Play without the theatre surround if SteamVR refuses it

Review (SWE-2 Max): a non-standby error creating the cosmetic surround
at startup still ended playback before the screen appeared. Theatre now
logs it and plays without the surround. close() treats any per-overlay
teardown error as best effort (signals are already ignored there).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.claude/skills/steam-frame/SKILL.md

@@ -22,7 +22,6 @@ desktop or panels.
 | See the Frame from the Mac, or the Mac inside the Frame | `docs/streaming.md` | `scripts/run-on-frame.sh mac-screen` |
 | Files and clipboard | `docs/file-transfer.md` | `scripts/push.sh`, `scripts/paste-to-frame.sh` |
 | Android apps (Lepton) | `docs/apks.md` | `scripts/install-apk.sh` |
-| Browse and install Android apps from inside the headset (APK Store panel) | `docs/apks.md` | `scripts/store-on-frame.sh` |
 | Reach the Frame off the home LAN (Tailscale) | `docs/tailscale.md` | `scripts/tailscale-on-frame.sh` |
 | Install or buy Steam games, Frame ratings | `docs/steam-games.md` | `ui/frame_steam.py` |
 | Flatpaks | `docs/streaming.md` | `scripts/install-apps.sh` |

.gitattributes

@@ -6,8 +6,3 @@
 *.json text eol=lf
 *.md text eol=lf
 *.bat text eol=crlf
-# Test fixtures are byte-exact (hashes, signatures): never convert line endings.
-tests/fixtures/** -text
-*.apk binary
-*.jar binary
-*.obb binary

.github/workflows/checks.yml

@@ -5,11 +5,6 @@ on:
     branches: [main]
   pull_request:
 
-# A newer push to the same pull request supersedes a run still in progress.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   checks:
     runs-on: ubuntu-latest
@@ -22,9 +17,7 @@ jobs:
         with:
           node-version: "24"
       - name: Install zsh
-        # The runner image's third-party apt sources (packages.microsoft.com) sometimes
-        # fail to refresh; Ubuntu's own lists still update, and the install fails if not.
-        run: (sudo apt-get update -qq || true) && sudo apt-get install -y -qq zsh
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq zsh
       - name: Script syntax
         run: |
           sh -n ui/local-bin/ssh
@@ -43,8 +36,8 @@ jobs:
         run: python -m unittest discover -s tests -v
       - name: App syntax
         run: node --check app/main.js && node --check app/build/make-icon.js && node --check app/build/fetch-deps.js && node --check app/preload.js && node --check app/install-link.js && node --check app/updater.js
-      - name: App tests
-        run: node --test app/test/*.test.js
+      - name: Updater tests
+        run: node --test app/test/updater.test.js
       - name: Website
         run: node --test site/test/*.test.mjs && node --check site/public/js/site.js && node --check site/public/js/feedback.js
 
@@ -91,8 +84,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install zsh
-        # The runner image's third-party apt sources (packages.microsoft.com) sometimes
-        # fail to refresh; Ubuntu's own lists still update, and the install fails if not.
-        run: (sudo apt-get update -qq || true) && sudo apt-get install -y -qq zsh
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq zsh
       - name: End-to-end tests
         run: scripts/e2e.sh

.github/workflows/pc-host.yml

@@ -1,53 +0,0 @@
-name: PC host libraries
-# PC in the headset (Experimental). The Windows job builds the native adapter
-# and runs the real-encoder protocol tests; the installer's own bundle is
-# tested in release.yml. The Linux adapter from PR #38 isn't shipped or offered
-# in the app, but shares capture.c and controller.c, so it's still built here.
-# These builds add the GPL x264 encoder for headless tests only: they're never
-# uploaded or shipped.
-on:
-  pull_request:
-    paths: ["desktop/**", "ui/**", "tests/**", "scripts/macview-bench.py", ".github/workflows/pc-host.yml"]
-  workflow_dispatch:
-jobs:
-  linux:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Native libraries
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libglib2.0-dev gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-pipewire libpipewire-0.3-modules libspa-0.2-modules
-          python3 desktop/build.py --with-x264
-      - name: Tests (real x264, fake capture consent/input)
-        env:
-          FRAME_PC_REQUIRE_NATIVE: "1"
-          FRAME_PC_REQUIRE_X264: "1"
-        run: python3 -m unittest discover -s tests -p 'test_pc*.py' -v
-  windows:
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: msys2/setup-msys2@v2
-        with:
-          msystem: UCRT64
-          update: true
-      # A mirror's HTTP 429 once failed this install (2026-10-24): retry, so a
-      # flaky mirror can't break a release build.
-      - name: MSYS2 packages for the PC host
-        shell: msys2 {0}
-        run: |
-          for attempt in 1 2 3; do
-            pacman -S --needed --noconfirm mingw-w64-ucrt-x86_64-gcc mingw-w64-ucrt-x86_64-pkgconf mingw-w64-ucrt-x86_64-python mingw-w64-ucrt-x86_64-gstreamer mingw-w64-ucrt-x86_64-gst-plugins-base mingw-w64-ucrt-x86_64-gst-plugins-good mingw-w64-ucrt-x86_64-gst-plugins-bad mingw-w64-ucrt-x86_64-gst-plugins-ugly && exit 0
-            sleep $((attempt * 30))
-          done
-          exit 1
-      - name: Native build and tests (x264; WGC and MF need a desktop/GPU)
-        shell: msys2 {0}
-        run: |
-          python desktop/build.py --with-x264
-          FRAME_PC_REQUIRE_NATIVE=1 FRAME_PC_REQUIRE_X264=1 python -m unittest discover -s tests -p 'test_pc*.py' -v

.github/workflows/release.yml

@@ -2,60 +2,19 @@ name: release
 
 # Pushing a v* tag builds Frame Control for macOS, Windows and Linux and attaches
 # the installers to that tag's GitHub release (created as a draft if missing).
-# Pull requests that change how the installers are built (the Electron app, the
-# Windows PC helper libraries, the macOS helper, or this workflow) build the same installers as
-# artifacts. ui/, scripts/, frame/ and apk-catalog/ are copied in as they are and
-# are tested by the checks workflow; run this one by hand to package them early.
+# Pull requests that touch the app build the same installers as artifacts.
 on:
   push:
     tags: ["v*"]
   pull_request:
-    paths: ["app/**", "desktop/**", "mac/frame-mac-view/**", ".github/workflows/release.yml"]
+    paths: ["app/**", "ui/**", "scripts/**", "frame/**", "apk-catalog/**", ".github/workflows/release.yml"]
   workflow_dispatch:
 
-# A newer push to the same pull request supersedes a build still in progress.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: write
 
 jobs:
-  # One job makes the draft, before the builds: three matrix jobs each running
-  # "view || create" could race and make duplicate drafts. The draft is tied to
-  # the pushed tag (the tag must already exist on GitHub, then tag_name is set
-  # explicitly), so scripts/publish-release.sh and `gh release upload` find it
-  # by tag. It is created with the REST API so the id comes straight back: the
-  # release list can lag a fresh draft (v0.4.2's first run found nothing and
-  # PATCHed releases/ with an empty id). tests/test_release_workflow.py runs
-  # this step against tests/fakegh.
-  draft:
-    if: startsWith(github.ref, 'refs/tags/')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create the draft release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          tag="${GITHUB_REF_NAME}"
-          # A rerun finds the draft an earlier attempt made.
-          id=$(gh api --paginate "repos/$GH_REPO/releases?per_page=100" --jq ".[] | select(.tag_name == \"$tag\") | .id" | head -n 1)
-          if [ -z "$id" ]; then
-            # Given a missing tag, GitHub would create it on the default branch.
-            gh api "repos/$GH_REPO/git/ref/tags/$tag" >/dev/null \
-              || { echo "tag $tag isn't on GitHub" >&2; exit 1; }
-            id=$(gh api -X POST "repos/$GH_REPO/releases" -f tag_name="$tag" -f name="Frame Control ${tag#v}" \
-              -F draft=true -f body="" --jq .id)
-          fi
-          [ -n "$id" ] || { echo "no release id for $tag; not PATCHing releases/" >&2; exit 1; }
-          gh api -X PATCH "repos/$GH_REPO/releases/$id" -f tag_name="$tag" --jq '"release " + (.id|tostring) + " tag_name " + .tag_name'
-
   build:
-    needs: draft
-    # Still runs for pull requests and manual runs, where the draft job is skipped.
-    if: ${{ !failure() && !cancelled() }}
     strategy:
       fail-fast: false
       matrix:
@@ -75,71 +34,22 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: "24"
-      # PC in the headset (Experimental, Windows only): our capture adapter and
-      # the GStreamer libraries it uses, bundled into resources/desktop/bundle.
-      - uses: msys2/setup-msys2@v2
-        if: runner.os == 'Windows'
-        with:
-          msystem: UCRT64
-          update: true
-      # A mirror's HTTP 429 once failed this install (2026-10-24): retry, so a
-      # flaky mirror can't break a release build.
-      - name: MSYS2 packages for the PC host
-        if: runner.os == 'Windows'
-        shell: msys2 {0}
-        run: |
-          for attempt in 1 2 3; do
-            pacman -S --needed --noconfirm mingw-w64-ucrt-x86_64-gcc mingw-w64-ucrt-x86_64-pkgconf mingw-w64-ucrt-x86_64-python mingw-w64-ucrt-x86_64-gstreamer mingw-w64-ucrt-x86_64-gst-plugins-base mingw-w64-ucrt-x86_64-gst-plugins-good mingw-w64-ucrt-x86_64-gst-plugins-bad mingw-w64-ucrt-x86_64-gst-plugins-ugly && exit 0
-            sleep $((attempt * 30))
-          done
-          exit 1
-      - name: Windows PC streaming libraries
-        if: runner.os == 'Windows'
-        shell: msys2 {0}
-        run: python desktop/build.py --out app/build/desktop/win-x64
       - name: Build
         working-directory: app
         shell: bash
         run: npm ci && npm run ${{ matrix.script }}
         env:
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
-      # The installer, not just the unpacked build: its 7-Zip payload once dropped
-      # the OpenXR layer's arm64 library without any error. Install it silently
-      # and compare every installed file with the unpacked build.
-      - name: Check the Windows installer installs every file
-        if: matrix.os == 'windows-latest'
-        shell: pwsh
-        run: |
-          $setup = Get-ChildItem app/dist/Frame-Control-Setup-*.exe | Select-Object -First 1
-          $p = Start-Process -FilePath $setup.FullName -ArgumentList '/S' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { throw "installer exited $($p.ExitCode)" }
-          $installed = Join-Path $env:LOCALAPPDATA 'Programs\Frame Control'
-          for ($i = 0; $i -lt 60 -and -not (Test-Path (Join-Path $installed 'Uninstall Frame Control.exe')); $i++) { Start-Sleep 2 }
-          node app/build/check-resources.js (Join-Path $installed 'resources') app/dist/win-unpacked/resources
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-      # From the installed app, so this also proves the installer carries the
-      # libraries. After the check above, and without writing __pycache__,
-      # so it can't change what that check compares.
-      - name: Test the installed app's Python with the Windows PC libraries
-        if: runner.os == 'Windows'
-        shell: bash
-        env:
-          PYTHONDONTWRITEBYTECODE: "1"
-        run: |
-          resources="$(cygpath -u "$LOCALAPPDATA")/Programs/Frame Control/resources"
-          python="$resources/python/python.exe"
-          native="$(cygpath -w "$resources/desktop/bundle")"
-          FRAME_PC_NATIVE="$native" FRAME_PC_REQUIRE_NATIVE=1 FRAME_PC_INSTALLER_BUNDLE=1 "$python" -B -m unittest discover -s tests -p 'test_pc*.py' -v
       - name: Upload to the release
         if: startsWith(github.ref, 'refs/tags/')
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release upload "${GITHUB_REF_NAME}" ${{ matrix.files }} --clobber
-      # Tagged builds are attached to the release above; only other builds need artifacts.
+          tag="${GITHUB_REF_NAME}"
+          gh release view "$tag" >/dev/null 2>&1 || gh release create "$tag" --draft --title "Frame Control ${tag#v}" --notes ""
+          gh release upload "$tag" ${{ matrix.files }} --clobber
       - uses: actions/upload-artifact@v4
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         with:
           name: frame-control-${{ matrix.os }}
           path: |

.gitignore

@@ -7,15 +7,5 @@ compat-db/.lakebed/
 tests/smoke/results/
 mac/bin/
 
-# Shared desktop streaming controller build products
-desktop/controller.dll
-desktop/controller.dylib
-desktop/controller.so
-desktop/*.obj
-desktop/*.lib
-desktop/*.exp
-desktop/bundle/
-app/build/desktop/
-
 # Downloaded at build time (frame/kdeconnect/fetch.py, app/build/fetch-deps.js)
 frame/kdeconnect/packages/

CHANGELOG.md

@@ -1,31 +0,0 @@
-# Changelog
-
-## Unreleased
-
-- Fix experimental PC screen capture on Windows builds whose streaming libraries
-  lack Windows Graphics Capture. Whole screens use Desktop Duplication; individual
-  windows are hidden with an explanation instead of failing when shown. A Windows
-  VM streamed a real desktop to the Frame; physical input remains unverified.
-
-- Add read-only battery health in Tools: charging state, temperature, cycle count,
-  and available capacity with explicit unknown states. The parser was checked
-  on a real Frame; the connected desktop UI was tested with synthetic readings.
-
-- Add Tools → Game storage: read-only headset filesystem capacity and Steam
-  library/game install-size breakdown, with unknown sizes, partial inventories
-  and permission/missing-drive states. Includes instructions for Steam's own
-  Move UI; Frame Control does not move or delete game files. The read-only
-  parser was checked on a real Frame; the connected UI and game moves were not.
-
-- Add `scripts/frame-doctor.sh` for read-only setup and pairing diagnostics,
-  with verified SSH identity, private summaries and actionable next steps
-  (issue #34). Connection steps links to the diagnostic guide. Repairs remain
-  manual; restart-loop evidence stops deeper diagnostics. The real Frame
-  verified the SSH connection and safety stop; deeper checks were skipped.
-- Fixed headset smoke cleanup reporting success while a smoke-title process
-  could remain running after its files were removed. Cleanup now stops and
-  rechecks processes tied to exact reserved test-title paths, uses PID handles
-  for safe TERM/KILL escalation, and records stopped PIDs. Unrelated titles and
-  shared Wine services are left alone. Verified with local Linux process
-  regressions and a 13/13 real Frame smoke run that stopped five test-owned
-  Proton process PIDs before removing the Windows test title.

README.md

@@ -50,7 +50,7 @@ Charge, charging watts and time left, storage, memory, temperature, Wi-Fi, and w
 <td valign="top">
 
 **🎮 Steam games**<br>
-Everything you own with its Steam Frame rating. Install onto the headset with live progress, search the store, and force quit a game that stops responding.
+Everything you own with its Steam Frame rating. Install onto the headset with live progress, and search the store.
 
 </td>
 <td valign="top">
@@ -63,17 +63,17 @@ About 4,500 F-Droid apps rated for the Frame. One click installs each as its own
 <tr>
 <td valign="top">
 
-**📁 Files and games**<br>
-Drag files onto the window to send them. Drop a game's .zip, folder or .exe to add it to the Steam library, with Proton or the Linux runtime picked for you.
+**📁 Files, games and clipboard**<br>
+Drag files onto the window to send them. Drop a game's .zip, folder or .exe to add it to the Steam library, with Proton or the Linux runtime picked for you. Send text or your clipboard straight to the headset's desktop.
 
 </td>
 <td valign="top">
 
-**📸 Screenshots and recordings**<br>
-Browse the shots you take in the headset and save them to your Pictures folder, or have new ones and your Steam clips copied over automatically. Record what the headset shows, with its sound, or export Steam's clips at any length, as .mp4 files in your Videos folder ([not tested on a headset yet](docs/recording.md)).
+**📸 Screenshots**<br>
+Browse the shots you take in the headset and save them to your Pictures folder.
 
-**⌨️ Type on the headset**<br>
-Type and point in the Frame's apps from your computer or phone, through KDE Connect, which Frame Control brings along and sets up on the Frame. Copy text to the headset's clipboard and back again. Nothing else to install, anywhere. Press T to open it.
+**⌨️ Keyboard and trackpad**<br>
+Type and point in the Frame's apps from your computer or phone, through KDE Connect, which Frame Control brings along and sets up on the Frame. Nothing else to install, anywhere.
 
 </td>
 </tr>
@@ -89,27 +89,13 @@ Install desktop apps like Moonlight or VLC, and set each Android app's resolutio
 **⚡ One-click tools**<br>
 SSH, SFTP, Steam Link, remote desktop, volume, sleep, restart and shut down.
 
-</td>
-</tr>
-<tr>
-<td colspan="2" valign="top">
-
-**💾 Backup and recovery**<br>
-Copy game saves, settings and Android app data to your computer, and restore them after a factory reset. Sign-in files and keys are never copied. A Return to Game Mode button helps when the headset is stuck in Desktop Mode. Not tested on a headset yet. [How it works](docs/backup-and-recovery.md).
-
 </td>
 </tr>
 </table>
 
-The optional [Family and comfort](docs/family-comfort.md) card adds session
-limits, breaks, local alerts and one-click casting. A session copies a small
-Frame Control worker into your headset user account.
-
-For the other features, nothing is installed on the Frame: the app uses what SteamOS
+Nothing is installed on the Frame for any of this: the app uses what SteamOS
 already ships (sideloading a game copies Valve's own devkit scripts to
-`~/devkit-utils`, as Valve's Devkit Client does). The optional
-[performance HUD](docs/vr-utilities.md) copies our own Python helpers into
-`~/.local/share/frame-control/vr/`. [How each feature works](docs/frame-control.md).
+`~/devkit-utils`, as Valve's Devkit Client does). [How each feature works](docs/frame-control.md).
 
 ## Install
 
@@ -197,7 +183,7 @@ entry to `~/.ssh/config` and keys at `~/.ssh/id_ed25519_frame` and
 
 This is a first public test, so reports are really useful, especially from
 Windows and Linux. The quickest way is **Report a problem** in the app (the
-speech-bubble button at the top, or **Help → Report a Problem…**). It adds
+warning-sign button at the top, or **Help → Report a Problem…**). It adds
 diagnostics with personal details removed, shows you exactly what's included,
 and sends it privately to the maintainer; nothing is published. Without the app,
 use the [feedback form](https://frame-control.pages.dev/feedback/). Please include:
@@ -221,19 +207,16 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels |
 | [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging |
 | [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances |
-| [Import from my Quest](docs/quest-import.md) | Copy games you own off your Quest by USB; what runs, and why licence-checked games may not |
-| [My Meta library](docs/meta-library.md) | Experimental: install and test Quest games your Meta account owns, with your own token |
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
-| [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
-| [PC in the headset](docs/pc-in-headset.md) | Experimental, Windows only, off until you turn it on: a whole PC screen as a panel in the Frame. Tested in a Windows VM; individual windows need a WGC-enabled build |
+| [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |
 | [Mac in the headset](docs/mac-in-headset.md) | Mac windows and screens as panels in the Frame, with laser and keyboard input |
-| [VR mods and custom songs](docs/mods.md) | UEVR for Unreal games from Frame Control (install, play in VR, remove), the per-game table, Beat Saber blockers |
+| [VR mods and custom songs](docs/mods.md) | Per-game feasibility, real-Frame results and blockers; no installer yet |
 | [SSH](docs/ssh.md) · [Streaming](docs/streaming.md) · [Files](docs/file-transfer.md) · [Panels](docs/panels.md) · [Tailscale](docs/tailscale.md) | Topic notes |
 | [Frame Control for iPhone](docs/iphone.md) | The iPhone and iPad app, how it runs the server on the Frame, pairing |
 | [Recovery and OS images](docs/recovery-and-images.md) | Where to download the Frame's OS, what's inside, testing without the headset |
 | [AI agents and assistant](docs/agents.md) | Key-free MCP tools, human approvals, and an opt-in assistant panel |
-| [Testing](docs/testing.md) | Unit tests, end-to-end tests against a fake Frame in Docker, the headset smoke test and a Windows test VM |
+| [Testing](docs/testing.md) | Unit tests, end-to-end tests against a fake Frame in Docker, and the headset smoke test |
 | [Open questions](docs/open-questions.md) | What's still unchecked |
 
 <details>
@@ -275,5 +258,3 @@ into a draft release, which reaches users once published. See
 licence, notably KDE Connect (GPL) for the keyboard and trackpad; see
 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). Steam, Steam Frame and SteamVR are trademarks of Valve
 Corporation. This project isn't affiliated with or endorsed by Valve.
-
-See [Game storage](docs/game-storage.md) for read-only headset space and Steam install sizes, and [the changelog](CHANGELOG.md) for unreleased changes.

THIRD_PARTY_NOTICES.md

@@ -10,8 +10,6 @@ ship other people's software, unchanged, each under its own licence:
 | adb (Android SDK Platform-Tools) | Desktop apps (not Linux arm64) | Apache-2.0 and others | `NOTICE.txt` in the app's `tools` folder |
 | Mozilla's CA certificate list, as published by curl | Desktop apps | MPL-2.0 | https://curl.se/docs/caextract.html |
 | Electron | Desktop apps | MIT (Chromium: BSD-3-Clause and others) | `LICENSE` and `LICENSES.chromium.html` in the app |
-| GStreamer 1.x, a few of its plugins and the libraries they need, as [MSYS2](https://packages.msys2.org/) builds them | Windows app only, for the experimental [PC in the headset](docs/pc-in-headset.md) | LGPL-2.1-or-later and others (per package); the GPL x264 encoder is left out | `libraries.json` (exact package versions) and the `licenses` folder in the app's `desktop/bundle` folder |
 
 Frame Control starts KDE Connect and talks to it over its network protocol;
-it doesn't link to it or include its code. On Windows, Frame Control's own
-`pc-host.dll` links to GStreamer dynamically; the libraries are unmodified.
+it doesn't link to it or include its code.

apk-catalog/reports.py

@@ -6,25 +6,11 @@ A report: package, version, result (runs | crashes | install_failed |
 instance_failed, from an automated test), rating (works | issues | broken, from
 a person), notes, via (harness | probe | user), date, steamos, lepton, runtime.
 Newest wins, and a person's rating beats an automated result.
-
-An install_failed report saying the file had no arm64-v8a build (or needed a
-newer Android) is about that one APK file, often the wrong per-ABI download of
-an app that has an arm64 build, so it says nothing about the app and is left out.
 """
-import re
-
-FILE_FAULT = re.compile(r'no arm64-v8a build|needs Android API')
-
-
-def about_app(r):
-    """False for reports about one wrong APK file rather than the app itself."""
-    return not (r.get('result') == 'install_failed' and not r.get('rating')
-                and FILE_FAULT.search(r.get('notes') or ''))
 
 
 def verdict(reports):
     """(verdict, summary lines) for one package's reports, or None."""
-    reports = [r for r in reports or () if about_app(r)]
     if not reports:
         return None
     rs = sorted(reports, key=lambda r: r.get('date') or '')

app/build/check-resources.js

@@ -1,79 +0,0 @@
-// Checks that the app's resources hold what Frame Control can't work without.
-// The OpenXR compatibility layer is why this exists: VR APK installs need its
-// arm64-v8a library (ui/frame_android.py XR_COMPAT_FILES).
-//
-// As electron-builder's afterPack hook it checks the unpacked app. From the
-// command line it checks an installed copy, which is what caught the Windows
-// installer silently dropping the library (see .github/workflows/release.yml):
-//   node build/check-resources.js INSTALLED_RESOURCES [REFERENCE_RESOURCES]
-// With a reference (the unpacked build's resources), every file in it must also
-// be in the installed copy, at the same size.
-const fs = require("fs");
-const path = require("path");
-
-const REQUIRED = [
-  "ui/server.py",
-  "ui/frame_android.py",
-  "frame/android/lepton-app.sh",
-  "frame/openxr-compat/XrApiLayer_FRAME_compat.json",
-  "frame/openxr-compat/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz",
-];
-
-function resourcesDir(context) {
-  if (context.electronPlatformName === "darwin" || context.electronPlatformName === "mas") {
-    const app = `${context.packager.appInfo.productFilename}.app`;
-    return path.join(context.appOutDir, app, "Contents", "Resources");
-  }
-  return path.join(context.appOutDir, "resources");
-}
-
-function size(file) {
-  try {
-    return fs.statSync(file).size;
-  } catch {
-    return -1;
-  }
-}
-
-// Required files that are missing or empty.
-function missing(dir) {
-  return REQUIRED.filter((rel) => size(path.join(dir, rel)) <= 0);
-}
-
-// Files under reference that aren't in dir at the same size.
-function differences(dir, reference) {
-  const out = [];
-  (function walk(rel) {
-    for (const e of fs.readdirSync(path.join(reference, rel), { withFileTypes: true })) {
-      const r = path.join(rel, e.name);
-      if (e.isDirectory()) walk(r);
-      else if (e.isFile() && size(path.join(dir, r)) !== size(path.join(reference, r))) out.push(r.split(path.sep).join("/"));
-    }
-  })("");
-  return out;
-}
-
-exports.default = async function afterPack(context) {
-  const dir = resourcesDir(context);
-  const gone = missing(dir);
-  if (gone.length) {
-    throw new Error(`packaged app is missing required resources in ${dir}: ${gone.join(", ")}`);
-  }
-};
-exports.missing = missing;
-exports.differences = differences;
-exports.REQUIRED = REQUIRED;
-
-if (require.main === module) {
-  const [dir, reference] = process.argv.slice(2);
-  if (!dir) {
-    console.error("usage: node build/check-resources.js INSTALLED_RESOURCES [REFERENCE_RESOURCES]");
-    process.exit(2);
-  }
-  const problems = [...missing(dir), ...(reference ? differences(dir, reference) : [])];
-  if (problems.length) {
-    console.error(`${dir} is missing or has the wrong size for:\n  ${[...new Set(problems)].join("\n  ")}`);
-    process.exit(1);
-  }
-  console.log(`${dir}: all required resources present${reference ? ", and every file of " + reference : ""}`);
-}

app/main.js

@@ -1,7 +1,7 @@
 // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
 // a free loopback port and shows it in a native window. The server does all the
 // work over the `frame` SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, session, shell } = require("electron");
+const { app, BrowserWindow, Menu, clipboard, dialog, ipcMain, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -11,8 +11,6 @@ const os = require("os");
 const path = require("path");
 const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link");
 const updater = require("./updater");
-const { preferenceStore } = require("./preferences");
-const { createMetaSignIn } = require("./meta-signin");
 
 const run = promisify(execFile);
 
@@ -29,7 +27,6 @@ const LOG_DIR = IS_MAC ? path.join(os.homedir(), "Library", "Logs", "Frame Contr
 const LOG = path.join(LOG_DIR, "server.log");
 const BG = "#0d1117";
 const FRAME = process.env.FRAME_ALIAS || "frame";
-const preferences = preferenceStore(path.join(app.getPath("userData"), "client-preferences.json"));
 
 let server = null;
 let url = null;
@@ -118,11 +115,10 @@ function ping(target) {
 }
 
 async function startServer() {
-  // The version, the time zone and whether this is a built app go to ui/frame_telemetry.py,
-  // which sends nothing from a source checkout.
+  // The version and whether this is a built app go to ui/frame_telemetry.py, which
+  // sends nothing from a source checkout.
   const env = { ...process.env, PATH: await loginPath(), FRAME_CONTROL_APP: "1",
                 FRAME_CONTROL_VERSION: app.getVersion(), FRAME_CONTROL_LOG: LOG,
-                FRAME_CONTROL_TIMEZONE: Intl.DateTimeFormat().resolvedOptions().timeZone || "",
                 ...(app.isPackaged ? { FRAME_CONTROL_PACKAGED: "1" } : {}),
                 ...(fs.existsSync(TOOLS) ? { FRAME_CONTROL_TOOLS: TOOLS } : {}) };
   python = await findPython(env);
@@ -153,7 +149,7 @@ async function startServer() {
   const target = `http://127.0.0.1:${port}/`;
   for (let i = 0; i < 100; i++) {
     if (exited !== null) throw new Error(`The server exited (${exited}). See ${LOG}.`);
-    if (await ping(target)) { url = target; serverStarted = Date.now(); return; }
+    if (await ping(target)) { url = target; return; }
     await new Promise((r) => setTimeout(r, 100));
   }
   if (server === child) server = null;
@@ -163,76 +159,51 @@ async function startServer() {
 
 // Closing stdin lets server.py close its SSH connections and exit (the only clean
 // way on Windows); SIGTERM does the same elsewhere.
-// Resolves once it has exited (or after 20 s), so a replacement can take the server
-// lock: server.py allows one per user.
 function endServer(child) {
-  const gone = child.exitCode !== null || child.signalCode !== null ? Promise.resolve()
-    : new Promise((resolve) => child.once("exit", resolve));
   try { child.stdin.end(); } catch {}
   if (!IS_WIN) child.kill("SIGTERM");
-  // server.py ignores a second SIGTERM while it shuts down, so the fallback is a hard kill.
-  setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill("SIGKILL"); }, 12000).unref();
-  return Promise.race([gone, new Promise((resolve) => setTimeout(resolve, 20000).unref())]);
+  setTimeout(() => { if (child.exitCode === null && child.signalCode === null) child.kill(); }, 5000).unref();
 }
 
 function stopServer() {
   if (server) endServer(server);
 }
 
-function errorPage(message, title = "Frame Control couldn't start") {
+function errorPage(message) {
   const esc = (s) => s.replace(/[&<>]/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
   const html = `<!doctype html><meta charset="utf-8"><body style="margin:0;height:100vh;display:grid;
     place-items:center;background:${BG};color:#e6edf3;font:14px -apple-system,sans-serif">
-    <div style="max-width:560px;padding:32px;line-height:1.5"><h2>${esc(title)}</h2>
-    <p>${esc(message)}</p>
-    <p><button onclick="this.disabled = true; frameApp.restartServer()" style="font:inherit;padding:6px 16px;
-      border-radius:6px;border:1px solid #30363d;background:#21262d;color:inherit;cursor:pointer">Try Again</button></p>
-    <p style="color:#8b98a8">Frame → Restart Server does the same.</p></div>`;
+    <div style="max-width:560px;padding:32px;line-height:1.5"><h2>Frame Control couldn't start</h2>
+    <p>${esc(message)}</p><p style="color:#8b98a8">Fix it, then choose Frame → Restart Server.</p></div>`;
   return "data:text/html;charset=utf-8," + encodeURIComponent(html);
 }
 
-// A server that had been running starts again by itself (something stopped it: a
-// signal, a crash). One that stops again within a minute shows the error instead,
-// so a server that can't stay up doesn't restart forever.
-let serverStarted = 0;
 function serverDied(why) {
   url = null;
-  if (!win) return;
-  if (Date.now() - serverStarted > 60000) restartServer();
-  else win.loadURL(errorPage(`Its server stopped unexpectedly (${why}). See ${LOG}.`, "Frame Control stopped"));
+  if (win) win.loadURL(errorPage(`The server stopped unexpectedly (${why}). See ${LOG}.`));
 }
 
-// Restarts that overlap share one: two could each start a server, and the one
-// that lost the lock would leave the app pointing at nothing.
-let restarting = null;
-function restartServer() {
-  if (!restarting) {
-    restarting = (async () => {
-      const old = server;
-      server = null;
-      url = null;
-      if (old) await endServer(old);
-      if (starting) await starting.catch(() => {});  // a start it cut short: then start afresh
-      await load();
-    })().finally(() => { restarting = null; });
-  }
-  return restarting;
+async function restartServer() {
+  const old = server;
+  server = null;
+  url = null;
+  if (old) endServer(old);
+  await load();
 }
 
 // On macOS the page's sticky header becomes the title bar, clear of the traffic lights.
 const CHROME_CSS = IS_MAC && `
   header { padding-left: 92px !important; -webkit-app-region: drag; user-select: none; }
-  header a, header button, header input, header select, header .chip { -webkit-app-region: no-drag; }
+  header a, header button, header input, header .chip { -webkit-app-region: no-drag; }
 `;
 
 // Restart Server can start a new load while an older one is still waiting for
 // its server; only the newest load may touch the window.
 let loadGen = 0;
-let starting = null;  // loads that overlap share one server start
 async function load() {
   const gen = ++loadGen;
   try {
-    if (!url) await (starting ||= startServer().finally(() => { starting = null; }));
+    if (!url) await startServer();
     if (gen === loadGen && win) { await win.loadURL(url); firstRunCheck(); }
   } catch (e) {
     if (gen === loadGen && win) await win.loadURL(errorPage(e.message));
@@ -276,130 +247,13 @@ function fromUi(e) {
   } catch { return false; }
 }
 
-// The error page's Try Again button. The error page is the only data: page the window
-// shows (`url` can still be set then: the server answered but the page failed to load).
-ipcMain.handle("server:restart", (e) => {
-  if (win && e.sender === win.webContents && e.senderFrame && e.senderFrame.url.startsWith("data:")) restartServer();
-});
 ipcMain.handle("clipboard:read", (e) => fromUi(e) ? clipboard.readText() : "");
-// Text from the headset's clipboard onto this computer's.
-ipcMain.handle("clipboard:write", (e, text) => {
-  if (!fromUi(e) || typeof text !== "string") return false;
-  clipboard.writeText(text);
-  return true;
-});
-ipcMain.handle("preferences:read", (e) => fromUi(e) ? preferences.read() : {});
-ipcMain.handle("preferences:write", (e, key, value) => fromUi(e) ? preferences.write(key, value) : false);
-// A PNG or JPEG (a screenshot) onto the clipboard as an image.
-ipcMain.handle("clipboard:writeImage", (e, bytes) => {
-  if (!fromUi(e) || !(bytes instanceof Uint8Array)) return false;
-  const img = nativeImage.createFromBuffer(Buffer.from(bytes));
-  if (img.isEmpty()) throw new Error("not an image");
-  clipboard.writeImage(img);
-  return true;
-});
 ipcMain.handle("connection:setup", (e) => { if (fromUi(e)) setUpConnection(); });
 ipcMain.on("keys:capture", (e, on) => { if (fromUi(e)) win.webContents.setIgnoreMenuShortcuts(on === true); });
 ipcMain.handle("update:get", (e) => fromUi(e) ? publicUpdate() : null);
 ipcMain.handle("update:check", (e) => fromUi(e) ? checkForUpdate({ manual: true }).then(publicUpdate) : null);
 ipcMain.handle("update:install", (e) => { if (fromUi(e)) installUpdate(); });
 
