elements.device.options[2].textContent,/<img src=x/,'hardware labels must stay plain text');
+assert.equal(elements.device.options[2].children.length,0);
+assert.equal(elements.reportSection.hidden,false);
+assert.equal(elements.results.children.length,1);
+elements.device.value='net:wlan0'; elements.device.onchange();
+assert.equal(elements.diagnose.disabled,false);
+assert.equal(elements.results.children.length,0,'changing hardware clears the previous result');
+assert.equal(elements.reportSection.hidden,true,'cannot export an old report for a new selection');
+promise=elements.diagnose.onclick();
+assert.equal(requests[1].path,'/api/wireless-doctor?device=net%3Awlan0');
+assert.equal(elements.device.disabled,true);
+pending({ok:true,json:async()=>({...fixture,selected:'net:wlan0'})}); await promise;
+assert.equal(elements.device.value,'net:wlan0');
+assert.equal(elements.device.disabled,false);
+await elements.copy.onclick();
+assert.match(elements.message.textContent,/Clipboard unavailable/);
+promise=elements.diagnose.onclick();
+assert.equal(elements.results.children.length,0,'clear a healthy snapshot before retrying');
+assert.equal(elements.reportSection.hidden,true);
+pending({ok:false,json:async()=>({error:'Device is no longer present. Refresh and select an observed device.'})}); await promise;
+assert.match(elements.message.textContent,/no longer present/);
+assert.equal(elements.results.children.length,0);
+assert.equal(elements.reportSection.hidden,true,'failed requests cannot export stale success');
+assert.equal(elements.inventory.disabled,false,'can refresh after failure');
+promise=elements.inventory.onclick();
+pending({ok:true,json:async()=>({...fixture,supported:false,usb:[],interfaces:[]})}); await promise;
+assert.equal(elements.selection.hidden,true);
+assert.equal(elements.diagnose.disabled,true);
+assert.match(elements.message.textContent,/only on a Linux PC/);
+console.log('doctor UI: on-demand reads, explicit selection, safe labels, stale report clearing and failure recovery passed');
@@ -230,8 +230,9 @@ def cleanup(smoke):
        # It logs a failed sync and exits 0, so read its log; a second run lists
        # what Steam still has registered, which must not include ours.
        try:
-            first = ssh('python3 ~/devkit-utils/steamos-delete 2>&1', timeout=120)
-            second = ssh('python3 ~/devkit-utils/steamos-delete 2>&1', timeout=120)
+            command = frame_titles.devkit_script('delete') + ' 2>&1'
+            first = ssh(command, timeout=120)
+            second = ssh(command, timeout=120)
            for out in (first, second):
                if 'sync of devkit games failed' in out:
                    raise AssertionError(out.strip().splitlines()[-1])
@@ -95,8 +95,20 @@ test('Assistant Back encodes the injected key for the same-origin workspace only
  assert.match(html, /referrerpolicy="no-referrer"/);
 });

+test('catalogue browsing starts while installed-app discovery is still pending', async () => {
+  const f = fixture(read('store.html'));
+  assert.deepEqual(f.requests.map(r => r.url.split('?')[0]), ['/api/android', '/api/search']);
+  await f.answer(1, {apps: [{name: 'Example Game', category: 'games', package: 'example.game',
+    offers: [{source: 'test', id: 'example'}]}], sources: []});
+  assert.equal(f.run('st.installedState'), 'loading');
+  assert.match(f.element('content').innerHTML, /Example Game/);
+  await f.answer(0, {apps: [{package: 'example.game', label: 'Example Game'}]});
+  assert.match(f.element('content').innerHTML, /Installed/);
+});
+
 test('installed read failure is persistent, retry recovers, and cached entries are marked stale', async () => {
  const f = fixture(read('store.html'));
+  await f.answer(1, {apps: [], sources: []});
  f.run('st.view = "installed"; render()');
  assert.doesNotMatch(f.element('content').innerHTML, /Nothing installed yet/);
  f.requests[0].reject(Error('offline')); await tick();
@@ -105,16 +117,16 @@ test('installed read failure is persistent, retry recovers, and cached entries a
  assert.doesNotMatch(f.element('content').innerHTML, /Nothing installed yet/);
  const retry = f.element('content').querySelector('[data-retry-installed]');
  for (const listener of f.events.get('click')) listener({target: retry});
-  assert.equal(f.requests[1].url, '/api/android');
-  await f.answer(1, {apps: [{package: 'cached.app', label: 'Cached app'}]});
+  assert.equal(f.requests[2].url, '/api/android');
+  await f.answer(2, {apps: [{package: 'cached.app', label: 'Cached app'}]});
  assert.equal(f.run('st.installedState'), 'ready');
  const failed = f.run('loadInstalled()');
  assert.match(f.element('content').innerHTML, /last (?:known|read)|stale/i);
-  f.requests[2].reject(Error('refresh failed')); await failed;
+  f.requests[3].reject(Error('refresh failed')); await failed;
  assert.match(f.element('content').innerHTML, /Cached app/);
  assert.match(f.element('content').innerHTML, /last (?:known|read)|stale/i);
  assert.match(f.element('content').innerHTML, /data-retry-installed/);
-  const empty = f.run('loadInstalled()'); await f.answer(3, {apps: []}); await empty;
+  const empty = f.run('loadInstalled()'); await f.answer(4, {apps: []}); await empty;
  assert.match(f.element('content').innerHTML, /Nothing installed yet/);
  assert.doesNotMatch(f.element('content').innerHTML, /data-retry-installed/);
 });
@@ -122,12 +134,12 @@ test('installed read failure is persistent, retry recovers, and cached entries a
 test('newest installed read wins over older success and failure without pruning cached data', async () => {
  const f = fixture(read('store.html'));
  f.run('st.needsData.add("new.app"); st.jobs.set("data:new.app", {done: false})');
-  const newer = f.run('loadInstalled()'); await f.answer(1, {apps: [{package: 'new.app', label: 'New app'}]}); await newer;
+  const newer = f.run('loadInstalled()'); await f.answer(2, {apps: [{package: 'new.app', label: 'New app'}]}); await newer;
  await f.answer(0, {apps: []});
  assert.equal(f.run('st.installed.has("new.app")'), true);
  assert.equal(f.run('st.needsData.has("new.app")'), true);
  const old = f.run('loadInstalled()'), newest = f.run('loadInstalled()');
-  await f.answer(4, {apps: []}); await newest; // bootstrap's catalogue search is request 2
+  await f.answer(4, {apps: []}); await newest; // request 1 is the independent bootstrap catalogue search
  f.requests[3].reject(Error('late failure')); await old;
  assert.equal(f.run('st.installedState'), 'ready');
  assert.equal(f.run('st.installedError'), '');
@@ -137,12 +149,12 @@ test('newest installed read wins over older success and failure without pruning
 test('an old success cannot mask the newest failure, and malformed data is not successful empty', async () => {
  const f = fixture(read('store.html'));
  f.run('st.view = "installed"');
-  const newest = f.run('loadInstalled()'); f.requests[1].reject(Error('latest offline')); await newest;
+  const newest = f.run('loadInstalled()'); f.requests[2].reject(Error('latest offline')); await newest;
  await f.answer(0, {apps: []});
  assert.equal(f.run('st.installedState'), 'error');
  assert.equal(f.run('st.installedError'), 'latest offline');
  assert.doesNotMatch(f.element('content').innerHTML, /Nothing installed yet/);
-  const malformed = f.run('loadInstalled()'); await f.answer(2, {}); await malformed;
+  const malformed = f.run('loadInstalled()'); await f.answer(3, {}); await malformed;
  assert.equal(f.run('st.installedState'), 'error');
  assert.match(f.element('content').innerHTML, /data-retry-installed/);
 });
@@ -197,12 +209,12 @@ test('named native Store dialog enters, contains and restores focus across async

 test('dialog Retry recovers installed knowledge without losing focus, and cancel restores its opener', async () => {
  const f = fixture(read('store.html'));
+  await f.answer(1, {apps: [], sources: []});
  f.context.app = {name: 'Example', detailed: true, offers: [{source: 'test', id: 'example'}]};
  f.run('st.view = "games"; st.apps = [app]; render()');
  const opener = f.element('content').querySelector('[data-i="0"]'); opener.focus();
  f.run('openDetail(app)');
  f.requests[0].reject(Error('offline')); await tick();
-  await f.answer(1, {apps: [f.context.app], sources: []});
  const retry = f.element('sheet').querySelector('[data-retry-installed]'); retry.focus();
  for (const listener of f.events.get('click')) listener({target: retry});
  assert.equal(f.document.activeElement.dataset.act, 'close');
@@ -0,0 +1,82 @@
+const {test} = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+const path = require('node:path');
+const html = fs.readFileSync(path.join(__dirname, '../ui/index.html'), 'utf8');
+const code = html.split('// Local Steam helper: never start')[1].split('// ---- shared destinations')[0];
+
+function fixture() {
+  const elements = new Map(), requests = [];
+  const $ = id => {
+    if (!elements.has(id)) elements.set(id, {disabled:true, textContent:''});
+    return elements.get(id);
+  };
+  const ctx = {$, api:(url, body) => new Promise((resolve, reject) => requests.push({url, body, resolve, reject}))};
+  vm.createContext(ctx);
+  vm.runInContext('// never start' + code, ctx);
+  return {ctx, $, requests};
+}
+
+test('navigation reads status; only clicks request launch or permission UI', async () => {
+  const {ctx, $, requests} = fixture();
+  assert.equal(requests.length, 0);
+  const load = ctx.loadSteamPipewire();
+  assert.equal(requests[0].url, '/api/steam-pipewire');
+  assert.equal(requests[0].body, undefined);
+  requests[0].resolve({available:true, guidance:'Verify the Steam session'});
+  await load;
+  assert.equal($('steamPipewireLaunch').disabled, false);
+  assert.equal($('steamPipewireGuidance').textContent, 'Verify the Steam session');
+  const launch = $('steamPipewireLaunch').onclick();
+  assert.deepEqual(JSON.parse(JSON.stringify(requests[1].body)), {action:'launch', confirmed:true});
+  assert.equal($('steamPipewireReset').disabled, true);
+  await $('steamPipewireReset').onclick(); // repeated action suppressed
+  assert.equal(requests.length, 2);
+  requests[1].reject(new Error('Exit Steam first'));
+  await launch;
+  assert.equal($('steamPipewireStatus').textContent, 'Exit Steam first');
+  const reset = $('steamPipewireReset').onclick();
+  assert.deepEqual(JSON.parse(JSON.stringify(requests[2].body)), {action:'permissions', confirmed:true});
+  requests[2].resolve({reset:false, opened:true, message:'No permission was changed'});
+  await reset;
+  assert.equal($('steamPipewireStatus').textContent, 'No permission was changed');
+});
+
+test('unsupported status and read failure keep actions disabled', async () => {
+  const {ctx, $, requests} = fixture();
+  const load = ctx.loadSteamPipewire();
+  requests[0].resolve({available:false, reason:'Local Wayland required'});
+  await load;
+  assert.equal($('steamPipewireLaunch').disabled, true);
+  assert.equal($('steamPipewireReset').disabled, true);
+  assert.equal($('steamPipewireStatus').textContent, 'Local Wayland required');
+  const retry = ctx.loadSteamPipewire();
+  requests[1].reject(new Error('Unavailable'));
+  await retry;
+  assert.equal($('steamPipewireLaunch').disabled, true);
+});
+
+test('stale status cannot overwrite an action result', async () => {
+  const {ctx, $, requests} = fixture();
+  const load = ctx.loadSteamPipewire();
+  const reset = ctx.steamPipewireAction('permissions');
+  requests[1].resolve({message:'No permission was changed'});
+  await reset;
+  requests[0].resolve({available:true});
+  await load;
+  assert.equal($('steamPipewireStatus').textContent, 'No permission was changed');
+});
+
+
+test('Tools navigation opens the separate Steam panel without starting PC capture', () => {
+  const {workspaceFixture} = require('./workspace_fixture.cjs');
+  const f = workspaceFixture();
+  f.navigate('#steamPipewire');
+  assert.equal(f.activePage, 'tools');
+  assert.equal(f.el('steamPipewire').hidden, false);
+  assert.equal(f.el('macview').hidden, true);
+  assert.ok(f.calls.some(call => call[0] === 'steam-pipewire'));
+  assert.ok(!f.calls.some(call => call[0] === 'macview'));
+  assert.match(html, /\$\("steamPipewireLink"\)\.hidden = h.mobile \|\| h.os !== "Linux"/);
+});
@@ -292,6 +292,13 @@ class Session(unittest.TestCase):
                    patch.object(remote.shutil, 'which', side_effect=lambda n: '/usr/bin/' + n if n in available else None):
                self.assertEqual(remote.session()['selector'], expected)