-// The page reports the headsets it knows (the server's Devices tab), so the Frame
-// menu can switch between them. Only plain names and ids go into the menu.
-const ALIAS_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-let devices = [];
-ipcMain.on("devices:changed", (e, list) => {
-  if (!fromUi(e) || !Array.isArray(list)) return;
-  const next = list.slice(0, 20).filter(d => d && typeof d.id === "string" && ALIAS_RE.test(d.alias || ""))
-    .map(d => ({ id: d.id.slice(0, 80), name: String(d.name || d.alias).slice(0, 60), alias: d.alias, active: !!d.active }));
-  if (JSON.stringify(next) === JSON.stringify(devices)) return;
-  devices = next;
-  buildMenu();
-});
-const activeAlias = () => (devices.find(d => d.active) || {}).alias || FRAME;
-
-// SSH through the server, so it goes to the headset and address the app is using
-// (with its own pinned identity), and refuses when there's none.
-function openSsh() {
-  if (!url) return dialog.showErrorBox("Couldn't open SSH", "Frame Control's server isn't running.");
-  const body = JSON.stringify({ what: "terminal" });
-  const req = http.request(new URL("/api/open", url), {
-    method: "POST", timeout: 15000,
-    headers: { "Content-Type": "application/json", "X-Frame-UI": "1", "Content-Length": Buffer.byteLength(body) },
-  }, (res) => {
-    let data = "";
-    res.on("data", (c) => { data += c; });
-    res.on("end", () => {
-      if (res.statusCode === 200) return;
-      let why = `HTTP ${res.statusCode}`;
-      try { why = JSON.parse(data).error || why; } catch {}
-      dialog.showErrorBox("Couldn't open SSH", why);
-    });
-  });
-  req.on("error", (e) => dialog.showErrorBox("Couldn't open SSH", e.message));
-  req.on("timeout", () => req.destroy(new Error("the server didn't answer")));
-  req.end(body);
-}
-function showDevices() {
-  if (win && url) win.webContents.executeJavaScript('location.hash = "devices"').catch(() => {});
-}
-
-ipcMain.handle("comfort:notify", (e, message) => {
-  if (!fromUi(e) || typeof message !== "string" || message.length > 500) throw new Error("Invalid notification");
-  if (!Notification.isSupported()) throw new Error("System notifications are unavailable");
-  return new Promise((resolve, reject) => {
-    const notification = new Notification({title: "Frame Control", body: message});
-    const timer = setTimeout(() => reject(new Error("Notification delivery was not confirmed. Check system notification settings.")), 5000);
-    notification.once("show", () => { clearTimeout(timer); resolve(true); });
-    notification.once("failed", (_event, error) => {
-      clearTimeout(timer);
-      reject(new Error("Notification delivery failed. Check system notification settings: " + error));
-    });
-    notification.show();
-  });
-});
-
-// ---- Sign in with Meta (app/meta-signin.js, docs/meta-library.md) ----
-// The token goes from the sign-in window's own session straight to the server's
-// connect path; the page asks for it and only hears the server's answer.
-function postApi(apiPath, body) {
-  return new Promise((resolve, reject) => {
-    if (!url) return reject(new Error("Frame Control's server isn't running."));
-    const data = JSON.stringify(body);
-    const req = http.request(new URL(apiPath, url), {
-      method: "POST", timeout: 60000,
-      headers: { "Content-Type": "application/json", "X-Frame-UI": process.env.FRAME_UI_KEY || "1",
-                 "Content-Length": Buffer.byteLength(data) },
-    }, (res) => {
-      let text = "";
-      res.setEncoding("utf8");
-      res.on("data", (c) => { text += c; });
-      res.on("end", () => {
-        let parsed = {};
-        try { parsed = JSON.parse(text); } catch {}
-        resolve({ status: res.statusCode, data: parsed });
-      });
-    });
-    req.on("error", reject);
-    req.on("timeout", () => req.destroy(new Error("the server didn't answer")));
-    req.end(data);
-  });
-}
-
-let metaSignIn = null;
-const meta = () => (metaSignIn ||= createMetaSignIn({
-  BrowserWindow, session, shell, parent: () => win,
-  // The page only offers sign-in after its "I understand" box is ticked (checked again below).
-  connect: (token, attempt) => postApi("/api/meta", { action: "connect", token, acknowledged: true, attempt }),
-  cancel: (attempt) => postApi("/api/meta", { action: "cancel-signin", attempt }),
-}));
-ipcMain.handle("meta:signin", (e, acknowledged) => {
-  if (!fromUi(e)) return null;
-  if (acknowledged !== true) return { ok: false, error: "My Meta library is experimental: tick that you understand the warning first." };
-  return meta().signIn();
-});
-ipcMain.handle("meta:signout", (e) => fromUi(e) ? meta().signOut() : false);
-
 // frame-control://install links from websites (docs/web-install.md). They can
 // arrive before the window or server exists (macOS open-url on a cold launch),
 // so they wait here until the page asks for them. The page checks the link with
@@ -522,7 +376,7 @@ function createWindow() {
     title: "Frame Control", backgroundColor: BG, show: false,
     ...(IS_MAC ? { titleBarStyle: "hiddenInset", trafficLightPosition: { x: 18, y: 26 } }
                : { icon: path.join(__dirname, "build", "icon.png") }),
-    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true, backgroundThrottling: false,
+    webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true,
                       preload: path.join(__dirname, "preload.js") },
   });
   win.once("ready-to-show", () => win.show());
@@ -556,14 +410,13 @@ async function runInTerminal(argv) {
   }
 }
 
-// Set Up Connection for the headset in use (or another alias, from the Devices tab).
-async function setUpConnection(name = activeAlias()) {
-  if (!ALIAS_RE.test(name)) return;
-  const alias = `FRAME_ALIAS=${name}`;
+async function setUpConnection() {
+  const alias = `FRAME_ALIAS=${FRAME}`;
   if (IS_MAC) return runInTerminal(["env", alias, "zsh", path.join(SCRIPTS, "connect.sh")]);
   const py = python || await findPython({ ...process.env, PATH: await loginPath() });
-  // --alias, since a new console on Windows (and some Linux terminals) doesn't get our environment.
-  runInTerminal([py || "python3", ...PY_FLAGS, path.join(ROOT, "ui", "frame_connect.py"), "--alias", name]);
+  const setup = [py || "python3", ...PY_FLAGS, path.join(ROOT, "ui", "frame_connect.py")];
+  // A new console inherits our environment on Windows; Linux terminals may not.
+  runInTerminal(IS_WIN ? setup : ["env", alias, ...setup]);
 }
 
 function buildMenu() {
@@ -578,15 +431,8 @@ function buildMenu() {
     {
       label: "Frame",
       submenu: [
-        { label: "Set Up Connection…", click: () => setUpConnection() },
-        { label: IS_MAC ? "Open SSH in Terminal" : "Open SSH in a Terminal", click: openSsh },
-        { type: "separator" },
-        ...(devices.length > 1 ? [{
-          label: "Headset",
-          submenu: devices.map(d => ({ label: d.name, type: "radio", checked: d.active,
-                                       click: () => { if (win) win.webContents.send("use-device", d.id); } })),
-        }] : []),
-        { label: "Devices…", accelerator: "CmdOrCtrl+5", click: showDevices },
+        { label: "Set Up Connection…", click: setUpConnection },
+        { label: IS_MAC ? "Open SSH in Terminal" : "Open SSH in a Terminal", click: () => runInTerminal(["ssh", FRAME]) },
         { type: "separator" },
         { label: "Open in Browser", click: () => url && shell.openExternal(url) },
         { label: "Restart Server", click: () => win ? restartServer() : createWindow() },

app/meta-signin.js

@@ -1,252 +0,0 @@
-// "Sign in with Meta" for My Meta library (docs/meta-library.md), the way BSManager's
-// "Log in with Meta" works: Meta's own login page in a Frame Control window, then the
-// access token cookie (oc_ac_at) that page sets is handed to the local server's
-// existing connect path (format check, "who am I" with Meta, 0600 file).
-//
-// The window has its own persistent session (PARTITION), so the cookie is read only
-// from there: never from Frame Control's main window, never from any browser. It has
-// no preload and no Node, and it only navigates within Meta's login sites; anything
-// else opens in the system browser. Nothing here logs the token, and the page only
-// ever gets back the server's answer (connected, display name), never the token.
-// Electron is passed in, so app/test/meta-signin.test.js can run it with fakes.
-const crypto = require("crypto");
-
-const PARTITION = "persist:meta-signin";
-// BSManager's loginUrl (src/main/services/bs-version-download/bs-oculus-downloader.service.ts).
-const LOGIN_URL = "https://secure.oculus.com";
-const COOKIE = "oc_ac_at";
-// Sites the login can go through: the Oculus store web, Meta accounts, Facebook login,
-// and Instagram (Meta's login passes through www.instagram.com: seen live, 2026-10-14).
-const ALLOWED = ["oculus.com", "meta.com", "facebook.com", "instagram.com"];
-const TIMEOUT = 10 * 60 * 1000;  // as BSManager
-
-const underDomain = (host, domains) => {
-  host = String(host || "").replace(/^\./, "").toLowerCase();
-  return domains.some((d) => host === d || host.endsWith("." + d));
-};
-
-// Plain HTTPS on the default port, to one of the login sites.
-function allowedUrl(raw) {
-  let u;
-  try { u = new URL(String(raw)); } catch { return false; }
-  if (u.protocol !== "https:" || u.username || u.password || (u.port && u.port !== "443")) return false;
-  return underDomain(u.hostname, ALLOWED);
-}
-
-// Frames inside the page: any HTTPS address (Meta's login can embed captcha and CDN
-// frames from other sites), or an empty frame; never data:, blob:, javascript:, http:,
-// file: or any other scheme. Frames can't reach the cookie read or IPC (main process only).
-function allowedSubframeUrl(raw) {
-  if (/^about:(?:blank|srcdoc)$/.test(String(raw))) return true;
-  let u;
-  try { u = new URL(String(raw)); } catch { return false; }
-  return u.protocol === "https:" && !u.username && !u.password;
-}
-
-const onOculus = (raw) => { try { return underDomain(new URL(raw).hostname, ["oculus.com"]); } catch { return false; } };
-
-// A cheap first look, so a signed-out or app value is never sent anywhere; the server's
-// check_token (ui/frame_meta.py) has the final word.
-function looksLikeUserToken(v) {
-  return typeof v === "string" && /^(?:OC|FRL)[A-Za-z0-9+/=_-]{18,4093}$/.test(v)
-    && !/^OC\d{15}$/.test(v) && /[a-z]/.test(v);
-}
-
-const fingerprint = (v) => crypto.createHash("sha256").update(v).digest("hex");
-
-// Anything token-shaped out of a message, in case a server error ever carried one.
-function scrub(text, token) {
-  let s = String(text == null ? "" : text);
-  if (token) s = s.split(token).join("<redacted>");
-  return s.replace(/(?:OC|FRL)[A-Za-z0-9+/=_%|:-]{8,}/g, "<redacted>").slice(0, 600);
-}
-
-// deps: { BrowserWindow, session, shell, parent() -> BrowserWindow|null, timeout,
-//         connect(token, attempt) -> Promise<{status, data}>  (the server's connect action),
-//         cancel(attempt) -> Promise  (the server's cancel-signin: never save that attempt) }
-function createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent = () => null, timeout = TIMEOUT }) {
-  let active = null;  // { win, promise, finish }
-  const pending = new Set();  // cancels still to reach the server, from flows already finished
-  let signingOut = null;      // the sign-out under way; no sign-in starts while it runs
-  const SIGNING_OUT = "Frame Control is signing out of Meta; try again in a moment.";
-
-  const openOutside = (target) => {
-    if (/^https?:\/\//i.test(String(target))) shell.openExternal(String(target));
-  };
-
-  function signIn() {
-    if (signingOut) return Promise.resolve({ ok: false, error: SIGNING_OUT });
-    if (active) { active.win.focus(); return active.promise; }
-    const ses = session.fromPartition(PARTITION);
-    ses.setPermissionRequestHandler((_wc, _permission, callback) => callback(false));
-    ses.setPermissionCheckHandler(() => false);
-    // Electron adds its own name and the app's to the user agent; send a plain Chrome one.
-    if (ses.getUserAgent && ses.setUserAgent) {
-      ses.setUserAgent(ses.getUserAgent().replace(/\s(?:Electron|frame-control|Frame Control)\/\S+/g, ""));
-    }
-    const p = parent();
-    const win = new BrowserWindow({
-      width: 520, height: 760, title: "Sign in with Meta – Frame Control", autoHideMenuBar: true,
-      ...(p ? { parent: p } : {}),
-      webPreferences: { partition: PARTITION, contextIsolation: true, nodeIntegration: false, sandbox: true,
-                        nodeIntegrationInSubFrames: false, webviewTag: false, safeDialogs: true, devTools: false },
-    });
-    const wc = win.webContents;
-
-    let resolve;
-    const promise = new Promise((r) => { resolve = r; });
-    let done = false, busy = false, again = false, lastError = null, blocked = null;
-    const tried = new Set();  // fingerprints of values already sent, so each goes once
-    // The server refuses to save a connect from an attempt this window gave up on.
-    const attemptId = crypto.randomUUID();
-
-    const onCookie = (_e, cookie, _cause, removed) => {
-      if (!removed && cookie && cookie.name === COOKIE && underDomain(cookie.domain, ["oculus.com"])) attempt();
-    };
-    const timer = setTimeout(() => finish({ ok: false, error: "Sign-in timed out after 10 minutes. Try again." }), timeout);
-    if (timer.unref) timer.unref();
-
-    // Stops cookie intake first, then the window (destroy: a page's beforeunload can't
-    // keep it open), and answers the page. Unless it connected, and if it sent a token, it
-    // then has the server drop this attempt: only once the connect under way has settled,
-    // so the server always sees the cancel after the connect (and deletes the token if
-    // that connect saved it). The returned promise settles when that is done.
-    let finished = null;
-    let inflight = null;  // the last connect sent
-    function finish(result) {
-      if (done) return finished || Promise.resolve();  // destroy() below re-enters through "closed"
-      done = true;
-      ses.cookies.removeListener("changed", onCookie);
-      clearTimeout(timer);
-      if (active && active.win === win) active = null;
-      if (!win.isDestroyed()) win.destroy();
-      resolve(result);
-      if (result.ok || !inflight) return (finished = Promise.resolve());  // nothing sent: nothing to cancel
-      finished = Promise.resolve(inflight).catch(() => {}).then(() => cancel(attemptId)).catch(() => {});
-      pending.add(finished);
-      finished.then(() => pending.delete(finished));
-      return finished;
-    }
-
-    async function attempt() {
-      if (done) return;
-      if (busy) { again = true; return; }
-      busy = true;
-      try {
-        do {
-          again = false;
-          // Only this window's own session, and only Meta's Oculus cookie.
-          const cookies = await ses.cookies.get({ name: COOKIE });
-          const c = cookies.find((k) => underDomain(k.domain, ["oculus.com"]) && looksLikeUserToken(k.value));
-          if (!c || done) continue;
-          const key = fingerprint(c.value);
-          if (tried.has(key)) continue;
-          tried.add(key);
-          let r;
-          try {
-            inflight = connect(c.value, attemptId);
-            r = await inflight;
-          } catch {
-            lastError = "Frame Control's local server didn't answer.";
-            continue;
-          }
-          if (done) return;
-          const d = (r && r.data) || {};
-          if (r && r.status === 200 && d.connected) {
-            finish({ ok: true, connected: true, user: d.user && d.user.name ? { name: scrub(d.user.name, c.value).slice(0, 80) } : null,
-                     message: scrub(d.message || "Connected your Meta account (Experimental)", c.value) });
-            return;
-          }
-          lastError = scrub(d.error || `HTTP ${r && r.status}`, c.value);
-        } while (again && !done);
-      } catch {
-        // The session went away (the window closed); nothing to do.
-      } finally {
-        busy = false;
-      }
-    }
-
-    // Navigation stays on Meta's login sites. A link elsewhere opens in the system
-    // browser; a redirect elsewhere is just stopped (it may carry sign-in data).
-    // Every frame: the window itself stays on the list; frames inside it may load any
-    // HTTPS page (captchas), and one going anywhere else is just stopped.
-    wc.on("will-navigate", (e, target) => { if (!allowedUrl(target)) { e.preventDefault(); openOutside(target); } });
-    // A stopped page change in the window itself says where it went (the host only), so
-    // closing the stuck window explains why instead of "closed before you signed in".
-    const stopped = (to) => {
-      let host = "";
-      try { host = new URL(String(to)).hostname; } catch { /* not an address */ }
-      blocked = `Meta's sign-in went to ${scrub(host || "an address", null).slice(0, 80)}, which Frame Control doesn't allow.`;
-    };
-    wc.on("will-frame-navigate", (e) => {
-      if (e.isMainFrame ? allowedUrl(e.url) : allowedSubframeUrl(e.url)) return;
-      e.preventDefault();
-      if (e.isMainFrame) stopped(e.url);
-    });
-    // Redirects fire for frames too: the same rule per frame (details on the event in
-    // current Electron, positional arguments in older ones; unknown counts as the window).
-    wc.on("will-redirect", (e, target, _inPlace, isMainFrame) => {
-      const to = e && e.url !== undefined ? e.url : target;
-      const main = e && e.isMainFrame !== undefined ? e.isMainFrame : isMainFrame !== false;
-      if (main ? allowedUrl(to) : allowedSubframeUrl(to)) return;
-      e.preventDefault();
-      if (main) stopped(to);
-    });
-    // A page's beforeunload never keeps the window open.
-    wc.on("will-prevent-unload", (e) => e.preventDefault());
-    wc.setWindowOpenHandler(({ url: target }) => {
-      if (allowedUrl(target)) wc.loadURL(target).catch(() => {});
-      else openOutside(target);
-      return { action: "deny" };
-    });
-    // Signed in: the cookie changes, or the window lands back on Meta's store site.
-    ses.cookies.on("changed", onCookie);
-    wc.on("did-navigate", (_e, target) => { blocked = null; if (onOculus(target)) attempt(); });  // it recovered
-    wc.on("did-navigate-in-page", (_e, target) => { if (onOculus(target)) attempt(); });
-    win.on("closed", () => finish({ ok: false, cancelled: true,
-      error: lastError ? `The sign-in window closed before Frame Control could connect. ${lastError}`
-           : blocked ? `The sign-in window was closed before you signed in. ${blocked}`
-                     : "The sign-in window was closed before you signed in." }));
-
-    active = { win, promise, finish };
-    wc.loadURL(LOGIN_URL).catch(() => {});
-    return promise;
-  }
-
-  // Signs out of Meta in Frame Control: stops any sign-in under way (and has the server
-// refuse to save it), destroys the window, then clears everything
-  // the sign-in session stored (cookies, storage, cache), so the next sign-in starts fresh.
-  // One at a time (a second call joins the first), and no sign-in can start meanwhile.
-  // It goes round until no window is open and no connect or cancel is left, so nothing
-  // started before it can set a token after it (or after the Disconnect that follows).
-  function signOut() {
-    if (!signingOut) {
-      signingOut = (async () => {
-        for (;;) {
-          if (active) {
-            const { win, finish } = active;
-            await finish({ ok: false, cancelled: true, error: "Signed out of Meta in Frame Control." });
-            // Clear only once nothing can write to the session again.
-            if (!win.isDestroyed()) throw new Error("The Sign in with Meta window didn't close; try again.");
-          } else if (pending.size) {
-            // A connect under way settles and is cancelled before the caller (Disconnect)
-            // deletes the account, so it can't be saved afterwards.
-            await Promise.all([...pending]);
-          } else {
-            break;
-          }
-        }
-        const ses = session.fromPartition(PARTITION);
-        await ses.clearStorageData();
-        await ses.clearCache();
-        if (ses.clearAuthCache) await ses.clearAuthCache();
-        return true;
-      })().finally(() => { signingOut = null; });
-    }
-    return signingOut;
-  }
-
-  return { signIn, signOut, isOpen: () => !!active, isSigningOut: () => !!signingOut };
-}
-
-module.exports = { createMetaSignIn, allowedUrl, allowedSubframeUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE, ALLOWED };

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.10",
+  "version": "0.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.10",
+      "version": "0.4.0",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.10",
+  "version": "0.4.0",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",
@@ -29,7 +29,6 @@
         ]
       }
     ],
-    "afterPack": "build/check-resources.js",
     "directories": {
       "output": "dist",
       "buildResources": "build"
@@ -39,8 +38,6 @@
       "preload.js",
       "install-link.js",
       "updater.js",
-      "preferences.js",
-      "meta-signin.js",
       "package.json",
       "build/icon.png"
     ],
@@ -51,19 +48,9 @@
         "filter": [
           "*.py",
           "*.html",
-          "*.js",
-          "*.css",
           "telemetry.json"
         ]
       },
-      {
-        "from": "../ui/apk_sources",
-        "to": "ui/apk_sources",
-        "filter": [
-          "*.py",
-          "*.json"
-        ]
-      },
       {
         "from": "../scripts",
         "to": "scripts",
@@ -76,8 +63,7 @@
         "to": "frame/android",
         "filter": [
           "*.sh",
-          "*.py",
-          "*.js"
+          "*.py"
         ]
       },
       {
@@ -85,7 +71,7 @@
         "to": "frame/openxr-compat",
         "filter": [
           "XrApiLayer_FRAME_compat.json",
-          "prebuilt/**/*.so.gz"
+          "prebuilt/**/*.so"
         ]
       },
       {
@@ -198,16 +184,7 @@
         "zip"
       ],
       "icon": "build/icon.png",
-      "artifactName": "Frame-Control-win-${arch}.${ext}",
-      "extraResources": [
-        {
-          "from": "build/desktop/${os}-${arch}",
-          "to": "desktop/bundle",
-          "filter": [
-            "**/*"
-          ]
-        }
-      ]
+      "artifactName": "Frame-Control-win-${arch}.${ext}"
     },
     "nsis": {
       "oneClick": false,

app/preferences.js

@@ -1,27 +0,0 @@
-// Client choices live outside the local server's changing URL/origin.
-const fs = require("node:fs");
-const path = require("node:path");
-const KEYS = ["mvSeparate", "padUsed", "pcView"];
-const valid = value => value === "0" || value === "1";
-
-function preferenceStore(file) {
-  function read() {
-    try {
-      const saved = JSON.parse(fs.readFileSync(file, "utf8"));
-      if (!saved || typeof saved !== "object" || Array.isArray(saved)) return {};
-      return Object.fromEntries(KEYS.filter(key => valid(saved[key])).map(key => [key, saved[key]]));
-    } catch { return {}; }
-  }
-  function write(key, value) {
-    if (!KEYS.includes(key) || !valid(value)) throw new Error("Invalid preference");
-    const saved = { ...read(), [key]: value };
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const tmp = file + ".tmp";
-    fs.writeFileSync(tmp, JSON.stringify(saved), { mode: 0o600 });
-    fs.renameSync(tmp, file);
-    return true;
-  }
-  return { read, write };
-}
-
-module.exports = { preferenceStore };

app/preload.js

@@ -1,32 +1,16 @@
-// Lets the page read and write this computer's clipboard through Electron, so sending
-// it to the Frame, and copying the Frame's back, needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
+// Lets the page read this computer's clipboard through Electron, so sending it
+// to the Frame needs no pbpaste, PowerShell, xclip or wl-clipboard. Also tells
 // the page where a dropped file or folder lives, so a folder can be sideloaded
 // as a title without zipping it (the local server reads it from there).
-// It can put a screenshot on the clipboard as an image, open Set Up Connection when
-// the headset can't be reached, and keeps the Frame menu's list of headsets up to date.
+// It can open Set Up Connection when the headset can't be reached.
 // It also receives frame-control://install links (docs/web-install.md): only
 // what the link asked for, never an install; the page asks the user first.
-// And it passes update state both ways: see app/updater.js. It opens the Sign in
-// with Meta window and signs out of it (app/meta-signin.js).
+// And it passes update state both ways: see app/updater.js.
 const { contextBridge, ipcRenderer, webUtils } = require("electron");
 
 contextBridge.exposeInMainWorld("frameApp", {
-  preferences: {
-    read: () => ipcRenderer.invoke("preferences:read"),
-    write: (key, value) => ipcRenderer.invoke("preferences:write", key, value),
-  },
-  notify: (message, request) => ipcRenderer.invoke("comfort:notify", message, request),
   readClipboard: () => ipcRenderer.invoke("clipboard:read"),
-  writeClipboard: (text) => ipcRenderer.invoke("clipboard:write", text),
-  writeImage: (bytes) => ipcRenderer.invoke("clipboard:writeImage", bytes),
   setUpConnection: () => ipcRenderer.invoke("connection:setup"),
-  restartServer: () => ipcRenderer.invoke("server:restart"),  // the "couldn't start" page's Try Again
-  // The Frame menu's headset switcher: the page tells it the headsets, and hears picks.
-  devicesChanged: (list) => ipcRenderer.send("devices:changed", list),
-  onUseDevice: (cb) => {
-    ipcRenderer.removeAllListeners("use-device");
-    ipcRenderer.on("use-device", (_e, id) => cb(String(id)));
-  },
   // While the keyboard-and-trackpad panel holds the keyboard, ⌘W, ⌘R and the rest go to the Frame.
   captureKeys: (on) => ipcRenderer.send("keys:capture", !!on),
   pathForFile: (file) => { try { return webUtils.getPathForFile(file) || ""; } catch { return ""; } },
@@ -45,12 +29,6 @@ contextBridge.exposeInMainWorld("frameApp", {
     ipcRenderer.removeAllListeners("report:open");
     ipcRenderer.on("report:open", () => cb());
   },
-  // Sign in with Meta (app/meta-signin.js): Meta's login page in its own window. The
-  // answer is the server's (connected, display name), never the token.
-  meta: {
-    signIn: (acknowledged) => ipcRenderer.invoke("meta:signin", acknowledged === true),
-    signOut: () => ipcRenderer.invoke("meta:signout"),
-  },
   onInstallLink: (cb) => {
     ipcRenderer.removeAllListeners("install-link");
     ipcRenderer.on("install-link", (_e, req) => cb({ kind: req.kind, target: req.target }));

app/test/meta-signin.test.js

@@ -1,578 +0,0 @@
-// Run: node --test app/test/
-// "Sign in with Meta" (app/meta-signin.js) with fake Electron windows, sessions and cookies.
-const nodeTest = require("node:test");
-// A broken flow can leave a sign-in waiting forever; fail it instead of hanging.
-const test = (name, fn) => nodeTest(name, { timeout: 5000 }, fn);
-const assert = require("node:assert");
-const { EventEmitter } = require("node:events");
-const { createMetaSignIn, allowedUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE } = require("../meta-signin");
-
-const TOKEN = "OCAbcdefghijklmnopQRSTUVwxyz0123456789abcdEFGH";
-const OTHER = "OCzyxwvutsrqponmlkJIHGFEDcba9876543210zyxwVUTS";
-
-class FakeCookies extends EventEmitter {
-  constructor() { super(); this.store = []; this.reads = 0; }
-  async get(filter) {
-    this.reads++;
-    return this.store.filter((c) => !filter.name || c.name === filter.name);
-  }
-  set(cookie) {  // as the page would: store it, then tell listeners
-    this.store = this.store.filter((c) => !(c.name === cookie.name && c.domain === cookie.domain)).concat(cookie);
-    this.emit("changed", {}, cookie, "explicit", false);
-  }
-}
-
-class FakeSession {
-  constructor(name, log) { this.name = name; this.log = log; this.cookies = new FakeCookies(); this.cleared = []; this.permission = null; }
-  setPermissionRequestHandler(fn) { this.permission = fn; }
-  setPermissionCheckHandler(fn) { this.permissionCheck = fn; }
-  getUserAgent() { return "Mozilla/5.0 Chrome/140.0 frame-control/0.4.4 Electron/44.4.5 Safari/537.36"; }
-  setUserAgent(ua) { this.ua = ua; }
-  async clearStorageData(opts) { this.log.push("clear"); this.cleared.push(["storage", opts]); }
-  async clearCache() { this.cleared.push(["cache"]); }
-  async clearAuthCache() { this.cleared.push(["auth"]); }
-}
-
-function fakes({ timeout } = {}) {
-  const log = [];  // the order things happened in
-  const sessions = new Map();
-  const defaultSession = new FakeSession("default", log);
-  const session = {
-    defaultSession,
-    fromPartition(name) {
-      if (!sessions.has(name)) sessions.set(name, new FakeSession(name, log));
-      return sessions.get(name);
-    },
-  };
-  const windows = [];
-  class BrowserWindow extends EventEmitter {
-    constructor(opts) {
-      super();
-      this.opts = opts;
-      this.destroyed = false;
-      this.veto = false;  // a page whose beforeunload keeps the window open on close()
-      this.focused = 0;
-      const wc = new EventEmitter();
-      wc.loaded = [];
-      wc.loadURL = async (u) => { wc.loaded.push(u); };
-      wc.setWindowOpenHandler = (fn) => { wc.openHandler = fn; };
-      // Deliberately a different session: the code must read the partition's, not guess.
-      wc.session = defaultSession;
-      this.webContents = wc;
-      windows.push(this);
-    }
-    isDestroyed() { return this.destroyed; }
-    focus() { this.focused++; }
-    close() { if (this.destroyed || this.veto) return; this.destroy(); }
-    destroy() { if (this.destroyed) return; this.destroyed = true; log.push("destroyed"); this.emit("closed"); }
-  }
-  const opened = [];
-  const shell = { openExternal: (u) => { opened.push(u); } };
-  const calls = [], attempts = [], cancels = [];
-  let answer = () => ({ status: 200, data: { connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" } });
-  const connect = async (token, attempt) => { calls.push(token); attempts.push(attempt); log.push("connect"); return answer(token); };
-  const cancel = async (attempt) => {
-    cancels.push(attempt);
-    log.push(`cancel (cookie listeners: ${session.fromPartition(PARTITION).cookies.listenerCount("changed")})`);
-  };
-  const flow = createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent: () => null, ...(timeout ? { timeout } : {}) });
-  return { flow, session, sessions, windows, opened, calls, attempts, cancels, log, setAnswer: (fn) => { answer = fn; },
-           meta: () => session.fromPartition(PARTITION) };
-}
-
-const tick = () => new Promise((r) => setImmediate(r));
-async function settle() { for (let i = 0; i < 10; i++) await tick(); }
-
-function navigate(wc, event, target) {
-  let prevented = false;
-  wc.emit(event, { preventDefault: () => { prevented = true; } }, target);
-  return prevented;
-}
-
-test("only plain HTTPS addresses on Meta's login sites are allowed", () => {
-  for (const ok of ["https://secure.oculus.com", "https://secure.oculus.com/my/profile", "https://auth.meta.com/login/",
-                    "https://www.meta.com/", "https://www.facebook.com/login.php", "https://oculus.com:443/",
-                    "https://www.instagram.com/accounts/login/"]) {
-    assert.ok(allowedUrl(ok), ok);
-  }
-  for (const bad of ["http://secure.oculus.com/", "https://oculus.com.evil.example/", "https://evil-oculus.com/",
-                     "https://notmeta.com/", "https://example.com/", "javascript:alert(1)", "file:///etc/passwd",
-                     "https://secure.oculus.com:8443/", "https://user:pw@secure.oculus.com/", "https://evil.example/?u=https://www.meta.com",
-                     "data:text/html,hi", "not a url"]) {
-    assert.ok(!allowedUrl(bad), bad);
-  }
-});
-
-test("the window is isolated: its own partition, no preload, no Node, sandboxed, on Meta's login page", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const [w] = f.windows;
-  const wp = w.opts.webPreferences;
-  assert.strictEqual(wp.partition, PARTITION);
-  assert.strictEqual(PARTITION, "persist:meta-signin");
-  assert.strictEqual(wp.contextIsolation, true);
-  assert.strictEqual(wp.nodeIntegration, false);
-  assert.strictEqual(wp.sandbox, true);
-  assert.strictEqual(wp.preload, undefined);
-  assert.strictEqual(wp.devTools, false);
-  assert.deepStrictEqual(w.webContents.loaded, [LOGIN_URL]);
-  assert.strictEqual(LOGIN_URL, "https://secure.oculus.com");
-  // Permission prompts (camera, notifications...) are refused.
-  let granted = null;
-  f.meta().permission(null, "media", (v) => { granted = v; });
-  assert.strictEqual(granted, false);
-  assert.strictEqual(f.meta().permissionCheck(null, "notifications", "https://secure.oculus.com"), false);
-  assert.ok(!/Electron|frame-control/.test(f.meta().ua));
-  w.close();
-});
-
-test("navigation stays on Meta's sites; other links open in the system browser", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(navigate(wc, "will-navigate", "https://auth.meta.com/login/"), false);
-  assert.strictEqual(navigate(wc, "will-navigate", "https://www.facebook.com/login.php"), false);
-  assert.strictEqual(navigate(wc, "will-navigate", "https://example.com/help"), true);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help"]);
-  // A redirect elsewhere is stopped and not opened anywhere (it may carry sign-in data).
-  assert.strictEqual(navigate(wc, "will-redirect", "https://evil.example/cb?x=1"), true);
-  assert.strictEqual(navigate(wc, "will-redirect", "https://auth.meta.com/next"), false);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help"]);
-  // New windows: never created. Meta's own load in this window; others go outside; non-web schemes nowhere.
-  assert.deepStrictEqual(wc.openHandler({ url: "https://www.meta.com/legal/terms/" }), { action: "deny" });
-  assert.deepStrictEqual(wc.openHandler({ url: "https://example.org/" }), { action: "deny" });
-  assert.deepStrictEqual(wc.openHandler({ url: "file:///etc/passwd" }), { action: "deny" });
-  await settle();
-  assert.deepStrictEqual(wc.loaded, [LOGIN_URL, "https://www.meta.com/legal/terms/"]);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help", "https://example.org/"]);
-  f.windows[0].close();
-});
-
-test("the cookie is read only from the sign-in partition, only for Meta's Oculus domain", async () => {
-  const f = fakes();
-  // The same cookie elsewhere: the default session and another partition. Never read.
-  f.session.defaultSession.cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  f.session.fromPartition("persist:other").cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  const done = f.flow.signIn();
-  const w = f.windows[0];
-  // A cookie with the right name on another site, and a signed-out value: ignored.
-  f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: OTHER });
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: "OC123456789012345" });
-  w.webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(f.session.defaultSession.cookies.reads, 0);
-  assert.strictEqual(f.session.fromPartition("persist:other").cookies.reads, 0);
-  assert.ok(f.sessions.get(PARTITION).cookies.reads > 0);
-});
-
-test("landing on the logged-in page picks up a cookie set earlier", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.store.push({ name: COOKIE, domain: "secure.oculus.com", value: TOKEN });  // no change event
-  f.windows[0].webContents.emit("did-navigate", {}, "https://auth.meta.com/login/");  // not Meta's store site yet
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");
-  assert.strictEqual((await done).ok, true);
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("after a connect the window closes, and the page gets the answer, never the token", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.ok(f.windows[0].isDestroyed());
-  assert.ok(!f.flow.isOpen());
-  assert.deepStrictEqual(r, { ok: true, connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" });
-  assert.ok(!JSON.stringify(r).includes(TOKEN));
-  // The cookie listener is gone: a later change sends nothing.
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("a token the server refuses keeps the window open, is sent once, and the next one connects", async () => {
-  const f = fakes();
-  f.setAnswer((t) => t === TOKEN ? { status: 400, data: { error: "Meta didn't accept this token." } }
-                                 : { status: 200, data: { connected: true, user: null } });
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");  // same value again
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  assert.ok(!f.windows[0].isDestroyed());
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  const r = await done;
-  assert.deepStrictEqual(f.calls, [TOKEN, OTHER]);
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(r.user, null);
-});
-
-test("the token is never logged, and an error that echoed it is scrubbed", async () => {
-  const seen = [];
-  const names = ["log", "info", "warn", "error", "debug", "trace"];
-  const saved = Object.fromEntries(names.map((n) => [n, console[n]]));
-  const writes = [process.stdout.write, process.stderr.write];
-  for (const n of names) console[n] = (...a) => { seen.push(a.map(String).join(" ")); };
-  process.stdout.write = (c, ...rest) => { seen.push(String(c)); return writes[0].call(process.stdout, c, ...rest); };
-  process.stderr.write = (c, ...rest) => { seen.push(String(c)); return writes[1].call(process.stderr, c, ...rest); };
-  let r;
-  try {
-    const f = fakes();
-    f.setAnswer((t) => ({ status: 500, data: { error: `RuntimeError: bad ${t} and ${t.slice(0, 12)}` } }));
-    const done = f.flow.signIn();
-    f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-    await settle();
-    f.windows[0].close();  // the user gives up
-    r = await done;
-  } finally {
-    for (const n of names) console[n] = saved[n];
-    [process.stdout.write, process.stderr.write] = writes;
-  }
-  assert.strictEqual(r.ok, false);
-  assert.strictEqual(r.cancelled, true);
-  assert.ok(!r.error.includes(TOKEN) && !r.error.includes(TOKEN.slice(0, 12)), r.error);
-  assert.match(r.error, /<redacted>/);
-  assert.ok(!seen.some((s) => s.includes(TOKEN.slice(0, 12))), "token in output");
-  assert.strictEqual(scrub(`x FRL${"a".repeat(30)} y`), "x <redacted> y");
-});
-
-test("closing the window before signing in reports it, and a second click reuses the open window", async () => {
-  const f = fakes();
-  const a = f.flow.signIn();
-  const b = f.flow.signIn();
-  assert.strictEqual(a, b);
-  assert.strictEqual(f.windows.length, 1);
-  assert.strictEqual(f.windows[0].focused, 1);
-  f.windows[0].close();
-  const r = await a;
-  assert.deepStrictEqual(r, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." });
-  assert.deepStrictEqual(f.calls, []);
-});
-
-test("disconnect's sign-out closes the window and clears only the sign-in partition", async () => {
-  const f = fakes();
-  f.session.fromPartition("persist:other");
-  const pending = f.flow.signIn();
-  await f.flow.signOut();
-  const r = await pending;
-  assert.strictEqual(r.ok, false);
-  assert.ok(f.windows[0].isDestroyed());
-  assert.deepStrictEqual(f.meta().cleared, [["storage", undefined], ["cache"], ["auth"]]);
-  assert.deepStrictEqual(f.session.defaultSession.cleared, []);
-  assert.deepStrictEqual(f.session.fromPartition("persist:other").cleared, []);
-  // The next sign-in starts with a new window.
-  f.flow.signIn();
-  assert.strictEqual(f.windows.length, 2);
-  f.windows[1].close();
-});
-
-test("the first look at a cookie value matches the server's token rules", () => {
-  assert.ok(looksLikeUserToken(TOKEN));
-  assert.ok(looksLikeUserToken("FRL" + "aB3".repeat(10)));
-  for (const bad of [undefined, "", "OC123456789012345", "OC|123|abc", "OCabc%2Fdef" + "x".repeat(20), "OCshort",
-                     "XY" + "a".repeat(30), "OC" + "A".repeat(30)]) {
-    assert.ok(!looksLikeUserToken(bad), String(bad));
-  }
-});
-
-function frameNav(wc, url, isMainFrame) {
-  let prevented = false;
-  wc.emit("will-frame-navigate", { url, isMainFrame, preventDefault: () => { prevented = true; } });
-  return prevented;
-}
-
-test("the window stays on Meta's sites; frames inside it may load any HTTPS page, nothing else", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  // Frames: captcha and CDN frames from other sites load; other schemes are stopped.
-  for (const ok of ["https://client-api.arkoselabs.com/fc/gc/", "https://newassets.hcaptcha.com/captcha/v1/x",
-                    "https://www.google.com/recaptcha/api2/anchor", "https://static.xx.fbcdn.net/x",
-                    "https://www.facebook.com/plugin", "about:blank", "about:srcdoc"]) {
-    assert.strictEqual(frameNav(wc, ok, false), false, ok);
-  }
-  for (const bad of ["http://www.facebook.com/plugin", "data:text/html,<script>x</script>", "blob:https://evil.example/1",
-                     "javascript:alert(1)", "file:///etc/passwd", "ftp://example.com/", "https://u:p@evil.example/",
-                     "chrome://settings", "not a url"]) {
-    assert.strictEqual(frameNav(wc, bad, false), true, bad);
-  }
-  // The window itself: Meta's sites only.
-  assert.strictEqual(frameNav(wc, "about:blank", true), true);
-  assert.strictEqual(frameNav(wc, "https://evil.example/", true), true);
-  assert.strictEqual(frameNav(wc, "https://client-api.arkoselabs.com/", true), true);
-  assert.strictEqual(frameNav(wc, "https://auth.meta.com/login/", true), false);
-  assert.deepStrictEqual(f.opened, []);  // stopped, never opened outside
-  f.windows[0].destroy();
-});
-
-function redirect(wc, url, isMainFrame, style) {
-  let prevented = false;
-  const e = { preventDefault: () => { prevented = true; } };
-  if (style === "details") wc.emit("will-redirect", Object.assign(e, { url, isMainFrame }));
-  else wc.emit("will-redirect", e, url, false, isMainFrame);
-  return prevented;
-}
-
-test("redirects follow the same rule per frame", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  for (const style of ["details", "positional"]) {
-    // A captcha frame redirected within HTTPS loads; a frame redirected to data: or http: doesn't.
-    assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", false, style), false, style);
-    assert.strictEqual(redirect(wc, "https://newassets.hcaptcha.com/x", false, style), false, style);
-    assert.strictEqual(redirect(wc, "data:text/html,<b>x</b>", false, style), true, style);
-    assert.strictEqual(redirect(wc, "http://www.facebook.com/x", false, style), true, style);
-    assert.strictEqual(redirect(wc, "javascript:alert(1)", false, style), true, style);
-    // The window: Meta's sites only.
-    assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", true, style), true, style);
-    assert.strictEqual(redirect(wc, "https://auth.meta.com/next", true, style), false, style);
-  }
-  // Without frame information it is treated as the window.
-  assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/", undefined, "positional"), true);
-  assert.deepStrictEqual(f.opened, []);
-  f.windows[0].destroy();
-});
-
-test("a redirect the window stops is named when the window is closed", async () => {
-  const f = fakes();
-  const p = f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(redirect(wc, "https://www.instagram.com/x?next=1", true, "details"), false);  // Meta's login goes here
-  assert.strictEqual(redirect(wc, "https://login.evil.example/cb?code=SECRET", true, "details"), true);
-  f.windows[0].close();
-  const r = await p;
-  assert.strictEqual(r.ok, false);
-  assert.match(r.error, /went to login\.evil\.example, which Frame Control doesn't allow/);
-  assert.doesNotMatch(r.error, /SECRET|code=/);
-});
-
-test("a stopped redirect is forgotten once the window loads a page again", async () => {
-  const f = fakes();
-  const p = f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(redirect(wc, "https://login.evil.example/cb", true, "details"), true);
-  wc.emit("did-navigate", {}, "https://auth.meta.com/login/");  // the user carried on
-  f.windows[0].close();
-  assert.deepStrictEqual(await p, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." });
-});
-
-test("a page's beforeunload can't keep the window open", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  const w = f.windows[0];
-  let prevented = false;
-  w.webContents.emit("will-prevent-unload", { preventDefault: () => { prevented = true; } });
-  assert.ok(prevented);
-  // Even if close() would be vetoed, finishing destroys the window.
-  w.veto = true;
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  assert.strictEqual((await done).ok, true);
-  assert.ok(w.isDestroyed());
-});
-
-test("closing during a connect: the cancel goes to the server only after that connect settles", async () => {
-  for (const outcome of ["saved", "refused", "failed"]) {
-    const f = fakes();
-    let release, fail;
-    f.setAnswer(() => new Promise((r, j) => { release = r; fail = j; }));
-    const done = f.flow.signIn();
-    f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-    await settle();
-    assert.deepStrictEqual(f.calls, [TOKEN]);
-    f.windows[0].close();  // the user gives up while the server and Meta are answering
-    const r = await done;  // the page hears at once
-    assert.strictEqual(r.ok, false);
-    await settle();
-    assert.deepStrictEqual(f.cancels, [], outcome);  // not before the connect has settled
-    if (outcome === "saved") release({ status: 200, data: { connected: true } });
-    else if (outcome === "refused") release({ status: 400, data: { error: "no" } });
-    else fail(new Error("socket hang up"));
-    await settle();
-    // The same attempt id the connect carried, after it settled and after cookie intake stopped.
-    assert.deepStrictEqual(f.cancels, [f.attempts[0]], outcome);
-    assert.match(f.cancels[0], /^[A-Za-z0-9-]{8,64}$/);
-    assert.deepStrictEqual(f.log, ["connect", "destroyed", "cancel (cookie listeners: 0)"], outcome);
-    assert.deepStrictEqual(f.calls, [TOKEN]);
-  }
-});
-
-test("closing before any connect needs no cancel", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: TOKEN });  // nothing usable
-  await settle();
-  f.windows[0].close();
-  assert.strictEqual((await done).ok, false);
-  await f.flow.signOut();
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  assert.deepStrictEqual(f.cancels, []);
-});
-
-test("a timeout during a connect cancels after it settles", async () => {
-  const f = fakes({ timeout: 50 });
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));  // Meta is slow
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.match(r.error, /timed out/);
-  assert.ok(f.windows[0].isDestroyed());
-  assert.deepStrictEqual(f.cancels, []);
-  release({ status: 400, data: { error: "no" } });
-  await settle();
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("disconnect during a connect waits for it, cancels it, then clears, before the page deletes the account", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.log.length = 0;
-  let signedOut = false;
-  const out = f.flow.signOut().then(() => { signedOut = true; });  // the page's Disconnect, step one
-  assert.strictEqual((await done).ok, false);
-  await settle();
-  assert.strictEqual(signedOut, false);  // still waiting for the connect
-  assert.deepStrictEqual(f.cancels, []);
-  release({ status: 200, data: { connected: true } });  // it saved, just now
-  await out;
-  // Only now would the page post its disconnect: the cancel (which deletes what that
-  // connect saved) has reached the server, and the session is cleared.
-  assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]);
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("a later disconnect still waits for a closed window's connect", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();
-  await done;
-  let signedOut = false;
-  const out = f.flow.signOut().then(() => { signedOut = true; });
-  await settle();
-  assert.strictEqual(signedOut, false);
-  release({ status: 400, data: { error: "no" } });
-  await out;
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("nothing sent means nothing to cancel; sign-out destroys the window, cancels, then clears", async () => {
-  const f = fakes();
-  // Nothing sent: closing cancels nothing.
-  const a = f.flow.signIn();
-  f.windows[0].close();
-  await a;
-  assert.deepStrictEqual(f.cancels, []);
-  // Something sent, then signed out: the attempt is cancelled before the session is cleared.
-  f.setAnswer(() => ({ status: 400, data: { error: "Meta didn't accept this token." } }));
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[1].veto = true;  // and its page tries to stay open
-  f.log.length = 0;
-  await f.flow.signOut();
-  assert.strictEqual((await b).ok, false);
-  assert.ok(f.windows[1].isDestroyed());
-  assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]);
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-  // After sign-out a new cookie in the partition sends nothing.
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("each sign-in has its own attempt id", async () => {
-  const f = fakes();
-  f.setAnswer(() => ({ status: 400, data: { error: "no" } }));
-  const a = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();
-  await a;
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  f.windows[1].close();
-  await b;
-  await settle();
-  assert.strictEqual(f.attempts.length, 2);
-  assert.notStrictEqual(f.attempts[0], f.attempts[1]);
-  assert.deepStrictEqual(f.cancels, f.attempts);
-});
-
-test("no sign-in can start while a sign-out waits on an earlier connect", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const first = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  const out = f.flow.signOut();  // Disconnect pressed while that connect is under way
-  assert.strictEqual((await first).ok, false);
-  assert.ok(f.flow.isSigningOut());
-  // The page answered, so the user tries again at once: refused, no window, nothing sent.
-  const second = await f.flow.signIn();
-  assert.deepStrictEqual(second, { ok: false, error: "Frame Control is signing out of Meta; try again in a moment." });
-  assert.strictEqual(f.windows.length, 1);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  // A second sign-out joins the first.
-  assert.strictEqual(f.flow.signOut(), out);
-  release({ status: 200, data: { connected: true } });
-  await out;
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-  assert.strictEqual(f.meta().cleared.filter(([k]) => k === "storage").length, 1);
-  assert.ok(!f.flow.isSigningOut());
-  // Once it is done, signing in works again.
-  f.setAnswer(() => ({ status: 200, data: { connected: true } }));
-  const third = f.flow.signIn();
-  assert.strictEqual(f.windows.length, 2);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  assert.strictEqual((await third).ok, true);
-});
-
-test("sign-out goes round until no window and no connect or cancel is left", async () => {
-  const f = fakes();
-  let releaseA;
-  f.setAnswer(() => new Promise((r) => { releaseA = r; }));
-  const a = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();  // window A closed; its cancel waits on its connect
-  await a;
-  // Window B is open, with its own connect under way, when sign-out starts.
-  let releaseB;
-  f.setAnswer(() => new Promise((r) => { releaseB = r; }));
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  let finished = false;
-  const out = f.flow.signOut().then(() => { finished = true; });
-  await b;
-  releaseB({ status: 400, data: { error: "no" } });
-  await settle();
-  assert.strictEqual(finished, false);  // A's connect is still under way
-  releaseA({ status: 200, data: { connected: true } });
-  await out;
-  assert.deepStrictEqual([...f.cancels].sort(), [...f.attempts].sort());
-  assert.strictEqual(f.attempts.length, 2);
-  assert.strictEqual(f.log[f.log.length - 1], "clear");
-});

app/test/preferences.test.js

@@ -1,68 +0,0 @@
-const test = require("node:test");
-const assert = require("node:assert/strict");
-const fs = require("node:fs");
-const os = require("node:os");
-const path = require("node:path");
-const { preferenceStore } = require("../preferences");
-
-function fixture(t) {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "frame-preferences-"));
-  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
-  return path.join(dir, "client-preferences.json");
-}
-
-test("desktop packaging includes every local application module dependency", () => {
-  const root = path.resolve(__dirname, "..");
-  const packaged = new Set(require("../package.json").build.files);
-  for (const file of ["main.js", "preload.js"]) {
-    const source = fs.readFileSync(path.join(root, file), "utf8");
-    for (const match of source.matchAll(/require\(["'](\.\/[^"']+)["']\)/g)) {
-      const target = match[1].slice(2) + ".js";
-      assert.ok(packaged.has(target), `${file} needs packaged ${target}`);
-    }
-  }
-});
-
-test("client choices survive a new native session and local server origin", t => {
-  const file = fixture(t);
-  const first = preferenceStore(file);
-  assert.deepEqual(first.read(), {});
-  first.write("mvSeparate", "0");
-  first.write("padUsed", "1");
-  // A new process/session reads the same client store, regardless of its URL.
-  const second = preferenceStore(file);
-  assert.deepEqual(second.read(), { mvSeparate: "0", padUsed: "1" });
-  second.write("mvSeparate", "1");
-  assert.deepEqual(first.read(), { mvSeparate: "1", padUsed: "1" });
-});
-
-test("only the non-sensitive binary choices can enter the native store", t => {
-  const file = fixture(t), store = preferenceStore(file);
-  for (const [key, value] of [["token", "secret"], ["__proto__", "1"], ["padUsed", true], ["mvSeparate", "yes"]]) {
-    assert.throws(() => store.write(key, value), /Invalid preference/);
-  }
-  assert.equal(fs.existsSync(file), false);
-  fs.writeFileSync(file, JSON.stringify({ token: "discard", mvSeparate: "0", padUsed: 1 }));
-  assert.deepEqual(store.read(), { mvSeparate: "0" });
-  store.write("padUsed", "1");
-  assert.deepEqual(JSON.parse(fs.readFileSync(file, "utf8")), { mvSeparate: "0", padUsed: "1" });
-});
-
-test("a missing or damaged preference file retains usable defaults", t => {
-  const file = fixture(t), store = preferenceStore(file);
-  assert.deepEqual(store.read(), {});
-  for (const bad of ["{broken", "null", "[]", '"text"']) {
-    fs.writeFileSync(file, bad);
-    assert.deepEqual(store.read(), {});
-  }
-  store.write("padUsed", "1");
-  assert.deepEqual(store.read(), { padUsed: "1" });
-});
-
-test("the PC in the headset opt-in is remembered and off unless saved", t => {
-  const file = fixture(t), store = preferenceStore(file);
-  assert.equal(store.read().pcView, undefined);
-  store.write("pcView", "1");
-  assert.deepEqual(preferenceStore(file).read(), { pcView: "1" });
-  assert.throws(() => store.write("pcView", "on"), /Invalid preference/);
-});

app/test/updater.test.js

@@ -51,27 +51,6 @@ test("update.json assets always download from this repository's release", () =>
   assert.throws(() => require("../updater").fromManifest({ version: "nope", assets: [] }));
 });
 
-test("the release page is this repository's tag page, never a draft's untagged-... link", () => {
-  const { fromManifest, fromApi } = require("../updater");
-  const tagPage = "https://github.com/saphid/frame-control/releases/tag/v0.4.0";
-  const page = (p) => fromManifest({ version: "0.4.0", assets: [], page: p }).page;
-  assert.strictEqual(page(tagPage), tagPage);
-  // 0.4.0's real update.json: the draft's address, a 404 once published.
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/untagged-c6ddfed7f75d67db2e99"), tagPage);
-  assert.strictEqual(page(undefined), tagPage);
-  assert.strictEqual(page("https://evil.example/releases/tag/v0.4.0"), tagPage);
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/v0.4.0?x=1"), tagPage);
-  // Paths that normalize to another repository.
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/..\\..\\..\\..\\other-owner\\other-repo"),
-                     tagPage);
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/%2e%2e/%2e%2e/%2e%2e/%2e%2e/other-owner/other-repo"),
-                     tagPage);
-  assert.strictEqual(page("https://github.com/saphid/frame-control/releases/tag/v0.3.9"), tagPage);  // only its own tag
-  assert.strictEqual(fromApi({ tag_name: "../../x", assets: [] }).page, "https://github.com/saphid/frame-control/releases");
-  assert.strictEqual(fromApi({ tag_name: "v0.4.0", assets: [],
-                               html_url: "https://github.com/saphid/frame-control/releases/tag/untagged-x" }).page, tagPage);
-});
-
 test("prepare refuses a release that isn't newer (no downgrades)", async () => {
   const { prepare } = require("../updater");
   const release = { version: "0.3.1", assets: [] };

app/updater.js

@@ -106,24 +106,12 @@ async function getJson(url, headers) {
   return JSON.parse(body);
 }
 
-// The release page the banner links to. update.json for 0.4.0 carried the draft's
-// address (releases/tag/untagged-...), which is dead once the release is published,
-// and a page from the manifest could also be steered elsewhere (e.g. tag/..\..\other/repo
-// normalizes to another repository) before shell.openExternal. So the given page is
-// ignored: the link is always this repository's tag page, built from a valid version.
-function releasePage(version) {
-  const v = parseVersion(version);
-  if (!v) return RELEASES;
-  return `${RELEASES}/tag/v${v.nums.join(".")}${v.pre ? "-" + v.pre : ""}`;
-}
-
 // update.json and the API's release both become { version, notes, page, assets }.
 function fromManifest(m) {
   if (!parseVersion(m.version) || !Array.isArray(m.assets)) throw new Error("update.json is malformed");
-  const version = String(m.version).replace(/^v/i, "");
-  const base = `https://github.com/${REPO}/releases/download/v${version}/`;
-  return { version, notes: String(m.notes || "").slice(0, 4000),
-           page: releasePage(version),
+  const base = `https://github.com/${REPO}/releases/download/v${String(m.version).replace(/^v/i, "")}/`;
+  return { version: String(m.version).replace(/^v/i, ""), notes: String(m.notes || "").slice(0, 4000),
+           page: m.page || RELEASES,
            // Assets always come from this repository's release, whatever the manifest says.
            assets: m.assets.map((a) => ({ name: String(a.name), url: base + encodeURIComponent(String(a.name)),
                                           size: a.size, digest: a.digest || null })) };
@@ -131,9 +119,8 @@ function fromManifest(m) {
 
 function fromApi(r) {
   if (r.draft || r.prerelease) throw new Error("GitHub returned an unpublished release");
-  const version = String(r.tag_name || "").replace(/^v/i, "");
-  return { version, notes: String(r.body || "").slice(0, 4000),
-           page: releasePage(version),
+  return { version: String(r.tag_name || "").replace(/^v/i, ""), notes: String(r.body || "").slice(0, 4000),
+           page: r.html_url || RELEASES,
            assets: (r.assets || []).map((a) => ({ name: a.name, url: a.browser_download_url, size: a.size,
                                                  digest: a.digest || null })) };
 }

bench/results/2026-09-28-c5fc552-dirty-pc-agent-frame-arm64-hairpin.json

@@ -1,311 +0,0 @@
-{
- "label": "pc-agent-frame-arm64-hairpin",
- "date": "2026-09-28T22:36:19",
- "commit": "c5fc552+dirty",
- "config": {
-  "quality": "balanced",
-  "mode": "separate",
-  "net": "none",
-  "delay_ms": 0,
-  "buffer_ms": 250,
-  "host": "frame",
-  "usb": false,
-  "ssh_opts": [],
-  "encoder": "",
-  "duration_s": 10.0,
-  "browser_flags": []
- },
- "frame_build": "20260925.6191901",
- "mac": "26.5.2",
- "host_platform": "Linux aarch64, SteamOS Frame, BUILD_ID 20260925.6191901 (synthetic host only)",
- "source": "",
- "pc_host": true,
- "headset": "0:03.056203 [Info] - 1 - leaving standby",
- "scenarios": [
-  {
-   "scenario": "test",
-   "frames_sent": 351,
-   "frames_drawn": 351,
-   "frames_shown": 324,
-   "duration_s": 10.1,
-   "stages_ms": {
-    "capture": {
-     "p50": 0.1,
-     "p95": 0.2,
-     "p99": 0.5,
-     "n": 351
-    },
-    "queue": {
-     "p50": 0.1,
-     "p95": 0.3,
-     "p99": 0.4,
-     "n": 351
-    },
-    "encode": {
-     "p50": 2.0,
-     "p95": 2.9,
-     "p99": 3.5,
-     "n": 351
-    },
-    "socket": {
-     "p50": 0.1,
-     "p95": 0.4,
-     "p99": 0.6,
-     "n": 351
-    },
-    "network": {
-     "p50": 11.6,
-     "p95": 75.7,
-     "p99": 130.1,
-     "n": 351
-    },
-    "decode": {
-     "p50": 0.7,
-     "p95": 2.1,
-     "p99": 4.1,
-     "n": 351
-    },
-    "draw": {
-     "p50": 0.4,
-     "p95": 0.8,
-     "p99": 1.1,
-     "n": 351
-    },
-    "present": {
-     "p50": 0.8,
-     "p95": 18.1,
-     "p99": 24.9,
-     "n": 324
-    },
-    "content": {
-     "p50": 15.1,
-     "p95": 80.3,
-     "p99": 134.2,
-     "n": 351
-    },
-    "content_shown": {
-     "p50": 21.0,
-     "p95": 71.8,
-     "p99": 146.3,
-     "n": 324
-    }
-   },
-   "fps": 34.8,
-   "fps_shown": 32.0,
-   "late_pct": 53.41,
-   "stall_max": 226.8,
-   "stalls_over_100ms": 7,
-   "mbps": 0.26,
-   "keyframes": 6,
-   "size": "1280x720",
-   "captured": 607,
-   "viewer_never_drawn": 0,
-   "input_ms": {
-    "p50": 43.3,
-    "p95": 98.4,
-    "p99": 110.1,
-    "n": 18
-   },
-   "input_shown_ms": {
-    "p50": 54.7,
-    "p95": 98.9,
-    "p99": 114.0,
-    "n": 18
-   },
-   "input_parts_ms": {
-    "uplink": {
-     "p50": 17.1,
-     "p95": 48.3,
-     "p99": 53.1,
-     "n": 18
-    },
-    "mac": {
-     "p50": 12.5,
-     "p95": 32.9,
-     "p99": 35.7,
-     "n": 18
-    },
-    "back": {
-     "p50": 16.8,
-     "p95": 50.0,
-     "p99": 55.9,
-     "n": 18
-    }
-   },
-   "inputs": {
-    "asked": 18,
-    "sent": 18,
-    "seen": 18
-   },
-   "timeline": [
-    {
-     "t": 0,
-     "fps": 38,
-     "mbps": 0.3,
-     "content_p50": 14.8,
-     "content_p95": 25.3,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 1,
-     "fps": 33,
-     "mbps": 0.24,
-     "content_p50": 15.6,
-     "content_p95": 103.5,
-     "bitrate": 3845448,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 2,
-     "fps": 39,
-     "mbps": 0.28,
-     "content_p50": 15.6,
-     "content_p95": 29.9,
-     "bitrate": 5283790,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 3,
-     "fps": 25,
-     "mbps": 0.21,
-     "content_p50": 17.8,
-     "content_p95": 175.9,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 4,
-     "fps": 34,
-     "mbps": 0.22,
-     "content_p50": 15.4,
-     "content_p95": 69.8,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 5,
-     "fps": 38,
-     "mbps": 0.29,
-     "content_p50": 17.7,
-     "content_p95": 68.7,
-     "bitrate": 2764800,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 6,
-     "fps": 38,
-     "mbps": 0.26,
-     "content_p50": 15.0,
-     "content_p95": 18.2,
-     "bitrate": 3091280,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 7,
-     "fps": 30,
-     "mbps": 0.22,
-     "content_p50": 19.2,
-     "content_p95": 111.0,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 8,
-     "fps": 35,
-     "mbps": 0.26,
-     "content_p50": 13.4,
-     "content_p95": 102.6,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 9,
-     "fps": 38,
-     "mbps": 0.28,
-     "content_p50": 12.3,
-     "content_p95": 20.9,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 10,
-     "fps": 3,
-     "mbps": 0.02,
-     "content_p50": 20.9,
-     "content_p95": 24.7,
-     "bitrate": 1725204,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    }
-   ],
-   "adapt": [],
-   "content_p50": 15.1,
-   "content_p95": 80.3,
-   "input_p50": 43.3,
-   "input_p95": 98.4,
-   "grades": {
-    "input_replies": "local",
-    "content_p50": "local",
-    "content_p95": "acceptable",
-    "input_p50": "local",
-    "input_p95": "acceptable",
-    "fps": "bad",
-    "late_pct": "bad",
-    "stall_max": "acceptable"
-   },
-   "controller": {
-    "target": 3442081,
-    "ceiling": 5529600,
-    "tier": 0,
-    "fps": 60,
-    "scale": 1.0,
-    "baseRtt": 13.334,
-    "inFlight": 1,
-    "slack": 71.738,
-    "adapt": true
-   },
-   "events": [
-    {
-     "t": 3.77,
-     "e": "target 2764800 bit/s; tier 0"
-    },
-    {
-     "t": 7.42,
-     "e": "target 1725204 bit/s; tier 0"
-    }
-   ],
-   "source_fps": 60.1,
-   "cpu": {
-    "host": "not sampled"
-   },
-   "viewer": "h264 software; ANGLE (Mesa, zink Vulkan 1.4(Turnip Adreno (TM) 750 (MESA_TURNIP)), OpenGL 4.6); raf 71 Hz",
-   "show_s": 1.88,
-   "panel": "valve.steam.desktopgame.2001932457",
-   "src": "test",
-   "route": "network"
-  }
- ],
- "proof": "Synthetic x264 PC agent runs on the Frame itself, forwarded via Mac and back. Not Windows/Linux desktop capture or laser input."
-}

bench/results/2026-09-28-cd20243-pc-agent-frame-arm64-final.json

@@ -1,302 +0,0 @@
-{
- "label": "pc-agent-frame-arm64-final",
- "date": "2026-09-28T22:55:27",
- "commit": "cd20243",
- "config": {
-  "quality": "balanced",
-  "mode": "native",
-  "net": "none",
-  "delay_ms": 0,
-  "buffer_ms": 250,
-  "host": "frame",
-  "usb": false,
-  "ssh_opts": [],
-  "encoder": "",
-  "duration_s": 10.0,
-  "browser_flags": []
- },
- "frame_build": "20260925.6191901",
- "mac": "26.5.2",
- "host_platform": "Linux aarch64, SteamOS Frame, BUILD_ID 20260925.6191901 (synthetic host only)",
- "source": "",
- "pc_host": true,
- "headset": "0:03.056203 [Info] - 1 - leaving standby",
- "scenarios": [
-  {
-   "scenario": "test",
-   "frames_sent": 400,
-   "frames_drawn": 400,
-   "frames_shown": 339,
-   "duration_s": 10.2,
-   "stages_ms": {
-    "capture": {
-     "p50": 0.1,
-     "p95": 0.1,
-     "p99": 0.2,
-     "n": 400
-    },
-    "queue": {
-     "p50": 0.1,
-     "p95": 0.2,
-     "p99": 0.4,
-     "n": 400
-    },
-    "encode": {
-     "p50": 2.0,
-     "p95": 2.7,
-     "p99": 3.1,
-     "n": 400
-    },
-    "socket": {
-     "p50": 0.1,
-     "p95": 0.3,
-     "p99": 0.4,
-     "n": 400
-    },
-    "network": {
-     "p50": 11.8,
-     "p95": 25.2,
-     "p99": 37.8,
-     "n": 400
-    },
-    "decode": {
-     "p50": 0.7,
-     "p95": 1.5,
-     "p99": 2.0,
-     "n": 400
-    },
-    "draw": {
-     "p50": 0.3,
-     "p95": 0.7,
-     "p99": 1.0,
-     "n": 400
-    },
-    "present": {
-     "p50": 0.8,
-     "p95": 19.3,
-     "p99": 26.8,
-     "n": 339
-    },
-    "content": {
-     "p50": 15.1,
-     "p95": 28.6,
-     "p99": 41.3,
-     "n": 400
-    },
-    "content_shown": {
-     "p50": 17.6,
-     "p95": 39.0,
-     "p99": 47.2,
-     "n": 339
-    }
-   },
-   "fps": 39.3,
-   "fps_shown": 33.4,
-   "late_pct": 50.25,
-   "stall_max": 69.3,
-   "stalls_over_100ms": 0,
-   "mbps": 0.35,
-   "keyframes": 6,
-   "size": "1280x720",
-   "captured": 612,
-   "viewer_never_drawn": 0,
-   "input_ms": {
-    "p50": 76.6,
-    "p95": 98.2,
-    "p99": 127.8,
-    "n": 19
-   },
-   "input_shown_ms": {
-    "p50": 80.5,
-    "p95": 107.8,
-    "p99": 128.1,
-    "n": 16
-   },
-   "input_parts_ms": {
-    "uplink": {
-     "p50": 36.5,
-     "p95": 57.6,
-     "p99": 83.2,
-     "n": 19
-    },
-    "mac": {
-     "p50": 14.6,
-     "p95": 31.3,
-     "p99": 31.7,
-     "n": 19
-    },
-    "back": {
-     "p50": 15.1,
-     "p95": 32.8,
-     "p99": 36.2,
-     "n": 19
-    }
-   },
-   "inputs": {
-    "asked": 19,
-    "sent": 19,
-    "seen": 19
-   },
-   "timeline": [
-    {
-     "t": 0,
-     "fps": 40,
-     "mbps": 0.34,
-     "content_p50": 11.7,
-     "content_p95": 27.4,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 1,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 11.9,
-     "content_p95": 28.2,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 2,
-     "fps": 41,
-     "mbps": 0.35,
-     "content_p50": 11.4,
-     "content_p95": 16.6,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 3,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 12.7,
-     "content_p95": 28.0,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 4,
-     "fps": 38,
-     "mbps": 0.33,
-     "content_p50": 15.3,
-     "content_p95": 30.0,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 5,
-     "fps": 39,
-     "mbps": 0.37,
-     "content_p50": 16.7,
-     "content_p95": 28.5,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 6,
-     "fps": 41,
-     "mbps": 0.38,
-     "content_p50": 15.9,
-     "content_p95": 29.4,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 7,
-     "fps": 41,
-     "mbps": 0.31,
-     "content_p50": 15.6,
-     "content_p95": 28.2,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 8,
-     "fps": 38,
-     "mbps": 0.38,
-     "content_p50": 15.5,
-     "content_p95": 25.9,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 9,
-     "fps": 38,
-     "mbps": 0.29,
-     "content_p50": 16.7,
-     "content_p95": 28.8,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    },
-    {
-     "t": 10,
-     "fps": 6,
-     "mbps": 0.03,
-     "content_p50": 17.6,
-     "content_p95": 23.1,
-     "bitrate": 5529600,
-     "tier": 0,
-     "w": 1280,
-     "net": null
-    }
-   ],
-   "adapt": [],
-   "content_p50": 15.1,
-   "content_p95": 28.6,
-   "input_p50": 76.6,
-   "input_p95": 98.2,
-   "grades": {
-    "input_replies": "local",
-    "content_p50": "local",
-    "content_p95": "local",
-    "input_p50": "acceptable",
-    "input_p95": "acceptable",
-    "fps": "bad",
-    "late_pct": "bad",
-    "stall_max": "local"
-   },
-   "controller": {
-    "target": 5529600,
-    "ceiling": 5529600,
-    "tier": 0,
-    "fps": 60,
-    "scale": 1.0,
-    "baseRtt": 12.332,
-    "inFlight": 0,
-    "slack": 74.12,
-    "adapt": true
-   },
-   "events": [],
-   "source_fps": 60.0,
-   "cpu": {
-    "host": "not sampled"
-   },
-   "viewer": "h264 software; ANGLE (Mesa, zink Vulkan 1.4(Turnip Adreno (TM) 750 (MESA_TURNIP)), OpenGL 4.6); raf 72 Hz",
-   "show_s": 1.75,
-   "panel": "valve.steam.desktopgame.2001932457",
-   "src": "test",
-   "route": "network"
-  }
- ],
- "proof": "Synthetic x264 PC agent runs on the Frame itself, forwarded via Mac and back. Not Windows/Linux desktop capture or laser input."
-}