+    def test_holo_nested_desktop_is_recognized(self):
+        with patch.object(remote, 'SDDM_CONFS', ()), \
+                patch.object(remote, '_session_target', return_value='not-found'), \
+                patch.object(remote, '_running', side_effect=lambda name, full=False: name == 'holo-nested-desktop'), \
+                patch.object(remote.shutil, 'which', return_value=None):
+            self.assertTrue(remote.session()['nested_desktop'])
+
    def test_script_probe_does_not_match_names_in_transmitted_python_source(self):
        with patch.object(remote.subprocess, 'call', return_value=1) as call:
            self.assertFalse(remote._running('steamos-nested-desktop', full=True))
@@ -185,6 +185,7 @@ class ConfigBlock(unittest.TestCase):
                fc.write_config("10.0.0.5", 22, "deck")
                text = fc.CONFIG.read_text(encoding="utf-8")
                self.assertEqual(fc.configured_user(), "deck")  # not "me" from Host other
+                self.assertEqual(fc.configured_host(), "10.0.0.5")
            finally:
                fc.SSH_DIR, fc.CONFIG = saved
        self.assertEqual(text.count(fc.BEGIN), 1)
@@ -323,6 +323,16 @@ class Pins(Base):


 class Registry(Base):
+    def test_mdns_result_remembers_numeric_ip_only_on_its_network(self):
+        d = self.reg.add_device("frame-cache", hosts=["frame-cache.local"])
+        self.reg.record_success(d["id"], "frame-cache.local", "n-home", 2.0, ip="192.168.1.40")
+        a = fd.Registry(self.reg.path).get(d["id"])["addresses"][0]
+        self.assertEqual((a["last_ip"], a["last_ip_network"]), ("192.168.1.40", "n-home"))
+        self.reg.record_success(d["id"], "frame-cache.local", "n-home", 2.0, ip="host;bad")
+        self.assertEqual(self.reg.get(d["id"])["addresses"][0]["last_ip"], "192.168.1.40")
+        self.reg.update_address(d["id"], "frame-cache.local", new_host="frame-next.local")
+        self.assertNotIn("last_ip", self.reg.get(d["id"])["addresses"][0])
+
    def test_replaced_registry_is_read_even_when_timestamp_and_size_match(self):
        d = self.reg.add_device('frame', name='First')
        before = self.reg.path.stat()
@@ -0,0 +1,94 @@
+"""Decky release validation and the removable user-service transaction."""
+import sandbox  # noqa: F401
+import hashlib
+import io
+import json
+import os
+import secrets
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / 'ui'))
+import frame_decky
+
+
+def arm_binary(fill=b'A'):
+    data = bytearray(b'\x7fELF' + fill * 2044)
+    data[18:20] = (183).to_bytes(2, 'little')
+    return bytes(data)
+
+
+class DeckyRelease(unittest.TestCase):
+    def test_official_arm_release_digest_is_checked(self):
+        data = arm_binary()
+        digest = hashlib.sha256(data).hexdigest()
+        url = f'https://github.com/{frame_decky.REPO}/releases/download/v3.3.0/PluginLoader-arm64'
+        info = {'tag_name':'v3.3.0', 'assets':[{'name':'PluginLoader-arm64', 'size':len(data),
+                'digest':'sha256:'+digest, 'browser_download_url':url}]}
+        with patch.object(frame_decky.urllib.request, 'urlopen', side_effect=[io.BytesIO(json.dumps(info).encode()), io.BytesIO(data)]):
+            self.assertEqual(frame_decky.release_binary(), ('v3.3.0', digest, data))
+        info['assets'][0]['digest'] = 'sha256:' + '0'*64
+        with patch.object(frame_decky.urllib.request, 'urlopen', side_effect=[io.BytesIO(json.dumps(info).encode()), io.BytesIO(data)]):
+            with self.assertRaisesRegex(ValueError, 'digest'):
+                frame_decky.release_binary()
+
+    def test_install_rejects_incompatible_headset_before_download(self):
+        state = {'arch':'x86_64','variant':'vr','cef':True,'managed':False,'upstreamInstall':False}
+        with patch.object(frame_decky, 'release_binary') as download:
+            with self.assertRaisesRegex(ValueError, 'Steam Frame'):
+                frame_decky.change(lambda *a, **k: json.dumps(state), 'install')
+            download.assert_not_called()
+
+
+@unittest.skipIf(os.name == 'nt', 'remote service script runs on Linux')
+class DeckyServiceScript(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        home = Path(self.tmp.name)
+        fake = home / 'systemctl'
+        fake.write_text('#!/bin/sh\nif [ "$FRAME_DECKY_TEST_FAIL" = "1" ] && [ "$2" = "enable" ]; then echo blocked >&2; exit 1; fi\nexit 0\n')
+        fake.chmod(0o700)
+        self.env = {**os.environ, 'HOME': self.tmp.name, 'PATH': self.tmp.name + os.pathsep + os.environ['PATH']}
+        self.base = home / '.local/share/frame-control/decky'
+
+    def apply(self, action, data=None, version='v3.3.0', fail=False):
+        token = secrets.token_hex(12)
+        stage = Path('/tmp/frame-control-decky-' + token)
+        if data is not None:
+            stage.write_bytes(data)
+        digest = hashlib.sha256(data or b'').hexdigest()
+        env = {**self.env, 'FRAME_DECKY_TEST_FAIL': '1' if fail else '0'}
+        try:
+            return subprocess.run([sys.executable, '-', action, token, digest, version],
+                                  input=frame_decky.APPLY, capture_output=True, text=True, env=env, timeout=15)
+        finally:
+            stage.unlink(missing_ok=True)
+
+    def test_install_update_rollback_and_remove(self):
+        first = arm_binary(b'A')
+        result = self.apply('install', first)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual((self.base / 'PluginLoader').read_bytes(), first)
+        receipt = self.base / '.frame-control/receipt.json'
+        self.assertEqual(json.loads(receipt.read_text())['version'], 'v3.3.0')
+        self.assertTrue((Path(self.tmp.name) / '.config/systemd/user/frame-control-decky.service').is_file())
+
+        second = arm_binary(b'B')
+        result = self.apply('update', second, version='v3.3.1', fail=True)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual((self.base / 'PluginLoader').read_bytes(), first)
+        self.assertEqual(json.loads(receipt.read_text())['version'], 'v3.3.0')
+
+        result = self.apply('update', second, version='v3.3.1')
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual((self.base / 'PluginLoader').read_bytes(), second)
+        result = self.apply('remove')
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse((self.base / 'PluginLoader').exists())
+        self.assertFalse(receipt.exists())
+        self.assertTrue((self.base / 'plugins').is_dir())
@@ -46,7 +46,8 @@ class FrameDoctor(unittest.TestCase):
        self.assertFalse(any('/register' in str(c.args[0]) for c in run.call_args_list))

    def test_fallback_preserves_identity_and_disables_mutating_ssh_options(self):
-        _, text, run = self.main([result(code=255), result(json.dumps({'guard': 'loop', 'checks': []}))])
+        _, text, run = self.main([result(code=255), result(json.dumps({'guard': 'loop', 'checks': []}))],
+                                 argv=['--lan', 'frame.local'])
        args = run.call_args_list[2].args[0]
        for flag in ('HostKeyAlias=pinned-frame', 'HostName=frame.local', 'BatchMode=yes',
                     'StrictHostKeyChecking=yes', 'UpdateHostKeys=no', 'PermitLocalCommand=no',
@@ -55,6 +56,10 @@ class FrameDoctor(unittest.TestCase):
        self.assertIn('OK Connection: LAN', text)
        self.assertIn('Counters are rising', text)

+    def test_no_implicit_mdns_fallback(self):
+        _, _, run = self.main([result(code=255), result(code=255)])
+        self.assertFalse(any('HostName=frame.local' in str(c.args[0]) for c in run.call_args_list))
+
    def test_hostkey_failure_does_not_suggest_deleting_identity(self):
        _, text, _ = self.main([result(code=255, err='REMOTE HOST IDENTIFICATION HAS CHANGED')] * 3)
        self.assertIn('Do not delete known_hosts', text)
@@ -0,0 +1,65 @@
+"""Headset panel packaging, ownership checks and window targeting."""
+import sandbox  # noqa: F401
+import io
+import json
+import os
+from pathlib import Path
+import secrets
+import subprocess
+import sys
+import tarfile
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'ui'))
+import frame_headset
+import frame_headset_runtime
+
+
+class HeadsetBundle(unittest.TestCase):
+    def test_bundle_is_deterministic_and_contains_the_local_ui(self):
+        first = frame_headset.bundle()
+        self.assertEqual(first, frame_headset.bundle())
+        with tarfile.open(fileobj=io.BytesIO(first), mode='r:gz') as archive:
+            names = set(archive.getnames())
+        self.assertIn('ui/headset.html', names)
+        self.assertIn('ui/frame_headset_runtime.py', names)
+        self.assertIn('ui/server.py', names)
+        self.assertFalse(any('\\' in name for name in names))
+        self.assertFalse(any('__pycache__' in name for name in names))
+
+    def test_incompatible_device_is_rejected_before_upload(self):
+        state = {'arch': 'x86_64', 'variant': 'vr'}
+        calls = []
+        def ssh(*args, **kwargs):
+            calls.append(args)
+            return json.dumps(state)
+        with patch.object(frame_headset, 'bundle') as bundle:
+            with self.assertRaisesRegex(ValueError, 'Steam Frame'):
+                frame_headset.change(ssh, 'install')
+            bundle.assert_not_called()
+        self.assertEqual(len(calls), 1)
+
+    @unittest.skipIf(os.name == 'nt', 'remote script runs on Linux')
+    def test_unowned_install_is_never_removed(self):
+        with tempfile.TemporaryDirectory() as home:
+            token = secrets.token_hex(12)
+            result = subprocess.run([sys.executable, '-', 'remove', token, 'none'],
+                                    input=frame_headset.APPLY, text=True, capture_output=True,
+                                    env={**os.environ, 'HOME': home}, timeout=5)
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn('No Frame Control managed', result.stderr)
+
+
+class HeadsetWindow(unittest.TestCase):
+    def test_uses_only_its_marker_title(self):
+        tree = ' 0x101 "Other panel"\n 0xabc "Frame Control VR [fc-headset]"\n'
+        with patch.object(frame_headset_runtime, 'command', return_value=tree):
+            self.assertEqual(frame_headset_runtime.panel_window(), '0xabc')
+        with patch.object(frame_headset_runtime, 'command', return_value=' 0x101 "Other panel"'):
+            self.assertIsNone(frame_headset_runtime.panel_window())
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -14,6 +14,15 @@ import frame_titles  # noqa: E402
 from frame_titles import FrameError  # noqa: E402


+class DevkitNames(unittest.TestCase):
+    def test_holo_script_is_preferred_with_vendored_steamos_fallback(self):
+        command = frame_titles.devkit_script('prepare-upload', '--gameid MyGame')
+        self.assertLess(command.index('holo-prepare-upload'), command.index('steamos-prepare-upload'))
+        self.assertIn('[ -f ~/devkit-utils/holo-prepare-upload ]', command)
+        with self.assertRaises(ValueError):
+            frame_titles.devkit_script('unknown')
+
+
 def elf(machine, e_type=3, interp=True, pad=0):
    """A 64-bit little-endian ELF header plus one program header (PT_INTERP or PT_LOAD)."""
    ident = b'\x7fELF' + bytes([2, 1, 1]) + b'\0' * 9
@@ -18,6 +18,7 @@ import tempfile
 import threading
 import time
 import unittest
+from unittest import mock
 from pathlib import Path

 ROOT = Path(__file__).resolve().parent.parent
@@ -631,3 +632,428 @@ class PageQueue(unittest.TestCase):