desktop/build-controller.py

@@ -1,16 +0,0 @@
-#!/usr/bin/env python3
-"""Build the common controller for the Python PC host (a C11 compiler needed)."""
-import os
-from pathlib import Path
-import subprocess
-import sys
-
-root = Path(__file__).resolve().parent
-suffix = '.dll' if sys.platform == 'win32' else '.dylib' if sys.platform == 'darwin' else '.so'
-out = root / ('controller' + suffix)
-if sys.platform == 'win32' and os.environ.get('CC', 'cl') == 'cl':
-    cmd = ['cl', '/nologo', '/O2', '/LD', '/std:c11', str(root / 'controller.c'), '/link', '/OUT:' + str(out)]
-else:
-    cmd = [os.environ.get('CC', 'cc'), '-O2', '-std=c11', '-shared', '-fPIC', str(root / 'controller.c'), '-o', str(out)]
-subprocess.run(cmd, cwd=root, check=True)
-print(out)

desktop/build.py

@@ -1,126 +0,0 @@
-#!/usr/bin/env python3
-"""Build our native PC adapter and bundle its ordinary shared libraries.
-
-Run on the target architecture after installing GStreamer development packages.
-No GStreamer executable or desktop streaming application is shipped or invoked.
-Linux libc, display/GPU drivers and the portal service remain platform pieces.
-
-x264 is GPL, so the bundle the Windows installer ships leaves it out: Windows
-encodes with Media Foundation. --with-x264 adds it for CI's headless protocol
-tests, which have no GPU or desktop to encode with.
-"""
-import argparse
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import subprocess
-import sys
-
-ROOT = Path(__file__).resolve().parent
-
-
-def output(*args):
-    return subprocess.check_output(args, text=True).strip()
-
-
-def build(destination, with_x264=False):
-    win = sys.platform == 'win32'
-    destination.mkdir(parents=True, exist_ok=True)
-    modules = ['gstreamer-1.0', 'gstreamer-app-1.0', 'gstreamer-video-1.0']
-    if not win:
-        modules += ['gio-unix-2.0']
-    import shlex
-    flags = shlex.split(output('pkg-config', '--cflags', '--libs', *modules))
-    lib = destination / ('pc-host.dll' if win else 'pc-host.so')
-    cmd = [os.environ.get('CC', 'gcc' if win else 'cc'), '-std=c11', '-O2', '-shared', '-Wall', '-Wextra']
-    if not win:
-        cmd += ['-fPIC', '-Wl,-rpath,$ORIGIN/lib']
-    subprocess.run(cmd + [str(ROOT / f) for f in ('controller.c', 'capture.c', 'portal.c')] + flags + ['-o', str(lib)], check=True)
-    prefix = Path(output('pkg-config', '--variable=prefix', 'gstreamer-1.0'))
-    plugin_dir = Path(output('pkg-config', '--variable=pluginsdir', 'gstreamer-1.0'))
-    plugins_out, libs_out = destination / 'lib' / 'gstreamer-1.0', destination / ('bin' if win else 'lib')
-    plugins_out.mkdir(parents=True, exist_ok=True)
-    libs_out.mkdir(parents=True, exist_ok=True)
-    names = ['coreelements', 'videotestsrc', 'videoconvertscale', 'app', 'jpeg', 'videoparsersbad']
-    if with_x264:
-        names.append('x264')
-    names += ['d3d11', 'mediafoundation'] if win else ['pipewire', 'va']
-    pending = [lib]
-    for name in names:
-        matches = list(plugin_dir.glob('*gst' + name + ('.dll' if win else '.so')))
-        if not matches:
-            raise SystemExit('Missing GStreamer library: ' + name)
-        for source in matches:
-            target = plugins_out / source.name
-            shutil.copy2(source, target)
-            pending.append(source)
-    if not win:
-        # PipeWire dynamically loads support and protocol modules. ldd cannot
-        # discover those; bundle them with a private client-only config instead
-        # of accidentally loading a different distro's client modules/config.
-        libdir = plugin_dir.parent
-        for relative in ('pipewire-0.3/libpipewire-module-protocol-native.so',
-                         'pipewire-0.3/libpipewire-module-client-node.so',
-                         'pipewire-0.3/libpipewire-module-adapter.so',
-                         'spa-0.2/support/libspa-support.so',
-                         'spa-0.2/support/libspa-dbus.so',
-                         'spa-0.2/videoconvert/libspa-videoconvert.so'):
-            source = libdir / relative
-            if not source.is_file():
-                raise SystemExit('Missing PipeWire runtime library: ' + str(source))
-            target = destination / 'lib' / relative
-            target.parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(source, target)
-            pending.append(source)
-        config = destination / 'share' / 'pipewire'
-        config.mkdir(parents=True, exist_ok=True)
-        (config / 'client.conf').write_text(
-            'context.spa-libs = { support.* = support/libspa-support video.* = videoconvert/libspa-videoconvert }\n'
-            'context.modules = [\n'
-            '  { name = libpipewire-module-protocol-native }\n'
-            '  { name = libpipewire-module-client-node }\n'
-            '  { name = libpipewire-module-adapter }\n'
-            ']\n')
-    copied = set()
-    while pending:
-        binary = pending.pop()
-        if win:
-            imported = re.findall(r'DLL Name:\s*(\S+)', output('objdump', '-p', str(binary)))
-            dependencies = [prefix / 'bin' / name for name in imported]
-        else:
-            dependencies = [Path(p) for p in re.findall(r'=>\s+(/\S+)', output('ldd', str(binary)))]
-        for dep in dependencies:
-            if not dep.is_file() or dep.name in copied:
-                continue
-            if not win and re.match(r'lib(c|m|dl|rt|pthread|resolv)\.so', dep.name):
-                continue
-            shutil.copy2(dep, libs_out / dep.name)
-            copied.add(dep.name)
-            pending.append(dep)
-    # License texts and package provenance accompany the dynamically linked
-    # libraries. Distribution builders keep the upstream package/source URLs.
-    licenses = destination / 'licenses'
-    licenses.mkdir(exist_ok=True)
-    if win:
-        source = prefix / 'share' / 'licenses'
-        if source.exists():
-            shutil.copytree(source, licenses, dirs_exist_ok=True)
-        packages = output('pacman', '-Q') if shutil.which('pacman') else 'See MSYS2 build log'
-    else:
-        packages = output('dpkg-query', '-W', '-f=${Package} ${Version}\n') if shutil.which('dpkg-query') else ''
-        # Debian copyright files contain licenses and source homepage details.
-        for path in Path('/usr/share/doc').glob('*/copyright'):
-            shutil.copy2(path, licenses / (path.parent.name + '.copyright'))
-    (destination / 'libraries.json').write_text(json.dumps(dict(gstreamer=output('pkg-config', '--modversion', 'gstreamer-1.0'),
-        plugins=names, libraries=sorted(copied), packages=packages), indent=2))
-    print(lib)
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument('--out', type=Path, default=ROOT / 'bundle')
-    parser.add_argument('--with-x264', action='store_true', help='add the GPL x264 encoder (CI tests only, never shipped)')
-    args = parser.parse_args()
-    build(args.out.resolve(), args.with_x264)

desktop/capture.c

@@ -1,134 +0,0 @@
-/* Frame Control's capture/encode adapter. GStreamer is a bundled library;
- * capture uses WGC on Windows and the consented PipeWire fd on Linux. */
-#include "controller.h"
-#include <gst/gst.h>
-#include <gst/app/gstappsink.h>
-#include <gst/video/video-event.h>
-#include <string.h>
-
-typedef int (*Gate)(int stage, int64_t pts, int64_t capture, int64_t arrived);
-typedef struct {
-    GstElement *pipeline, *encoder, *sink, *raw_queue;
-    Gate gate;
-    GstSample *sample;
-    GstMapInfo map;
-    int mapped;
-    char error[512];
-} Capture;
-typedef struct { const unsigned char *data; int size, key, width, height; int64_t pts; } Encoded;
-FC_API int64_t fc_now(void) {return g_get_monotonic_time();}
-FC_API void fc_gst_init(void) {gst_init(NULL,NULL);}
-FC_API int fc_has_element(const char *name) {
-    GstElementFactory *f=gst_element_factory_find(name);
-    if(!f)return 0;gst_object_unref(f);return 1;
-}
-FC_API int fc_has_property(const char *element, const char *property) {
-    /* Probe the same initialized GStreamer instance that capture uses. The
-     * bundled MSYS2 plugin can omit optional WGC properties entirely. */
-    GstElement *source=gst_element_factory_make(element,NULL);
-    if(!source)return 0;
-    int found=g_object_class_find_property(G_OBJECT_GET_CLASS(source),property)!=NULL;
-    gst_object_unref(source);
-    return found;
-}
-static GstPadProbeReturn probe(GstPad *pad,GstPadProbeInfo *info,gpointer data) {
-    Capture *c=data; GstBuffer *b=GST_PAD_PROBE_INFO_BUFFER(info);
-    if(!b)return GST_PAD_PROBE_OK;
-    int64_t now=fc_now(), cap=now;
-    GstClock *clock=gst_element_get_clock(c->pipeline);
-    if(clock && GST_BUFFER_PTS_IS_VALID(b)) {
-        GstClockTime current=gst_clock_get_time(clock),origin=gst_element_get_base_time(c->pipeline);
-        if(current>=origin && current-origin>=GST_BUFFER_PTS(b))
-            cap-= (int64_t)((current-origin-GST_BUFFER_PTS(b))/1000);
-    }
-    if(clock)gst_object_unref(clock);
-    int stage=GPOINTER_TO_INT(g_object_get_data(G_OBJECT(pad),"stage"));
-    if(stage==1) return c->gate(stage,(int64_t)GST_BUFFER_PTS(b),cap,now)>0 ? GST_PAD_PROBE_OK : GST_PAD_PROBE_DROP;
-    int phase=0;
-    for(;;) {
-        /* While congested, prefer a newer raw picture queued upstream. If
-         * nothing changed, retain this last picture until the gate opens;
-         * an idle window must not stay stale after a dropped final update. */
-        guint queued=0;
-        if(phase && c->raw_queue)g_object_get(c->raw_queue,"current-level-buffers",&queued,NULL);
-        if(queued)return GST_PAD_PROBE_DROP;
-        int decision=c->gate(phase,(int64_t)GST_BUFFER_PTS(b),cap,now);
-        if(decision)return decision>0 ? GST_PAD_PROBE_OK : GST_PAD_PROBE_DROP;
-        phase=2;g_usleep(2000);
-    }
-}
-FC_API Capture *fc_capture_open(const char *pipeline,Gate gate,char *error,int capacity) {
-    GError *e=NULL;Capture *c=g_new0(Capture,1);c->gate=gate;
-    c->pipeline=gst_parse_launch(pipeline,&e);
-    if(e || !c->pipeline) {
-        g_strlcpy(error,e?e->message:"No pipeline",capacity);
-        if(e)g_error_free(e);if(c->pipeline)gst_object_unref(c->pipeline);g_free(c);return NULL;
-    }
-    c->encoder=gst_bin_get_by_name(GST_BIN(c->pipeline),"enc");
-    c->sink=gst_bin_get_by_name(GST_BIN(c->pipeline),"out");
-    GstElement *raw=gst_bin_get_by_name(GST_BIN(c->pipeline),"gate");
-    if(!c->encoder || !c->sink || !raw) {
-        g_strlcpy(error,"Pipeline is missing enc, out or gate",capacity);
-        if(raw)gst_object_unref(raw);if(c->encoder)gst_object_unref(c->encoder);
-        if(c->sink)gst_object_unref(c->sink);gst_object_unref(c->pipeline);g_free(c);return NULL;
-    }
-    c->raw_queue=gst_bin_get_by_name(GST_BIN(c->pipeline),"raw_queue");
-    GstPad *p=gst_element_get_static_pad(raw,"src");
-    g_object_set_data(G_OBJECT(p),"stage",GINT_TO_POINTER(0));
-    gst_pad_add_probe(p,GST_PAD_PROBE_TYPE_BUFFER,probe,c,NULL);gst_object_unref(p);gst_object_unref(raw);
-    p=gst_element_get_static_pad(c->encoder,"sink");
-    g_object_set_data(G_OBJECT(p),"stage",GINT_TO_POINTER(1));
-    gst_pad_add_probe(p,GST_PAD_PROBE_TYPE_BUFFER,probe,c,NULL);gst_object_unref(p);
-    gst_element_set_state(c->pipeline,GST_STATE_PLAYING);
-    return c;
-}
-FC_API int fc_capture_pull(Capture *c,Encoded *out) {
-    if(c->mapped) {gst_buffer_unmap(gst_sample_get_buffer(c->sample),&c->map);c->mapped=0;}
-    if(c->sample){gst_sample_unref(c->sample);c->sample=NULL;}
-    GstBus *bus=gst_element_get_bus(c->pipeline);
-    GstMessage *m=gst_bus_pop_filtered(bus,GST_MESSAGE_ERROR);gst_object_unref(bus);
-    if(m) {
-        if(GST_MESSAGE_TYPE(m)==GST_MESSAGE_ERROR) {
-            GError *e=NULL;char *debug=NULL;gst_message_parse_error(m,&e,&debug);
-            g_strlcpy(c->error,e->message,sizeof(c->error));g_error_free(e);g_free(debug);
-        } else g_strlcpy(c->error,"The capture source closed",sizeof(c->error));
-        gst_message_unref(m);return -1;
-    }
-    c->sample=gst_app_sink_try_pull_sample(GST_APP_SINK(c->sink),100*GST_MSECOND);
-    if(!c->sample) {
-        if(gst_app_sink_is_eos(GST_APP_SINK(c->sink))) {
-            g_strlcpy(c->error,"The capture source closed",sizeof(c->error));return -1;
-        }
-        return 0;
-    }
-    GstBuffer *b=gst_sample_get_buffer(c->sample);
-    if(!gst_buffer_map(b,&c->map,GST_MAP_READ))return 0;
-    c->mapped=1;out->data=c->map.data;out->size=(int)c->map.size;
-    out->key=!GST_BUFFER_FLAG_IS_SET(b,GST_BUFFER_FLAG_DELTA_UNIT);out->pts=(int64_t)GST_BUFFER_PTS(b);
-    const GstStructure *s=gst_caps_get_structure(gst_sample_get_caps(c->sample),0);
-    gst_structure_get_int(s,"width",&out->width);gst_structure_get_int(s,"height",&out->height);return 1;
-}
-FC_API const char *fc_capture_error(Capture *c) {return c->error;}
-FC_API void fc_capture_bitrate(Capture *c,int bps) {
-    g_object_set(c->encoder,"bitrate",(guint)MAX(1,bps/1000),NULL);
-}
-FC_API void fc_capture_test(Capture *c,uint32_t input) {
-    GstElement *source=gst_bin_get_by_name(GST_BIN(c->pipeline),"source");
-    if(source) {
-        /* Each benchmark click visibly changes the ball, before injection is
-         * timestamped. This is a response, not merely a protocol input echo. */
-        guint color=0xff000000u | ((input*2654435761u)&0x00ffffffu);
-        g_object_set(source,"foreground-color",color,NULL);gst_object_unref(source);
-    }
-}
-FC_API void fc_capture_key(Capture *c) {
-    GstPad *p=gst_element_get_static_pad(c->encoder,"src");
-    gst_pad_send_event(p,gst_video_event_new_upstream_force_key_unit(GST_CLOCK_TIME_NONE,TRUE,0));gst_object_unref(p);
-}
-FC_API void fc_capture_close(Capture *c) {
-    gst_element_set_state(c->pipeline,GST_STATE_NULL);
-    if(c->mapped)gst_buffer_unmap(gst_sample_get_buffer(c->sample),&c->map);
-    if(c->sample)gst_sample_unref(c->sample);
-    if(c->raw_queue)gst_object_unref(c->raw_queue);
-    gst_object_unref(c->sink);gst_object_unref(c->encoder);gst_object_unref(c->pipeline);g_free(c);
-}

desktop/controller.c

@@ -1,130 +0,0 @@
-/* A C port of the Mac agent's RateController (mac/frame-mac-view/Sources/
- * Controller.swift) for the Windows host. Same gate, demand protection, bitrate
- * recovery and tier hysteresis; bounded sample buffers. The Mac agent keeps its
- * Swift original, so a change to either must be made to both:
- * tests/test_pc_controller.py checks this one against the Swift trace. */
-#include "controller.h"
-#include <stdlib.h>
-#include <string.h>
-#define CAP 1024
-#define MIN(a,b) ((a)<(b)?(a):(b))
-#define MAX(a,b) ((a)>(b)?(a):(b))
-typedef struct { int64_t t, v; uint32_t seq; } Sample;
-typedef struct { Sample a[CAP]; int n; } Samples;
-struct FCController {
-    int max_fps, enabled, ceiling, target, tier, frame_bytes, held, signal, saw_ack;
-    int64_t decrease, increase, below, above, slack;
-    Samples flight, rtts, acked, sent, captures;
-};
-static const int fps[] = {60,45,30,30,30}, scale[] = {100,100,100,75,50};
-static const double floors[] = {.45,.28,.16,.08,0};
-static void remove_first(Samples *s, int n) {
-    s->n -= n; memmove(s->a, s->a+n, (size_t)s->n*sizeof(Sample));
-}
-static void add(Samples *s, Sample v, int cap) {
-    if (s->n >= cap) remove_first(s, 1);
-    s->a[s->n++] = v;
-}
-static void expire(Samples *s, int64_t oldest) {
-    int n=0; while(n<s->n && s->a[n].t<oldest) n++;
-    remove_first(s,n);
-}
-static int64_t base(FCController *c) {
-    int64_t v=0;
-    for(int i=0;i<c->rtts.n;i++) if(!i || c->rtts.a[i].v<v) v=c->rtts.a[i].v;
-    return v;
-}
-static int compare(const void *a, const void *b) {
-    int64_t x=*(const int64_t*)a, y=*(const int64_t*)b;
-    return (x>y)-(x<y);
-}
-static int64_t quantile(Samples *s,int64_t since,int numerator,int denominator) {
-    int64_t a[CAP]; int n=0;
-    for(int i=0;i<s->n;i++) if(s->a[i].t>since) a[n++]=s->a[i].v;
-    if(!n) return 0;
-    qsort(a,(size_t)n,sizeof(int64_t),compare);
-    return a[n*numerator/denominator];
-}
-static int rate(Samples *s) {
-    int64_t total=0; for(int i=0;i<s->n;i++) total+=s->a[i].v;
-    return (int)MIN(total*16,2147483647);
-}
-FCController *fc_new(int max_fps,int enabled) {
-    FCController *c=calloc(1,sizeof(*c));
-    if(c) {c->max_fps=MAX(1,max_fps);c->enabled=enabled;c->slack=40000;}
-    return c;
-}
-void fc_free(FCController *c) {free(c);}
-void fc_ceiling(FCController *c,int bps) {
-    if(!c->target || c->target>bps) c->target=bps;
-    c->ceiling=bps;
-}
-int fc_gate(FCController *c,int64_t now,int counts) {
-    if(!c->enabled || !c->saw_ack) return 1;
-    expire(&c->flight,now-2000000);
-    if(!c->flight.n) return 1;
-    int64_t interval=1000000/MIN(c->max_fps,fps[c->tier]);
-    int window=MAX(3,(int)((base(c)+c->slack)/interval)+1);
-    if(c->flight.n<window && now-c->flight.a[0].t<=base(c)+c->slack) return 1;
-    if(counts) c->held++;
-    return 0;
-}
-void fc_capture(FCController *c,int64_t now) {add(&c->captures,(Sample){now,0,0},256);}
-void fc_sent(FCController *c,uint32_t seq,int bytes,int64_t now) {
-    Sample s={now,bytes,seq};add(&c->flight,s,512);add(&c->sent,s,CAP);
-}
-int fc_ack(FCController *c,uint32_t seq,int64_t now) {
-    c->saw_ack=1;
-    for(int i=0;i<c->flight.n;i++) if(c->flight.a[i].seq==seq) {
-        Sample s=c->flight.a[i];remove_first(&c->flight,i+1);
-        add(&c->rtts,(Sample){now,now-s.t,0},CAP);
-        add(&c->acked,(Sample){now,s.v,0},CAP);return 1;
-    }
-    return 0;
-}
-int fc_update(FCController *c,int64_t now) {
-    expire(&c->rtts,now-10000000);expire(&c->acked,now-500000);
-    expire(&c->sent,now-500000);expire(&c->flight,now-2000000);
-    expire(&c->captures,now-1000000);
-    if(!c->enabled || c->ceiling<=0) return 0;
-    int64_t baseline=base(c), spread=quantile(&c->rtts,now-2000000,9,10);
-    int64_t jitter=spread ? spread-baseline : 0;
-    c->slack=1000000/MIN(c->max_fps,fps[c->tier])+MIN(MAX(jitter*3/2,25000),80000);
-    int64_t recent=quantile(&c->rtts,now-300000,1,2);
-    int64_t queue=recent ? recent-baseline : 0;
-    int64_t age=c->flight.n ? now-c->flight.a[0].t : 0;
-    int delivered=rate(&c->acked),sending=rate(&c->sent);
-    if(c->sent.n) c->frame_bytes=sending/16/c->sent.n;
-    int demand=(int)MIN((int64_t)MIN(c->captures.n,MIN(c->max_fps,fps[c->tier]))*c->frame_bytes*8,2147483647);
-    int signal=(sending>=c->target/2 && queue>40000)||c->held>=3||age>baseline+100000;
-    int congested=signal && c->signal;c->signal=signal;c->held=0;
-    if(congested && now-c->decrease>300000) {
-        int next=MAX(300000,MIN((int64_t)c->target*4/5,MAX((int64_t)delivered*9/10,c->target/2)));
-        if(demand>0 && (int64_t)demand*2<=(int64_t)c->target*5/4) next=MAX(next,MIN(c->target,(int64_t)demand*2));
-        c->target=next;c->decrease=now;
-    } else if(!congested && now-c->decrease>1000000 && now-c->increase>250000 && c->target<c->ceiling &&
-              (sending>(int64_t)c->target*6/10 || now-c->decrease>3000000)) {
-        c->target=MIN(c->ceiling,(int64_t)(c->target*1.1)+50000);c->increase=now;
-    }
-    double share=(double)c->target/MAX(c->ceiling,1);
-    if(c->tier<4 && share<floors[c->tier] && sending>=(int64_t)c->target*7/10) {
-        if(!c->below)c->below=now;
-        if(now-c->below>500000) {
-            for(c->tier=0;c->tier<4 && share<floors[c->tier];c->tier++) {}
-            c->below=0;
-        }
-    } else c->below=0;
-    if(c->tier>0 && share>floors[c->tier-1]*1.25) {
-        if(!c->above)c->above=now;
-        if(now-c->above>2000000) {c->tier--;c->above=0;}
-    } else c->above=0;
-    return c->target;
-}
-int64_t fc_value(FCController *c,int field) {
-    switch(field) {
-    case 0:return c->target;case 1:return c->ceiling;case 2:return c->tier;
-    case 3:return MIN(c->max_fps,fps[c->tier]);case 4:return scale[c->tier];
-    case 5:return base(c);case 6:return c->flight.n;case 7:return c->slack;
-    default:return 0;
-    }
-}

desktop/controller.h

@@ -1,29 +0,0 @@
-/* Shared latency controller. Times are monotonic host microseconds.
- * Callers serialize access. Capture is gated BEFORE encoding: dropping an
- * encoded inter frame would break the decoder's reference chain. */
-#ifndef FRAME_CONTROLLER_H
-#define FRAME_CONTROLLER_H
-#include <stdint.h>
-#ifdef _WIN32
-#define FC_API __declspec(dllexport)
-#else
-#define FC_API
-#endif
-#ifdef __cplusplus
-extern "C" {
-#endif
-typedef struct FCController FCController;
-FC_API FCController *fc_new(int fps, int enabled);
-FC_API void fc_free(FCController *c);
-FC_API void fc_ceiling(FCController *c, int bps);
-FC_API int fc_gate(FCController *c, int64_t now, int counts);
-FC_API void fc_capture(FCController *c, int64_t now);
-FC_API void fc_sent(FCController *c, uint32_t seq, int bytes, int64_t now);
-FC_API int fc_ack(FCController *c, uint32_t seq, int64_t now);
-FC_API int fc_update(FCController *c, int64_t now);
-/* target, ceiling, tier, fps, scale percent, baseline us, in flight, slack us */
-FC_API int64_t fc_value(FCController *c, int field);
-#ifdef __cplusplus
-}
-#endif
-#endif

desktop/portal.c

@@ -1,147 +0,0 @@
-/* xdg-desktop-portal RemoteDesktop + ScreenCast, one consented session per
- * panel. PipeWire receives the portal fd, never the unrestricted daemon fd.
- * Input uses only the devices granted in Start's response. */
-#ifndef _WIN32
-#include "controller.h"
-#include <gio/gio.h>
-#include <gio/gunixfdlist.h>
-#include <unistd.h>
-#include <string.h>
-#define BUS "org.freedesktop.portal.Desktop"
-#define PATH "/org/freedesktop/portal/desktop"
-#define RD "org.freedesktop.portal.RemoteDesktop"
-#define SC "org.freedesktop.portal.ScreenCast"
-typedef struct {
-    GDBusConnection *bus;
-    GMainContext *context;
-    char *session;
-    int fd;
-    unsigned node, devices;
-    int width,height;
-} Portal;
-typedef struct {GVariant *result;int done;unsigned code;} Response;
-static void response(GDBusConnection *c,const char *sender,const char *path,const char *iface,
-                     const char *signal,GVariant *params,gpointer data) {
-    (void)c;(void)sender;(void)path;(void)iface;(void)signal;
-    Response *r=data;g_variant_get(params,"(u@a{sv})",&r->code,&r->result);r->done=1;
-}
-static void option(GVariantBuilder *b,const char *key,GVariant *v) {g_variant_builder_add(b,"{sv}",key,v);}
-static GVariant *request(Portal *p,const char *iface,const char *method,GVariant *args,
-                         const char *token,char *error,int capacity) {
-    char *sender=g_strdup(g_dbus_connection_get_unique_name(p->bus)+1);
-    for(char *c=sender;*c;c++)if(*c=='.')*c='_';
-    char *path=g_strdup_printf(PATH "/request/%s/%s",sender,token);g_free(sender);
-    Response r={0};GError *e=NULL;
-    guint sub=g_dbus_connection_signal_subscribe(p->bus,BUS,"org.freedesktop.portal.Request","Response",
-                                                 path,NULL,G_DBUS_SIGNAL_FLAGS_NONE,response,&r,NULL);
-    GVariant *reply=g_dbus_connection_call_sync(p->bus,BUS,PATH,iface,method,args,G_VARIANT_TYPE("(o)"),
-                                               G_DBUS_CALL_FLAGS_NONE,10000,NULL,&e);
-    if(reply)g_variant_unref(reply);
-    int64_t deadline=g_get_monotonic_time()+120000000;
-    while(!e && !r.done && g_get_monotonic_time()<deadline) {
-        while(g_main_context_iteration(p->context,FALSE)) {}
-        g_usleep(10000);
-    }
-    if(!r.done) {
-        GVariant *closed=g_dbus_connection_call_sync(p->bus,BUS,path,"org.freedesktop.portal.Request","Close",
-                                NULL,NULL,G_DBUS_CALL_FLAGS_NONE,2000,NULL,NULL);
-        if(closed)g_variant_unref(closed);
-    }
-    g_dbus_connection_signal_unsubscribe(p->bus,sub);g_free(path);
-    if(e || !r.done || r.code) {
-        g_strlcpy(error,e?e->message:!r.done?"Screen sharing request timed out":"Screen sharing was cancelled or refused",capacity);
-        if(e)g_error_free(e);if(r.result)g_variant_unref(r.result);return NULL;
-    }
-    return r.result;
-}
-FC_API void fc_portal_close(Portal *p) {
-    if(!p)return;
-    if(p->session && p->bus) {
-        GVariant *r=g_dbus_connection_call_sync(p->bus,BUS,p->session,"org.freedesktop.portal.Session","Close",
-                                                NULL,NULL,G_DBUS_CALL_FLAGS_NONE,2000,NULL,NULL);
-        if(r)g_variant_unref(r);
-    }
-    if(p->fd>=0){close(p->fd);p->fd=-1;}
-    g_free(p->session);if(p->bus)g_object_unref(p->bus);
-    if(p->context)g_main_context_unref(p->context);g_free(p);
-}
-/* Each pipeline gets a fresh restricted PipeWire connection. A dup of a
- * previously consumed protocol socket is not a new connection.
- * Ownership: the Portal owns p->fd for its whole life and is its only closer.
- * pipewiresrc never takes the fd it is given: its core connects with
- * pw_context_connect_fd(ctx, fcntl(fd, F_DUPFD_CLOEXEC, 3), ...) and that
- * duplicate is what PipeWire closes on teardown (src/gst/gstpipewirecore.c,
- * unchanged from 0.3.19 through 1.x). So closing p->fd here is not a double
- * close; not closing it would leak one socket per pipeline reopen. The
- * caller closes the previous pipeline before asking for a new fd. */
-FC_API int fc_portal_refresh(Portal *p,char *error,int capacity) {
-    GVariantBuilder b;g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    GUnixFDList *fds=NULL;GError *e=NULL;
-    GVariant *r=g_dbus_connection_call_with_unix_fd_list_sync(p->bus,BUS,PATH,SC,"OpenPipeWireRemote",
-         g_variant_new("(oa{sv})",p->session,&b),G_VARIANT_TYPE("(h)"),G_DBUS_CALL_FLAGS_NONE,10000,NULL,&fds,NULL,&e);
-    if(!r){g_strlcpy(error,e->message,capacity);g_error_free(e);return -1;}
-    int handle;g_variant_get(r,"(h)",&handle);g_variant_unref(r);
-    int fd=g_unix_fd_list_get(fds,handle,&e);g_object_unref(fds);
-    if(fd<0){g_strlcpy(error,e->message,capacity);g_error_free(e);return -1;}
-    if(p->fd>=0)close(p->fd);
-    p->fd=fd;return fd;
-}
-FC_API Portal *fc_portal_select(char *error,int capacity) {
-    Portal *p=g_new0(Portal,1);p->fd=-1;p->context=g_main_context_new();
-    g_main_context_push_thread_default(p->context);
-    GError *e=NULL;GVariant *r=NULL;
-    p->bus=g_bus_get_sync(G_BUS_TYPE_SESSION,NULL,&e);
-    if(!p->bus) {g_strlcpy(error,e->message,capacity);g_error_free(e);goto fail;}
-    GVariantBuilder b;char token[64],session[64];
-    g_snprintf(session,sizeof(session),"fc_%u",g_random_int());
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());
-    g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"session_handle_token",g_variant_new_string(session));
-    r=request(p,RD,"CreateSession",g_variant_new("(a{sv})",&b),token,error,capacity);if(!r)goto fail;
-    g_variant_lookup(r,"session_handle","s",&p->session);g_variant_unref(r);r=NULL;
-    if(!p->session){g_strlcpy(error,"Portal did not return a session",capacity);goto fail;}
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"types",g_variant_new_uint32(3));
-    r=request(p,RD,"SelectDevices",g_variant_new("(oa{sv})",p->session,&b),token,error,capacity);if(!r)goto fail;g_variant_unref(r);
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));option(&b,"types",g_variant_new_uint32(3));
-    option(&b,"multiple",g_variant_new_boolean(FALSE));option(&b,"cursor_mode",g_variant_new_uint32(2));
-    r=request(p,SC,"SelectSources",g_variant_new("(oa{sv})",p->session,&b),token,error,capacity);if(!r)goto fail;g_variant_unref(r);
-    g_snprintf(token,sizeof(token),"fc_%u",g_random_int());g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    option(&b,"handle_token",g_variant_new_string(token));
-    r=request(p,RD,"Start",g_variant_new("(osa{sv})",p->session,"",&b),token,error,capacity);if(!r)goto fail;
-    g_variant_lookup(r,"devices","u",&p->devices);
-    GVariant *streams=g_variant_lookup_value(r,"streams",G_VARIANT_TYPE("a(ua{sv})"));
-    if(streams && g_variant_n_children(streams)>0) {
-        GVariant *entry=g_variant_get_child_value(streams,0),*props=NULL;
-        g_variant_get(entry,"(u@a{sv})",&p->node,&props);
-        g_variant_lookup(props,"size","(ii)",&p->width,&p->height);
-        g_variant_unref(props);g_variant_unref(entry);
-    }
-    if(streams)g_variant_unref(streams);g_variant_unref(r);r=NULL;
-    if(!p->node || p->width<=0 || p->height<=0) {g_strlcpy(error,"Portal returned no stream size",capacity);goto fail;}
-    if(fc_portal_refresh(p,error,capacity)<0)goto fail;
-    g_main_context_pop_thread_default(p->context);return p;
-fail:
-    g_main_context_pop_thread_default(p->context);fc_portal_close(p);return NULL;
-}
-FC_API int fc_portal_value(Portal *p,int field) {
-    switch(field){case 0:return p->fd;case 1:return (int)p->node;case 2:return p->width;
-                 case 3:return p->height;case 4:return (int)p->devices;default:return 0;}
-}
-FC_API int fc_portal_input(Portal *p,int type,double x,double y,int code,int down) {
-    const char *method=NULL;GVariant *args=NULL;GVariantBuilder b;g_variant_builder_init(&b,G_VARIANT_TYPE_VARDICT);
-    if(type==0 && (p->devices&2)) {
-        method="NotifyPointerMotionAbsolute";args=g_variant_new("(oa{sv}udd)",p->session,&b,p->node,x,y);
-    } else if(type==1 && (p->devices&2)) {
-        method="NotifyPointerButton";args=g_variant_new("(oa{sv}iu)",p->session,&b,code,(guint)down);
-    } else if(type==2 && (p->devices&2)) {
-        method="NotifyPointerAxis";args=g_variant_new("(oa{sv}dd)",p->session,&b,x,y);
-    } else if(type==3 && (p->devices&1)) {
-        method="NotifyKeyboardKeysym";args=g_variant_new("(oa{sv}iu)",p->session,&b,code,(guint)down);
-    } else return 0;
-    GError *e=NULL;GVariant *r=g_dbus_connection_call_sync(p->bus,BUS,PATH,RD,method,args,NULL,
-                                                       G_DBUS_CALL_FLAGS_NONE,2000,NULL,&e);
-    if(e)g_error_free(e);if(r)g_variant_unref(r);return r!=NULL;
-}
-#endif

docs/agents.md

@@ -97,7 +97,7 @@ replies, screenshots and approval payloads are not sent to analytics.
 
 ## Assistant panel
 
-Open **Settings** (the gear in the header) **→ Open assistant settings**, or `http://127.0.0.1:47810/assistant`.
+Open **Tools → Open assistant**, or `http://127.0.0.1:47810/assistant`.
 To put the same page in the headset, with the HTTP server still running:
 
 ```sh
@@ -168,43 +168,6 @@ on this branch (run 36421345682).
 **Verified on the same Frame/build:** both Ctrl-C and SIGTERM close the dedicated
 browser profile and SSH tunnel and remove the profile and panel log.
 
-**Verified end to end on the same Frame/build (2026-09-29), with mutations:**
-a stdio MCP client started `ui/frame_mcp.py` in its default mode (private
-backend, no API key, no prestarted server) and a human approved or rejected
-each change in the approval page in a real Chrome window:
-
-| Tool | Result on the Frame |
-|---|---|
-| `send_file` | Approved; the file arrived in `~/Downloads` with identical contents |
-| `install` | Approved; `io.github.fizzyizzy05.binary` job finished in about 35 s |
-| `panel` | Approved; gamescope listed a new panel window, and `computer_state` reported the same window ID and PID. The app rendered in that window (below) |
-| `launch` | Approved; Keep Talking and Nobody Explodes (341800) started under Proton and `computer_state` reported it as the focused app |
-| `uninstall` | Approved; app and locale removed |
-| `power` | Rejected in the page. Unapproved retries, the same token used for `uninstall`, and a retry after rejection were all refused. Nothing was powered off |
-| `send_text` | Approved, then refused because the Plasma desktop was not open (documented requirement) |
-| `keep_awake` | `status` reports the script unavailable until PR #16 lands |
-
-A separate Claude Code CLI session, with only this server configured, read
-status, `computer_state` and a headset capture, and requested an install. It
-received an approval URL and did not execute anything.
-
-The assistant opened as a Frame panel through `scripts/assistant-on-frame.py`.
-Against a loopback stub model, a send without consent made zero requests. With
-consent it made exactly one, carrying the text and a fresh Frame screenshot.
-Consent unticked itself after sending. SIGTERM removed the panel, profile, log
-and tunnel.
-
-**Not verified while unworn:** every headset capture was a uniform dark frame,
-so SteamVR's rendered view of panels and the game could not be checked; window
-captures (`xwd`) were used instead. MCP can launch a game or panel but has no
-tool to stop one: the tester stopped them over SSH. Removing an app leaves any
-runtime it pulled in; Flatpak may also remove related extensions when that
-runtime is removed by hand.
-
-![Approval page showing the exact install action](img/mcp-approval-install.png)
-
-![The installed Flatpak rendering in its own gamescope panel window](img/mcp-panel-binary.png)
-
 ![Assistant in Frame Chromium, after an opted-in request to the local test endpoint](img/assistant-panel.png)
 
 ## Computer-use coverage

docs/android-backups.md

@@ -1,57 +0,0 @@
-# Import an Android game backup
-
-A SideQuest backup can contain a small APK and much larger `main.…obb` and
-`patch.…obb` files. All of them belong to the same game. Installing only the APK
-can leave the game unable to start because its assets are missing.
-
-In **Add / Install → Import Android game** (or **Apps → Browse → Import Android game**), choose the APK and its OBB files together.
-You can also drop them anywhere in the window. In the desktop app, dropping the
-APK alone finds matching OBB files beside it; dropping a folder containing the
-APK and OBBs also works. Browsers can read only the files you explicitly choose.
-
-The import screen shows the game app and its game-data files together. **Import
-game & data** installs the APK, starts its own Steam library instance, waits for
-Android and the installed package, copies the OBBs, and closes the game. Open it
-again from the Steam library to play. The screen explains this before import;
-choosing files alone never starts a game.
-
-Files are matched using the package inside the APK and the standard
-`main|patch.<version>.<package>.obb` name, not the APK's filename. Both main and
-patch files are preserved. OBB version numbers need not equal the APK's current
-version code: updates can reuse older expansion files. The copy uses the existing
-SHA-256 transfer check inside Android and writes to that game's own
-`/sdcard/Android/obb/<package>` folder.
-
-If no data files are selected, the screen reminds you to include any OBBs in the
-backup before offering **Install game app**. An APK cannot reliably tell Frame
-Control whether separate expansion files are required. Game-data files are never
-silently sent to Downloads by this flow.
-
-If setup fails, the import screen keeps the error and retry instructions visible.
-The APK may already be installed, but the game is not reported ready. Import the
-same backup again, or choose just its OBB files to add data to an existing install.
-The importer checks the installed package and version before writing data and
-closes the instance after a failed copy. Unrelated or duplicate files, running
-games that would be replaced, and downgrades are rejected. Uploaded staging files
-are discarded after use or cancellation; abandoned imports expire after an hour
-when the importer is next used, and dead-server staging folders are swept at
-startup.
-
-This flow handles one ordinary APK and standard OBB files for one game at a time.
-Split APKs, XAPK/APKS archives, nested Android/data folders and private save
-archives need their own import handling. PC ZIP/folder/EXE imports keep their
-existing route. Quest USB and Meta library imports keep their existing workflow.
-
-Validation covers actual APK parsing, the three-file backup layout, package
-matching, sibling discovery, browser upload staging and cleanup, instance/version
-guards and failure recovery with mocked headset operations. Browser verification
-uses the real page and upload/inspection endpoints with simulated installation.
-**Verified 2026-10-20 on a real Steam Frame**, BUILD_ID `20260925.6191901`:
-F-Droid Basic 2.0.2 with two synthetic main/patch OBBs completed the automatic
-install/start/copy/close sequence. Reopening its persistent instance confirmed
-both SHA-256 hashes in `/sdcard/Android/obb/org.fdroid.basic`. The test app,
-shortcut and instance were removed afterward, the shared device lock was
-released, and the battery remained at 99%. See [device evidence](evidence/android-import/device.json).
-The headset was unworn; this checks transfer and persistence, not rendering,
-Resident Evil 4 gameplay, or a game that exits before data can be copied. This
-flow does not change APK compatibility or remove licence checks.

docs/apk-repos.md

@@ -1,197 +0,0 @@
-# APK repositories
-
-Frame Control supports **F-Droid-format repositories**, including F-Droid,
-F-Droid archive, IzzyOnDroid and user-provided HTTPS repositories. Repository
-indexes are authenticated before their apps appear. Search lists builds with
-Android API ≤30 and arm64-v8a or no native libraries, using the same streaming
-reducer as the existing catalogue. This does not guarantee an app works in Lepton.
-
-## Formats considered
-
-| Format | Users and purpose | Support in this source |
-|---|---|---|
-| F-Droid v2 | F-Droid, IzzyOnDroid, self-hosted fdroidserver repositories; consumed by F-Droid clients including Droid-ify and Neo Store | Preferred: signed `entry.jar` authenticates `entry.json`; its SHA-256 authenticates `index-v2.json`, which supplies APK SHA-256 hashes |
-| F-Droid v1 | Older F-Droid servers and clients | Fallback: verify `index-v1.jar`, then read its signed `index-v1.json` |
-| Obtainium configurations / exports | Obtainium users share app URLs plus source-specific filters and update settings; exports can contain a list of app configuration objects | Not imported here: configurations describe how to find releases, not one signed repository index |
-| SideQuest listings / custom feeds | SideQuest's own app discovery and installation service | No interoperable signed custom-repository specification was established from the public project documentation examined; SideQuest needs its own adapter |
-| GitHub release lists | Developers publish APK assets on release pages; community lists link to projects | Not a repository standard: asset naming, build selection and publisher verification vary; handled separately from this F-Droid source |
-| Minimal JSON list | A private list could contain package, title, APK URL and SHA-256 | Deliberately not introduced: unsigned hashes downloaded alongside files do not authenticate their publisher; another bespoke signing/update protocol would duplicate F-Droid |
-
-Research references (checked 2026-09-28):
-
-- [F-Droid APIs](https://f-droid.org/docs/All_our_APIs/) and
-  [repository setup](https://f-droid.org/docs/Setup_an_F-Droid_App_Repo/).
-- [F-Droid signing keys](https://f-droid.org/docs/Release_Channels_and_Signing_Keys/)
-  and [IzzyOnDroid's repository page and fingerprint](https://apt.izzysoft.de/fdroid/).
-- [Droid-ify](https://github.com/Droid-ify/client) and
-  [Neo Store](https://github.com/NeoApplications/Neo-Store).
-- [Obtainium](https://github.com/ImranR98/Obtainium), its
-  [configuration/deep-link format](https://wiki.obtainium.imranr.dev/deep_links/),
-  and [community app configurations](https://apps.obtainium.imranr.dev/).
-- [SideQuest's public client](https://github.com/SideQuestVR/SideQuest).
-  The absence of a specification in these materials is not proof that no
-  historical or private custom-feed format exists.
-
-## Add a repository in Frame Control
-
-From the Frame Control checkout, use its source-management CLI:
-
-```sh
-python3 ui/apk_sources/fdroid.py add 'https://example.org/fdroid/repo?fingerprint=YOUR_64_HEX_CERTIFICATE_FINGERPRINT' --name 'My apps'
-python3 ui/apk_sources/fdroid.py list
-python3 ui/apk_sources/fdroid.py search SOURCE_ID 'music'
-python3 ui/apk_sources/fdroid.py download SOURCE_ID org.example.app
-python3 ui/apk_sources/fdroid.py remove SOURCE_ID
-```
-
-Replace `SOURCE_ID` with the `id` printed by `add` or `list`. `--fingerprint`
-can also supply the pin. `fdroidrepos://example.org/fdroid/repo?fingerprint=…`
-links are accepted and converted to HTTPS. Conflicting fingerprints are refused.
-A URL must identify the repository directory, not its website or an index file.
-
-Adding fetches and validates the complete index **before saving** the source.
-Without a fingerprint, Frame Control verifies the JAR signature and remembers
-its signer: trust on first use (TOFU). This establishes continuity with the
-first server response, not independent publisher identity. Obtain the published
-fingerprint through a trusted channel when possible; the store's Add a source
-form shows the pinned one ("Trusted on first use: …") so you can compare it.
-Re-adding an existing URL preserves its pin; changing it requires deliberately
-removing and re-adding it.
-
-### Repositories behind a login
-
-Some self-hosted repositories sit behind HTTP basic auth. As in F-Droid's own
-client, the login can be part of the address
-(`https://user:pass@example.org/fdroid/repo`), or given separately: in the
-store's **Add a source** form under "This repository needs a login", in the
-server API (`username` and `password` beside `url`), or on the command line,
-where the password is read from standard input so it stays out of shell history
-and `ps`:
-
-```sh
-printf '%s\n' "$PASSWORD" | python3 ui/apk_sources/fdroid.py add 'https://example.org/fdroid/repo' --username me --password-stdin
-```
-
-How the login is kept and used:
-
-- **Kept out of the address.** The `user:pass@` part is removed before anything
-  is saved, so the saved repository URL, its id, the source list, job results
-  and the page never contain it. The store only says "Uses a login".
-- **Stored separately.** Logins live in
-  `frame_host.data_dir('source-credentials.json')`
-  (`~/Library/Application Support/Frame Control/source-credentials.json` on
-  macOS), written with mode 0600 and keyed by source id. They are stored in
-  plain text there, protected by file permissions only (on Windows,
-  the folder's normal ACLs). Removing the repository deletes its login, and
-  the file goes when the last login is removed. Each change holds a lock
-  file (`source-credentials.lock`), so the app and the command line can't undo
-  each other's saves or removals.
-- **HTTPS only.** An `http://` address with a login is refused before any request.
-- **Inside the repository only.** The `Authorization` header is decided
-  separately for every request, redirects included: index, `entry.jar`,
-  APKs and the store's artwork proxy. It is sent only when the request's
-  scheme, host and port match the repository's and its path is inside the
-  repository's directory by whole path segments. A redirect to another host
-  or port, or to another path on the same server, gets no login, and that
-  request's own `Authorization` header is removed. Paths with `.` or `..`
-  segments (plain or percent-encoded), encoded `/` or `\`, double encoding
-  or `;` get no login, since a server could normalise them to a path
-  outside the repository. Index file names like that are refused outright.
-- **Never echoed.** Logins are not written to logs, error messages, API
-  responses or the cache. The CLI prints only the saved source.
-- **Checked before saving.** As with any repository, the whole index must
-  download and verify before anything is saved. HTTP 401 (or 403 when a login
-  was sent) stops the add with "check the username and password" and saves
-  nothing: no repository, no login, no rollback state. A 403 with a login is
-  not treated as rate limiting.
-- **Same verification.** The login changes only who may download. Signature,
-  fingerprint pin or TOFU, index hash and rollback checks apply exactly as for
-  any other repository.
-
-Re-adding the same address with a new login replaces the saved one. Re-adding
-it without a login keeps the saved one.
-
-The API for the search/server integration is in `ui/apk_sources/fdroid.py`:
-`add_repo(url, fingerprint=None, name=None, username=None, password=None)`, `remove_repo(source_id)`,
-`set_enabled(source_id, enabled)`, and `user_repos()`. The module also exposes
-`sources`, `search`, `details`, and `download` from the shared source contract.
-This change supplies the CLI and API; the integrated source-management UI is
-separate work. Built-in sources can be disabled but cannot be removed.
-
-Settings and pins live in `frame_host.data_dir('apk-repos.json')`
-(`~/Library/Application Support/Frame Control/apk-repos.json` on macOS).
-Authenticated reduced indexes and APKs live under
-`frame_host.cache_dir('apk-sources')`; indexes refresh after 24 hours. An
-expired index is still served (marked stale in the store) while it refreshes in
-the background; a failed refresh is retried after 10 minutes.
-Only the running Frame Control app prunes cached APKs (at start and after store
-downloads); the command-line tools never do.
-The existing catalogue's unverified index cache is never treated as authenticated.
-
-Rollback protection: each repository's newest accepted signed index timestamp
-is kept in `apk-repo-state.json` next to the settings, and an older index is
-refused. Once a repository has served a v2 `entry.jar`, a missing `entry.jar`
-is an error rather than a reason to fall back to `index-v1.jar`. `entry.jar`
-must be signed with SHA-2 (SHA-1 is still accepted for legacy `index-v1.jar`).
-Removing a repository clears its state.
-
-## Publish your own repository
-
-Only publish free APKs you own or have the developer's permission to distribute.
-Do not publish paid app mirrors or bypass store licences. Check distribution
-terms before adding someone else's repository; this module does not infer legal
-permission from a signature or automatically audit a repository's terms.
-
-Install a current [fdroidserver](https://f-droid.org/docs/Installing_the_Server_and_Repo_Tools/)
-and its documented Android/Java dependencies on the publishing machine, then:
-
-```sh
-mkdir my-fdroid
-cd my-fdroid
-fdroid init
-# Set repo_url in config.yml to https://example.org/fdroid/repo
-# Also set repo_name and repo_description; keep the generated signing key safe.
-cp /path/to/your-free-app.apk repo/
-fdroid update --create-metadata
-# Review the generated metadata (name, summary, licence, source and website).
-fdroid update
-```
-
-Serve the generated **repo directory** at that HTTPS URL, including APKs,
-icons, `entry.jar`, `index-v2.json` and `index-v1.jar`. Do not publish the
-private signing keystore or configuration passwords. Configure fdroidserver's
-`serverwebroot` and run `fdroid deploy` for managed publication, or copy the
-public directory with your existing deployment tool. Publish the SHA-256
-repository certificate fingerprint displayed by fdroidserver in a link such as
-`https://example.org/fdroid/repo?fingerprint=…`.
-
-Keep the repository signing key backed up: changing it breaks existing pins.
-For updates, add the new APK, edit metadata as needed, run `fdroid update` and
-publish again. Test the published URL with Frame Control's `add`, `search` and
-`download` commands. The above publisher setup is documented from fdroidserver;
-it was not executed as part of this implementation.
-
-## Verification and limits
-
-The stdlib verifier supports one RSA PKCS#1 v1.5 JAR/CMS signer with a key of
-2048–8192 bits; SHA-256/384/512 and legacy SHA-1 digest encodings are
-recognized. It checks the signer certificate pin, the signature over `.SF`,
-the whole-manifest digest, and the manifest's digest of the JSON member.
-ECDSA, DSA, RSA-PSS, multiple signers and section-only `.SF` manifests are
-rejected. Certificates are pinned identities, not validated as Web PKI chains.
-HTTPS certificates are separately checked by Python's normal TLS validation.
-
-v1 fallback occurs only when `entry.jar` returns HTTP 404 or 410. Signature,
-fingerprint, index hash, TLS and server errors never trigger an unsigned
-fallback. APKs are cached by SHA-256 and checked again before reuse. Here,
-`verified: true` means the bytes match the signed repository's APK hash; it
-is not an independent APK publisher-signature or runtime compatibility verdict.
-There is no repository timestamp rollback/expiry policy or automated signing-key
-rotation yet. An old correctly signed index can still validate.
-
-Offline fixtures exercise v2, v1, TOFU, pin changes, disabled sources, cache
-reuse, URL rejection and corruption of every signature/hash layer. On the Mac,
-the real IzzyOnDroid repository was added with its published pin, searched for
-Tiny Music Player, and its 16,520-byte APK downloaded with SHA-256
-`d7bcb24d101b04beb3394b695b24be4e2c3d6ed702f1d0e06bc4dd707f64d86a`.
-No headset connection or installation was performed.

docs/apk-sources.md

@@ -1,116 +0,0 @@
-# Developer-consented APK sources
-
-Surveyed 2026-09-28. Free access is not proof of redistribution permission or
-Frame compatibility. These adapters fetch only public publisher releases or
-link to publisher pages. They do not acquire store entitlements, defeat access
-checks, install anything, or rehost APKs. See [VR compatibility](vr-apks.md).
-
-| Source | Developer consent and automated-access position | API/feed; VR coverage | Decision |
-|---|---|---|---|
-| [itch.io](https://itch.io/docs/legal/terms) | Publishers warrant distribution rights (§4). Users may access content through the service; this is not blanket scraping permission. Main robots excludes `/game/download/`; author subdomains exclude `/*/download/`. No challenge bypass. | Public free Android RSS for `openxr` and `oculus-quest`; substantial indie VR. Server API is mostly authenticated publisher/account functionality, not a general anonymous store-download API. | Implement RSS search, artwork and page links; `downloadable: False`. The supplied free-download script follows keyed download pages excluded by robots, so it is not shipped. |
-| [GitHub releases](https://docs.github.com/en/rest/releases/releases) | Maintainers publish assets; curated repositories below establish provenance. Public hosting or an open-source topic alone does not establish rights to every uploaded binary. Use supported REST API under [API terms](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service#h-api-terms), not HTML crawling. | Releases API includes APK assets and sometimes SHA-256. Topic search finds OpenXR/Quest projects. 60 unauthenticated requests/hour; authenticated user limits are generally 5,000/hour, with separate search/secondary limits. | Implement curated downloads and explicit topic discovery. Unreviewed topic results are page-only. |
-| [Uptodown](https://www.uptodown.com/aboutus) | Developer distribution program exists, but that does not prove publisher authorization for every catalog item. [Privacy policy](https://www.uptodown.com/aboutus/privacy) explicitly describes protection against automated access. General automation permission was not established. | Broad Android catalog, limited VR focus; no supported public consumer-download API established in this survey. | Page links only; no downloader. Do not infer consent from an unchanged APK signature. |
-| [APKPure](https://apkpure.com/terms) | Third-party APK catalog; individual publisher consent and automation rights were not established. Terms request returned HTTP 403; no bypass attempted. | Broad Android coverage, incidental VR; internal endpoints are not permission to automate. | Exclude automatic indexing/downloading; user may open site. |
-| [APKMirror](https://www.apkmirror.com/faq/) | Publisher-signed files and a free-app policy are not a blanket developer-consent or automation grant. FAQ request returned HTTP 403, so current terms could not be confirmed. | General Android/version archive; APK bundles often need another installer; little VR focus. No supported consumer-download API established. | Page links only, no scraping or bundle conversion. |
-| [Aptoide](https://en.aptoide.com/company/legal) | Terms define an app supplier as developer, owner or authorized distributor; user stores still require per-item provenance. API availability alone does not settle third-party access rights. | API ecosystem and general Android catalog; weak VR focus. | Defer until a publisher-owned store and its API terms can be approved. No blanket community-store downloader. |
-| [Amazon Appstore](https://developer.amazon.com/docs/app-submission/understanding-submission.html) | Official developer submissions; store account, device and license rules apply. Publisher submission APIs do not authorize public binary extraction. | Fire-device distribution; Android-device Appstore support ended in 2025; little Quest relevance. | Official product links only; no account or entitlement extraction. |
-| [PICO / ByteDance store](https://developer.picoxr.com/document/distribute) | Official publisher channel with store/device entitlements. No public unauthenticated binary-download grant established; documentation request encountered a redirect error. | Strong standalone VR; PICO builds may depend on PICO services/extensions. | Store links only. A developer's independently published GitHub/itch build can qualify separately. |
-| [Meta Horizon Store / former App Lab](https://www.meta.com/experiences/) | Official developer submissions. A free store entitlement is still an entitlement; no license bypass or authenticated store extraction. App Lab was folded into the main store in 2024. | Strongest Quest coverage; no supported anonymous APK-download API established. | Store links only; independently distributed free builds use their publisher source. |
-| [Khronos samples](https://github.com/KhronosGroup/OpenXR-SDK-Source) | Official upstream, Apache-2.0 sample; developer-published release APKs. GitHub API terms apply. | `hello_xr` Vulkan/OpenGL ES APKs; excellent OpenXR diagnostics. | Included in GitHub curated list, Vulkan variant selected. |
-| [Meta OpenXR samples](https://github.com/meta-quest/Meta-OpenXR-SDK) | Official upstream; check each sample's license. Source availability does not imply a published APK, and some samples require Meta extensions/services. | Source/build examples, inconsistent ready-made APK releases. | Link to upstream; add specific free APKs only after release/provenance review. |
-| [Godot XR demos](https://github.com/GodotVR/godot-xr-tools) | Official project source and publisher demo pages; licenses and dependencies vary by demo. | OpenXR examples on GitHub/itch. Older Godot builds can fail on Lepton's missing clipboard service. | Covered by source discovery; no compatibility promise from an OpenXR tag. |
-
-The table distinguishes observed restrictions from unknown permission. An
-unverified policy is a reason to defer automation, not a claim that a site is
-unlawful. Only the two implemented source kinds are registered by their own
-`sources()` functions; the other rows are recommendations, not new UI entries.
-
-## Adapters
-
-`ui/apk_sources/github.py` uses `github_curated.json`: Khronos `hello_xr`,
-[Open Brush](https://github.com/icosa-foundation/open-brush), and
-[SuperTux 3D](https://github.com/SgtBilko76/SuperTux-3D). These have official
-OpenXR project/release evidence, not a blanket claim of headset compatibility.
-Open Brush's compatibility evidence is recorded in [vr-apks.md](vr-apks.md).
-Open Brush and SuperTux publish the selected builds as prereleases; curated
-opt-ins preserve that label in version records. Exact APK filename patterns
-avoid downloading desktop archives or alternate non-Quest builds.
-[OpenSaberPlus](https://github.com/arpruss/OpenSaberPlus) was examined but not
-curated: GitHub reports its license as `NOASSERTION`, and current OpenXR APK
-provenance was not established in this pass.
-
-Default GitHub search is offline against this small list. Queries
-`topic:openxr`, `topic:oculus-quest`, and `topic:quest` explicitly call repository
-search. Results outside the curated list stay page-only, even if a repository
-claims an open-source license. This prevents an arbitrary tagged mirror from
-becoming a trusted downloader. Extend the curated JSON after provenance review.
-
-For a higher API quota, add a GitHub access token in the store's source
-settings (the GitHub row's token field) or through the server API
-(`POST /api/sources` with `action: "set-token"` or `"clear-token"` and
-`source: "github"`). `FRAME_GITHUB_TOKEN` in the process environment still
-works and wins over a saved token. A saved token is kept with repository
-logins in `source-credentials.json` (mode 0600, see
-[APK repositories](apk-repos.md#repositories-behind-a-login)). The source list
-reports only whether a token is set, where it came from and whether GitHub
-rejected it, never its value. Tokens are sent as `Authorization: Bearer` only to
-`api.github.com`, never written to the cache, never sent to asset hosts (public
-release downloads don't need them), and removed on redirects. If GitHub answers
-401 to the token, the request is retried once without it, as Obtainium does.
-The rejection is logged without the token and shown in source settings. The
-token is not tried again until it is saved again or the app restarts. Rate-limit
-backoff is kept per login (anonymous, or each token), so saving a token after
-anonymous requests were limited lets the next request go out with it. The
-adapter does not read `gh` credentials automatically. Metadata is cached for one hour under
-`frame_host.cache_dir('apk-sources', 'publisher')`. A cold details request
-fetches at most ten releases. Rate-limit errors are surfaced without retry
-loops. Asset IDs and release tags are not Android version codes: metadata
-leaves the latter unknown and rejects a requested `version_code` rather than
-silently fetching a different build.
-
-`itch.py` exposes separate OpenXR and Quest feed sources, so one feed's failure
-does not suppress the other at the aggregator level. Queries filter the current
-feed window locally: this is not an exhaustive historical itch search. Only
-explicit zero-price Android entries are returned. Covers are exposed in
-`images`; absent screenshots, APK version, ABI and minimum SDK stay unknown.
-Curated GitHub entries include publisher artwork and plain-language summaries.
-Repository image URLs are pinned to inspected commits. Open Brush screenshots
-come from its README-linked Steam listing; SuperTux uses the upstream gameplay
-preview embedded in the port's README (not a headset capture). The hello_xr
-sample has a launcher icon and GitHub social banner; no published screenshot
-was found in the inspected repository/README, so its screenshot list is empty.
-Uncurated topic results use the owner's avatar and GitHub's repository social
-preview. These are repository placeholders, not app screenshots. Itch's recorded
-RSS includes only covers, so screenshot lists remain empty without page scraping. VR is
-based on curated evidence or a VR-specific feed/topic, not a compatibility claim.
-
-Downloads stream to unique temporary files, require an APK manifest entry,
-restrict HTTPS origins and redirects, and enforce a 2 GiB ceiling. `verified`
-means the downloaded SHA-256 matches GitHub's published digest. Without such a
-digest, the computed SHA-256 is returned with `verified: False`; neither value
-claims publisher-signature validation. Installation must inspect the APK as
-usual. OBBs, split APKs, paid assets and external release-body download links
-are unsupported.
-
-## Evidence and limits
-
-On this Mac, Python 3.9 downloaded the real Khronos Vulkan 1.1.63 APK through
-the GitHub adapter, matched its published SHA-256
-`f24bbe8ba6f6339fca658628868ba8189cbc33390d6ac508f69d76fb67b5fa34`, and
-`python3 ui/frame_android.py info <apk>` exited 0: package
-`org.khronos.openxr.hello_xr.vulkan`, version code 1063, minimum API 24,
-arm64-v8a present, OpenXR detected. No Frame connection or installation occurred.
-
-The itch OpenXR RSS was fetched successfully and recorded as a fixture.
-Subsequent live adapter search encountered HTTP 429; it is not claimed as a
-successful live end-to-end search. Fixture search finds Off Nominal and parses
-nine Android entries from the ten-item feed (one has only an HTML platform).
-A real itch download and APK inspection were deliberately not performed:
-robots restrictions take precedence over that requested proof. No current
-policy text is claimed verified where the table records failed access.
-
-Tests use recorded, reduced API/RSS fixtures with network access blocked in
-the new test class. They cover selection, prereleases, unknown topic results,
-paid/non-Android exclusion, URL restrictions, redirect credential removal,
-caching, rate limits, checksum mismatch, non-APK rejection and partial-file
-cleanup. See `.claude/NOTES-more-sources.md` for commands and local evidence.

docs/apks.md

@@ -39,12 +39,6 @@ section below), instead of going into Lepton Development:
    run at once alongside Lepton Development, each in its own container
    (`lepton-steamlaunch-<id>`, ADB on 5556, 5557, …).
 
-Split APKs (a base plus `split_*.apk` files) install as one app:
-`python3 ui/frame_android.py install base.apk split1.apk …`. Lepton runs one
-APK, so splits that add native libraries or assets are merged into the base
-and re-signed; density and language splits are refused. See
-[quest-import.md](quest-import.md#split-apks). Not yet tried on a real Frame.
-
 Verified with AntennaPod and Tabletop Tools: installed in about 7 s, launched
 from the shortcut, stopped, and relaunched with their data intact. ADB and
 Lepton Development aren't involved.
@@ -183,63 +177,6 @@ See
 [compat-db/README.md](../compat-db/README.md) and
 [apk-catalog/README.md](../apk-catalog/README.md).
 
-## Store and Library in Frame Control
-
-The Android tab has two views. **Store** finds apps across the sources (F-Droid,
-IzzyOnDroid, curated GitHub releases, itch.io). **Library** shows the apps on the
-Frame as cards, with Play and a menu for Test, Report and Remove; the display
-settings and recent reports are below it.
-
-The store groups apps by what a headset is good for, not by F-Droid's list:
-VR, Games, Emulators, Watch & listen, Read & learn, Create, Work, Web & chat
-and Tools (`ui/apk_sources/_categories.py`). A VR app is always in VR. Otherwise
-F-Droid's own categories decide, the finer one first (an app in *Multimedia* and
-*Social Network* is Web & chat).
-
-Apps built around a phone are hidden from browsing unless **Show phone-only
-apps** is on; a search always finds them, labelled *Phone app*. Hidden: apps in
-a category that only makes sense in a phone's own system (launchers, keyboards,
-wallpapers, Xposed modules), apps in a phone-side category (calls and SMS, VPNs,
-fitness, alarms, system tools) unless a useful category says otherwise
-(FluffyChat is in Phone & SMS, but it's a messenger), apps named for a phone
-part (a widget, a launcher, a battery tool), and apps that need hardware the
-Frame lacks (an IR blaster, a watch, NFC, root). They would install and run in
-Lepton, but do nothing useful on the Frame. In the October 2026 indexes that is
-about 1,600 of F-Droid's 4,500 apps and 550 of IzzyOnDroid's 1,300.
-
-Without a search, each source offers its best 300 for the chosen category:
-apps with a banner first, then with screenshots, then the newest.
-
-## The store in the headset: Frame Control's store as a panel (inferred, not yet run on the Frame)
-
-The **APK Store** panel is the Store above, drawn for the laser: the same
-sources, categories and artwork, with Install, Open, Stop and Remove, opened as
-its own floating panel:
-
-```sh
-scripts/store-on-frame.sh open     # copy the server over if it changed, start it, open the panel
-scripts/store-on-frame.sh close
-```
-
-`open` copies the same bundle the iPhone app uses
-(`ios/scripts/make_frame_bundle.py`) to
-`~/.local/share/frame-control/store-server/<version>` on the Frame. It then
-starts `ui/server.py` there with `FRAME_LOCAL=1` on `127.0.0.1:47812`, with a
-fresh `X-Frame-UI` key. Chromium XR (or the `org.chromium.Chromium` Flatpak)
-opens `/store` (`ui/store.html`) in a 1280×800 app window, tagged as panel
-`2001947812` ([panels.md](panels.md)). Downloads, SHA-256 checks and installs
-all run on the Frame, so the Mac can go away after `open`.
-
-The page has a category rail (Home, the store's categories, Installed), eight
-art cards a page, and a featured VR app on Home. It turns pages instead of
-scrolling, because a tagged panel gets mouse clicks and a drag would select
-text; the thumbstick (a mouse wheel) turns pages, and an on-screen keyboard is
-there for search. **Checked on the Mac only** (2026-10-14, 1280×800, against
-the real sources): Home, categories, Installed, the detail sheet. **Still to
-check in the headset:** that the panel opens and takes laser clicks, that an
-install completes when run on the Frame, and that **Open** brings up the app's
-panel.
-
 ## In-headset app store: F-Droid 1.17 (verified 2026-09-25)
 
 F-Droid 1.23 uses an old Compose and crashes on launch. **F-Droid 1.17.2**, the
@@ -394,11 +331,3 @@ because gamescope scales Lepton's surface to fit the same panel. Also unverified
 whether the settings survive the app or its Lepton instance relaunching.
 Lepton Development rebuilds its Android data on exit, so there they probably
 don't.
-
-## Expansion files and save backups
-
-SideQuest-inspired CLI helpers install local OBB files into an already-running
-app instance and back up/restore a stopped instance's private app data. See
-[SideQuest features and limits](sidequest.md) for commands, archive scope and
-verification status. These paths have offline coverage; real Frame storage and
-permissions remain unverified. They do not change APK install or launch behavior.

docs/backup-and-recovery.md

@@ -1,174 +0,0 @@
-# Backup and recovery
-
-**Tools → Backup & recovery** copies what a factory reset would lose from the