 if __name__ == "__main__":
    unittest.main()
+
+
+class PadEvents(unittest.TestCase):
+    """The trackpad and key row go through gamescope; accents and emoji go the KDE Connect way."""
+
+    @classmethod
+    def setUpClass(cls):
+        import server
+        cls.pad = staticmethod(server.pad_events)
+
+    def test_moves_clicks_and_scroll(self):
+        out, extra = self.pad([{"dx": 3, "dy": -2}, {"singleclick": True}, {"singlehold": True},
+                               {"singlerelease": True}, {"scroll": True, "dy": 1}, {"rightclick": True}])
+        self.assertEqual(out[0], {"dx": 3, "dy": -2})
+        self.assertEqual(out[1:3], [{"button": "left", "down": True}, {"button": "left", "down": False}])
+        self.assertEqual(out[3:5], [{"button": "left", "down": True}, {"button": "left", "down": False}])
+        self.assertEqual(out[5], {"scroll": [0, -15]})  # up = content follows the finger
+        self.assertEqual(out[6:], [{"button": "right", "down": True}, {"button": "right", "down": False}])
+        self.assertEqual(extra, [])
+
+    def test_keys_and_modifiers(self):
+        out, _ = self.pad([{"specialKey": 12}, {"specialKey": 1, "ctrl": True}, {"key": "c", "ctrl": True}])
+        self.assertEqual(out[:2], [{"key": 28, "down": True}, {"key": 28, "down": False}])
+        self.assertEqual([e["key"] for e in out[2:6]], [29, 14, 14, 29])  # Ctrl+Backspace
+        self.assertEqual([(e["key"], e["down"]) for e in out[6:]],
+                         [(29, True), (46, True), (46, False), (29, False)])  # Ctrl+C
+
+    def test_text_stays_ascii_through_gamescope(self):
+        out, slow = self.pad([{"key": "Hi "}, {"key": "there"}])
+        self.assertEqual(out, [{"text": "Hi there"}])
+        self.assertEqual(slow, [])
+
+    def test_keyboard_goes_to_kde_whole_and_in_order(self):
+        events = [{"key": "a"}, {"key": "é"}, {"specialKey": 12}, {"key": "c", "ctrl": True}, {"dx": 2, "dy": 1}]
+        out, slow = self.pad(events, kde=True)
+        self.assertEqual(out, [{"dx": 2, "dy": 1}])  # the pointer still goes through gamescope
+        self.assertEqual(slow, events[:4])  # the keyboard as sent, in order
+
+    def test_shifted_key_with_modifier(self):
+        out, _ = self.pad([{"key": "A", "ctrl": True}])
+        self.assertEqual([e["key"] for e in out], [29, 42, 30, 30, 42, 29])
+
+
+class PadDelivery(unittest.TestCase):
+    """remote_input's promises: "sent" means the whole batch is taken; accents go once, in order."""
+
+    class Agent:
+        def __init__(self, sent=True, state="ready"):
+            self.sent, self.state, self.got = sent, state, []
+
+        def send(self, events):
+            if events and self.sent:
+                self.got.append(events)
+            return {"state": self.state, "sent": self.sent and bool(events)}
+
+    def setUp(self):
+        import server
+        self.s = server
+        self.saved = (server._touch, server._input, server.KDE_WAIT)
+        server._touch, server._input = self.Agent(), self.Agent()
+        self.reset()
+
+    def tearDown(self):
+        self.s._touch, self.s._input, self.s.KDE_WAIT = self.saved
+        self.settle()
+        self.reset()
+
+    def reset(self):
+        self.s._kde_queue.clear()
+        self.s._kde_error = None
+        self.s._kde_until = self.s._typed_until = 0.0
+        self.s._kde_worker[0] = None
+
+    def settle(self):
+        worker = self.s._kde_worker[0]
+        if worker:
+            worker.join(5)
+
+    def typed(self):
+        return [e for batch in self.s._input.got for e in batch]
+
+    def test_accent_only_batch_is_acknowledged_and_typed_once(self):
+        status = self.s.remote_input({"events": [{"key": "é"}]})
+        self.assertTrue(status["sent"])  # so the page doesn't send it again
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "é"}])
+
+    def test_mixed_text_stays_in_one_ordered_stream(self):
+        self.s.remote_input({"events": [{"key": "aéb"}, {"specialKey": 12}]})
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "aéb"}, {"specialKey": 12}])
+        self.assertEqual(self.s._touch.got, [])  # none of it split off through gamescope
+
+    def test_batch_gamescope_didnt_take_is_not_queued(self):
+        self.s._touch = self.Agent(sent=False, state="starting")
+        status = self.s.remote_input({"events": [{"dx": 1, "dy": 1}, {"key": "é"}]})
+        self.assertFalse(status["sent"])  # the page tries the whole batch again...
+        self.assertEqual(self.s._kde_queue, [])  # ...so the accent isn't queued twice
+
+    def test_waits_for_kde_connect_then_sends_without_more_input(self):
+        self.s._input = self.Agent(sent=False, state="starting")
+        self.s.remote_input({"events": [{"key": "é"}]})
+        time.sleep(0.2)
+        self.assertEqual(self.s._kde_queue, [{"key": "é"}])
+        self.s._input.sent = True
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "é"}])
+        self.assertEqual(self.s._kde_queue, [])
+
+    def test_later_ascii_waits_behind_a_pending_accent(self):
+        self.s._input = self.Agent(sent=False, state="starting")
+        self.s.remote_input({"events": [{"key": "é"}]})
+        self.s.remote_input({"events": [{"key": "x"}]})
+        self.assertEqual(self.s._touch.got, [])  # "x" can't overtake the "é"
+        self.assertEqual(self.s._kde_queue, [{"key": "é"}, {"key": "x"}])
+        self.s._input.sent = True
+        self.settle()
+        self.assertEqual(self.typed(), [{"key": "é"}, {"key": "x"}])
+
+    def test_errors_and_timeout_retain_accepted_text_for_explicit_retry(self):
+        events = [{"key": "é"}] * 150
+        for state in ("error", "starting"):
+            with self.subTest(state=state):
+                self.reset()
+                self.s._input = self.Agent(sent=False, state=state)
+                self.s.KDE_WAIT = 0
+                self.assertTrue(self.s.remote_input({"events": events})["sent"])
+                self.settle()
+                self.assertEqual(self.s._kde_queue, events)
+                self.assertIsNone(self.s._kde_worker[0])
+                self.assertEqual(self.s._kde_until, 0)
+                status = self.s.pad_status({"state": "ready"})
+                self.assertEqual(status["state"], "error")
+                self.assertIn("retained", status["message"])
+                self.assertFalse(self.s.remote_input({"events": [{"key": "x"}]})["sent"])
+                self.s._input = self.Agent()
+                self.s.start_pad()
+                self.settle()
+                self.assertEqual(self.typed(), events)
+                self.assertEqual(self.s._kde_queue, [])
+                self.assertIsNone(self.s._kde_error)
+
+    def test_worker_exception_and_start_failure_are_visible_and_retryable(self):
+        for start_failure in (False, True):
+            with self.subTest(start_failure=start_failure):
+                self.reset()
+                events = [{"key": "é"}]
+                if start_failure:
+                    with mock.patch.object(threading.Thread, "start", side_effect=RuntimeError("no thread")):
+                        self.assertTrue(self.s.remote_input({"events": events})["sent"])
+                else:
+                    with mock.patch.object(self.s._input, "send", side_effect=OSError("send failed")):
+                        self.assertTrue(self.s.remote_input({"events": events})["sent"])
+                        self.settle()
+                self.assertEqual(self.s._kde_queue, events)
+                self.assertIsNone(self.s._kde_worker[0])
+                self.assertEqual(self.s._kde_until, 0)
+                self.assertEqual(self.s.pad_status({"state": "ready"})["state"], "error")
+                self.s._input = self.Agent()
+                self.s.start_pad()
+                self.settle()
+                self.assertEqual(self.typed(), events)
+
+    def test_ascii_just_after_an_accent_stays_behind_it(self):
+        self.s.remote_input({"events": [{"key": "é"}]})
+        self.settle()
+        self.s.remote_input({"events": [{"key": "x"}]})  # KDE Connect may still be typing the é
+        self.settle()
+        self.assertEqual(self.s._touch.got, [])
+        self.assertEqual(self.typed(), [{"key": "é"}, {"key": "x"}])
+
+    def test_accent_just_after_gamescope_text_waits_for_it(self):
+        self.s.remote_input({"events": [{"key": "x" * 50}]})
+        self.assertEqual(self.s._touch.got, [[{"text": "x" * 50}]])
+        start = time.time()
+        self.s.remote_input({"events": [{"key": "é"}]})
+        self.settle()
+        self.assertGreater(time.time() - start, 0.6)  # 50 keys at 16 ms, plus the margin
+        self.assertEqual(self.typed(), [{"key": "é"}])
+
+    def test_typing_time_counts_every_key_transition(self):
+        t = self.s.typing_seconds
+        self.assertAlmostEqual(t([{"text": "ab"}]), 4 * 0.008)
+        self.assertAlmostEqual(t([{"text": "A"}]), 4 * 0.008)  # shift down, key down, key up, shift up
+        self.assertAlmostEqual(t([{"text": "x" * 500}]), 8.0)  # a long paste
+        self.assertAlmostEqual(t([{"key": 29, "down": True}, {"dx": 3, "dy": 0}]), 0.008)
+
+    def test_the_margin_is_added_once_not_per_request(self):
+        for _ in range(10):
+            self.s.remote_input({"events": [{"key": "ab"}]})
+        # ten requests of 4 transitions each: the work queues up, with no margin added per request
+        self.assertLess(self.s._typed_until - time.time(), 10 * 4 * 0.008 + 0.05)
+
+    def hold_worker(self):
+        entered, release = threading.Event(), threading.Event()
+        class Gate:
+            def wait(self, timeout):
+                entered.set()
+                if not release.wait(3):
+                    raise RuntimeError("test did not release worker")
+                return False
+        patch = mock.patch.object(self.s, "_kde_cancel", Gate())
+        patch.start()
+        self.addCleanup(patch.stop)
+        self.addCleanup(release.set)
+        return entered, release
+
+    def test_saturation_rejects_whole_batch_and_retry_delivers_every_accepted_event_once(self):
+        entered, release = self.hold_worker()
+        self.s._typed_until = time.time() + 60
+        first = [{"key": "é"}] * 150
+        remainder = [{"key": "ü"}] * 50
+        overflow = [{"singleclick": True}, {"key": "ß"}] * 75
+        self.assertTrue(self.s.remote_input({"events": first})["sent"])
+        self.assertTrue(entered.wait(1))  # batch is in flight, waiting for prior ASCII
+        try:
+            self.assertTrue(self.s.remote_input({"events": remainder})["sent"])
+            status = self.s.remote_input({"events": overflow})
+            self.assertFalse(status["sent"])
+            self.assertEqual(status["state"], "waiting")
+            self.assertEqual(self.s._kde_queue, first + remainder)
+            self.assertEqual(len(self.s._kde_queue), self.s.KDE_QUEUE_LIMIT)
+            self.assertEqual(self.s._touch.got, [])  # rejected clicks cannot be duplicated
+        finally:
+            self.s._typed_until = 0
+            release.set()
+            self.settle()
+        self.assertEqual(self.typed(), first + remainder)
+        self.assertTrue(self.s.remote_input({"events": overflow})["sent"])
+        self.settle()
+        self.assertEqual(self.typed(), first + remainder + [{"key": "ß"}] * 75)
+        self.assertEqual(self.s._touch.got, [[e for _ in range(75) for e in (
+            {"button": "left", "down": True}, {"button": "left", "down": False})]])
+
+    def test_retrying_batch_keeps_its_capacity_and_order(self):
+        entered, release = self.hold_worker()
+        self.s._input = self.Agent(sent=False, state="starting")
+        first, second = [{"key": "é"}] * 150, [{"key": "ü"}] * 150
+        self.assertTrue(self.s.remote_input({"events": first})["sent"])
+        self.assertTrue(entered.wait(1))  # first send failed; worker is in retry delay
+        try:
+            self.assertFalse(self.s.remote_input({"events": second})["sent"])
+            self.assertEqual(self.s._kde_queue, first)
+        finally:
+            self.s._input.sent = True
+            release.set()
+            self.settle()
+        self.assertTrue(self.s.remote_input({"events": second})["sent"])
+        self.settle()
+        self.assertEqual(self.typed(), first + second)
+
+    def test_concurrent_requests_cannot_both_claim_the_last_capacity(self):
+        entered, release = self.hold_worker()
+        self.s._typed_until = time.time() + 60
+        first = [{"key": "é"}]
+        self.s.remote_input({"events": first})
+        self.assertTrue(entered.wait(1))
+        barrier, results = threading.Barrier(3), []
+        def request(key):
+            barrier.wait(2)
+            batch = [{"key": key}] * 150
+            results.append((batch, self.s.remote_input({"events": batch})["sent"]))
+        threads = [threading.Thread(target=request, args=(key,)) for key in ("ü", "ß")]
+        try:
+            for thread in threads:
+                thread.start()
+            barrier.wait(2)
+            for thread in threads:
+                thread.join(2)
+                self.assertFalse(thread.is_alive())
+            self.assertEqual(sorted(sent for _, sent in results), [False, True])
+        finally:
+            self.s._typed_until = 0
+            release.set()
+            self.settle()
+        accepted = next(batch for batch, sent in results if sent)
+        rejected = next(batch for batch, sent in results if not sent)
+        self.assertEqual(self.typed(), first + accepted)
+        self.assertTrue(self.s.remote_input({"events": rejected})["sent"])
+        self.settle()
+        self.assertEqual(self.typed(), first + accepted + rejected)
+
+    def test_input_queued_as_the_worker_finishes_is_still_sent(self):
+        for _ in range(40):
+            self.reset()
+            self.s._input.got.clear()
+            self.s.remote_input({"events": [{"key": "é"}]})
+            time.sleep(0.002)
+            self.s.remote_input({"events": [{"key": "ü"}]})
+            self.settle()
+            self.assertEqual(self.s._kde_queue, [])
+            self.assertEqual(self.typed(), [{"key": "é"}, {"key": "ü"}])
+
+
+class PadRoute(unittest.TestCase):
+    def test_unicode_start_and_headset_switch_do_not_deadlock(self):
+        # Real InputAgent.send/start takes the route lock. Race it with route(),
+        # which cancels the pad worker; mocks of send() hide this lock inversion.
+        # A child keeps a regression's blocked daemon threads out of this suite.
+        code = r'''
+import sandbox
+import server as s
+import threading
+from unittest import mock
+
+entered, release, switching = threading.Event(), threading.Event(), threading.Event()
+s._input = s.InputAgent(packages=[])
+s._input._launch = lambda *args: None  # exercise real start, without any SSH
+s._touch = mock.Mock()
+send = s._input.send
+def held(events):
+    entered.set()
+    assert release.wait(2)
+    return send(events)
+s._input.send = held
+s._power.stop = lambda *args: switching.set()
+s._queue_for_kde([{'key': 'é'}])
+worker = s._kde_worker[0]
+assert entered.wait(2), 'Unicode worker never reached send'
+switch = threading.Thread(target=s.route, args=('frame-pr66-new', []), daemon=True)
+switch.start()
+switching.wait(0.2)
+release.set()
+worker.join(2)
+switch.join(2)
+assert not worker.is_alive(), 'Unicode worker deadlocked starting input during headset switch'
+assert not switch.is_alive(), 'headset switch deadlocked cancelling Unicode input'
+assert not s._kde_queue
+'''
+        env = {**os.environ, "PYTHONPATH": os.pathsep.join([str(ROOT / 'tests'), str(ROOT / 'ui')])}
+        result = subprocess.run([sys.executable, '-c', code], env=env, capture_output=True,
+                                text=True, timeout=8)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def setUp(self):
+        import server
+        self.s = server
+        self.agents = mock.patch.multiple(server, _touch=mock.Mock(), _input=mock.Mock())
+        self.agents.start()
+        self.addCleanup(self.agents.stop)
+        self.s._touch.send.return_value = {"state": "ready", "sent": True}
+        self.s._input.send.return_value = {"state": "ready", "sent": True}
+        self.s.reset_pad_route()
+        self.s._touch.reset_mock(); self.s._input.reset_mock()
+        self.addCleanup(self.s.reset_pad_route)
+
+    def switch(self):
+        with mock.patch.multiple(self.s, FRAME="frame-a", HOST_OPTS=[], MUX=[], SSH=[], macview=None), \
+             mock.patch.multiple(self.s.frame_android, FRAME="frame-a", SSH_OPTS=[]):
+            self.s.route("frame-b", [])
+
+    def test_stale_worker_exception_cannot_damage_new_route(self):
+        entered, release = threading.Event(), threading.Event()
+        class BrokenWait:
+            def wait(self, timeout):
+                entered.set()
+                if not release.wait(2):
+                    raise RuntimeError("test did not release old worker")
+                raise OSError("old route wait failed")
+            def set(self):
+                pass  # hold its exception until the new route has been published
+        self.s._kde_cancel = BrokenWait()
+        self.s._typed_until = time.time() + 60
+        self.s.remote_input({"events": [{"key": "é"}]})
+        worker = self.s._kde_worker[0]
+        try:
+            self.assertTrue(entered.wait(1))
+            self.switch()
+            marker = object()
+            with self.s._kde_lock:
+                self.s._kde_queue.append({"key": "new"})
+                self.s._kde_worker[0] = marker
+                self.s._kde_until = 42
+        finally:
+            release.set()
+            worker.join(2)
+        self.assertFalse(worker.is_alive())
+        self.assertEqual(self.s._kde_queue, [{"key": "new"}])
+        self.assertIs(self.s._kde_worker[0], marker)
+        self.assertEqual(self.s._kde_until, 42)
+        self.assertIsNone(self.s._kde_error)
+
+    def test_switch_stops_both_input_agents_and_discards_old_queue(self):
+        self.s._kde_queue.append({"key": "old"})
+        self.s._kde_until = self.s._typed_until = time.time() + 60
+        cancel = self.s._kde_cancel
+        self.switch()
+        self.s._input.stop.assert_called_once()
+        self.s._touch.stop.assert_called_once()
+        self.assertEqual(self.s._kde_queue, [])
+        self.assertEqual((self.s._kde_until, self.s._typed_until), (0, 0))
+        self.assertTrue(cancel.is_set())
+
+    def test_switch_cancels_delayed_and_retrying_text_before_new_input(self):
+        for delaying in (True, False):
+            with self.subTest(delaying=delaying):
+                waiting, cancel = threading.Event(), threading.Event()
+                class ObservedCancel:
+                    def wait(self, timeout):
+                        waiting.set()
+                        return cancel.wait(timeout)
+                    def set(self):
+                        cancel.set()
+                self.s.reset_pad_route()
+                self.s._kde_cancel = ObservedCancel()
+                self.s._typed_until = time.time() + 60 if delaying else 0
+                self.s._input.reset_mock()
+                self.s._input.send.return_value = {"state": "starting", "sent": False}
+                self.s.remote_input({"events": [{"key": "é"}]})
+                worker = self.s._kde_worker[0]
+                self.assertTrue(waiting.wait(1), "worker never reached its cancellable delay")
+                self.switch()
+                worker.join(1)
+                self.assertFalse(worker.is_alive())
+                attempts = self.s._input.send.call_count
+                self.assertEqual(attempts, 0 if delaying else 1)
+                self.s._input.send.return_value = {"state": "ready", "sent": True}
+                self.s.remote_input({"events": [{"key": "ü"}]})
+                next_worker = self.s._kde_worker[0]
+                if next_worker:
+                    next_worker.join(1)
+                    self.assertFalse(next_worker.is_alive())
+                self.assertEqual(self.s._input.send.call_count, attempts + 1)
+                self.assertEqual(self.s._input.send.call_args.args[0], [{"key": "ü"}])
+                self.assertEqual(self.s._kde_queue, [])
@@ -58,6 +58,50 @@ class FailureDetail(unittest.TestCase):