-Steam Frame to your computer, puts it back afterwards, and gets the headset out
-of Desktop Mode. It runs from Frame Control on a computer, not from the iPhone
-app or the Frame itself.
-
-**Partly tested on a headset.** On a Frame running SteamOS 0.5.6 (build
-20261015.6141207), a full backup saved 26 parts (40.7 MB): 14 games' Proton
-saves, Linux game saves, Steam and desktop settings and 9 Android apps' data,
-with no sign-in files or keys in the archives. Restoring one game's saves on top
-of identical files wrote nothing and left nothing behind. The session check
-reported Game Mode, so **Return to Game Mode** changed nothing. Not tested on a
-headset: a restore after a real factory reset, a restore that replaces files,
-Android data restore, and the switch out of a real Desktop Mode session. Unit
-tests and the fake Frame cover those (see [Verification](#verification)).
-On 2026-10-24 a read-only session check on the same build again reported Game
-Mode (`gamescope=true`, `plasma=false`, `nested_desktop=false`) and the
-`steamos-session-select` command was present. Opening the nested desktop for a
-clipboard test did not enter full Desktop Mode. A full session switch was not
-attempted because it restarts the headset session and a reliable return path
-was not established; the **Return to Game Mode** branch for a real full
-Desktop Mode session remains unverified.
-
-## Back up
-
-Choose **Game saves**, **Steam and desktop settings** and **Android app data**
-(all three by default), then **Back up now**. **See what's included** lists each
-part and its size first. Backing up only reads the headset.
-
-Each backup is a folder named after the time it started:
-
-```
-~/Documents/Frame Control Backups/2026-10-23-142530/
-  manifest.json
-  saves/saves-1234.tar.gz          one per game
-  saves/saves-linux.tar.gz
-  settings/settings-steam.tar.gz
-  settings/settings-system.tar.gz
-  android/org.example.game.tar.gz  one per Android app
-```
-
-`manifest.json` records the headset's name, SteamOS version and BUILD_ID, every
-file with its size and SHA-256, and each archive's SHA-256. It also lists what
-was skipped and why. A backup is written under a hidden `.…partial` name and
-renamed when complete, so a cut-off backup never shows up as one.
-
-### What's saved
-
-| Part | From the headset (`~` is `/home/steamos`) | Restored? |
-|---|---|---|
-| Windows game saves | `~/.local/share/Steam/steamapps/compatdata/<appid>/pfx/drive_c/users/steamuser/` → `AppData/Roaming`, `AppData/Local`, `AppData/LocalLow`, `Documents`, `Saved Games`. Wine's own folders in them (`Temp`, `Microsoft`, `D3DSCache`, `CrashDumps`) are left out. Sideloaded Windows games (non-Steam shortcuts) have prefixes here too | Yes |
-| Linux game saves | `~/.config/unity3d`, `~/.local/share/godot/app_userdata`: where Unity and Godot games save by default | Yes |
-| Steam controller layouts | `userdata/<account>/241100/remote/controller_config`, `steamapps/common/Steam Controller Configs/<account>/config` | Yes |
-| Steam library settings | `userdata/<account>/config/localconfig.vdf`, `shortcuts.vdf`, `grid/` (custom artwork) | Kept for reference |
-| Desktop settings | `~/.config/kdeglobals`, `kwinrc`, `kxkbrc` (keyboard layout), `konsolerc`, `dolphinrc` | Yes |
-| SteamVR settings | `~/.config/openvr/config/steamvr.vrsettings` | Kept for reference |
-| Android app data | Each Frame Control Android app's private data, through the existing `backup-data` helper ([sidequest.md](sidequest.md#private-app-data-backups)) | Yes |
-
-"Kept for reference" files are in the backup but not put back automatically:
-Steam and SteamVR rewrite them while they run, and an old `shortcuts.vdf` would
-point at apps that aren't installed after a reset. Open the backup folder to
-copy one by hand if you need it.
-
-### What's never copied
-
-- **Steam sign-in:** `steam.token`, `config/config.vdf`, `loginusers.vdf`,
-  `registry.vdf` and `ssfn*` files.
-- **Keys and passwords:** `~/.ssh`, `~/.gnupg`, keyrings and KWallet, any
-  `*.token`, `*.key` or `*.pem` file, Tailscale state and proxy settings
-  (`secrets.env`). These are refused by name wherever they turn up, including
-  inside a game's folder, and a restore refuses them too.
-- Games, Proton and the Steam runtimes: reinstall them from Steam.
-- Steam Cloud's own folders (`userdata/<account>/<appid>`), shader caches and
-  screenshots (**Tools → Capture & Live** saves those to Pictures).
-- Android apps themselves, their OBB files and shared storage (`/sdcard`).
-- Symbolic links (never followed), and single files over 2 GiB.
-
-Backups aren't encrypted. Game folders can still hold a launcher's login, and
-Android app data can hold an app's, so keep backups private.
-
-Android apps that are open are skipped (the helper needs the app closed); close
-them and back up again.
-
-## Restore after a factory reset
-
-1. Set up the headset again: Developer Mode, **Set Up Connection**, sign in to
-   Steam with the same account.
-2. Reinstall your games, and **start each once** so Proton creates its folders.
-3. Reinstall your Android apps from Frame Control.
-4. **Tools → Backup & recovery → Restore…** on a backup. Frame Control checks
-   each part against the headset and says what it would do: how many files it
-   replaces and how many are new.
-5. Tick the parts to restore and **Restore selected**. It asks before replacing
-   anything.
-
-Parts that can't go back yet are skipped, not failed, with the reason:
-
-| Reason | What to do |
-|---|---|
-| Install the game first | Install it from Steam, then restore |
-| Start the game once | Proton hasn't made its folders yet; start the game, quit, restore |
-| Sign in to Steam first | Controller layouts go under your account's folder |
-| Install the app first / close the app first | Android app data needs the app installed and closed |
-| The backup file doesn't match its checksum | The archive changed since it was made |
-
-A restore writes only the files in the parts you chose, and only inside that
-part's folders: it never deletes a file, and a save archive can't write outside
-its game. Before replacing a file it copies the current one to
-`~/.local/share/frame-control/restore-previous/<time>/` on the headset. Files
-already identical are left alone. Android app data goes through the existing
-`restore-data` helper, which keeps the previous data folder beside it.
-
-## Stuck in Desktop Mode
-
-On the Frame, Game Mode is gamescope running Steam, and the Linux desktop
-normally runs *inside* it as one panel (`steamos-nested-desktop`, see
-[how-the-frame-works.md](how-the-frame-works.md#the-layer-cake)). If that panel
-is what you see, you're already in Game Mode: close it from the Steam dashboard.
-
-Full Desktop Mode is a different session. SteamOS picks the session through
-SDDM's autologin file, `/etc/sddm.conf.d/zz-steamos-autologin.conf` (or the
-default `/etc/sddm.conf.d/steamos.conf`), and switches with
-`steamos-session-select` (`holo-session-select` on newer images). This is what
-Valve's own devkit tools on the Frame read and run
-([`steamos-get-status`](../frame/devkit-utils/steamos-get-status),
-[`steamos-delete`](../frame/devkit-utils/steamos-delete)).
-
-**Check** reads that file and whether gamescope and Plasma are running; it
-changes nothing. On the Frame gamescope's process is `gamescope-wl`, started by
-`start-gamescope-session`, and either counts as Game Mode. Only when Plasma is
-running without gamescope (Desktop Mode) does **Return to Game Mode** run
-exactly `steamos-session-select gamescope` (or `holo-session-select
-gamescope`) over SSH, after asking. It closes the desktop and anything open in
-it. Frame Control never edits the SDDM files itself, and runs nothing when the
-headset is in Game Mode, when it can't tell which mode it's in, or when the
-image has neither command.
-
-**Uncertain:** whether the Frame offers a full Desktop Mode session at all
-(only the nested desktop has been seen on BUILD_ID 20260922.6101926 and
-20260925.6191901), and whether `steamos-session-select` there works without
-the Developer Mode password. If the switch is refused, Frame Control says so and
-leaves the headset as it was.
-
-### Manual fallback
-
-If the button can't help, or the headset isn't reachable:
-
-1. **Restart it:** hold Power about 10 seconds until the light goes off, then
-   power on. On the Steam Deck, **Switch to Desktop** starts a one-shot
-   Desktop Mode session, so a restart brings Game Mode back. That the Frame
-   behaves the same is **inferred**, not tested.
-2. **Over SSH** (Developer Mode on), run Valve's switch yourself:
-   `ssh frame steamos-session-select gamescope`.
-3. **Boot menu:** hold Power 10 seconds, then power on while holding the AUX
-   button on top of Power. Choose `Current`, or `Previous` to start the other
-   SteamOS slot; both keep your data. Details and the further options
-   (`Repair Steam Installation`, `Erase User Data`, a full re-image) are in
-   [how-the-frame-works.md](how-the-frame-works.md#facts-worth-knowing) and
-   [recovery-and-images.md](recovery-and-images.md). Back up first if you can:
-   `Erase User Data` is a factory reset.
-
-## Verification
-
-`tests/test_backup.py` runs the headset-side script (`ui/frame_backup_remote.py`)
-for real against a folder laid out like the Frame's home, with only SSH faked:
-which paths are picked, that sign-in files and keys never are (also inside game
-folders), links never followed, the manifest and its checksums, restore checks
-after a reset (game not installed, no Proton folders yet, not signed in), that a
-restore replaces only its own files and keeps the old ones, unsafe archives
-(`..`, absolute paths, links, other games' folders) writing nothing, backup
-names that try to leave the backups folder, and the exact Game Mode command.
-`tests/e2e/test_recovery_kit.py` backs up a Proton save from the fake Frame through
-the server, deletes it and restores it. Neither involves a real headset.

docs/battery-health.md

@@ -1,59 +0,0 @@
-# Battery and health monitoring
-
-Open **Control Center → Battery & thermal health**, or expand **System
-information**, to read the Frame's charge, charging state, signed battery
-power, battery temperature and driver-reported health. Optional readings show
-charge cycles, full charge capacity, design capacity and full / design capacity.
-The existing battery chip also shows charging state and temperature.
-
-These are read-only readings from the Linux host's `/sys/class/power_supply`,
-not Android's container battery view. The probe prefers the documented Frame
-fuel gauge, `max1720x_bat_7-36`, over other battery nodes, excludes peripheral
-(`scope=Device`) and absent batteries, and otherwise uses a deterministic
-battery fallback. The UI shows the selected source path.
-
-| Reading | Linux attribute | Interpretation |
-|---|---|---|
-| Charge | `capacity` | Integer 0–100 percent; zero is a real reading |
-| Charging state | `status` | Charging, Full, Discharging or Not charging; missing/unknown states stay unavailable |
-| Battery power | `voltage_now × current_now` | Microvolts and microamps converted to signed watts; positive means charging on the Frame |
-| Temperature | `temp` | Tenths of a degree Celsius, including valid negative readings |
-| Battery health | `health` | Driver status such as Good or Overheat; not a wear percentage |
-| Charge cycles | `cycle_count` | Driver-reported count, including zero |
-| Full/design capacity | `charge_full`, `charge_full_design` | Microamp-hours converted to mAh |
-| Full / design capacity | Ratio of those two capacities | Fuel-gauge estimate; not a diagnosis or a guaranteed runtime |
-| Time estimate | `time_to_full_now`, `time_to_empty_now` | Seconds; displayed only for the corresponding charging/discharging state |
-
-Unavailable means the field is absent, unreadable or invalid. One missing
-sensor does not hide the others. Zero design capacity cannot produce a ratio. Time estimates outside 1 second
-to 7 days and battery temperatures outside −273.15 to 200 °C are rejected
-as invalid readings; these bounds are not thermal warning thresholds.
-The ratio may exceed 100% because full capacity is a gauge estimate, so the app
-does not clamp it or invent a wear warning. The app does not estimate health
-from charge percentage or assign temperature thresholds. Existing thermal
-alerts use the kernel's own hot/critical trip points.
-
-A connected charger does not necessarily mean charging: the Frame can still
-drain under load or sit idle near full charge. A 100% capacity reading alone
-does not prove the driver reports Full. Missing status is explicitly unknown;
-near-zero measured battery power with a charger is shown as not charging.
-Failed, stale or disconnected status samples clear Control Center readings.
-
-**No charge controls are provided.** Frame's SteamOS charge-limit backend is
-unsupported; see [charge-limit research](charge-limit.md). Monitoring never
-writes to power supplies, pauses charging, changes current or sets a limit.
-
-## Verification
-
-`tests/test_battery.py` uses temporary sysfs-like files for conversion,
-malformed/missing values, permission failures, source selection and partial
-sensor support. `tests/control_center.cjs` exercises charging states, optional
-metrics and failed/stale/disconnected sample handling. These tests do not
-connect to a headset. On 2026-10-24, the PR's uninstalled parser was also
-piped over SSH to a real Frame running SteamOS 0.5.6 (build
-`20261015.6141207`). Its read-only sysfs result selected
-`max1720x_bat_7-36` and reported 99% charge, Not charging, 24.9 °C,
-Good driver health, 14 cycles, 2,920 mAh full and 2,700 mAh design capacity
-(108.1% fuel-gauge estimate). The Control Center UI was not run against this
-headset; Windows and macOS were not tested. Optional fields are not claimed to
-be available on every firmware build.

docs/changelog.md

@@ -1,9 +0,0 @@
-# Changelog
-
-## Unreleased
-
-- Battery monitoring now selects the Frame fuel gauge predictably, handles
-  missing or invalid readings, and shows optional cycle count, full/design
-  capacity and estimated capacity health in Control Center. Unknown charging
-  status stays explicit. Monitoring is read-only; charge limits remain
-  unsupported on Frame. The read-only parser was checked on a real Frame; the UI was not.

docs/charge-limit.md

@@ -1,168 +0,0 @@
-# Battery charge limit (80%): research
-
-**Question:** can Frame Control set an 80% battery charge limit on the Frame
-over SSH or adb, safely?
-
-**Verdict: don't build it.** Valve's supported mechanism (the one Steam's own
-charge-limit setting uses on the Deck) is not configured for the Frame. The
-only control the Frame has is a vendor charger attribute that Valve's own
-charging daemon also manages. Research as of 2026-10-23, confirmed with the
-read-only checks below on a Frame running SteamOS 0.5.6 (build 20261015.6141207):
-
-- `steamosctl get-max-charge-level` fails with `UnknownInterface: ...BatteryChargeLimit1`.
-- `/usr/share/steamos-manager/devices/` has `[battery_charge_limit]` only for
-  the Steam Deck, ROG Ally, ROG Xbox Ally and MSI Claw, not the Frame.
-- Power supplies: `max1720x_bat_7-36` (Battery, driver `max1720x`),
-  `pm8550b-charger` (driver `qcom,pm8550b-charger`) and the USB-C `tcpm-source-psy-…`.
-  No `charge_control_end_threshold` anywhere; `pm8550b-charger` has
-  `charging_enable` and `charging_pause`, both `root`-only (`-rw-r--r--`).
-- `deckard-charger.service` (Deckard Battery Charger service) is enabled and running.
-
-For safe read-only readings in Control Center, see [battery and health
-monitoring](battery-health.md). It does not provide charging controls.
-
-## How Steam does it on other devices
-
-- Steam's **Settings → Power → Battery Charge Limit** shipped to the Deck in
-  SteamOS 3.7.8 (beta client 2025-05-08)
-  ([GamingOnLinux](https://www.gamingonlinux.com/2025/05/steamos-3-7-7-beta-brings-a-battery-charge-limit-option-and-improved-lenovo-legion-go-s-support/)).
-- Steam calls SteamOS Manager on the session bus:
-  `com.steampowered.SteamOSManager1.BatteryChargeLimit1`, with properties
-  `MaxChargeLevel` (`i`, read/write; `-1` resets to the default) and
-  `SuggestedMinimumLimit` (`i`, read-only). The CLI is
-  `steamosctl get-max-charge-level` / `set-max-charge-level` /
-  `suggested-minimum-charge-limit`. Source: `data/interfaces/com.steampowered.SteamOSManager1.xml`
-  and `steamos-manager/src/bin/steamosctl.rs` in
-  [holo/steamos-manager](https://gitlab.steamos.cloud/holo/steamos-manager),
-  read at commit `83981ab` (2026-10-21).
-- The root daemon writes the value to sysfs only if the device's TOML in
-  `data/devices/` has a `[battery_charge_limit]` section. Two methods exist
-  (`steamos-manager/src/power.rs`, `BatteryChargeLimitMethod`):
-  - `hwmon_attribute`: the Deck writes `max_battery_charge_level` on
-    `steamdeck_hwmon` (`data/devices/steam-deck.toml`).
-  - `acpi_sb`: ROG Ally, MSI Claw and others write the standard
-    `charge_control_end_threshold` on the ACPI battery
-    (`/sys/bus/{platform,acpi}/drivers/…battery…/PNP0C0A:00/…/power_supply/*/`).
-    On ARM there's no ACPI, so this path can't match there either.
-- With no `[battery_charge_limit]` section, the interface fails with
-  `UnknownInterface` (Steam can still show its toggle on unsupported hardware:
-  [steam-for-linux#12044](https://github.com/ValveSoftware/steam-for-linux/issues/12044)).
-
-## What the Frame has
-
-- **Upstream `data/devices/steam-frame.toml`** (matched by
-  `dt.compatible = "qcom,sm8650"`, variant `Deckard`) configures GPU clocks
-  and performance profiles only. It has **no `[battery_charge_limit]`**, so
-  SteamOS Manager on the Frame has no charge-limit backend. Its git history
-  (2026-09-10 to 2026-10-12) never added one.
-- **Battery driver:** the Frame's battery is
-  `/sys/class/power_supply/max1720x_bat_7-36`, and the charger is a
-  `tcpm-source-psy-…` USB-PD supply ([how-the-frame-works.md](how-the-frame-works.md)).
-  Both were verified 2026-09-25, and `ui/frame_status.py` `battery()` and
-  `power_source()` read them. The Maxim MAX1720x is a **fuel gauge** and
-  can't control charging. Mainline `drivers/power/supply/max1720x_battery.c`
-  exposes only read-only properties (capacity, voltage, current, temp,
-  charge_full…), with no `charge_control_end_threshold`. Valve's build is
-  patched: it reports `time_to_full_now`, which mainline doesn't have. Even
-  so, a charge stop would have to come from the separate charger IC, not this
-  node.
-- **Not the qcom_battmgr path.** Some other SM8650/SM8750 handhelds get
-  `charge_control_end_threshold` from Qualcomm's `qcom_battmgr`
-  (pmic_glink) driver, clamped at 55% or above. A third-party distro enabled
-  Steam's limit on those by patching steamos-manager
-  ([armada-os/armada#758](https://github.com/armada-os/armada/pull/758)). The
-  Frame's battery isn't exposed by `qcom_battmgr`, so that doesn't carry over.
-  (Unverified: whether a `qcom_battmgr` node also exists on the Frame. The
-  read-only checks below answer this.)
-- **What third parties found:**
-  [y0usaf/frame-charge](https://github.com/y0usaf/frame-charge) reports that
-  the Frame has no `charge_control_end_threshold` and falls back to a vendor
-  `charging_pause` attribute. It also reports that `constant_charge_current`
-  changes on its own, which it attributes to Valve's `deckard_charge_daemon`
-  (`deckard-charger.service`). By its own README, that tool has only run its
-  read-only `status` on a Frame and has **not** been tested against real
-  charging. Two questions are still open: whether pausing stops the current,
-  and whether Valve's daemon undoes it.
-
-## Why not build it now
-
-- **No supported endpoint.** The only Valve-supported interface,
-  `BatteryChargeLimit1`, isn't backed on the Frame. Writing sysfs ourselves
-  would bypass Steam and SteamOS Manager, and it needs root (`sudo -S` with
-  the user's password).
-- **A rival owner.** Valve's charge daemon already adjusts charging
-  parameters. Toggling `charging_pause` underneath it could be undone without
-  warning, fight it in a loop, or leave charging paused.
-- **Stuck at a low charge.** If the app or the Frame dies while charging is
-  paused, the Frame could sit at a low charge on the charger. Whether a
-  reboot clears `charging_pause` is unknown.
-- **The UI would mislead.** Steam's setting (if it shows at all) wouldn't
-  reflect our limit.
-- **adb doesn't help.** Wi-Fi adb (`frame:5555`) reaches the Lepton Android
-  container only. USB-C adb reaches the Linux side as `steamos` (non-root, the
-  same as SSH, [ssh.md](ssh.md)). Neither adds a charging-control route.
-  Android's `dumpsys battery` in Lepton is a container view, not the hardware.
-
-**Revisit when** a SteamOS update adds `[battery_charge_limit]` to
-`steam-frame.toml` (or `steamosctl get-max-charge-level` stops returning
-`UnknownInterface` on the Frame). Then the feature is just a SteamOS Manager
-call:
-
-- Read: `steamosctl get-max-charge-level`
-- Set: `steamosctl set-max-charge-level 80`
-- Undo: `steamosctl set-max-charge-level -- -1`
-
-That runs as `steamos` with no sudo. It's the same value Steam's own
-Settings → Power shows, so both stay in sync.
-
-## Headset checks (read-only first)
-
-Run these over SSH as `steamos`. Steps 1–4 only read.
-
-```sh
-# 1. Does SteamOS Manager offer the interface on this build?
-steamosctl get-max-charge-level; steamosctl suggested-minimum-charge-limit
-busctl --user introspect com.steampowered.SteamOSManager1 \
-  /com/steampowered/SteamOSManager1 | grep -i -A3 ChargeLimit
-grep -n battery_charge_limit /usr/share/steamos-manager/devices/*frame* 2>/dev/null
-
-# 2. Which power supplies exist, and which drivers back them?
-for d in /sys/class/power_supply/*; do
-  echo "== $d ($(cat $d/type)) driver=$(basename "$(readlink -f $d/device/driver)" 2>/dev/null)"
-  ls $d
-done
-
-# 3. Any charge-control attributes, with their values and permissions?
-ls -l /sys/class/power_supply/*/{charge_control_*,charging_pause,charging_enable,constant_charge_current*,charge_behaviour} 2>/dev/null
-grep -H . /sys/class/power_supply/*/{charge_control_*,charging_pause,charging_enable,constant_charge_current*,charge_behaviour} 2>/dev/null
-
-# 4. What is Valve's charger daemon, and what does it touch?
-systemctl status deckard-charger.service --no-pager
-systemctl cat deckard-charger.service
-journalctl -b -u deckard-charger.service --no-pager | tail -50
-```
-
-If step 1 succeeds on some build, test `steamosctl set-max-charge-level 80`
-on a charger at a charge above 80%. Watch `current_now` on the
-`max1720x_bat_*` node fall to about 0, then `steamosctl set-max-charge-level -- -1` and
-confirm charging resumes. Do this on a supervised Frame only. If only step 3
-finds a vendor attribute, **stop**: don't write it, and leave the question
-with Valve.
-
-## Sources
-
-- steamos-manager source, commit `83981ab` (2026-10-21):
-  `data/devices/steam-frame.toml`, `data/devices/steam-deck.toml`,
-  `data/interfaces/com.steampowered.SteamOSManager1.xml`,
-  `steamos-manager/src/power.rs`, `steamos-manager/src/manager/user.rs`.
-  [gitlab.steamos.cloud/holo/steamos-manager](https://gitlab.steamos.cloud/holo/steamos-manager)
-- Mainline [`max1720x_battery.c`](https://github.com/torvalds/linux/blob/master/drivers/power/supply/max1720x_battery.c)
-- [ValveSoftware/steam-for-linux#12044](https://github.com/ValveSoftware/steam-for-linux/issues/12044):
-  the Steam toggle shows on unsupported hardware
-- [armada-os/armada#758](https://github.com/armada-os/armada/pull/758):
-  `qcom_battmgr` threshold on other SM8650/SM8750 devices
-- [y0usaf/frame-charge](https://github.com/y0usaf/frame-charge): third-party,
-  untested on real charging
-- [GamingOnLinux: SteamOS 3.7.7 beta charge limit](https://www.gamingonlinux.com/2025/05/steamos-3-7-7-beta-brings-a-battery-charge-limit-option-and-improved-lenovo-legion-go-s-support/)
-- Repo: [how-the-frame-works.md](how-the-frame-works.md) (battery and
-  charger nodes), [ssh.md](ssh.md) (adb scope), `ui/frame_status.py`

docs/devices.md

@@ -1,241 +0,0 @@
-# Headsets, addresses and the connection
-
-Frame Control can manage more than one Steam Frame, and each headset can be
-reached at more than one address: a LAN IP at home, another at the office, its
-mDNS name (`frame.local`), its Tailscale IP or MagicDNS name. The **Devices**
-tab (key 5) lists them. The connection pill in the header says whether the one in
-use is connected and how (Tailscale, or the network's name); click it to add,
-edit or reorder that headset's addresses, or to see each step of connecting.
-
-The code is in three modules, all stdlib-only Python on your computer:
-
-| Module | What it does |
-|---|---|
-| `ui/frame_devices.py` | The registry: headsets, their addresses, networks; importing and updating `~/.ssh/config`; pinned host keys |
-| `ui/frame_network.py` | Which network this computer is on, and Tailscale's state |
-| `ui/frame_link.py` | The connector: finds the headset, keeps the SSH connection, publishes each stage; the Devices API |
-
-## Headsets
-
-Each headset keeps its own SSH alias, as Set Up Connection has always written
-it: the first is `frame`, the next `frame-2`, and so on. Terminal's
-`ssh frame-2` and the helper scripts (`FRAME_ALIAS=frame-2 scripts/push.sh …`)
-work for each one.
-
-- **Nothing to migrate by hand.** On first start, the app imports every
-  `# >>> steam-frame (ALIAS) >>>` block in `~/.ssh/config` as a headset, with
-  the block's HostName as its first address. It also copies the host key your
-  `known_hosts` already trusts for that address into the headset's own
-  known_hosts file, `~/.ssh/frame-control-hosts/<id>`, so nobody is asked to trust it again.
-- **Add a headset** runs Set Up Connection (`scripts/connect.sh` on macOS,
-  `ui/frame_connect.py --alias NAME` elsewhere) in a terminal with a new alias.
-  When it writes its block, the app picks the headset up by itself. If Set Up
-  Connection runs again and finds a headset somewhere new, that address is added
-  at the top of its list.
-- **Use this headset** (or the switcher in the header, or the app's
-  **Frame → Headset** menu) moves the whole app to another headset; every panel
-  reloads from it. From that moment no command goes to the previous headset, even
-  if the new one never answers. It waits while an install is running, since an
-  install reads the SSH settings step by step.
-- **Remove** forgets a headset. Its `~/.ssh/config` block stays unless you tick
-  the box; either way it isn't imported again unless Set Up Connection changes it.
-- A plain `FRAME_ALIAS` that Set Up Connection never configured still works: the
-  app shows it as not set up and lets ssh's own config decide where it goes.
-
-## Addresses
-
-Each address has a kind (LAN, mDNS, Tailscale or Other, guessed from the address
-and changeable), an optional label, the networks it has worked on, and when it
-last worked with its round-trip time.
-
-When connecting, the app **tries all addresses at once** (TCP to the SSH port)
-and ranks them:
-
-1. addresses that worked on the network this computer is on now;
-2. mDNS names;
-3. Tailscale addresses, if Tailscale is running here;
-4. addresses not tried on this network yet;
-5. addresses that only ever worked on other networks;
-6. Tailscale addresses while Tailscale is off.
-
-Your order (on the Devices tab, or in the pill's dialog) breaks ties. The best-ranked address that answers
-wins; one that answers first waits up to 0.35 s for a better-ranked one that is
-still trying. If SSH to the winner fails in a way another address could fix
-(a different device answered there, or the link dropped), the next one that
-answered is tried. Every success records the network on that address, so next
-time on that network it's tried first.
-
-**Test now** probes every address and tries SSH on each one that answers, without
-disturbing the connection in use: "SSH works", "answered as a different
-headset", "refused this computer's key", or why it didn't answer. **Find on
-Tailscale** lists your tailnet's devices (likely headsets first, from `tailscale
-status --json`, including the Mac app's own CLI) with buttons to add their
-MagicDNS name or IP. **Find on this network** asks mDNS for SteamOS devkit
-services and checks `ALIAS.local` and `frame.local`.
-
-**The pill's dialog** lists the same addresses, with what each one answered, and
-can add, edit, reorder and remove them without leaving the page you're on. When
-the headset reports a LAN IP on the same network as this computer and that IP
-isn't saved, it offers to add it. The offer puts the address first in the list,
-so on that network it wins over the Tailscale name; away from home the Tailscale
-name still leads. A new or edited address is tested straight away. While
-connected, **Reconnect** applies your changes now rather than at the next
-connection: it tries the addresses again, ranked as above, and the best-ranked
-one that answers promptly wins. It doesn't pick a particular address.
-
-## Networks
-
-A network is told apart by its default gateway: the router's IP address plus its
-hardware (MAC) address, read with `route`/`arp` (macOS), `ip route`/`ip neigh`
-(Linux) or `route print`/`arp -a` (Windows). That works on wired networks, and
-on macOS 14 and later, which hides the Wi-Fi name from apps without Location
-permission. Where the system does share the Wi-Fi name, it's shown, and you can
-name any network yourself ("Home Wi-Fi") on the Devices tab.
-
-The app rereads the gateway every 5 seconds and Tailscale's state every
-30 seconds. Changing networks reconnects.
-
-## The connection, stage by stage
-
-The connector runs in the server (`frame_link.Link`) and moves through:
-
-1. **Checking this computer's network**: gateway, Wi-Fi, this computer's IP, Tailscale.
-2. **Finding the headset**: each address resolving, trying, answered in N ms,
-   no answer, refused, or can't be found.
-3. **Opening SSH** to the address that answered.
-4. **Checking the headset's identity**: the host key must match the one pinned
-   for this headset.
-5. **Logging in** as the headset's user.
-6. **Connected** via network N, address A, round trip T; or **failed** at a stage
-   with the reason in plain words and a countdown to the next try (5, 10, 20,
-   then every 30 seconds). Retry now skips the wait.
-
-Stages 3 to 5 come from following `ssh -v` as it runs. On macOS and Linux the
-connection is an SSH ControlMaster that every command shares; when it dies (the
-headset slept or left the network) the connector notices and starts again. On
-Windows, where OpenSSH can't share a connection, the same handshake runs once
-and each command then connects on its own; a command that can't reach the
-headset makes the connector start again. There ssh's stderr goes to a file that
-the connector reads as it grows, not a pipe: Windows' OpenSSH can block writing
-to a redirected pipe.
-
-Once connected, every `ssh`, `scp` and `rsync` the app runs gets
-`-o HostName=<address> -o HostKeyAlias=frame-control-<id>
--o UserKnownHostsFile=~/.ssh/frame-control-hosts/<id> -o HashKnownHosts=no -o User=… -o Port=…`. The
-alias's block in `~/.ssh/config` is also updated to the last address that
-worked (and to the user and port you set), so Terminal's `ssh frame` and the
-scripts follow. Edits to `~/.ssh/config` take a lock file
-(`~/.ssh/config.frame-control.lock`) that Set Up Connection takes too, and never
-write over a change someone else made since the app last read the file.
-
-**Host keys are pinned per headset, not per address.** Your own `known_hosts`
-is keyed by address, so a different device answering at a remembered IP (a DHCP
-lease that moved) would look like a new host there. The app keeps one known_hosts
-file per headset instead, so saving or forgetting one headset's key never touches
-another's: a different device answering at one of its
-addresses is refused, and the pill says so. A headset's first connection trusts
-the key it shows, as Set Up Connection does: while a headset has never had an
-identity here, every ssh command gets `StrictHostKeyChecking=accept-new` (the
-first contact saves it, whichever command makes it), and from then on
-`StrictHostKeyChecking=yes`. `accept-new` never replaces a saved key, so it
-can't hide a change. The saved key's fingerprint is also recorded in
-`devices.json` (`identity`), along with a flag that never clears
-(`identity_established`), as soon as ssh saves the key: even if the login is then
-refused. A headset counts as having had an identity if the flag is set, a
-fingerprint is recorded, its pin file exists at all, or a connection to it ever
-worked (older files get the flag from that when loaded, so editing or removing
-the address that worked doesn't undo it); then
-a pin file that's deleted, empty, unreadable or not parseable **fails closed**
-(*Checking the headset's identity* fails, "missing or can't be read") rather than
-trusting whatever answers, and only **Check its key…** saves a key again. It
-says when the key it reads matches the recorded fingerprint.
-
-**When the key changes** (SteamOS reinstalled or reset, a new headset at the
-same address, or a different device answering there), nothing is accepted by
-itself. The connection fails at *Checking the headset's identity*; the banner
-and the headset on the Devices tab say so, with **Check the new key…** (also
-**Check its key…** on the Devices tab at any time). That reads the key the
-headset shows now, and nothing more: ssh writes it to a throwaway known_hosts
-file during the key exchange, before any login, and is stopped as soon as it
-has. Every other kind of contact is ruled out on the command line, ahead of
-anything `~/.ssh/config` says: no authentication of any kind, no agent
-(`IdentityAgent=none`, `ForwardAgent=no`), no X11 or port forwarding, no local
-or remote command (`-N`), no terminal, and `-F none`. Through a ProxyJump host
-it builds that hop itself, as a ProxyCommand whose ssh forwards nothing and runs
-no local command (ProxyJump's own ssh would take `ForwardAgent` and
-`LocalCommand` from `~/.ssh/config`); it still logs in to the jump host as
-configured. Every word of that ProxyCommand is quoted for the shell that runs it
-(and `%` doubled for ssh's own tokens), the forward is `[%h]:%p` so an IPv6
-headset works, and an IPv6 jump host is passed bare with its port. Through a ProxyCommand from `~/.ssh/config`, or several jump hosts,
-it refuses, since those can't be made safe from here: add an address it can
-reach directly, or compare the key by hand. It shows the key's SHA256 fingerprint next to
-the saved one, with the command that prints it on the headset
-(`ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub`, in Konsole on its desktop).
-**This is my headset: trust its new key** then saves exactly that key, replacing
-the old one, and reconnects. The server keeps the key it showed for 10 minutes
-and saves it only if the page sends back the same fingerprint, and only while
-the headset's port, user and that address are unchanged; it never saves whatever
-answers next. The API's old `forget-identity`, which deleted the pin so that the
-next contact saved any key unseen, is refused. Set Up Connection can't fix a changed key: it checks your
-own `known_hosts`, not the headset's file.
-
-**When the headset refuses this computer's key** (`Permission denied
-(publickey,…)`), the connection stops at *Logging in*, and the banner and the
-Devices tab offer **Set Up Connection…**, which pairs this computer again.
-
-Neither is reported as a fault: the diagnostics report each kind at most once
-a session ([privacy.md](privacy.md)).
-
-## One server at a time
-
-Only one Frame Control server runs per user (a lock file, `server.lock`, in the app's
-data folder). Two would each connect, reconnect and edit the headsets on their own, and
-one could move the other's install to a different headset. A second one, say
-`scripts/frame-ui.sh` while the app is open, exits with "Frame Control is already
-running". `FRAME_CONTROL_DATA_DIR` gives a separate one, with its own headsets.
-
-## API
-
-All under the usual `/api/` guards (loopback `Host`, `X-Frame-UI` header).
-
-| Request | Returns |
-|---|---|
-| `GET /api/connection` | The connection state: `phase` (connecting, connected, failed), `device`, `network`, `stages`, `probes`, `via`, `error`, `retry_at`, `tests`, `version` |
-| `GET /api/connection/events` | The same as server-sent events, one each time it changes (the page reads it with `fetch`, since `EventSource` can't send the header) |
-| `GET /api/devices` | Headsets, the current network, known networks, the next free alias |
-| `GET /api/devices/tailscale?id=` | Tailscale peers, likely headsets first |
-| `GET /api/devices/mdns?id=` | Headsets found on this network |
-| `POST /api/devices` | `{"action": ...}`: `use`, `update` (name, user, port), `remove`, `address-add`, `address-update`, `address-remove`, `address-move`, `test`, `identity-scan` (read the key the headset shows: `scan` with `type`, `fingerprint`, `host`, `saved`, `recorded`, `matches`, `recorded_match`), `identity-trust` (`fingerprint`: save the key `identity-scan` showed), `forget-identity` (refused: use the two before), `name-network`, `setup` (alias, optional host), `retry` |
-
-Every host, alias and user is checked against strict patterns before it's
-stored, because they end up in ssh arguments and `~/.ssh/config`; nothing goes
-through a shell.
-
-## The registry file
-
-`devices.json` in the app's data folder (`~/Library/Application Support/Frame
-Control` on macOS, `%APPDATA%\Frame Control` on Windows,
-`~/.local/share/frame-control` on Linux). It's plain JSON so the iPhone app can
-share the format later (it still connects to one host; see
-[iphone.md](iphone.md)):
-
-```json
-{"version": 1, "active": "f67f8b7e",
- "devices": [{"id": "f67f8b7e", "name": "Steam Frame", "alias": "frame", "user": "steamos", "port": 22,
-              "identity_files": ["~/.ssh/id_ed25519_frame"], "identity": ["SHA256:…"], "identity_established": true,
-              "addresses": [{"host": "frame.local", "kind": "mdns", "label": "",
-                             "networks": ["n-e0998baa61"], "last_ok": 1790593550.4, "last_rtt_ms": 0.9}]}],
- "networks": {"n-e0998baa61": {"name": "Home Wi-Fi", "ssid": null, "gateway": "192.168.1.1",
-                               "gateway_mac": "b4:fb:e4:b5:67:55", "wifi": true, "last_seen": 1790593550.0}}}
-```
-
-A network id is `n-` and the first 10 hex digits of SHA-1 of `gateway|mac`.
-
-## Tests
-
-`tests/test_devices.py`, `tests/test_network.py` and `tests/test_link.py` run
-with the other unit tests. They use a stand-in `ssh` (`tests/fakessh/ssh`) that
-prints what `ssh -v` prints and plays a ControlMaster, real sockets on this
-computer for the addresses, and temporary folders for `~/.ssh`
-(`FRAME_CONTROL_SSH_DIR`) and the app data (`FRAME_CONTROL_DATA_DIR`), so they
-never touch yours.

docs/evidence/android-import/device.json

@@ -1,34 +0,0 @@
-{
-  "date": "2026-10-20T03:53:25Z",
-  "build_id": "20260925.6191901",
-  "app": "F-Droid Basic 2.0.2 (org.fdroid.basic, version code 2000052)",
-  "input": "One real APK plus synthetic main and patch OBBs named with older version code 2000050",
-  "sibling_discovery": true,
-  "automatic_import": "passed",
-  "closed_after_import": true,
-  "independent_readback": [
-    "5023b41e7ac80f8b26a868db1f66884976bf864fab81a070ad37539f3481b352  /sdcard/Android/obb/org.fdroid.basic/main.2000050.org.fdroid.basic.obb",
-    "aecbed7433e81aaeef40942069d03ad23130f09d93b7e78bbe224865a9573157  /sdcard/Android/obb/org.fdroid.basic/patch.2000050.org.fdroid.basic.obb"
-  ],
-  "cleanup": {
-    "test_install_removed": true,
-    "running_instances_before": {},
-    "running_instances_after": {},
-    "battery_before": [
-      "100",
-      "Full",
-      "Charging"
-    ],
-    "battery_after": [
-      "99",
-      "Discharging",
-      "Charging"
-    ],
-    "shared_lock_released": true
-  },
-  "limits": [
-    "No headset rendering or gameplay assertion; headset unworn.",
-    "Synthetic expansion files verify transport and persistence, not Resident Evil 4 compatibility.",
-    "A game that exits before its Lepton instance can accept data was not tested."
-  ]
-}

docs/evidence/linux-vr/2026-09-29.txt

@@ -1,29 +0,0 @@
-Locked real-Frame repeat, 2026-09-29
-SteamOS 0.4.1, BUILD_ID 20260925.6191901; aarch64.
-mkdir /tmp/frame-test.lock succeeded before installs/launches; rmdir issued after cleanup.
-Preflight battery 44%, charging; before WiVRn 46%, before ALVR 47%, cleanup 47%.
-Original Steam PID 49823 and vrserver PID 49571 present after cleanup.
-Same unmodified upstream release APKs and SHA-256s as 2026-09-28.txt.
-Installer functions loaded from a613735 before checkout was fast-forwarded to current main.
-No compatibility layer injected. Per-app immersive Lepton instances, Steam shortcut launches.
-Headset unworn. No Linux gaming host. No pairing or streaming session reached.
-
-WIVRN: selected journal lines (local +1000 prefix, Android timestamps UTC).
-Sep 29 11:03:15 frame lepton-steamlaunch-2817846116[1967]: 09-29 01:03:15.202  1153  1181 E OpenXR-Loader: Error [GENERAL | xrCreateInstance | OpenXR-Loader] : LoaderInstance::CreateInstance, no support found for requested extension: XR_KHR_convert_timespec_time
-Sep 29 11:03:15 frame lepton-steamlaunch-2817846116[1967]: 09-29 01:03:15.210  1153  1181 I WiVRn   : [2026-09-29 01:03:15.210] [WiVRn] [info] Failed to create OpenXR instance version 1.1.58: XR_ERROR_EXTENSION_NOT_PRESENT
-Sep 29 11:03:15 frame lepton-steamlaunch-2817846116[1967]: 09-29 01:03:15.248  1153  1181 E OpenXR-Loader: Error [GENERAL | xrCreateInstance | OpenXR-Loader] : LoaderInstance::CreateInstance, no support found for requested extension: XR_KHR_convert_timespec_time
-Sep 29 11:03:15 frame lepton-steamlaunch-2817846116[1967]: 09-29 01:03:15.256  1153  1181 I WiVRn   : [2026-09-29 01:03:15.256] [WiVRn] [info] Failed to create OpenXR instance version 1.0.58: XR_ERROR_EXTENSION_NOT_PRESENT
-Sep 29 11:03:15 frame lepton-steamlaunch-2817846116[1967]: 09-29 01:03:15.257  1153  1181 E WiVRn   : [2026-09-29 01:03:15.257] [WiVRn] [error] Error during initialization: Failed to create OpenXR instance: XR_ERROR_EXTENSION_NOT_PRESENT
-Screenshot API exit 0; 1920x1080 uniformly dark image; no client scene visible.
-
-ALVR: selected journal lines (local +1000 prefix, Android timestamps UTC).
-Sep 29 11:03:36 frame lepton-steamlaunch-2831623938[1967]: 09-29 01:03:35.553  1139  1167 E OpenXR-Loader: Error [GENERAL | xrCreateInstance | OpenXR-Loader] : LoaderInstance::CreateInstance, no support found for requested extension: XR_KHR_convert_timespec_time
-Sep 29 11:03:36 frame lepton-steamlaunch-2831623938[1967]: 09-29 01:03:35.553  1139  1165 I RustStdoutStderr: Error [GENERAL | xrCreateInstance | OpenXR-Loader] : LoaderInstance::CreateInstance, no support found for requested extension: XR_KHR_convert_timespec_time
-Sep 29 11:03:36 frame lepton-steamlaunch-2831623938[1967]: 09-29 01:03:35.611  1139  1167 E [ALVR NATIVE-RUST]: panicked at alvr/client_openxr/src/lib.rs:220:10:
-Sep 29 11:03:36 frame lepton-steamlaunch-2831623938[1967]: 09-29 01:03:35.611  1139  1167 E [ALVR NATIVE-RUST]: called `Result::unwrap()` on an `Err` value: ERROR_EXTENSION_NOT_PRESENT
-Screenshot API exit 0; 1920x1080 uniformly dark image; no client scene visible.
-
-Cleanup: both test app directories, compatdata, shadercache, containers and shortcuts absent.
-Capture output directory removed. No global settings changed; Steam/SteamVR not stopped.
-The shared lock was subsequently acquired by another thread (new directory timestamp 11:03:49 +1000).
-Native clients and Valve host streaming not exercised: no native build or Linux gaming host available.

docs/evidence/mods-2026-09-29.md

@@ -1,122 +0,0 @@
-# UEVR from Frame Control, 2026-09-29
-
-**Verified observations**, with limits below. Same device and software as
-[2026-09-28](mods-2026-09-28.md): aarch64, SteamOS `0.4.1`, BUILD_ID
-`20260925.6191901`, Proton `11.0-2c` ARM64, SteamVR `2.18.1`. Times are the
-Frame's AEST clock. Headset tests ran under the shared
-`/tmp/frame-test.lock`, taken 11:13–11:28, 11:33–11:49, 12:02–12:40,
-12:44–12:52 and 13:01–13:03. Battery 45 % →
-93 %, on charge throughout.
-
-**Not observed:** the VR image, head tracking and controller input. SteamVR
-reported `activity_level` 3 (user interaction timeout; the headset was not
-being worn) with `average_target_fps` 1. Every `frame_vrshot.py` stereo
-capture was a uniform dark frame. Frame submits prove the app is presenting
-to SteamVR, not that the image is correct.
-
-## Manual injection (11:13–11:28)
-
-Game launched with `steam steam://rungameid/1067310`. `UEVRInjector.exe` was
-started with the game process's Wine variables, and its WPF window drew
-through DXVK's D3D9. It listed `Drop-Win64-Shipping (pid: 320) (SkyArk
-(64-bit, PCD3D_SM5))`, a Wine-side process id.
-
-- `--attach=Drop-Win64-Shipping` didn't inject. The button still read
-  **Inject**, and the saved `OpenVRRadio=True` in `AppData/Local/praydog/…/user.config`
-  was not restored on the next start.
-- XTest clicks landed on the game: `XQueryPointer` reported child
-  `0x2000001` (the game) at the injector's coordinates, and
-  `XLowerWindow`/`XRaiseWindow`/`XSetInputFocus` didn't change that.
-- `XSendEvent` button events to the injector window worked. After OpenVR and
-  Inject, `/proc/<game>/maps` contained
-  `drive_c/frame26/uevr/UEVRBackend.dll` and `openvr_api.dll`, next to
-  Proton's `vrclient_x64.dll`. UEVR's log:
-
-```text
-[11:17:32.948] Hooking D3D11
-[11:17:33.020] Hooked DirectX 11
-[11:17:34.263] Framework initialized
-[11:17:34.475] [VR] Requested runtime: openvr_api.dll
-[11:17:39.791] UGameViewportClient::Draw called for the first time.
-[11:17:39.792] is stereo enabled called!
-```
-
-It also logged repeated `Failed to initialize Framework on DirectX 12` (probing
-before it chose D3D11) and failed Unreal scans, for example `Failed to locate
-r.EnableStereoEmulation cvar` and `Failed to find FSceneView constructor`.
-SteamVR loaded UEVR's action manifest and `bindings_oculus_touch.json` for
-`steam.app.1067310`. `vrcmd --stats` then showed `"key" :
-"steam.app.1067310"` with `frame_submits` 4439, then 5506 a few seconds later.
-
-A second session's injector exited within about 20 seconds. The third,
-started fresh, injected again (`frame_submits` 1412). After the game was
-stopped, a plain launch had no UEVR modules and no SteamVR scene app. All test
-files were removed.
-
-## Through Frame Control (11:33–11:49)
-
-Local `ui/server.py` against the `frame` alias. First the API, then the
-page's **VR mod** dialog, driven with a headless Chromium:
-
-| Step | Result |
-|---|---|
-| `status` for 2177750 (HL2 VR) | `eligible: false`; `install` refused ("doesn't look like an Unreal Engine game") |
-| `install` for 1067310 | 3 s. Three downloads, hashes matched, receipt written |
-| `start`, game running | First run refused: `the UEVR window is 960 px wide, not 625`. It was measured before WPF laid it out; `start` now waits for the width to settle. Rerun: injected, `frame_submits` 27 (36 s) |
-| `uninstall` while running | Refused: "the game is running; quit it first" |
-| `start`, game not running | Launched the game, injected, `frame_submits` 45 (55 s) |
-| UI: Remove, Install | Worked; the prefix listing matched its pre-install state except an empty `UnrealVRMod`, which uninstall now also removes |
-| UI: Play in VR | Failed once: the injector died with `Process terminated. … Resource name: Arg_AccessViolationException`, after `Fontconfig error: No writable cache directories` (it had no `HOME`). Fixed by keeping the normal environment under the game's (the relaunch-on-failure added next is gone with the GUI injector; see below) |
-| UI: Play in VR ×4 | 4 of 4 injected. The three cold starts took 54, 58 and 58 s; frame submits 56, 71, 80 |
-| UI: Remove | `drive_c`, `AppData/Roaming` and `AppData/Local` listings matched the pre-install state; download cache and receipt gone |
-
-## The GUI injector wasn't reliable (12:02–12:40)
-
-After review fixes, cold starts through the API with UEVR's own injector:
-
-- Batches of 4, 6 and 8 runs: 3/4, 4/6 and 6/8 injected. A retry that
-  relaunched the injector didn't rescue a bad session. In both failures of
-  the last batch, the first injector ignored the clicks and the next two
-  never showed a window within 60 s.
-- Captures of the ignoring injector (`xwd`) showed its first-drawn frame,
-  with OpenVR still unselected. The injector's log had no error.
-
-Lock released at 12:40 before redesigning.
-
-## Frame Control's own injector (12:44–12:52)
-
-`start` now runs `frame_inject.py` under python.org's embeddable Python
-3.14.7 (SHA-256 `d297e5ff…1f15`, matching python.org's release-file API), in
-the game's Wine session. The old install was removed and the new one
-installed without the headset lock, since neither launches anything. The
-prefix listing after removal matched the pre-install state; the new install
-is 47 MB.
-
-| Step | Result |
-|---|---|
-| API `start`, cold | Injected in 35 s, `frame_submits` 39. UEVR log: `Hooked DirectX 11`, `Framework initialized`, `Requested runtime: openvr_api.dll`; `config.txt` has `Frontend_RequestedRuntime=openvr_api.dll` |
-| API `start` ×8, cold | **8/8** injected, 33–34 s each; `frame_submits` 33–42 at the check |
-| UI: dialog while running | "UEVR is running in the game now." Remove disabled (screenshot in `docs/img/uevr-dialog.png`) |
-| UI: Remove → Install → Play in VR → Remove | Each worked; Play in VR injected (`frame_submits` 106 a few seconds later) |
-| After the last Remove | `drive_c`, `AppData/Roaming` and `AppData/Local` listings matched the pre-install state; download cache and receipts gone; no game or `python.exe` processes. The empty `/tmp/frame-control-mods.lock` was deleted by hand (tmpfs) |
-
-Battery 98–100 % on charge. Lock released at 12:52.
-
-## After the second review (13:01–13:03)
-
-`frame_inject.py` now declares every Win32 signature, checks each result,
-frees its remote buffers and closes its handles; uninstall accepts only our
-folder and UEVR's own settings folders. Rechecked: install; three cold starts
-injected in 35, 34 and 33 s (`frame_submits` 42, 38, 47), UEVR logging
-`Framework initialized` and `Requested runtime: openvr_api.dll`; uninstall
-left `drive_c`, `AppData/Roaming` and `AppData/Local` as before, with no cache,
-receipts or processes. Frame Control's injector total: 12 of 12 cold starts
-through the API, plus the UI run.
-
-## Left on the Frame
-
-- Gravitas (free, 7.4 GB, installed 2026-09-28 for this work) is still
-  installed; nothing else from this work is left.
-- No `UEVRInjector.exe` or game processes were left running. Steam and
-  SteamVR were running at the end.
-- The test lock was released at 13:03.

docs/evidence/vr-utilities/device.json

@@ -1,53 +0,0 @@
-{
-  "date": "2026-09-28",
-  "os": {
-    "version": "0.4.1",
-    "build": "20260925.6191901",
-    "variant": "vr"
-  },
-  "performance": {
-    "compositorFps": 72.0,
-    "frameMs": 13.89,
-    "appFps": null,
-    "gpuMs": 3.07,
-    "compositorCpuMs": 0.61,
-    "cpuPercent": 40.6,
-    "gpuMHz": 903.0
-  },
-  "batteryPercent": 16,
-  "maxTempC": 73.5,
-  "ownership": [
-    {
-      "id": 1009850,
-      "owned": false,
-      "installed": false,
-      "frame": 0
-    },
-    {
-      "id": 1173510,
-      "owned": false,
-      "installed": false,
-      "frame": 0
-    },
-    {
-      "id": 1068820,
-      "owned": false,
-      "installed": false,
-      "frame": 0
-    },
-    {
-      "id": 908520,
-      "owned": false,
-      "installed": false,
-      "frame": 0
-    },
-    {
-      "id": 1494460,
-      "owned": false,
-      "installed": false,
-      "frame": 0
-    }
-  ],
-  "hudLifecycle": "open, duplicate-open, close passed before control-test pause; overlay probe removal verified",
-  "comfort": "Initial 1cm seated probe restored exactly. Later commits/readback disagreed while Frame in use; Alex paused control tests. No controls shipped."
-}

docs/evidence/vr-utilities/review.md

@@ -1,58 +0,0 @@
-# Independent review attempts — 2026-09-28
-
-Target: the implementation and evidence in
-[3fb541d](https://github.com/saphid/frame-control/commit/3fb541d) and
-[6a63a5a](https://github.com/saphid/frame-control/commit/6a63a5a), supplied as a
-frozen diff before those commits were made. No executable code changed after
-the final review snapshot.
-
-Requested model: **SWE-2 Max**, explicitly selected with `--model swe-2-max`.
-No completed verdict or model self-identification was returned. This is not a
-passed review, and there is no "no actionable findings" claim.
-
-## First attempt
-
-Launcher:
-
-```sh
-devin -p --model swe-2-max --permission-mode auto --respect-workspace-trust false --prompt-file /tmp/frame-vr-review-prompt.txt
-```
-
-The prompt required read-only review, no delegation, no edits and no Frame
-access. The reviewer inspected surrounding code, then stopped while checking
-the public OpenVR header. The tool runner reported:
-
-> warning: rejected a tool call that requires confirmation. Running in non-interactive mode.
-
-The real launcher exit status was **0**, but no verdict was returned. A zero
-process status here is not evidence that the review completed.
-
-## Tool-free retry
-
-Launcher:
-
-```sh
-devin -p --model swe-2-max --permission-mode auto --respect-workspace-trust false --prompt-file /tmp/frame-vr-review-final-prompt.txt
-```
-
-The self-contained prompt supplied the complete frozen changes, surrounding
-code, standards and locally fetched authoritative OpenVR header excerpts. It
-explicitly prohibited tools, edits, delegation and device access. This avoided
-the first attempt's permission boundary without escalating permissions.
-
-No output or verdict arrived within the fifteen-minute review window. The
-process was sent SIGTERM at 918 seconds; the shell recorded real exit status
-**143**. Findings are unavailable. Review must be completed before considering
-this partial draft ready; playspace feasibility is also still paused.
-
-## Other validation
-
-- 166 Python unit tests passed locally.
-- 8 website tests and UI JavaScript syntax passed locally.
-- Desktop and phone-width attached-preview checks passed using live telemetry;
-  paid optional install buttons were disabled, and unavailable metrics cleared.
-- [Fake-Frame CI](https://github.com/saphid/frame-control/actions/runs/36423548487/job/108931878908)
-  passed, as did Windows/Linux server tests and the main checks job. Docker was
-  unavailable locally. macOS/iOS jobs were still queued at this handoff.
-- Real-device evidence and the paused-control limitation are in
-  [VR utilities](../../vr-utilities.md).

docs/evidence/windows-vm-2026-10-24.md

@@ -1,151 +0,0 @@
-# Windows VM and real Frame test, 2026-10-24
-
-The v0.4.10 installer could enumerate windows/screens and encode a synthetic
-Media Foundation stream, but every desktop capture failed at pipeline parsing:
-`no property "capture-api" in element "d3d11screencapturesrc"`.
-MSYS2's GStreamer 1.28.8 package disables WGC. After the fix, the same installed
-bundle captured the actual Windows desktop with Desktop Duplication and sent
-H.264 to a real Frame: 219 sent frame records, 215 decoded and drawn before the
-snapshot. Individual windows are explicitly unavailable with this bundle.
-
-The base was `e9cbb8fd5555f5cfceeba1babadf2d7d35dcd3be` (`v0.4.10`, origin/main,
-including merged #121), in isolated branch `t3/test-windows-vm-headset`.
-
-## Evidence
-
-- [Capture before the fix](windows-vm-2026-10-24/capture-before.json): five
-  synthetic H.264 frames and five JPEG frames; zero desktop/window frames,
-  with the missing-property error for both codecs.
-- [Actual bundled properties](windows-vm-2026-10-24/plugin-properties.json):
-  `monitor-handle` exists; `capture-api`, `window-handle`, `show-border` do not.
-  [MSYS2 package build](https://github.com/msys2/MINGW-packages/blob/master/mingw-w64-gst-plugins-bad/PKGBUILD)
-  sets `-Dd3d11-wgc=disabled`. Upstream
-  [installs those properties conditionally](https://github.com/GStreamer/gstreamer/blob/main/subprojects/gst-plugins-bad/sys/d3d11/gstd3d11screencapturesrc.cpp).
-- [Capture after the fix](windows-vm-2026-10-24/capture-after.json): the real
-  display produces five H.264 and five JPEG frames. Window sources are hidden
-  with an explicit reason, and the display selects `capture_api=dxgi`.
-- [Raw locked headset session](windows-vm-2026-10-24/headset-session.json):
-  Windows helper, Media Foundation encoder, reverse SSH tunnel, production
-  panel launcher and shared viewer. The image below was captured from that
-  viewer's own X window on the Frame, rather than the VM's console.
-- [Windows tests](windows-vm-2026-10-24/windows-tests.txt) and
-  [guest system details](windows-vm-2026-10-24/windows-system.txt).
-
-![Windows VM desktop decoded in the Frame's own viewer](windows-vm-2026-10-24/headset-view.png)
-
-## Host and VM prerequisites
-
-lxso2: Intel Core i7-8700, 12 logical CPUs, VT-x/KVM; Docker 29.1.3 and Compose
-2.40.3. Before starting: 31 GiB RAM, 15 GiB available; 147 GiB free disk.
-Swap was already full. No other VM or service workload was started or stopped.
-Docker listed no Windows VM, and ports 2222/8006/13389 were unused.
-
-The execution sandbox hid KVM and denied Docker/network access. Checks outside
-it found `/dev/kvm`, `/dev/net/tun` and the Docker daemon. Direct user access to
-KVM was denied, but a disposable Docker container with `--device /dev/kvm`
-opened it successfully; no host permissions changed.
-
-Created only `frame-winvm-priority3`, labelled
-`frame-control.task=priority3-windows-test`: 4 vCPUs, 8 GiB guest RAM, 32 GiB
-growable disk, no restart, 150-second stop timeout. SSH 2222 and console 8006
-bind only 127.0.0.1; RDP is unpublished. No GPU passthrough. Image:
-`dockurr/windows@sha256:16fd7c39a3e48bb946d29c59dc6015942e5b900a1fa5d7e5552053bfc48ee2ea`
-(Windows for Docker v6.06, QEMU v11.1.1).
-
-The container downloaded Windows 11 from Microsoft, with no activation changes.
-It took about 16 minutes to reach the first desktop. Guest build 26200.8037,
-Red Hat VirtIO GPU DOD driver 100.103.104.30200. The old WindowsProductName
-registry field still says Windows 10 Pro; the actual desktop/setup is Windows
-11. After installing the app, the 32 GiB disk had about 9.3 GB free.
-
-Official `Frame-Control-Setup-x64.exe` v0.4.10 SHA-256:
-`30165bc5aa39f941cacc697d195dc5c30b01ad0b9ffb472da8a18a5220549202`.
-Its installer exited 0. The VM stream used an intermediate Python/UI-only
-fix with the released DLL bundle and bundled Python 3.12.14. A later CI failure
-showed that probing GStreamer through a separately loaded DLL could see a
-different, uninitialized instance. The final fix probes optional properties
-through the capture DLL itself. Windows CI checks that native change; the VM
-stream was not repeated with the final DLL.
-
-OEM setup added OpenSSH Server, PowerShell and a dedicated public login key;
-password authentication is disabled. Its config needed an explicit
-`AuthorizedKeysFile C:/ProgramData/ssh/administrators_authorized_keys` before
-key login worked. The default informational share was replaced with a private
-writable staging share inside this container. These were test-VM setup steps,
-not app defects. Host setup files and the stopped VM disk are retained under
-`/tmp/frame-winvm-priority3/`; no private keys are committed or printed.
-The Frame test key was generated inside Windows and its private key stayed
-there. Only its public key was temporarily authorized on the Frame. After
-testing, the guest key and scheduled task were removed; `docker stop -t 150`
-shut down the dedicated VM. Inspection confirmed `exited`, restart `no`
-(container exit 143; logs show the ACPI shutdown signal, waiting for Windows,
-and `Shutdown completed!`). The disk is retained
-for reuse; the VM is not running.
-
-## Checks
-
-- Baseline PC-focused suite: 24 tests passed, one native class skipped.
-- After fix: full Linux unittest suite **1260 tests, OK, 15 skipped**, 144.366 s;
-  focused final PC suite **27 tests, OK, one native class skipped**. The C
-  controller's frozen 600-state trace ran on Linux.
-- Actual Windows installer bundle with the intermediate Python/UI fix:
-  **33 tests, OK, four skipped** (no C compiler, Linux PipeWire test, two
-  CI-only x264 tests). Its GObject property probe, host/encoder check and
-  x264-absence check ran. The final native probe is checked in the PR's
-  Windows CI build, not by this VM run.
-- Browser check with the real production HTML/JavaScript and mocked Windows API
-  responses: DXGI whole-screen Show remains available, the limitation appears
-  once, WGC window sources retain Show, off hides controls, and the limitation
-  text is escaped. This used a static asset server, without headset API access.
-- `node --test app/test/*.test.js`: passed, three test files.
-- `node --test site/test/*.test.mjs`: passed, one test file.
-- The first full Linux run inside the sandbox failed (11 failures, 139 errors),
-  including loopback socket `PermissionError`. The successful full runs were
-  outside that socket restriction.
-- An initial guest test archive omitted `apk-catalog`, causing one import
-  error; the complete archive produced the 33-test passing Windows run.
-
-Raw local logs: `/tmp/frame-windows-{pc,app,site}-tests.log`,
-`/tmp/frame-windows-full-tests-unrestricted.log`,
-`/tmp/frame-windows-full-fixed-tests.log`, and
-`/tmp/frame-winvm-priority3/`. The committed artifacts above preserve the
-capture, Windows test and headset evidence independently of those local files.
-
-## Shared Frame session and cleanup
-
-Read-only checks first: SteamOS 0.5.6, BUILD_ID `20261015.6141207`, battery 99%,
-Not charging (another supply reports Full). The lock was free.
-
-Both attempts acquired `/tmp/frame-test.lock` atomically before any key or
-viewer changes, and removed only the lock acquired by this task. The first,
-35-second attempt failed because the test wrapper sent CRLF script input and
-left SSH stdin open. Production already sends script bytes and closes stdin;
-correcting the wrapper resolved both. Its key was removed and lock released.
-
-The successful session held the lock **03:09:36–03:10:05 UTC (29 seconds)**.
-It used a dedicated `pc-view-priority3` profile and port range 47960–47964,
-leaving existing viewers/profiles alone. The app's Windows `PCView` captured
-`display:65537`, 1280×800, Light preset (30 fps ceiling), and opened panel
-`valve.steam.desktopgame.2001396898`. The viewer reported H.264 software decode,
-218 received frames, 215 decoded/drawn before the snapshot (219 sent records).
-
-This mostly idle, roughly ten-second sample reported 19 fps and content delay
-p50/p95 51.6/75.2 ms. These are observations, not a performance-target pass.
-
-Cleanup stopped the helper and tunnel, closed the own viewer, removed its two
-possible profile paths and log, then removed the exact public-key line. The
-`authorized_keys` SHA-256 was identical before/after. A follow-up login from
-Windows with that key failed with exit 255. Separate checks found no task-owned
-viewer processes, the profile absent, and the shared lock released. Battery
-remained 99%; the sampled gamescope focus properties matched before/after.
-No reboot, global settings changes, game launch or Steam/SteamVR stop occurred.
-
-## Limits
-
-This verifies a Windows VM's desktop capture, Media Foundation encoding and
-real Frame viewer decode/rendering. It does not verify physical-PC hardware
-encoding, WGC or individual-window capture, mixed DPI, multiple displays,
-physical laser alignment/clicks, keyboard layouts, resize/minimise, busy-scene
-performance, bitrate/encoder restarts, or worn-headset comfort. No input was
-injected during the real Frame session. The installed app’s Tools navigation was not exercised; its streaming
-controller, tunnel and viewer were exercised directly. No independent review was performed.

docs/evidence/windows-vm-2026-10-24/capture-after.json

@@ -1,53 +0,0 @@
-{
-  "python": "3.12.14 (main, Sep 24 2026, 17:57:31) [MSC v.1944 64 bit (AMD64)]",
-  "resources": "C:\\Users\\frame\\AppData\\Local\\Programs\\Frame Control\\resources",
-  "elements": {
-    "d3d11screencapturesrc": true,
-    "mfh264enc": true,
-    "jpegenc": true,
-    "x264enc": false
-  },
-  "windowCaptureReason": "Individual windows are unavailable in this build. Choose a whole screen instead.",
-  "windows": [],
-  "displays": [
-    {
-      "src": "display:65537",
-      "name": "Display 1",
-      "x": 0,
-      "y": 0,
-      "w": 1280,
-      "h": 800,
-      "capture_api": "dxgi"
-    }
-  ],
-  "runs": [
-    {
-      "source": "test",
-      "codec": "h264",
-      "frames": 5,
-      "pipeline": "videotestsrc name=source is-live=true pattern=ball ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360,format=NV12 ! mfh264enc name=enc low-latency=true bframes=0 gop-size=60 bitrate=1000 ! h264parse config-interval=-1 ! video/x-h264,stream-format=byte-stream,alignment=au ! appsink name=out sync=false max-buffers=2 drop=false",
-      "last_bytes": 154
-    },
-    {
-      "source": "test",
-      "codec": "jpeg",
-      "frames": 5,
-      "pipeline": "videotestsrc name=source is-live=true pattern=ball ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360 ! jpegenc name=enc quality=80 ! appsink name=out sync=false max-buffers=2 drop=false",
-      "last_bytes": 7336
-    },
-    {
-      "source": "display:65537",
-      "codec": "h264",
-      "frames": 5,
-      "pipeline": "d3d11screencapturesrc show-cursor=true monitor-handle=65537 ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360,format=NV12 ! mfh264enc name=enc low-latency=true bframes=0 gop-size=60 bitrate=1000 ! h264parse config-interval=-1 ! video/x-h264,stream-format=byte-stream,alignment=au ! appsink name=out sync=false max-buffers=2 drop=false",
-      "last_bytes": 65
-    },
-    {
-      "source": "display:65537",
-      "codec": "jpeg",
-      "frames": 5,
-      "pipeline": "d3d11screencapturesrc show-cursor=true monitor-handle=65537 ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360 ! jpegenc name=enc quality=80 ! appsink name=out sync=false max-buffers=2 drop=false",
-      "last_bytes": 113339
-    }
-  ]
-}

docs/evidence/windows-vm-2026-10-24/capture-before.json

@@ -1,96 +0,0 @@
-{
-  "python": "3.12.14 (main, Sep 24 2026, 17:57:31) [MSC v.1944 64 bit (AMD64)]",
-  "resources": "C:\\Users\\frame\\AppData\\Local\\Programs\\Frame Control\\resources",
-  "elements": {
-    "d3d11screencapturesrc": true,
-    "mfh264enc": true,
-    "jpegenc": true,
-    "x264enc": false
-  },
-  "windows": [
-    {
-      "src": "window:131836",
-      "id": 131836,
-      "title": "Administrator: C:\\WINDOWS\\system32\\cmd.exe - powershell  -noprofile -executionpolicy bypass -file \\\\host.lan\\data\\bootstrap.ps1",
-      "app": "Windows",
-      "w": 1115,
-      "h": 628,
-      "x": 51,
-      "y": 52
-    },
-    {
-      "src": "window:327926",
-      "id": 327926,
-      "title": "Administrator: Install",
-      "app": "Windows",
-      "w": 979,
-      "h": 512,
-      "x": 85,
-      "y": 78
-    },
-    {
-      "src": "window:65856",
-      "id": 65856,
-      "title": "Program Manager",
-      "app": "Windows",
-      "w": 1280,
-      "h": 800,
-      "x": 0,
-      "y": 0
-    }
-  ],
-  "displays": [
-    {
-      "src": "display:65537",
-      "name": "Display 1",
-      "x": 0,
-      "y": 0,
-      "w": 1280,
-      "h": 800
-    }
-  ],
-  "runs": [
-    {
-      "source": "test",
-      "codec": "h264",
-      "frames": 5,
-      "pipeline": "videotestsrc name=source is-live=true pattern=ball ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360,format=NV12 ! mfh264enc name=enc low-latency=true bframes=0 gop-size=60 bitrate=1000 ! h264parse config-interval=-1 ! video/x-h264,stream-format=byte-stream,alignment=au ! appsink name=out sync=false max-buffers=2 drop=false",
-      "last_bytes": 154
-    },
-    {
-      "source": "test",
-      "codec": "jpeg",
-      "frames": 5,
-      "pipeline": "videotestsrc name=source is-live=true pattern=ball ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360 ! jpegenc name=enc quality=80 ! appsink name=out sync=false max-buffers=2 drop=false",
-      "last_bytes": 7336
-    },
-    {
-      "source": "display:65537",
-      "codec": "h264",
-      "frames": 0,
-      "pipeline": "d3d11screencapturesrc capture-api=wgc show-cursor=true show-border=true monitor-handle=65537 ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360,format=NV12 ! mfh264enc name=enc low-latency=true bframes=0 gop-size=60 bitrate=1000 ! h264parse config-interval=-1 ! video/x-h264,stream-format=byte-stream,alignment=au ! appsink name=out sync=false max-buffers=2 drop=false",
-      "error": "no property \"capture-api\" in element \"d3d11screencapturesrc\""
-    },
-    {
-      "source": "display:65537",
-      "codec": "jpeg",
-      "frames": 0,
-      "pipeline": "d3d11screencapturesrc capture-api=wgc show-cursor=true show-border=true monitor-handle=65537 ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360 ! jpegenc name=enc quality=80 ! appsink name=out sync=false max-buffers=2 drop=false",
-      "error": "no property \"capture-api\" in element \"d3d11screencapturesrc\""
-    },
-    {
-      "source": "window:131836",
-      "codec": "h264",
-      "frames": 0,
-      "pipeline": "d3d11screencapturesrc capture-api=wgc show-cursor=true show-border=true window-handle=131836 ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360,format=NV12 ! mfh264enc name=enc low-latency=true bframes=0 gop-size=60 bitrate=1000 ! h264parse config-interval=-1 ! video/x-h264,stream-format=byte-stream,alignment=au ! appsink name=out sync=false max-buffers=2 drop=false",
-      "error": "no property \"capture-api\" in element \"d3d11screencapturesrc\""
-    },
-    {
-      "source": "window:131836",
-      "codec": "jpeg",
-      "frames": 0,
-      "pipeline": "d3d11screencapturesrc capture-api=wgc show-cursor=true show-border=true window-handle=131836 ! video/x-raw,framerate=30/1 ! queue name=raw_queue leaky=downstream max-size-buffers=1 max-size-bytes=0 max-size-time=0 ! identity name=gate ! videoconvert ! videoscale add-borders=false ! video/x-raw,width=640,height=360 ! jpegenc name=enc quality=80 ! appsink name=out sync=false max-buffers=2 drop=false",
-      "error": "no property \"capture-api\" in element \"d3d11screencapturesrc\""
-    }
-  ]
-}

docs/evidence/windows-vm-2026-10-24/plugin-properties.json

@@ -1,65 +0,0 @@
-{
-  "gstreamer": "1.28.8",
-  "plugins": [
-    "coreelements",
-    "videotestsrc",
-    "videoconvertscale",
-    "app",
-    "jpeg",
-    "videoparsersbad",
-    "d3d11",
-    "mediafoundation"
-  ],
-  "packages": [
-    "mingw-w64-ucrt-x86_64-gst-plugins-bad 1.28.8-2",
-    "mingw-w64-ucrt-x86_64-gst-plugins-bad-libs 1.28.8-2",
-    "mingw-w64-ucrt-x86_64-gstreamer 1.28.8-1"
-  ],
-  "elements": {
-    "d3d11screencapturesrc": {
-      "name": "The name of the object",
-      "parent": "The parent of the object",
-      "blocksize": "Size in bytes to read per buffer (-1 = default)",
-      "num-buffers": "Number of buffers to output before sending EOS (-1 = unlimited)",
-      "typefind": "Run typefind before negotiating (deprecated, non-functional)",
-      "do-timestamp": "Apply current stream time to buffers",
-      "automatic-eos": "Automatically EOS when the segment is done",
-      "monitor-index": "Zero-based index for monitor to capture (-1 = primary monitor)",
-      "monitor-handle": "A HMONITOR handle of monitor to capture",
-      "show-cursor": "Whether to show mouse cursor",
-      "crop-x": "Horizontal coordinate of top left corner for the screen capture area",