 class Probe(unittest.TestCase):
+    def test_mdns_falls_back_only_to_ip_authenticated_on_this_network(self):
+        address = {"host": "frame.local", "kind": "mdns", "last_ip": "192.168.1.40",
+                   "last_ip_network": "n-home"}
+        def result(host, port, **kwargs):
+            return {"state": "answered", "ip": host, "rtt_ms": 1} if host == "192.168.1.40" else \
+                   {"state": "unresolved", "detail": "Can't find name"}
+        with mock.patch.object(fl, "probe", side_effect=result) as probe:
+            self.assertEqual(fl.probe_address(address, 22, "n-home")["ip"], "192.168.1.40")
+            self.assertEqual([c.args[0] for c in probe.call_args_list], ["frame.local", "192.168.1.40"])
+            probe.reset_mock()
+            self.assertEqual(fl.probe_address(address, 22, "n-cafe")["state"], "unresolved")
+            probe.assert_called_once()
+
+    def test_find_uses_cached_ip_and_neighbours_without_trusting_them(self):
+        device = {"id": "d1", "alias": "frame", "port": 22, "addresses": [{"host": "frame.local", "kind": "mdns",
+                  "last_ip": "192.168.1.40", "last_ip_network": "n-test"}]}
+        link = mock.Mock()
+        link.active_device.return_value = device
+        link.state = {"network": NET}
+        def answer(host, port, timeout=3):
+            return {"state": "answered" if host in ("192.168.1.40", "192.168.1.41") else "unresolved",
+                    "detail": "test", "ip": host if host.startswith("192.") else None, "rtt_ms": 1}
+        with mock.patch.object(fl, "probe", side_effect=answer), \
+             mock.patch.object(fl.frame_network, "local_scan_candidates", return_value=["192.168.1.40", "192.168.1.41"]), \
+             mock.patch.object(fl.frame_network, "neighbour_cache", return_value=""), \
+             mock.patch.object(fl.frame_devices, "pinned_keys", return_value=[("ssh-ed25519", "SHA256:test")]), \
+             mock.patch.object(fl, "matches_pinned_key", return_value=True), \
+             mock.patch.object(fl.frame_host, "which", return_value=None), \
+             mock.patch("frame_connect.discover_devkit", return_value=[]):
+            found = fl.mdns_find(link)
+        self.assertEqual(found["scanned"], 1)  # cached IP is tried once
+        self.assertEqual({h["host"] for h in found["hosts"]}, {"192.168.1.40", "192.168.1.41"})
+        self.assertTrue(found["hosts"][0]["added"] is False)
+
+    def test_scan_requires_saved_matching_ssh_key(self):
+        key = ("ssh-ed25519", fd.fingerprint("a2V5"))
+        response = subprocess.CompletedProcess([], 0, "192.168.1.41 ssh-ed25519 a2V5\n", "")
+        with mock.patch.object(fl.frame_host, "which", return_value="ssh-keyscan"), \
+             mock.patch.object(fl.frame_host, "run_ssh", return_value=response):
+            self.assertTrue(fl.matches_pinned_key("192.168.1.41", 22, [key]))
+            self.assertFalse(fl.matches_pinned_key("192.168.1.41", 22, [("ssh-ed25519", "SHA256:other")]))
+            self.assertFalse(fl.matches_pinned_key("name;bad", 22, [key]))
+            self.assertFalse(fl.matches_pinned_key("192.168.1.41", 22, []))
+
    def test_answers_refusals_and_unknown_names(self):
        with socket.socket() as srv:
            srv.bind(("127.0.0.1", 0))
@@ -68,7 +68,7 @@ class Media(unittest.TestCase):
        self.assertIn('-frames:v', cmd)

    def play_with(self, name, busy=0, on_pixels=None, sleeps=None, info=None,
-                  fail=None, layout='auto'):
+                  fail=None, layout='auto', on_create=None, on_call=None):
        """Run the player against a fake OpenVR; returns (status, pixels calls).

        Handle 0 is the theatre surround and 1 the screen. `fail(handle, n)` makes
@@ -82,11 +82,18 @@ class Media(unittest.TestCase):
            write_status(path, **values)

        class FakeOverlay:
+            created = 0
+
            def create(self, *a, **k):
-                return len(calls)
+                # Handles in creation order: surround 0, then screen 1 (theatre).
+                FakeOverlay.created += 1
+                if on_create:
+                    on_create(*a, **k)
+                return FakeOverlay.created - 1

            def call(self, *a):
-                pass
+                if on_call:
+                    on_call(*a)

            def pixels(self, handle, data, w, h):
                calls.append((handle, w, h))
@@ -132,6 +139,58 @@ class Media(unittest.TestCase):
        self.assertEqual(result['dropped'], 2)
        self.assertIn((0, 1, 1), calls[3:])

+    def test_theatre_surround_failure_does_not_stop_playback(self):
+        def fail_surround(n):
+            if n == 1:  # the surround's upload is the first pixels call
+                raise RuntimeError('OpenVR SetOverlayRaw failed: 11')
+        result, _ = self.play_with('clip_SBS.mp4', on_pixels=fail_surround)
+        self.assertEqual((result['state'], result['frames']), ('ended', 4))
+
+    def test_theatre_surround_creation_and_setup_failures_are_cosmetic(self):
+        def fail_create(key, *a, **k):
+            if key.endswith('.surround'):
+                raise RuntimeError('OpenVR CreateOverlay failed: 11')
+        def fail_alpha(name, *a):
+            if name == 'SetOverlayAlpha':
+                raise RuntimeError('OpenVR SetOverlayAlpha failed: 11')
+        for hooks in ({'on_create': fail_create}, {'on_call': fail_alpha}):
+            with self.subTest(hooks=hooks), patch('builtins.print') as log:
+                result, calls = self.play_with('clip_SBS.mp4', **hooks)
+            self.assertEqual((result['state'], result['frames']), ('ended', 4))
+            self.assertEqual(sum(h == 1 for h, w, hgt in calls), 4)
+            self.assertIn('Theatre surround unavailable:', log.call_args.args[0])
+
+    def test_theatre_surround_refusal_after_standby_is_not_retried(self):
+        def refuse_retry(n):
+            if n == 3:  # surround busy, screen accepted, surround retry refused
+                raise RuntimeError('OpenVR SetOverlayRaw failed: 11')
+        with patch('builtins.print') as log:
+            result, calls = self.play_with('clip_SBS.mp4', busy=1, on_pixels=refuse_retry)
+        self.assertEqual((result['state'], result['frames'], result['dropped']), ('ended', 4, 0))
+        self.assertEqual(sum(h == 0 for h, w, hgt in calls), 2)
+        self.assertIn('Theatre surround unavailable:', log.call_args.args[0])
+
+    def test_screen_refusal_still_fails_playback(self):
+        def refuse_screen(n):
+            if n == 2:
+                raise RuntimeError('OpenVR SetOverlayRaw failed: 11')
+        with self.assertRaisesRegex(RuntimeError, 'SetOverlayRaw failed: 11'):
+            self.play_with('clip_SBS.mp4', on_pixels=refuse_screen)
+
+    def test_close_attempts_every_overlay_and_shuts_down_after_teardown_errors(self):
+        for error in (RuntimeError('OpenVR error'), ValueError('bad handle'),
+                      InterruptedError('late Stop')):
+            with self.subTest(error=type(error).__name__):
+                overlay = player.Overlay.__new__(player.Overlay)
+                overlay.handles = [10, 20]
+                overlay.vr = unittest.mock.Mock()
+                overlay.call = unittest.mock.Mock(side_effect=[error, None])
+                overlay.close()
+                self.assertEqual(overlay.call.call_args_list, [
+                    unittest.mock.call('DestroyOverlay', 20),
+                    unittest.mock.call('DestroyOverlay', 10)])
+                overlay.vr.VR_ShutdownInternal.assert_called_once_with()
+
    def test_stop_mid_video_reports_stopped(self):
        result, _ = self.play_with('clip_SBS.mp4', on_pixels=lambda n: n == 3 and stop_now())
        self.assertEqual(result['state'], 'stopped')
@@ -102,6 +102,17 @@ class Parsers(unittest.TestCase):
        self.assertEqual(fn.parse_nmcli(NMCLI), "Cafe: upstairs")
        self.assertIsNone(fn.parse_nmcli("no:Neighbour\n"))

+    def test_neighbour_scan_stays_on_local_subnet(self):
+        nearby = ("192.168.50.31 dev wlan0 lladdr 00:11:22:33:44:55 REACHABLE\n"
+                  "192.168.51.31 dev wlan0 lladdr 00:11:22:33:44:66 STALE\n"
+                  "192.168.50.1 dev wlan0 lladdr 00:11:22:33:44:77 STALE\n")
+        self.assertEqual(fn.parse_neighbours(nearby, "192.168.50.9", "192.168.50.1"), ["192.168.50.31"])
+        candidates = fn.local_scan_candidates("192.168.50.9", "192.168.50.1", nearby)
+        self.assertEqual(candidates[0], "192.168.50.31")
+        self.assertEqual(len(candidates), 252)
+        self.assertNotIn("192.168.51.31", candidates)
+        self.assertEqual(fn.local_scan_candidates("100.101.1.4", "100.101.1.1"), [])
+
    def test_windows(self):
        self.assertEqual(fn.parse_route_windows(WIN_ROUTE), ("192.168.1.1", "192.168.1.50"))
        self.assertEqual(fn.parse_arp_windows(WIN_ARP, "192.168.1.1"), "b4:fb:e4:b5:67:55")
@@ -0,0 +1,169 @@
+"""The OBS relay must preserve transport packets and keep its output local."""
+import importlib.util
+import io
+import json
+import os
+from pathlib import Path
+import signal
+import socket
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+import unittest
+from unittest import mock
+
+
+SCRIPT = Path(__file__).resolve().parents[1] / 'scripts' / 'obs-headset-source.py'
+spec = importlib.util.spec_from_file_location('obs_headset_source', SCRIPT)
+obs = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(obs)
+
+
+class Receiver:
+    def __init__(self):
+        self.chunks = []
+
+    def send(self, data):
+        self.chunks.append(data)
+
+
+class ObsSourceTests(unittest.TestCase):
+    def test_desktop_packages_the_helper_as_a_required_resource(self):
+        root = SCRIPT.parents[1]
+        build = json.loads((root / 'app' / 'package.json').read_text())['build']
+        scripts = next(item for item in build['extraResources'] if item['to'] == 'scripts')
+        self.assertIn(SCRIPT.name, scripts['filter'])
+        self.assertIn('scripts/' + SCRIPT.name, (root / 'app' / 'build' / 'check-resources.js').read_text())
+
+    def test_relay_keeps_whole_transport_packets(self):
+        stream = bytes(range(188)) * 101
+        receiver = Receiver()
+        self.assertEqual(obs.relay(io.BytesIO(stream), receiver), len(stream))
+        self.assertEqual(b''.join(receiver.chunks), stream)
+        self.assertTrue(all(len(chunk) % 188 == 0 and len(chunk) <= 1316
+                            for chunk in receiver.chunks))
+
+    def test_incomplete_packet_fails(self):
+        with self.assertRaisesRegex(RuntimeError, 'incomplete'):
+            obs.relay(io.BytesIO(b'x' * 189), Receiver())
+
+    def test_remote_command_uses_recording_sources(self):
+        with_audio = obs.remote_command()
+        self.assertIn('/dev/video99', with_audio)
+        self.assertIn('@DEFAULT_MONITOR@', with_audio)
+        self.assertIn('-map 1:a:0', with_audio)
+        self.assertIn('-f mpegts', with_audio)
+        self.assertNotIn('@DEFAULT_MONITOR@', obs.remote_command(audio=False))
+
+    def test_watchdog_ends_a_stalled_child_on_every_host_platform(self):
+        class Child:
+            def __init__(self):
+                self.stopped = threading.Event()
+
+            def poll(self):
+                return 255 if self.stopped.is_set() else None
+
+            def terminate(self):
+                self.stopped.set()
+
+        for ready in (False, True):
+            with self.subTest(ready=ready):
+                child = Child()
+                watchdog = obs.StreamWatchdog(child, startup=0.1, stall=0.1)
+                if ready:
+                    watchdog.packet()
+                try:
+                    self.assertTrue(child.stopped.wait(1), 'a stalled SSH child was not terminated')
+                    self.assertIn('stopped' if ready else 'no OBS video', watchdog.reason)
+                finally:
+                    watchdog.close()
+
+    @unittest.skipIf(sys.platform == 'win32', 'the packaged Start/Stop control is Linux/macOS only')
+    def test_relay_stops_its_ssh_child_on_app_signal_or_control_pipe(self):
+        for mode in ('signal', 'control-pipe'):
+            with self.subTest(mode=mode):
+                self._check_stop_mode(mode)
+
+    def _check_stop_mode(self, mode):
+        with tempfile.TemporaryDirectory() as folder, socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as receiver:
+            directory = Path(folder)
+            stopped = directory / 'stopped'
+            fake = directory / 'ssh'
+            fake.write_text("#!/usr/bin/env python3\n"
+                            "import os, signal, sys, time\n"
+                            "def stop(*_):\n"
+                            "    open(os.environ['FAKE_SSH_STOPPED'], 'w').close()\n"
+                            "    sys.exit(255)\n"
+                            "signal.signal(signal.SIGTERM, stop)\n"
+                            "sys.stdout.buffer.write(b'G' * 1316)\n"
+                            "sys.stdout.buffer.flush()\n"
+                            "while True: time.sleep(1)\n")
+            fake.chmod(0o755)
+            receiver.bind(('127.0.0.1', 0))
+            receiver.settimeout(8)
+            env = {**os.environ, 'PATH': str(directory) + os.pathsep + os.environ.get('PATH', ''),
+                   'FAKE_SSH_STOPPED': str(stopped)}
+            arguments = [sys.executable, str(SCRIPT), '--frame', 'fake-frame',
+                         '--port', str(receiver.getsockname()[1])]
+            if mode == 'control-pipe':
+                arguments.append('--control-stdin')
+            process = subprocess.Popen(arguments,
+                                       stdin=subprocess.PIPE if mode == 'control-pipe' else subprocess.DEVNULL,
+                                       stdout=subprocess.PIPE,
+                                       stderr=subprocess.PIPE, env=env)
+            try:
+                packet, _ = receiver.recvfrom(1500)
+                self.assertEqual(packet, b'G' * 1316)
+                if mode == 'control-pipe':
+                    process.stdin.close()
+                    process.wait(timeout=8)
+                    errors = process.stderr.read()
+                else:
+                    process.send_signal(signal.SIGTERM)
+                    _, errors = process.communicate(timeout=8)
+                self.assertEqual(process.returncode, 0, errors.decode())
+                self.assertIn(b'Frame Control OBS stream is ready', errors)
+                for _ in range(30):
+                    if stopped.exists():
+                        break
+                    time.sleep(0.1)
+                self.assertTrue(stopped.exists(), 'the SSH child survived relay shutdown')
+            finally:
+                if process.poll() is None:
+                    process.kill()
+                    process.communicate(timeout=5)
+                process.stdout.close()
+                process.stderr.close()
+
+    @unittest.skipIf(sys.platform == 'win32', 'the stand-in SSH script uses a POSIX shebang')
+    def test_startup_and_stream_stalls_end_ssh_with_a_clear_error(self):
+        for mode in ('startup', 'stream'):
+            with self.subTest(mode=mode), tempfile.TemporaryDirectory() as folder:
+                directory = Path(folder)
+                fake = directory / 'ssh'
+                fake.write_text("#!/usr/bin/env python3\n"
+                                "import os, signal, sys, time\n"
+                                "def stop(*_):\n"
+                                "    open(os.environ['FAKE_SSH_STOPPED'], 'w').close()\n"
+                                "    sys.exit(255)\n"
+                                "signal.signal(signal.SIGTERM, stop)\n"
+                                "if os.environ['FAKE_SSH_MODE'] == 'stream':\n"
+                                "    sys.stdout.buffer.write(b'G' * 1316)\n"
+                                "    sys.stdout.buffer.flush()\n"
+                                "while True: time.sleep(1)\n")
+                fake.chmod(0o755)
+                stopped = directory / 'stopped'
+                env = {'PATH': str(directory) + os.pathsep + os.environ.get('PATH', ''),
+                       'FAKE_SSH_STOPPED': str(stopped), 'FAKE_SSH_MODE': mode}
+                with mock.patch.dict(os.environ, env), \
+                     mock.patch.object(obs, 'STARTUP_TIMEOUT', 0.3), \
+                     mock.patch.object(obs, 'STREAM_STALL', 0.3):
+                    with self.assertRaisesRegex(RuntimeError, 'no OBS video' if mode == 'startup' else 'video stopped'):
+                        obs.main(['--frame', 'fake-frame'])
+                self.assertTrue(stopped.exists(), 'SSH survived the relay timeout')
+
+
+if __name__ == '__main__':
+    unittest.main()
@@ -9,7 +9,7 @@ import subprocess
 import unittest

 ROOT = pathlib.Path(__file__).resolve().parents[1]
-STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadPanels', 'loadPanelSwitcher', 'loadBackups', 'loadStorage', 'loadPower', 'loadTitles', 'showAndroidTab',
+STUBS = ['$', 'toggleLive', 'scrollToY', 'scroller', 'loadMacView', 'loadSteamPipewire', 'loadPanels', 'loadPanelSwitcher', 'loadExtensions', 'loadDecky', 'loadHeadsetPanel', 'loadBackups', 'loadStorage', 'loadPower', 'loadTitles', 'showAndroidTab',
         'loadAndroid', 'loadDisplays', 'setGameSource', 'requestAnimationFrame']

 RUN = r'''
@@ -7,6 +7,7 @@ Run: python3 -m unittest discover -s tests
 """
 import sandbox  # noqa: F401  (first: keeps tests off real data and services)
 import json
+import hashlib
 import os
 import subprocess
 import tempfile
@@ -26,6 +27,9 @@ def draft(tag_name="untagged-c6ddfed7f75d67db2e99", name="Frame Control 9.8.7",
    if assets is None:
        assets = [{"id": 100 + i, "name": n, "size": 1000 + i, "digest": "sha256:" + "%064x" % i}
                  for i, n in enumerate(INSTALLERS)]
+        body = "".join(f"{i:064x}  {n}\n" for i, n in enumerate(INSTALLERS)).encode()
+        assets.append({"id": 200, "name": "SHA256SUMS", "size": len(body),
+                       "digest": "sha256:" + hashlib.sha256(body).hexdigest()})
    return {"id": rid, "tag_name": tag_name, "name": name, "draft": True, "prerelease": False,
            "body": "notes", "html_url": "https://github.com/saphid/frame-control/releases/tag/" + tag_name,
            "assets": assets}
@@ -79,6 +83,16 @@ class PublishRelease(unittest.TestCase):
        self.assertIsNone(upload)
        self.assertFalse(any(c[1:3] == ["-X", "PATCH"] for c in log))

+    def test_refuses_missing_or_stale_checksums(self):
+        for assets in (draft()["assets"][:-1],
+                       draft()["assets"][:-1] + [{"id": 200, "name": "SHA256SUMS",
+                                                  "digest": "sha256:" + "0" * 64}]):
+            p, log, upload = self.run_script([draft(assets=assets)], "v9.8.7")
+            self.assertNotEqual(p.returncode, 0)
+            self.assertIn("SHA256SUMS is absent or does not match", p.stderr)
+            self.assertIsNone(upload)
+            self.assertFalse(any("PATCH" in c for c in log))
+
    def test_refuses_ambiguous_or_absent_drafts_and_missing_tags(self):
        p, _, _ = self.run_script([draft(rid=1), draft(rid=2)], "v9.8.7")
        self.assertNotEqual(p.returncode, 0)
@@ -0,0 +1,38 @@
+"""Checksum generator uses only complete, unambiguous GitHub asset metadata."""
+import sandbox  # noqa: F401
+import hashlib
+import importlib.util
+import unittest
+from pathlib import Path
+
+SCRIPT = Path(__file__).resolve().parent.parent / "scripts" / "release-checksums.py"
+spec = importlib.util.spec_from_file_location("release_checksums", SCRIPT)
+module = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(module)
+
+
+class Checksums(unittest.TestCase):
+    def test_complete_list_matches_bytes(self):
+        assets = []
+        for i, name in enumerate(module.INSTALLERS):
+            assets.append({"name": name, "digest": "sha256:" + hashlib.sha256(str(i).encode()).hexdigest()})
+        actual = module.checksums({"assets": assets})
+        self.assertEqual(len(actual.splitlines()), 8)
+        self.assertEqual(actual.splitlines()[0], hashlib.sha256(b"0").hexdigest() + "  " + module.INSTALLERS[0])
+
+    def test_missing_duplicate_and_bad_digest_fail(self):
+        assets = [{"name": name, "digest": "sha256:" + "0" * 64} for name in module.INSTALLERS]
+        for changed in (assets[:-1], assets + [assets[0]],
+                        [dict(assets[0], digest="sha256:bad"), *assets[1:]]):
+            with self.assertRaises(ValueError):
+                module.checksums({"assets": changed})
+
+    def test_tag_or_exact_untagged_draft(self):
+        lines = ['{"id": 1, "tag_name": "untagged-a", "draft": true, "name": "Frame Control 9.8.7"}',
+                 '{"id": 2, "tag_name": "v9.8.8", "draft": false, "name": "Frame Control 9.8.8"}']
+        self.assertEqual(module.find_release(lines, "v9.8.7")["id"], 1)
+        self.assertEqual(module.find_release(lines, "v9.8.8")["id"], 2)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -94,6 +94,46 @@ class ServerGuards(unittest.TestCase):
        self.assertEqual(headers["X-Frame-Options"], "DENY")
        self.assertIn(b"<title>APK Store</title>", payload)

+    def test_local_extension_is_listed_and_sandboxed(self):
+        folder = Path(os.environ["FRAME_CONTROL_DATA_DIR"]) / "extensions" / "test-glance"
+        folder.mkdir(parents=True, exist_ok=True)
+        (folder / "manifest.json").write_text(json.dumps({"id": "test-glance", "name": "Test Glance",
+            "version": "1.0", "description": "Test status", "entry": "index.html"}))
+        (folder / "index.html").write_text('<script src="main.js"></script>')
+        (folder / "main.js").write_text('parent.postMessage({type:"frame-control:request",id:1,action:"status"},"*");')
+        try:
+            code, _, body = self.request("GET", "/api/extensions", headers={"X-Frame-UI": "1"})
+            self.assertEqual(code, 200)
+            self.assertIn("test-glance", [x["id"] for x in json.loads(body)["extensions"]])
+            code, headers, body = self.request("GET", "/extension/test-glance/index.html")
+            self.assertEqual(code, 200)
+            self.assertIn(b"main.js", body)
+            self.assertIn("frame-ancestors 'self'", headers["Content-Security-Policy"])
+            self.assertNotIn("X-Frame-Options", headers)
+            self.assertEqual(self.request("GET", "/extension/test-glance/manifest.json")[0], 404)
+            self.assertEqual(self.request("GET", "/extension/test-glance/../index.html")[0], 404)
+            try:
+                (folder / "escape.js").symlink_to(Path(__file__))
+            except OSError:  # Windows may not allow an unprivileged test to create a symlink.
+                pass
+            else:
+                self.assertEqual(self.request("GET", "/extension/test-glance/escape.js")[0], 404)
+        finally:
+            shutil.rmtree(folder)
+
+    def test_decky_write_requires_experimental_acknowledgement(self):
+        code, body = self.post('/api/decky', {'action': 'install'})
+        self.assertEqual(code, 400)
+        self.assertIn('experimental', body['error'])
+
+    def test_headset_page_and_install_acknowledgement(self):
+        code, _, body = self.request('GET', '/headset')
+        self.assertEqual(code, 200)
+        self.assertIn(b'Frame Control VR [fc-headset]', body)
+        code, body = self.post('/api/headset', {'action': 'install'})
+        self.assertEqual(code, 400)
+        self.assertIn('opt-in', body['error'])
+
    def test_foreign_host_rejected(self):
        # DNS rebinding: a hostile name pointed at 127.0.0.1.
        for path in ("/", "/api/status"):
@@ -296,7 +336,7 @@ class OneServer(unittest.TestCase):
        self.assertIn("Frame Control on", first.stdout.readline())
        second = subprocess.run([sys.executable, str(ROOT / "ui" / "server.py"), "--port", "0"], env=env,
                                capture_output=True, text=True, timeout=60)
-        self.assertEqual(second.returncode, 1)
+        self.assertEqual(second.returncode, 1, second.stderr)
        self.assertIn("already running", second.stderr)
        first.terminate()
        first.wait(10)
@@ -2,6 +2,7 @@
 import sandbox  # noqa: F401
 import contextlib
 import hashlib
+import io
 import json
 import os
 from pathlib import Path
@@ -19,6 +20,28 @@ import frame_agent as agent
 import frame_android as android


+class StartupTests(unittest.TestCase):
+    def test_rejected_server_starts_no_background_work(self):
+        # A losing process exits through Python teardown. Background TLS/index
+        # workers there can crash it, and it must not sweep the owner's files.
+        with mock.patch.object(server, 'LOCAL', False), \
+                mock.patch.object(server, 'PRIVATE', False), \
+                mock.patch.object(sys, 'argv', ['server.py', '--port', '0']), \
+                mock.patch.object(server, 'one_server', side_effect=SystemExit('already running')), \
+                mock.patch.object(server, 'LoopbackServer') as listener, \
+                mock.patch.object(server, 'sweep_tmp') as sweep, \
+                mock.patch.object(server.threading, 'Thread') as worker, \
+                mock.patch.object(server.frame_telemetry, 'start') as telemetry, \
+                mock.patch.object(server.frame_contact, 'start') as contact:
+            with self.assertRaisesRegex(SystemExit, 'already running'):
+                server.main()
+            listener.assert_not_called()
+            sweep.assert_not_called()
+            worker.assert_not_called()
+            telemetry.assert_not_called()
+            contact.assert_not_called()
+
+
 class TargetTests(unittest.TestCase):
    def setUp(self):
        self.active = {'id': 'a', 'name': 'Headset A'}
@@ -32,6 +55,7 @@ class TargetTests(unittest.TestCase):
        self.stack.enter_context(mock.patch.object(server, '_backfill', {'running': False, 'last': 0.0}))
        self.stack.enter_context(mock.patch.object(server.macview, 'retarget'))
        self.stack.enter_context(mock.patch.object(server._input, 'stop'))
+        self.real_devices_action = server.frame_link.devices_action
        self.stack.enter_context(mock.patch.object(server.frame_link, 'devices_action', self.switch))

    def switch(self, link, body, setup, busy):
@@ -90,6 +114,39 @@ class TargetTests(unittest.TestCase):
                server._live_tunnels.discard(proc)
                server.route(*before)

+    def test_input_post_reserves_headset_through_send_and_enqueue(self):
+        body = json.dumps({'events': [{'singleclick': True}, {'key': 'é'}]}).encode()
+        handler = server.Handler.__new__(server.Handler)
+        handler.path = '/api/input'
+        handler.local_request = lambda: True
+        handler.headers = {'Content-Length': str(len(body)), 'X-Frame-Device': 'a'}
+        handler.rfile = io.BytesIO(body)
+        handler.send_json, handler.send_error_json = mock.Mock(), mock.Mock()
+        stages = []
+        def check_switch(stage):
+            self.assertEqual(server._work[0], 1)
+            with self.assertRaises(server.Failure):
+                server.devices_post({'action': 'use', 'id': 'b'})
+            stages.append(stage)
+        def send(events):
+            check_switch('send')
+            return {'state': 'ready', 'sent': True}
+        def enqueue(events):
+            check_switch('enqueue')
+            self.assertEqual(events, [{'key': 'é'}])
+            return True
+        with mock.patch.object(server.frame_link, 'devices_action', self.real_devices_action), \
+                mock.patch.object(server._touch, 'send', side_effect=send), \
+                mock.patch.object(server, '_queue_for_kde', side_effect=enqueue):
+            handler.do_POST()
+        handler.send_error_json.assert_not_called()
+        self.assertTrue(handler.send_json.call_args.args[0]['sent'])
+        self.assertEqual(stages, ['send', 'enqueue'])
+        self.assertEqual(self.active['id'], 'a')
+        self.assertEqual(server._work[0], 0)
+        server.devices_post({'action': 'use', 'id': 'b'})
+        self.assertEqual(self.active['id'], 'b')
+
    def test_backfill_counts_work_until_error_cleanup(self):
        entered, release = threading.Event(), threading.Event()
        writes = []
@@ -380,9 +437,9 @@ class FinalGetStartTests(unittest.TestCase):
        self.active.update(id='b', name='Headset B')
        for name in ('input', 'touch'):
            with self.subTest(name=name):
-                fresh = server.InputAgent(packages=[]) if name == 'input' else server.TouchAgent()
+                fresh = server.TouchAgent()
                handler = self.handler('/api/%s?start=1' % name, 'a')
-                with mock.patch.object(server, '_' + name, fresh), mock.patch.object(fresh, 'start') as start:
+                with mock.patch.object(server, '_touch', fresh), mock.patch.object(fresh, 'start') as start:
                    handler.do_GET()
                start.assert_not_called()
                self.assertEqual(handler.send_error_json.call_args.args[1], 409)
@@ -391,14 +448,46 @@ class FinalGetStartTests(unittest.TestCase):
    def test_desktop_get_start_requires_an_intended_device(self):
        for name in ('input', 'touch'):
            with self.subTest(name=name):
-                fresh = server.InputAgent(packages=[]) if name == 'input' else server.TouchAgent()
+                fresh = server.TouchAgent()
                handler = self.handler('/api/%s?start=1' % name, None)
-                with mock.patch.object(server, '_' + name, fresh), mock.patch.object(fresh, 'start') as start:
+                with mock.patch.object(server, '_touch', fresh), mock.patch.object(fresh, 'start') as start:
                    handler.do_GET()
                start.assert_not_called()
                self.assertEqual(handler.send_error_json.call_args.args[1], 400)
                self.assertEqual(server._work[0], 0)

+    def test_input_get_starts_and_polls_gamescope_without_starting_kde_connect(self):
+        touch, kde = mock.Mock(), mock.Mock()
+        touch.status = {'state': 'ready', 'focus': 7}
+        touch.send.return_value = {'state': 'starting', 'sent': False}
+        with mock.patch.object(server, '_touch', touch), mock.patch.object(server, '_input', kde):
+            start = self.handler('/api/input?start=1', 'a')
+            start.do_GET()
+            touch.send.assert_called_once_with([])
+            start.send_json.assert_called_once_with(touch.send.return_value)
+            status = self.handler('/api/input', 'a')
+            status.do_GET()
+            status.send_json.assert_called_once_with(touch.status)
+        kde.send.assert_not_called()
+        kde.start.assert_not_called()
+
+    def test_input_poll_exposes_retained_text_error_and_start_retries(self):
+        touch = mock.Mock(status={'state': 'ready'})
+        touch.send.return_value = {'state': 'ready', 'sent': False}
+        with mock.patch.object(server, '_touch', touch), \
+                mock.patch.object(server, '_kde_queue', [{'key': 'é'}]), \
+                mock.patch.object(server, '_kde_error', 'Text is retained; try again.'), \
+                mock.patch.object(server, '_kde_worker', [None]), \
+                mock.patch.object(server, '_start_kde_locked') as retry:
+            status = self.handler('/api/input', 'a')
+            status.do_GET()
+            self.assertEqual(status.send_json.call_args.args[0]['state'], 'error')
+            retry.assert_not_called()  # polling never retries typing on its own
+            start = self.handler('/api/input?start=1', 'a')
+            start.do_GET()
+            retry.assert_called_once_with()
+            touch.send.assert_called_once_with([])
+
    def test_get_start_validation_and_thread_registration_are_one_reservation(self):
        attempts = []
        fresh = server.TouchAgent()
@@ -458,10 +547,10 @@ class FinalGetStartTests(unittest.TestCase):
                                    (None, None, '?start=1')):
            for name in ('input', 'touch'):
                with self.subTest(name=name, query=query, local=link is None):
-                    fresh = server.InputAgent(packages=[]) if name == 'input' else server.TouchAgent()
+                    fresh = server.TouchAgent()
                    handler = self.handler('/api/' + name + query, meant)
                    with mock.patch.object(server, 'LINK', link), mock.patch.object(server, 'LOCAL', link is None), \
-                            mock.patch.object(server, '_' + name, fresh), mock.patch.object(fresh, 'start') as start:
+                            mock.patch.object(server, '_touch', fresh), mock.patch.object(fresh, 'start') as start:
                        handler.do_GET()
                    self.assertEqual(start.call_count, 1 if query else 0)
                    handler.send_error_json.assert_not_called()
@@ -0,0 +1,92 @@
+"""Screenshot copies retain the headset, Steam account and game identity."""
+import sandbox  # noqa: F401
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "ui"))
+import server  # noqa: E402
+
+
+NAME = "20261025020000_1.jpg"
+FIRST = f"1/620/{NAME}"
+SECOND = f"1/730/{NAME}"
+
+
+class ShotCopyTest(unittest.TestCase):
+    def setUp(self):
+        self.folder = Path(tempfile.mkdtemp(prefix="frame-shot-copy-"))
+        self.addCleanup(shutil.rmtree, self.folder, ignore_errors=True)
+        patch = mock.patch.object(server, "SHOTS_DIR", self.folder)
+        patch.start()
+        self.addCleanup(patch.stop)
+        patch = mock.patch.object(server, "LINK", None)
+        patch.start()
+        self.addCleanup(patch.stop)
+        self.payloads = {
+            server.shot_path(FIRST): b"first game",
+            server.shot_path(SECOND): b"second game",
+        }
+
+    def scp(self, argv, **_kwargs):
+        target = Path(argv[-1])
+        for source in argv[1:-1]:
+            if not source.startswith("frame-a:") and not source.startswith("frame-b:"):
+                continue
+            remote = source.split(":", 1)[1]
+            (target / Path(remote).name).write_bytes(self.payloads[remote])
+        return subprocess.CompletedProcess(argv, 0, "", "")
+
+    def test_equal_names_survive_across_games_and_headsets(self):
+        # A pre-upgrade flat file has no provable source identity. Leave it alone.
+        legacy = self.folder / NAME
+        legacy.write_bytes(b"older screenshot")
+        with mock.patch.object(server, "FRAME", "frame-a"), \
+             mock.patch.object(server, "ensure_master"), \
+             mock.patch.object(server.frame_host, "run_ssh", side_effect=self.scp) as copy:
+            self.assertEqual(server.save_shots({"ids": [FIRST, SECOND]})["saved"], 2)
+            self.assertEqual(copy.call_count, 2)  # scp cannot flatten equal names together
+            first = server.shot_local_path(FIRST)
+            second = server.shot_local_path(SECOND)
+            self.assertEqual(first.read_bytes(), b"first game")
+            self.assertEqual(second.read_bytes(), b"second game")
+            self.assertNotEqual(first, second)
+            self.assertEqual(legacy.read_bytes(), b"older screenshot")
+            listing = "\n".join([
+                f"1/760/remote/620/screenshots/{NAME}\t10\t1792893600",
+                f"1/760/remote/730/screenshots/{NAME}\t11\t1792893601",
+            ])
+            with mock.patch.object(server, "ssh", return_value=listing):
+                self.assertTrue(all(s["saved"] for s in server.list_shots()["shots"]))
+            with mock.patch.object(server.frame_host, "reveal_path") as reveal:
+                server.open_thing({"what": "shot", "id": SECOND})
+                reveal.assert_called_once_with(second)
+
+        self.payloads[server.shot_path(FIRST)] = b"another headset"
+        with mock.patch.object(server, "FRAME", "frame-b"), \
+             mock.patch.object(server, "ensure_master"), \
+             mock.patch.object(server.frame_host, "run_ssh", side_effect=self.scp):
+            self.assertEqual(server.save_shots({"ids": [FIRST]})["saved"], 1)
+            other = server.shot_local_path(FIRST)
+            self.assertNotEqual(other, first)
+            self.assertEqual(other.read_bytes(), b"another headset")
+            self.assertEqual(first.read_bytes(), b"first game")
+
+    def test_missing_staged_file_does_not_claim_saved(self):
+        with mock.patch.object(server, "FRAME", "frame-a"), \
+             mock.patch.object(server, "ensure_master"), \
+             mock.patch.object(server.frame_host, "run_ssh",
+                               return_value=subprocess.CompletedProcess([], 0, "", "")):
+            with self.assertRaisesRegex(server.Failure, "did not contain every"):
+                server.save_shots({"ids": [FIRST]})
+            self.assertFalse(server.shot_local_path(FIRST).exists())
+            self.assertFalse(list(self.folder.glob(".incoming-*")))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -0,0 +1,261 @@
+"""PC-only Steam helper tests. All app launches and KDE calls are mocked.
+No portal, interactive Wayland session, Steam installation or Frame is used.
+"""
+import sandbox  # noqa: F401
+import contextlib
+import http.client
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+from unittest import mock
+from http.server import ThreadingHTTPServer
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / 'ui'))
+import frame_steam_pipewire as helper
+import server
+
+ENV = {'XDG_SESSION_TYPE': 'wayland', 'WAYLAND_DISPLAY': 'wayland-0',
+       'DBUS_SESSION_BUS_ADDRESS': 'unix:path=/mock/session-bus', 'XDG_CURRENT_DESKTOP': 'KDE'}
+
+
+class HelperTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = contextlib.ExitStack()
+        self.addCleanup(self.stack.close)
+        patches = [mock.patch.dict(os.environ, ENV, clear=True),
+                   mock.patch.object(helper.sys, 'platform', 'linux'),
+                   mock.patch.object(helper.os, 'geteuid', return_value=1000, create=True),
+                   mock.patch.object(helper.Path, 'exists', return_value=False),
+                   mock.patch.object(helper, '_launch', None),
+                   mock.patch.object(helper, '_steam_running', return_value=False),
+                   mock.patch.object(helper.shutil, 'which', side_effect=lambda n: '/usr/bin/' + n),
+                   mock.patch.object(helper.subprocess, 'Popen'),
+                   mock.patch.object(helper.subprocess, 'run')]
+        started = [self.stack.enter_context(p) for p in patches]
+        self.running, self.which, self.spawn, self.run = started[-4:]
+        self.spawn.return_value.poll.return_value = None
+        self.spawn.return_value.wait.side_effect = subprocess.TimeoutExpired('app', 1)
+        self.run.return_value = subprocess.CompletedProcess([], 0, 'kcm_app-permissions - Application Permissions\n', '')
+
+    def action(self, action):
+        return helper.action({'action': action, 'confirmed': True})
+
+    def test_status_is_read_only(self):
+        self.assertTrue(helper.status()['available'])
+        self.spawn.assert_not_called()
+        self.run.assert_not_called()
+        self.running.assert_not_called()
+
+    def test_platform_and_local_session_gates(self):
+        for platform in ('win32', 'darwin'):
+            with self.subTest(platform=platform), mock.patch.object(helper.sys, 'platform', platform):
+                self.assertFalse(helper.status()['available'])
+                with self.assertRaises(helper.HelperError):
+                    self.action('launch')
+        for change in ({'FRAME_LOCAL': '1'}, {'XDG_SESSION_TYPE': 'x11'}, {'WAYLAND_DISPLAY': ''},
+                       {'DBUS_SESSION_BUS_ADDRESS': ''}, {'SSH_CONNECTION': 'remote'}, {'SSH_CLIENT': 'remote'}):
+            with self.subTest(change=change), mock.patch.dict(os.environ, change):
+                for action in ('launch', 'permissions'):
+                    with self.assertRaises(helper.HelperError):
+                        self.action(action)
+        self.spawn.assert_not_called()
+        self.run.assert_not_called()
+
+    def test_root_and_sandbox_refused(self):
+        with mock.patch.object(helper.os, 'geteuid', return_value=0):
+            self.assertIn('not root', helper.status()['reason'])
+        with mock.patch.object(helper.Path, 'exists', return_value=True):
+            with self.assertRaisesRegex(helper.HelperError, 'sandbox'):
+                self.action('launch')
+        self.spawn.assert_not_called()
+
+    def test_only_explicit_supported_actions(self):
+        for body in ({}, {'action': 'launch'}, {'action': 'permissions', 'confirmed': 'true'},
+                     {'action': 'delete-all', 'confirmed': True}):
+            with self.subTest(body=body), self.assertRaises(helper.HelperError):
+                helper.action(body)
+        self.spawn.assert_not_called()
+        self.run.assert_not_called()
+
+    def test_launch_exact_command_and_duplicate_guard(self):
+        result = self.action('launch')
+        self.assertTrue(result['launched'])
+        self.assertIn('does not confirm', result['message'])
+        self.spawn.assert_called_once_with(['/usr/bin/steam', '-pipewire'], stdin=subprocess.DEVNULL,
+                                          stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                                          start_new_session=True)
+        with self.assertRaisesRegex(helper.HelperError, 'already running or starting'):
+            self.action('launch')
+        self.assertEqual(self.spawn.call_count, 1)
+        self.run.assert_not_called()
+
+    def test_running_and_unknown_steam_fail_closed(self):
+        self.running.return_value = True
+        with self.assertRaisesRegex(helper.HelperError, 'Steam > Exit'):
+            self.action('launch')
+        self.running.side_effect = helper.HelperError('Cannot verify')
+        with self.assertRaisesRegex(helper.HelperError, 'Cannot verify'):
+            self.action('launch')
+        self.spawn.assert_not_called()
+
+    def test_missing_launcher_does_not_guess_flatpak(self):
+        self.which.side_effect = None
+        self.which.return_value = None
+        with self.assertRaisesRegex(helper.HelperError, 'Flatpak-only'):
+            self.action('launch')
+        self.spawn.assert_not_called()
+
+    def test_launch_error_is_not_success(self):
+        self.spawn.side_effect = OSError('missing')
+        with self.assertRaisesRegex(helper.HelperError, 'Could not start'):
+            self.action('launch')
+
+    def test_immediate_application_failure_is_not_success(self):
+        self.spawn.return_value.wait.side_effect = None
+        self.spawn.return_value.wait.return_value = 1
+        for action in ('launch', 'permissions'):
+            with self.subTest(action=action), mock.patch.object(helper, '_launch', None):
+                with self.assertRaisesRegex(helper.HelperError, 'exited with an error'):
+                    self.action(action)
+
+    def test_permissions_opens_only_verified_exact_module_never_resets(self):
+        result = self.action('permissions')
+        self.assertTrue(result['opened'])
+        self.assertFalse(result['reset'])
+        self.assertIn('No permission was changed', result['message'])
+        self.run.assert_called_once_with(['/usr/bin/kcmshell6', '--list'], capture_output=True,
+                                         text=True, timeout=5, stdin=subprocess.DEVNULL)
+        self.assertEqual(self.spawn.call_args.args[0], ['/usr/bin/kcmshell6', 'kcm_app-permissions'])
+        self.running.assert_not_called()
+
+    def test_wrong_module_missing_tool_and_other_desktops_only_give_guidance(self):
+        for listing in ('kcm_flatpak - Flatpak Permissions', 'evil_kcm_app-permissions - nope', ''):
+            self.run.return_value.stdout = listing
+            result = self.action('permissions')
+            self.assertFalse(result['reset'])
+            self.assertFalse(result['opened'])
+        self.which.side_effect = None
+        self.which.return_value = None
+        self.assertFalse(self.action('permissions')['opened'])
+        self.which.reset_mock()
+        with mock.patch.dict(os.environ, {'XDG_CURRENT_DESKTOP': 'GNOME'}):
+            self.assertFalse(self.action('permissions')['opened'])
+            self.which.assert_not_called()
+        self.spawn.assert_not_called()
+
+    def test_module_listing_error_or_timeout_is_guidance_not_reset(self):
+        for error in (OSError('missing'), subprocess.TimeoutExpired('kcm', 5)):
+            self.run.side_effect = error
+            result = self.action('permissions')
+            self.assertFalse(result['opened'])
+            self.assertFalse(result['reset'])
+            self.assertIn('kde-config-flatpak', result['message'])
+        self.spawn.assert_not_called()
+
+
+class ProcessTests(unittest.TestCase):
+    def setUp(self):
+        self.stack = contextlib.ExitStack()
+        self.addCleanup(self.stack.close)
+        self.tmp = self.stack.enter_context(tempfile.TemporaryDirectory())
+        self.proc = Path(self.tmp)
+        # Match the temp files' owner even when tests run as root or on Windows.
+        self.stack.enter_context(mock.patch.object(helper.os, 'geteuid', return_value=self.proc.stat().st_uid, create=True))
+        self.add('1', 'python', b'python\0server.py\0')
+
+    def add(self, pid, comm, cmdline):
+        p = self.proc / pid
+        p.mkdir()
+        (p / 'comm').write_text(comm)
+        (p / 'cmdline').write_bytes(cmdline)
+
+    def test_native_launcher_webhelper_and_flatpak_detected(self):
+        for comm, cmd in [('steam', b'/x/steam\0'), ('bash', b'bash\0/x/steam.sh\0'),
+                          ('steamwebhelper', b'/x/steamwebhelper\0'),
+                          ('flatpak', b'flatpak\0run\0com.valvesoftware.Steam\0')]:
+            with self.subTest(comm=comm):
+                (self.proc / '1' / 'comm').write_text(comm)
+                (self.proc / '1' / 'cmdline').write_bytes(cmd)
+                self.assertTrue(helper._steam_running(self.proc))
+
+    def test_unrelated_names_are_not_steam(self):
+        self.add('2', 'steamdeck-tools', b'/bin/steam-tools\0')
+        self.assertFalse(helper._steam_running(self.proc))
+
+    def test_other_user_steam_is_not_this_users_instance(self):
+        self.add('2', 'steam', b'steam\0')
+        with mock.patch.object(helper.os, 'geteuid', return_value=self.proc.stat().st_uid + 1):
+            self.assertFalse(helper._steam_running(self.proc))
+
+    def test_exited_process_is_skipped(self):
+        (self.proc / '2').mkdir()
+        self.assertFalse(helper._steam_running(self.proc))
+
+    def test_unreadable_or_missing_inventory_fails_closed(self):
+        with self.assertRaisesRegex(helper.HelperError, 'Cannot verify'):
+            helper._steam_running(self.proc / 'missing')
+        with mock.patch.object(helper.Path, 'read_bytes', side_effect=PermissionError('denied')):
+            with self.assertRaisesRegex(helper.HelperError, 'Cannot verify'):
+                helper._steam_running(self.proc)
+
+
+class RouteTests(unittest.TestCase):
+    def test_headset_and_private_servers_never_call_helper(self):
+        for local, private in ((True, False), (False, True)):
+            with mock.patch.object(server, 'LOCAL', local), mock.patch.object(server, 'PRIVATE', private), \
+                    mock.patch.object(helper, 'action') as action, mock.patch.object(helper, 'status') as status:
+                self.assertFalse(server.steam_pipewire_state()['available'])
+                with self.assertRaises(server.Failure):
+                    server.steam_pipewire_action({'action': 'launch', 'confirmed': True})
+                action.assert_not_called()
+                status.assert_not_called()
+
+    def test_http_guards_get_read_only_and_post_bypasses_headset_work(self):
+        with ThreadingHTTPServer(('127.0.0.1', 0), server.Handler) as httpd:
+            thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+            thread.start()
+            try:
+                def request(method, body=None, headers=None):
+                    conn = http.client.HTTPConnection('127.0.0.1', httpd.server_port)
+                    conn.request(method, '/api/steam-pipewire', json.dumps(body) if body else None, headers or {})
+                    reply = conn.getresponse()
+                    code, data = reply.status, json.loads(reply.read())
+                    conn.close()
+                    return code, data
+                with mock.patch.object(server, 'LOCAL', False), mock.patch.object(server, 'PRIVATE', False), \
+                        mock.patch.object(server, 'working', side_effect=AssertionError('headset work')), \
+                        mock.patch.object(server, 'ssh', side_effect=AssertionError('Frame access')), \
+                        mock.patch.object(helper, 'action', return_value={'reset': False}) as action, \
+                        mock.patch.object(helper, 'status', return_value={'available': True}) as status:
+                    self.assertEqual(request('POST', {'action': 'launch'})[0], 403)
+                    self.assertEqual(request('GET')[0], 403)
+                    action.assert_not_called()
+                    headers = {'X-Frame-UI': server.UI_KEY, 'X-Frame-Device': 'unrelated-device'}
+                    self.assertEqual(request('GET', headers=headers), (200, {'available': True}))
+                    action.assert_not_called()
+                    status.assert_called_once()
+                    body = {'action': 'permissions', 'confirmed': True}
+                    self.assertEqual(request('POST', body, headers), (200, {'reset': False}))
+                    action.assert_called_once_with(body)
+            finally:
+                httpd.shutdown()
+                thread.join()
+
+
+class PageTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which('node'), 'Node exercises production page handlers')
+    def test_production_page_handlers(self):
+        result = subprocess.run(['node', '--test', str(ROOT / 'tests/steam_pipewire_ui.cjs')],
+                                capture_output=True, text=True)
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+
+if __name__ == '__main__':
+    unittest.main()
Author	SHA1	Message	Date
SAPHID	d44b6121ae	Use POSIX member paths in headset bundle on Windows	2026-10-25 03:39:53 +00:00
SAPHID	af6f97ca5a	Add removable Frame Control headset panel	2026-10-25 03:33:58 +00:00
Alex SouthwellandSAPHID	509ddbdc95	Add experimental Decky Loader manager for Steam Frame (#195 ) * Add sandboxed local Frame Control extensions * Add experimental Decky Loader manager for Steam Frame * ci: verify Decky PR against main --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 03:14:42 +00:00
Alex SouthwellandSAPHID	f2d293bd1a	Add local Frame Control extensions (#194 ) * Add sandboxed local Frame Control extensions * docs: clarify local extension network boundary --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 02:48:37 +00:00
Alex Southwell	a5a554d0c2	Document real Frame screenshot Save verification (#193 ) Document real Frame screenshot Save verification	2026-10-25 02:36:30 +00:00
SAPHID	af2dca8365	Document real Frame screenshot copy check	2026-10-25 02:29:56 +00:00
Alex Southwell	6a8e0093de	Keep equal Steam screenshot filenames from overwriting each other (#192 ) Keep equal Steam screenshot filenames from overwriting each other	2026-10-25 02:28:29 +00:00
SAPHID	53107fd91b	Keep saved Steam screenshots separate by headset and game	2026-10-25 02:17:29 +00:00
Alex SouthwellandSAPHID	548f5d8496	Bump Frame Control to 0.4.26 (#191 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 01:48:22 +00:00
Alex SouthwellandSAPHID	a03c94ae12	Attach SHA256SUMS and explain download verification (#186 ) * Attach and verify release SHA256SUMS with download guidance * Write release checksums as exact LF bytes on Windows * Read release safety text as UTF-8 on Windows * Clarify checksum rollout and macOS signing status --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 01:38:26 +00:00
Alex SouthwellandSAPHID	dd3df85fd6	Stop stalled OBS relays and handle intentional shutdown (#190 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 01:34:13 +00:00
Alex SouthwellandSAPHID	e7bfa80e09	Add opt-in Open at Login with tray startup (#189 ) * Add opt-in Open at Login with tray startup * Show login window when Linux tray has no visible icon --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 01:32:10 +00:00
Alex SouthwellandSAPHID	b26e34ce09	Document current real-device, VM and untested coverage (#188 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 01:11:55 +00:00
Alex SouthwellandSAPHID	ab4b58b1c7	Document OBS game audio capture issue and workaround (#187 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 01:08:10 +00:00
Alex SouthwellandSAPHID	74089fb2f1	Bump Frame Control to 0.4.25 (#185 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 00:43:52 +00:00
Alex SouthwellandSAPHID	7f828cbcf8	Compare Windows wireless snapshots after dropouts (#184 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 00:35:48 +00:00
Alex SouthwellandSAPHID	42665d14db	Guide recovery for Windows Wireless Adapter dropouts (#183 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 00:23:39 +00:00
Alex SouthwellandSAPHID	8dd6eb3fe9	Bump Frame Control to 0.4.24 (#182 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-25 00:06:07 +00:00
Alex SouthwellandSAPHID	ef309c9931	Add window switch control to desktop panels (#181 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 23:57:35 +00:00
Alex SouthwellandSAPHID	de0f0eb0e3	Bump Frame Control to 0.4.23 (#180 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 23:39:29 +00:00
Alex SouthwellandSAPHID	bdef125f68	Enable OBS source control on Windows (#179 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 23:31:23 +00:00
Alex SouthwellandSAPHID	f64cbe5bac	Add read-only wired connection doctor (#178 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 23:23:29 +00:00
Alex SouthwellandSAPHID	d4714eadf7	Open Android catalogue without waiting for installed apps (#177 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 23:04:06 +00:00
Alex SouthwellandSAPHID	bcdd69f6d8	Bump Frame Control to 0.4.22 (#176 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 22:45:11 +00:00
Alex SouthwellandSAPHID	f5becdd2c0	Document real OBS Media Source verification (#175 ) * Document real OBS Media Source video and audio verification * Record packaged OBS Start and Stop headset check --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 22:33:11 +00:00
Alex SouthwellandSAPHID	e185cb3b29	Bundle OBS source with desktop Start and Stop control (#174 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 22:05:20 +00:00
Alex SouthwellandSAPHID	2320dc4d0e	Bump Frame Control to 0.4.21 (#173 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 21:40:55 +00:00
Alex SouthwellandSAPHID	affe3eda65	Record Round 3 headset mirror and charge-limit checks (#172 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 21:30:51 +00:00
Alex SouthwellandSAPHID	9e9b25e9f4	Add local OBS headset view source with output audio (#170 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 21:29:23 +00:00
Alex SouthwellandSAPHID	f7153b3ab1	Guide emulator setup and clarify ROM storage limits (#171 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 21:28:49 +00:00
Alex SouthwellandSAPHID	5c987ae8b8	Bump Frame Control to 0.4.20 (#167 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 13:32:38 +00:00
Alex SouthwellandSAPHID	42b0d729cb	Document Frame OS 0.5.6 live compatibility findings (#168 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 13:24:32 +00:00
Alex SouthwellandSAPHID	ae63fa584c	Add read-only Windows Wireless Adapter doctor (#166 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:44:24 +00:00
Alex SouthwellandSAPHID	337ac99b3e	Add a read-only Linux Wireless Adapter doctor (#165 ) * Add read-only Linux PC Wireless Adapter doctor * Cross-reference coordinated SteamOS compatibility notes --------- Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:30:08 +00:00
Alex SouthwellandSAPHID	aada257325	Handle Frame OS 0.5.6 discovery and SteamOS name changes (#164 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:24:04 +00:00
Alex SouthwellandSAPHID	8bc3d63126	Add local Linux helper for Steam PipeWire desktop sharing (#163 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:18:08 +00:00
Alex SouthwellandSAPHID	c690e691a3	Bump Frame Control to 0.4.19 (#162 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 12:04:30 +00:00
Alex Southwell Claude Sonnet 5.5 SAPHID	e3fcd3eef8	Use gamescope input for Frame trackpad and keyboard (#66 ) * Live view: a Desktop view that stays still, and Control to tap on the Frame The live view gets a second source and a way to use the Frame from it: - Desktop: the app panel in use in the headset, streamed from its own window (x11grab of gamescope's redirected window), so it doesn't move as the wearer looks around. A picker shows any other panel, view only. - Control: on the Desktop view a tap or click lands exactly where you put it; drag is a mouse drag, press and hold right-clicks, two fingers scroll, and on a computer the mouse, wheel and keyboard work directly. On the headset view the view is a trackpad. A text field and key row type from a phone. Input goes through gamescope's own EIS socket (the way Steam feeds Remote Play input) with the libei already on the image: ui/frame_touch.py, over the same long-lived ssh machinery as the keyboard agent, nothing to install. It reaches the panel that has focus on either X display, which the KDE Connect route can't. Verified on the Frame and from the iPhone app in the Simulator. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: fixes from review - Keys held on the Frame are released with buttons when Control stops or the view loses focus; keys for the Frame no longer trigger Frame Control's own shortcuts. - Taps only act when the picture on screen is the panel in use; positions, presses, keys, text and scrolls name their panel (display and window: ids repeat across :0 and :1, told apart by pid), and the Frame drops them if focus has moved on. Releases always go. - While connecting, a tap keeps its position; on an error only releases wait and retries back off; trimming a long queue never drops a release. - Lifting one of two scrolling fingers ends the scroll; a cancelled touch isn't a tap; clicks and holds on the bars around the picture do nothing. - A capture loop from before a Live restart can't stop the new video. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: close the targeting gaps from the second review - The focused panel's display comes from GAMESCOPE_FOCUS_DISPLAY (gamescope packs ":1" into the first value), so a window id repeated across :0 and :1 can't be mistaken; the pid is only the fallback. - Presses, keys, text and scrolls read focus afresh on the Frame; only moves use a reading up to a second old. - A gesture remembers the panel it started on and does nothing more if that stops being the one in use; a press with no panel to aim at isn't sent. - Opening a screenshot clears the panel Control would act on; switching to another app releases held keys and buttons. - Trimming keeps a click with its position; the error backoff holds for new input too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: fixes from the SWE-2 Max review - The Frame side tracks keys as well as buttons and lets go of both when the session ends. - A stale tap tells the page, which re-reads the panels at once. - A paused input device waits instead of ending the session; only a disconnect does. An OS error on one event skips it. - Presses check focus with two property reads and do the full lookup only when it changed. - Writes to an agent's stdin are serialized, so two devices sending at once can't tear a line (the keyboard agent too). - Connecting gives up with a message after 15 s instead of hanging on "Connecting…"; text goes in 100-character pieces so releases don't wait behind a long paste; a cancelled mouse gesture releases what's held. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Control: stale clears, pauses reconverge, pastes split per request - The Frame says it has caught up as soon as an aimed event lands after a stale one, so the page stops re-reading the panels. - After a device pause it lets go of everything it holds (releases that arrived while paused were dropped), and waits for the device once per batch, not once per event. - The quick focus check no longer freshens the panel geometry's age. - Each request carries at most about 100 characters of text. - Turning Control off while it connects doesn't report an error. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * frame_touch: build the socket path on the Frame, so Windows can import it for tests Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * frame_touch: any event that goes through clears the stale flag A trackpad move names no panel, so waiting for an aimed event could leave the page re-reading panels for the rest of the session; a release still aimed at the old panel doesn't count. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Trackpad and key row go through gamescope's input; KDE Connect only for accents and emoji The pad reaches whichever panel has focus (Steam's menus too), needs nothing installed, and no longer clamps to 1280x720. Characters that aren't on a US keyboard start KDE Connect the first time they're typed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Touch: a bare release no longer clears the stale-focus notice before the page has seen it The page leaves the panel off releases, so a release says nothing about focus. Found in review of the stale-latch fix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Pad: keep typing in order and acknowledge it once, with accents through one KDE Connect queue Review found accent-only input repeated forever (sent was false), text split across two transports out of order, accents stuck until the next keypress, duplicated on retry, and racy. A batch with an accent now sends its whole keyboard through KDE Connect; later keys follow while any are queued; the server owns one ordered, bounded queue drained by a single thread; sent means the whole batch is taken. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Pad: drain the KDE Connect queue without losing, stranding or reordering input Second review found the queue could be trimmed under an in-flight send (deleting unsent events), the worker could retire as a request enqueued, and ASCII could overtake an accent still being typed (or the reverse). The worker now takes its batch out while sending and puts it back on failure, retires under the lock, and each way waits out the other's estimated typing time. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Pad: count gamescope's real typing time, with the settle margin added once Review found the estimate used 12 ms a character where the agent takes 16 ms (32 shifted), and added the margin on every request so it piled up. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Document gamescope pad verification and shared-device limits * Prevent Unicode input startup from deadlocking a headset switch * Record real focused-panel click and ASCII key delivery * Retain accepted Unicode input under queue saturation and failure --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 11:54:36 +00:00
Alex SouthwellandSAPHID	0da1fe5077	Bump Frame Control to 0.4.18 (#161 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:53:48 +00:00
Alex Southwell Claude Opus 5.5 SAPHID	1f7615b312	Keep theatre playback running without optional surround (#51 ) * Never end playback over the cosmetic surround; always shut down OpenVR Review (SWE-2 Max): a non-standby error re-sending the theatre surround could end a healthy still, and a non-RuntimeError during DestroyOverlay skipped VR_ShutdownInternal. drain() now drops a surround that fails for other reasons, and close() shuts down in finally. Fake overlay handles no longer depend on call order. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Play without the theatre surround if SteamVR refuses it Review (SWE-2 Max): a non-standby error creating the cosmetic surround at startup still ended playback before the screen appeared. Theatre now logs it and plays without the surround. close() treats any per-overlay teardown error as best effort (signals are already ignored there). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * Verify media surround fallback and guard server startup ownership * Record exact-head real Frame theatre playback smoke --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:45:48 +00:00
Alex SouthwellandSAPHID	2ded4c5a0d	Document saved panel layout feasibility on SteamVR 2.18.2 (#160 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:19:35 +00:00
Alex SouthwellandSAPHID	5b47cd3330	Document packaged Desktop Capture result and visibility limit (#159 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 10:03:36 +00:00
Alex SouthwellandSAPHID	aead570b5d	Clarify Return to Game Mode switch help (#158 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:47:24 +00:00
Alex SouthwellandSAPHID	de931bc56f	Document packaged Return to Game Mode button verification (#157 ) Co-authored-by: SAPHID <saphid@users.noreply.github.com>	2026-10-24 09:39:21 +00:00