-      "crop-y": "Vertical coordinate of top left corner for the screen capture area",
-      "crop-width": "Width of screen capture area (0 = maximum)",
-      "crop-height": "Height of screen capture area (0 = maximum)"
-    },
-    "d3d12screencapturesrc": null,
-    "mfh264enc": {
-      "name": "The name of the object",
-      "parent": "The parent of the object",
-      "qos": "Handle Quality-of-Service events from downstream",
-      "min-force-key-unit-interval": "Minimum interval between force-keyunit requests in nanoseconds",
-      "bitrate": "Bitrate in kbit/sec",
-      "rc-mode": "Rate Control Mode",
-      "adaptive-mode": "Adaptive Mode",
-      "vbv-buffer-size": "VBV(HRD) Buffer Size in bytes (0 = MFT default)",
-      "max-bitrate": "The maximum bitrate applied when rc-mode is \"pcvbr\" in kbit/sec",
-      "quality-vs-speed": "Quality and speed tradeoff, [0, 33]: Low complexity, [34, 66]: Medium complexity, [67, 100]: High complexity",
-      "cabac": "Enable CABAC entropy coding",
-      "sps-id": "The SPS id to use",
-      "pps-id": "The PPS id to use",
-      "bframes": "The maximum number of consecutive B frames",
-      "gop-size": "The number of pictures from one GOP header to the next. Depending on GPU vendor implementation, zero gop-size might produce only one keyframe at the beginning (-1 for automatic)",
-      "threads": "The number of worker threads used by a encoder, (0 = MFT default)",
-      "content-type": "Indicates the type of video content",
-      "qp": "QP applied when rc-mode is \"qvbr\"",
-      "low-latency": "Enable low latency encoding",
-      "min-qp": "The minimum allowed QP applied to all rc-mode",
-      "max-qp": "The maximum allowed QP applied to all rc-mode",
-      "qp-i": "QP applied to I frames",
-      "qp-p": "QP applied to P frames",
-      "qp-b": "QP applied to B frames",
-      "ref": "The number of reference frames",
-      "d3d11-aware": "Whether device can support Direct3D11 interop"
-    }
-  }
-}

docs/evidence/windows-vm-2026-10-24/windows-system.txt

@@ -1,18 +0,0 @@
-
-WindowsProductName WindowsVersion OsBuildNumber
------------------- -------------- -------------
-Windows 10 Pro     2009           26200        
-
-
-
-Name                              DriverVersion     Status
-----                              -------------     ------
-Red Hat VirtIO GPU DOD controller 100.103.104.30200 OK    
-
-
-
-       Used       Free
-       ----       ----
-23951253504 9314816000
-
-

docs/evidence/windows-vm-2026-10-24/windows-tests.txt

@@ -1,79 +0,0 @@
-python.exe : test_original_mac_congestion_and_recovery 
-(test_pc_controller.ControllerTrace.test_original_mac_congestion_and_recovery) ... skipped 'C 
-compiler not installed; native build jobs cover this trace'
-At line:12 char:1
-+ & $python -B -m unittest discover -s tests -p 'test_pc*.py' -v 2>&1 | ...
-+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-    + CategoryInfo          : NotSpecified: (test_original_m...ver this trace':String) [], Remote 
-   Exception
-    + FullyQualifiedErrorId : NativeCommandError
- 
-test_controller_is_inert_after_close 
-(test_pcview.AdapterTests.test_controller_is_inert_after_close) ... ok
-test_dxgi_only_bundle_captures_displays_without_optional_wgc_properties (test_pcview.AdapterTests.
-test_dxgi_only_bundle_captures_displays_without_optional_wgc_properties) ... ok
-test_idle_source_is_not_a_stall (test_pcview.AdapterTests.test_idle_source_is_not_a_stall) ... ok
-test_library_path_prepend_adds_no_empty_entry 
-(test_pcview.AdapterTests.test_library_path_prepend_adds_no_empty_entry) ... ok
-test_linux_uses_only_portal_fd_and_node 
-(test_pcview.AdapterTests.test_linux_uses_only_portal_fd_and_node) ... ok
-test_malformed_viewer_input_is_dropped_not_fatal 
-(test_pcview.AdapterTests.test_malformed_viewer_input_is_dropped_not_fatal) ... ok
-test_pc_card_receives_window_capture_limitation 
-(test_pcview.AdapterTests.test_pc_card_receives_window_capture_limitation) ... ok
-test_pc_reuses_launcher_and_namespaces_panel_ids 
-(test_pcview.AdapterTests.test_pc_reuses_launcher_and_namespaces_panel_ids) ... ok
-test_portal_input_clamps_and_releases_held_state 
-(test_pcview.AdapterTests.test_portal_input_clamps_and_releases_held_state) ... ok
-test_refused_windows_focus_never_clicks_the_covering_app 
-(test_pcview.AdapterTests.test_refused_windows_focus_never_clicks_the_covering_app) ... ok
-test_session_end_releases_native_input_only_once 
-(test_pcview.AdapterTests.test_session_end_releases_native_input_only_once) ... ok
-test_stats_keep_capture_time_and_bound_records 
-(test_pcview.AdapterTests.test_stats_keep_capture_time_and_bound_records) ... ok
-test_windows_release_and_negative_monitor_origin 
-(test_pcview.AdapterTests.test_windows_release_and_negative_monitor_origin) ... ok
-test_windows_sources_follow_actual_wgc_capabilities 
-(test_pcview.AdapterTests.test_windows_sources_follow_actual_wgc_capabilities) ... ok
-test_windows_uses_wgc_and_media_foundation 
-(test_pcview.AdapterTests.test_windows_uses_wgc_and_media_foundation) ... ok
-test_never_offered_off_windows_even_when_turned_on 
-(test_pcview.GatingTests.test_never_offered_off_windows_even_when_turned_on) ... ok
-test_off_by_default_starts_nothing (test_pcview.GatingTests.test_off_by_default_starts_nothing) 
-... ok
-test_only_windows_gets_the_pc_host (test_pcview.GatingTests.test_only_windows_gets_the_pc_host) 
-... ok
-test_server_enable_action (test_pcview.GatingTests.test_server_enable_action) ... ok
-test_turning_off_stops_streams_and_the_helper 
-(test_pcview.GatingTests.test_turning_off_stops_streams_and_the_helper) ... ok
-test_turning_on_checks_for_the_bundled_libraries 
-(test_pcview.GatingTests.test_turning_on_checks_for_the_bundled_libraries) ... ok
-test_expiry_and_stop_before_redeem (test_pcview.GrantsTests.test_expiry_and_stop_before_redeem) 
-... ok
-test_source_bound_retry_ack_and_stop 
-(test_pcview.GrantsTests.test_source_bound_retry_ack_and_stop) ... ok
-test_agent_reports_its_host_and_encoder 
-(test_pcview.NativeTests.test_agent_reports_its_host_and_encoder) ... ok
-test_auth_and_real_h264_stats (test_pcview.NativeTests.test_auth_and_real_h264_stats) ... skipped 
-'x264 is only in CI test bundles, not the installer'
-test_bundled_pipewire_context_needs_no_system_modules 
-(test_pcview.NativeTests.test_bundled_pipewire_context_needs_no_system_modules) ... skipped 
-'Linux PipeWire client libraries'
-test_installer_bundle_leaves_out_gpl_x264 
-(test_pcview.NativeTests.test_installer_bundle_leaves_out_gpl_x264) ... ok
-test_last_raw_picture_survives_a_closed_gate 
-(test_pcview.NativeTests.test_last_raw_picture_survives_a_closed_gate) ... skipped 'x264 is only 
-in CI test bundles, not the installer'
-test_native_property_probe_checks_the_instantiated_element 
-(test_pcview.NativeTests.test_native_property_probe_checks_the_instantiated_element) ... ok
-test_card_says_experimental_and_what_is_unverified 
-(test_pcview.PageTests.test_card_says_experimental_and_what_is_unverified) ... ok
-test_opt_in_is_remembered_with_the_client_preferences 
-(test_pcview.PageTests.test_opt_in_is_remembered_with_the_client_preferences) ... ok
-test_tool_link_is_windows_only_and_marked_experimental 
-(test_pcview.PageTests.test_tool_link_is_windows_only_and_marked_experimental) ... ok
-
-----------------------------------------------------------------------
-Ran 33 tests in 1.684s
-
-OK (skipped=4)

docs/family-comfort.md

@@ -1,122 +0,0 @@
-# Family and comfort
-
-Frame Control's Home tab has a **Family and comfort** card, on desktop and
-on iPhone. No third-party notification or parental-control app is needed.
-This is Frame Control code using Python, Steam and SteamVR already on the Frame.
-
-![Family and comfort controls in the desktop app](img/comfort-desktop.png)
-
-## Sessions
-
-Set a limit of 1–240 minutes, optional break and check-in intervals, then
-**Start session**. Break and check-in intervals of 0 turn those reminders off.
-**Cancel session** cancels the timer and monitoring without changing the game.
-Cancel before starting a session with different settings.
-
-The Frame shows a one-minute warning, then opens Steam Home in its dashboard.
-**Games stay running**: save and pause before the limit. Some games pause when
-the dashboard opens; others do not. There is no kill, power-off, Steam restart,
-account restriction or parental lock. The wearer can return to the game.
-
-**Documented implementation:** the timer is a single, opt-in Python worker in
-the Frame user's account. Desktop and iPhone share its state. It keeps going
-when the companion disconnects, closes or is suspended. It exits after
-completion or cancellation (normally within five seconds). Cancellation waits
-for any in-flight SteamVR action to finish within its timeout; it is not a boot
-service. A Frame reboot invalidates the session. Suspend counts toward the
-limit, using Linux's boot-time clock. If a warning was delayed by suspend or a
-SteamVR failure, Home waits until at least a full minute after a successful
-warning. A failed Home transition remains active and retries, with an error
-shown in the companion. A stale worker is reported as unverified enforcement.
-
-## Alerts and breaks
-
-During a session, battery, overheating and check-in alerts go to connected
-companions. Break reminders and session warnings also appear on the headset.
-
-- **Low battery:** 15% or below while discharging. One alert until charging or
-  recovery to 20%, so values around 15% do not produce repeated notifications.
-- **Overheating:** a thermal zone reaches its own kernel-reported hot/critical
-  trip, or the battery reports `Overheat`. Missing sensors mean unknown, not
-  safe. These are status alerts, not medical advice or an extra thermal governor.
-- **Check in:** an alert after the chosen number of active minutes.
-- **Breaks:** a SteamVR reminder and companion notification at the chosen interval.
-
-**Inferred:** SteamVR activity levels 1 and 2 are a useful proxy for use, not
-proof someone is wearing the headset. Inactive readings reset continuous use;
-missing readings add no time. Long gaps count at most 30 seconds. Breaks and
-check-ins are distinct from the elapsed-time session limit.
-
-Click **Enable / test notifications** on each companion. iOS asks for permission;
-macOS, Windows and Linux follow their notification settings. The page also shows
-recent events and errors. Keep Frame Control open and connected for companion
-alerts. **Phone alerts are local, not push notifications:** iOS suspension,
-force-quit or a lost SSH connection prevents live delivery. Old alerts are not
-replayed as a notification burst on reconnect. Headset warnings and the session
-limit continue without the phone. A physical iPhone's background delivery has
-not been verified and is not guaranteed.
-
-## Casting
-
-**Cast to this screen** (Home → **Right now**) starts the existing headset Live view and requests full
-screen where supported. Show that screen to people in the room, or use the
-computer/phone's own screen mirroring. It creates no new stream transport,
-public URL or LAN server. iPhone uses the inline viewer if full screen is not
-available. The image includes private content visible to the wearer.
-
-## What is installed
-
-The shared authenticated `/api/comfort` endpoint copies three bundled Python
-files to `~/.cache/frame-control/comfort/<content-hash>/`. Session state and
-locks live in `~/.local/state/frame-control/comfort/`, with a private directory
-and 0600 state file. There is no network listener or system service. Cancel a
-session before removing these directories. The iPhone's normal server still
-exits on disconnect; the explicitly started comfort worker is the exception.
-
-## Verification
-
-**Verified 2026-09-28**, SteamOS 0.4.1, build `20260925.6191901`: shipped
-`/opt/steamvr/bin/linuxarm64/vrcmd --notify TEXT` reported success for a custom
-reminder. Steam's CDP `SteamUIStore.Navigate('/library/home')` and
-`SteamClient.OpenVR.VROverlay.ShowDashboard('valve.steam.gamepadui.main')`
-opened Home while the running app ID stayed unchanged. Prior page and dashboard
-visibility were restored. Kernel hot/critical trips and SteamVR activity were
-read from the real device. No temperature or battery fault was induced.
-
-**Verified locally:** deterministic fake-Frame tests cover late warnings,
-failed warnings/Home actions, cancellation, activity gaps, thresholds, duplicate
-suppression, reboot invalidation, shared session state and the exact Home
-JavaScript. `python3 -m unittest discover -s tests` runs them. The iOS Simulator
-build tests notification content and bounds. Physical iPhone delivery and
-wearer-perceived headset notification visibility remain unverified.
-
-**Verified end to end on the same Frame:** a two-minute session with no companion
-connection for 135 seconds emitted its warning, break and check-in, then opened
-Home. The running app ID was unchanged; the test restored the previous page and
-dashboard visibility and confirmed the worker exited. Casting through the Home
-shortcut decoded the existing headset stream at 30 fps.
-
-**Verified on the iOS 26.5 Simulator:** connected to the real Frame, approved the
-notification prompt, and saw the native Frame Control test banner. Seven iOS
-tests passed.
-
-![Native test notification in the iOS Simulator](img/comfort-notification-ios.png)
-
-Desktop and 390-pixel phone layouts had no horizontal overflow.
-On macOS the development Electron app's real notification attempt was denied
-(`UNErrorDomain` 1); the bridge now returns that failure instead of reporting
-success. Successful macOS/Windows/Linux notification display remains unverified.
-
-**Verified on the real Frame:** its naturally discharging 15% battery produced
-one low-battery event during a short session; the test then cancelled the
-session. Overheating alerts use fake sensor samples in tests: the shared
-headset was not deliberately overheated.
-
-**Verified 2026-09-29 on the same Frame:** a fresh one-minute session opened
-Home more than 60 seconds after the successful warning. The test restored the
-previous page and dashboard visibility. Local regression coverage now includes
-slow notification delivery, a total Home-action timeout, failed worker startup,
-unreadable saved state, malformed activity samples and notification UX: 173
-Python tests passed. Desktop and 390-pixel layouts were checked again; system
-notification-denial guidance stayed visible across polls. Initial event history
-did not replay notifications, and only the latest new event was announced.

docs/file-transfer.md

@@ -15,10 +15,6 @@ depends on SSH working through the `frame` alias from `scripts/connect.sh`.
 | KDE Connect | KDE Connect on both | Guess | There's a macOS build of KDE Connect, but whether it's present or installable on the Frame wasn't confirmed. It would give you clipboard sync, file send, and remote input. Worth checking on-device. |
 | microSD | Physical card | Confirmed that the slot exists ([Wikipedia](https://en.wikipedia.org/wiki/Steam_Frame)) | Offline fallback. |
 
-Screenshots and Steam clips have their own buttons on **Tools → Capture &
-Live**, and **Settings → Copy to this computer** copies new ones here
-automatically: see [recording.md](recording.md#copying-new-ones-automatically).
-
 ## Clipboard
 
 `scripts/paste-to-frame.sh` sends the Mac clipboard (or stdin) to the
@@ -40,34 +36,3 @@ desktop has to be running in the headset. It's text only, and pastes over about
 
 A simpler fallback: `ssh frame 'cat > ~/clip.txt'` < file, then open it in the
 headset.
-
-### In Frame Control
-
-**Tools → Type on the headset** (also on Home, and press `T` anywhere) has the
-clipboard next to the keyboard and trackpad, both ways:
-
-- **Send text** or **Send this computer's clipboard** puts text on the headset's
-  clipboard, as above.
-- **Copy the headset's clipboard** brings it back: copy something in a desktop
-  app on the Frame, then press it, and paste on your computer. It calls
-  Klipper's `getClipboardContents` on the same D-Bus bus, and sends the text
-  back as base64, so accents, emoji and line breaks arrive unchanged. The
-  desktop app and the iPhone app put it on their own clipboard. With the server
-  in a browser, the server sets the clipboard of the computer it runs on:
-  `pbcopy` on macOS, PowerShell's `Set-Clipboard` (or `clip.exe`) on Windows,
-  `wl-copy`, `xclip` or `xsel` on Linux.
-
-It's text only, and copying back takes up to 1 MB; a bigger clipboard is
-refused with a message, so send big things as a file. An empty clipboard, or
-one holding an image, says so. Neither the server nor its log ever records what
-was on the clipboard.
-
-**Verified on a Frame, 2026-10-24:** SteamOS 0.5.6, build
-`20261015.6141207`. With a temporary nested desktop open, Frame Control sent
-a 47-character test marker to Klipper, then **Copy the headset's clipboard**
-read it through `getClipboardContents` and set a Linux PC's X11 clipboard.
-Reading that PC clipboard returned the exact marker. The prior headset
-clipboard was restored and the test desktop was closed. The PC side used a
-temporary X display on lxso2; macOS and Windows clipboard backends, a user's
-copy action in a headset app, and image/size error cases remain untested on a
-real headset. The fake Frame (`tests/fakeframe`) covers the protocol cases.

docs/frame-control.md

@@ -17,23 +17,13 @@ python3 ui/server.py         # anywhere: then open http://127.0.0.1:47810
 
 ## Features
 
-The window has six tabs: **Home** (what the headset's doing and what you'd do
-next, the headset view, screenshots, family and comfort, the keyboard and
-trackpad, and VR performance, folded away), **Games** (installed games,
-sideloaded titles, getting games), **Android** (apps, the catalogue, display
-settings, reports), **Tools** (in the headset: your computer's windows, the media
-player and the panel switcher; then sending files and text, Flatpaks, remote and
-power), **Devices** (your headsets and their addresses), and **Control** (the
-searchable Control Center, metrics, supported settings and headset guidance).
-Keys 1–6 switch between them, and `T` opens Type on the headset. The gear in the header (key 7) opens **Settings**:
-privacy and updates, library artwork and the assistant. The battery chip opens
-the headset's details: storage, memory, temperature, Wi-Fi, uptime and SteamOS
-build. Files can be dropped anywhere in the window. A
-connection pill in the header always shows which headset and whether it's
-connected, and how (Tailscale, or the network's name). Click it to add, edit or
-reorder the headset's addresses, or to see each step of connecting. When the Frame can't be
-reached, a banner says why in plain words, what was tried, and counts down to
-the next try, filling everything in once it answers. Flatpak and Android installs run in the background; the bottom bar
+The window has four tabs: **Home** (headset view, status, screenshots),
+**Games** (installed games, sideloaded titles, getting games), **Android** (apps,
+the catalogue, display settings, reports) and **Tools** (sending files and text,
+Flatpaks, remote and power). Keys 1–4 switch between them. Files can be dropped
+anywhere in the window. When the Frame can't be reached, one banner says why in
+plain words and the app retries every few seconds, filling everything in once it
+answers. Flatpak and Android installs run in the background; the bottom bar
 counts them while they run.
 
 - **Headset view**: what the lenses show, as SteamVR composites it (the room,
@@ -49,27 +39,11 @@ counts them while they run.
   gamescope's flat layer instead.
 - **Screenshots** you take in the headset with Steam's shortcut: browse them and
   save them to `~/Pictures/SteamFrame`.
-- **Record** what the headset shows, with its sound, to an `.mp4` in
-  `~/Videos/SteamFrame`, and **Steam clips**: export clips and background
-  recordings from Steam's game recording at any length, without re-encoding.
-  See [recording.md](recording.md). Not tested on a headset yet.
-- **Backup & recovery** (Tools): copy game saves, settings and Android app data
-  to `~/Documents/Frame Control Backups/<time>/` with a checksummed manifest,
-  restore chosen parts after a factory reset, and **Return to Game Mode** when
-  the headset is stuck in Desktop Mode. Sign-in files and keys are never copied.
-  Not tested on a headset yet. See [backup-and-recovery.md](backup-and-recovery.md).
 - **Battery** with charging state: charge rate in watts, time to full or empty,
   charger type and wattage (for example USB-C PD 20 W), and battery temperature.
 - **Status**: storage, memory, temperature, Wi-Fi, uptime, and whether SteamVR,
   the desktop, Lepton and xrdp are running.
 - **Library** shelf with Steam cover art and a Play button (`steam://rungameid`).
-- **Force quit** a game that has stopped responding: Steam games, sideloaded
-  titles, non-Steam shortcuts and Android apps. **Running now** at the top of
-  Games lists what's running; each game's own **Force quit…** (on its library
-  tile, or in a sideloaded title's ⋯ menu) and the Control Center's **Force quit
-  a game** card do the same. Each asks first, because unsaved progress is lost.
-  Steam is asked to quit the game, then its processes get SIGTERM and SIGKILL;
-  see [steam-games.md](steam-games.md#force-quitting-a-running-game).
 - **Get games**: every game you own with its Steam Frame rating (Verified,
   Playable, Unsupported, Unknown). Install on Frame downloads it to the headset
   with live progress. Search the Steam store with prices and Frame ratings; Buy
@@ -96,95 +70,18 @@ counts them while they run.
   their own Android app. A game's `.zip`, folder or `.exe` becomes a title in
   the Steam library (Valve's Devkit Game path, with Proton or the Steam Linux
   Runtime picked from the program's header), listed under **Sideloaded titles**
-  with Launch and Remove; see [sideloading.md](sideloading.md).
-- **Type on the headset** (on Home, in Tools, in the Control Center, or press
-  `T`): use your computer's keyboard and mouse, or a phone's touchscreen, in the
-  Frame's apps through KDE Connect, and move clipboard text both ways. Send
-  typed text or your computer's clipboard to the headset, or copy the headset's
-  clipboard back: copy in a desktop app on the Frame, then **Copy the headset's
-  clipboard**. The clipboard needs the desktop panel open in the headset; it's
-  text only, up to 1 MB. See [file-transfer.md](file-transfer.md#clipboard).
+  with Launch and Remove; see [sideloading.md](sideloading.md). Send typed text, or your computer's clipboard, to the
+  Frame clipboard.
 - **Mac in the headset** (macOS): show any Mac window, or a whole screen, as
   its own panel in the headset. Place it with the SteamVR dashboard, click and
   scroll with the laser, and type on the Mac. Streams hardware H.264 through
   an SSH tunnel; see [mac-in-headset.md](mac-in-headset.md).
 - **Flatpaks**: install and remove them (quick picks: Moonlight, Firefox, VLC,
   Remmina).
-- **Devices**: several headsets, each with several addresses (LAN IPs per
-  network, its `.local` mDNS name, its Tailscale IP or MagicDNS name). The app
-  tries them all at once and learns which worked on which network. Add, edit,
-  reorder and test addresses, find a headset on Tailscale or on this network,
-  name your networks, and switch headsets. See [devices.md](devices.md).
 - **One-click tools**: SSH or SFTP in a terminal window, Steam Link, and remote
   desktop (Windows App on macOS, Remote Desktop on Windows, Remmina or FreeRDP on
-  Linux). Remote desktop first checks that the Frame's xrdp answers on port
-  3389 (Developer Mode turns it on). On Windows it opens a connection file for
-  user `steamos`, because `mstsc /v:` alone offers your Windows account, which
-  xrdp turns away. Accept the warning about the Frame's own certificate, then
-  sign in with the Developer Mode password. Sleep, restart and
-  shut down open a terminal window because SteamOS asks for the sudo password
-  over SSH.
-
-## Control Center
-
-Open **Control** or `#control` to search controls, status and help. Categories
-cover device/audio, VR/comfort, apps/files, connection/remote and Frame Control
-preferences. Search is local: it matches labels, descriptions and familiar terms
-such as “DPI”, “microphone”, “recenter” and “keep awake”. Queries are not sent to
-Steam, app catalogues, analytics or models. Choosing a workflow link opens its
-existing screen; it does not install, cast, open a helper or change a setting.
-Home, Games, Android, Tools and Devices retain their existing features.
-
-The overview and detail cards use the shared `/api/status` sample: charge and
-power, user/system storage, memory, Wi-Fi, IP, OS/build, uptime, detected services
-and VR timings. Values refresh with the normal 30-second poll. A failed status
-request, lost connection, headset switch or sample received more than 90 seconds
-ago clears current readings and disables audio writes. The client receipt time
-and failed-read state are retained through page startup and UI redraws. Only a
-new successful status read clears a failure; reusing the retained sample does not.
-The headset timestamp is shown without assuming
-its clock matches this computer. Missing sensors show **Unavailable**;
-they are not converted to zero. Compositor FPS is separate from application FPS;
-GPU time is render time, not GPU utilisation. The temperature is the hottest
-readable sensor. Thermal trip warnings use per-zone kernel hot/critical limits,
-not a guessed universal temperature threshold.
-
-**Force quit a game** lists what's running only when you choose **Check what's
-running**, and says so when nothing is. Each **Force quit…** names the game and
-warns that unsaved progress will be lost before anything is sent; it uses the
-selected headset, refuses a second quit while one is running, and drops the
-list when you switch headsets.
-
-**Audio** controls the default output sink through the existing `/api/volume`
-endpoint. Moving its slider prepares a value; **Apply volume** sends it. **Mute**
-and **Unmute** send explicit mute states. The UI captures the selected headset,
-blocks duplicate/pending actions, and requests status after command acknowledgment
-for readback, draining an earlier poll first. Mute preserves an unapplied volume
-draft; switching headsets discards it. It reports
-unconfirmed or differing output separately from confirmed state. API validation
-rejects invalid types, out-of-range levels and invalid mute states before SSH.
-
-Other settings link to the existing forms and their validation, progress,
-confirmations and reset behavior: per-instance Android resolution/density/text,
-comfort sessions and alerts, media layouts, Mac streaming quality, privacy,
-sources and artwork. Android display links reveal the **Library** before
-scrolling to the form. Mac streaming remains searchable on all platforms, with
-its action shown only when the server is on macOS.
-
-Hardware guidance is deliberately separate from controls. Microphone/routing,
-brightness, refresh selection, optics, controllers, Bluetooth, passthrough,
-tracking-origin changes, saved spatial layouts, firmware updates and recovery
-have no verified remote setting here. Use the headset's own controls or the
-documented manual procedures. Movement comfort remains per-game; automatic
-sleep is in Steam Settings → Power → Sleep after inactivity. Keep-awake and
-Android data backup/restore remain script/MCP capabilities, not new UI switches.
-
-**Verification:** the Control Center's JavaScript runs under Node with mocked
-API and DOM boundaries; the server tests mock SSH and reject invalid values
-before any device command. Packaging tests cover the shared CSS/JS in desktop
-and iPhone bundles. These checks establish wiring, search, navigation, offline,
-error and device-switch behavior; they do not establish wearer experience,
-physical settings persistence or a new hardware capability.
+  Linux). Sleep, restart and shut down open a terminal window because SteamOS
+  asks for the sudo password over SSH.
 
 ## How it works
 
@@ -204,9 +101,7 @@ Frame for the keyboard and trackpad.
 The server is Python stdlib only and listens on 127.0.0.1. It rejects requests
 with a non-local `Host` header, and any `/api/` request without a custom
 header, so other websites can't drive it or read captures. Everything reaches
-the headset through its SSH alias (`frame` for the first one), pointed at the
-address that answered with `-o HostName=` (`ui/frame_link.py`, described in
-[devices.md](devices.md)). On macOS and Linux it keeps one
+the headset through the `frame` SSH alias. On macOS and Linux it keeps one
 multiplexed SSH connection open, so status and each capture take about 0.3 s.
 Windows' OpenSSH can't share a connection, so there each request connects on
 its own and the app is a little slower. What differs between the three
@@ -248,8 +143,8 @@ Google publishes no arm64 Linux platform-tools. Set Up Connection runs
 `ui/frame_connect.py` in your terminal emulator (GNOME Terminal, Konsole, xterm
 and others). The log is at
 `~/.config/Frame Control/logs/server.log`. Running `ui/server.py` in a browser
-instead of the app, sending the clipboard, or copying the headset's to this
-computer, needs `wl-clipboard` (Wayland), `xclip` or `xsel` (X11).
+instead of the app, sending the clipboard needs `wl-clipboard` (Wayland) or
+`xclip` (X11).
 
 ## Building
 
@@ -273,5 +168,5 @@ Control implementations. MCP wraps this HTTP API without API keys. Changes
 require a separate user approval; power also retains its password prompt. The
 assistant uses a user-chosen endpoint and sends nothing until the user opts in
 for a message. Screenshot context is separately opt-in. Model replies cannot
-operate the headset. Settings → Open assistant settings opens the page; the linked guide
+operate the headset. Tools → Open assistant opens the page; the linked guide
 covers putting it in a Chromium panel on the Frame.

docs/frame-doctor.md

@@ -1,121 +0,0 @@
-# Frame doctor
-
-Run `scripts/frame-doctor.sh` from a checkout on macOS or Linux to diagnose
-first-time setup, pairing and common Frame failures without applying repairs.
-It needs Bash, Python 3 and OpenSSH on the computer, and Python 3 on the Frame.
-Windows users can run `python scripts/frame_doctor.py` with Python and OpenSSH
-installed; the desktop app does not bundle this command.
-
-```sh
-scripts/frame-doctor.sh
-scripts/frame-doctor.sh --alias bedroom --lan frame.local
-scripts/frame-doctor.sh --alias frame --lan 192.168.1.40
-```
-
-Use only addresses belonging to your intended headset. The command tries the
-existing `frame` SSH alias first (Tailscale if setup configured it that way),
-then `frame.local`, then USB-C at `10.86.200.233`. `--alias`, `--lan` and `--usb`
-override those defaults. It reports the successful path without printing its
-address. It neither discovers other devices nor enables Tailscale.
-
-The existing alias supplies the user, port, keys and known-hosts file. LAN and
-USB overrides preserve its `HostKeyAlias`, or its configured hostname if no
-alias was set. A first connection therefore needs trusted setup first. The
-doctor never accepts a new host key, deletes a saved key, generates keys or
-sends a pairing request. It uses your trusted OpenSSH configuration; OpenSSH
-can evaluate `Match exec` conditions in that configuration. Proxy commands,
-jumps, local commands, forwarding and connection sharing are disabled for
-these direct diagnostic connections.
-
-## Reading the result
-
-Each of the eleven runbook sections has one line: `OK`, `WARN`, `BROKEN` or
-`UNKNOWN`. `OK` means only that the stated check passed, not that the whole
-feature works. Optional features that are off may produce a warning.
-
-| Section | Read-only evidence and limits |
-|---|---|
-| 1. Boot and crash history | Previous-boot kernel-oops signatures; one day of coredump history. An oops alone does not prove an unclean reset. |
-| 2. Wi-Fi | NetworkManager's wlan0 state, without SSIDs or connection profiles. |
-| 3. Displays and SteamVR | DSI timeout signatures in the recent kernel journal; no display, compositor or game is launched. |
-| 4. Steam and storage | Free space in home and `devkit-game`, including separate mounts; missing Steam install marker. No CRC scan or restart. |
-| 5. Idle sleep and keep-awake | Existing keep-awake unit state; never takes ownership or changes idle timers. |
-| 6. Remote wake | WoWLAN state, without arming it or testing suspend. Wake with the power button. |
-| 7. Lepton | Recent port-clash, binder and data-clearing signatures; no Android/container commands. |
-| 8. Chromium XR | Crash history; no browser profile or environment inspection. |
-| 9. KDE Connect | Process presence; absence is normal when sharing is off. |
-| 10. Streaming and capture | ffmpeg crash history; no capture or encoder is started. |
-| 11. Panels | Always `UNKNOWN`: placement requires the user's visual confirmation. |
-
-Journal samples are capped at 2,000 entries; current-boot samples cover the
-last ten minutes. This can miss older or high-volume failures. Empty,
-inaccessible or permission-limited journals are `UNKNOWN`, never zero errors.
-Commands time out individually, and each SSH probe is bounded to 90 seconds.
-
-Exit codes: **0** if all reported checks are OK; **1** for warnings, broken or
-unknown checks after connecting; **2** if no authenticated SSH path exists or
-local SSH setup is unavailable. Panel verification currently means a connected
-run normally exits 1. Automation should read the labelled checks rather than
-treating a warning as proof the headset is unusable.
-
-## First-time setup and pairing
-
-- **No SSH response:** wake the headset with its power button. Check the cable
-  or Steam Settings → Internet, then enable Developer Mode. Sleep and network
-  failure can look alike; a timeout cannot distinguish them.
-- **Key rejected:** open **Set Up Connection** in Frame Control. In the headset,
-  open Steam Settings → Developer → **Pair new host**, then approve setup's
-  request. The doctor only checks whether devkit port 32000 responds; that
-  does not prove pairing mode is open or the service is healthy.
-- **Unknown or changed identity:** verify the intended headset through setup
-  or Devices → **Check its key**. Do not delete `known_hosts` to bypass this.
-- **No devkit response:** check Developer Mode and the address. See
-  [SSH setup](ssh.md) for the manual fallback. The doctor cannot turn SSH on.
-
-No password is requested. Enter any password required by the separate setup
-flow only in its local terminal; never paste it into an issue or report.
-
-## Restart safety and recovery
-
-Before deeper checks, and again afterwards, the doctor samples Steam and
-SteamVR `NRestarts` and health-check tracker sizes two seconds apart. Rising
-counters stop diagnostics immediately. Nonempty health-check trackers also stop
-deeper checks even when stable, since a short sample could miss a slower loop.
-Missing counters or counters that reset stop deeper checks as `UNKNOWN`. Stable
-counters with empty trackers still cannot rule out a slower restart loop.
-
-The [historical runbook from PR #33](https://github.com/saphid/frame-control/blob/cce3d940302054ab5246c92d740afaefc4e58d38/docs/frame-doctor.md)
-is the source for these section numbers and observed signatures (September
-2026 builds). Its section 4 describes freezing and verifying health-check
-trackers before prolonged recovery during a live loop. That changes headset
-state, so this read-only implementation stops and directs you there instead.
-It does not implement issue #34's automatic fixes, before/after repair runs,
-or full recovery automation. Review build-specific recovery instructions with
-the person using the headset; a repair can remove data.
-
-Never reload `ath12k`, suspend remotely, kill gamescope to diagnose a loop,
-reset or force power off during extraction/repair, or write passwords to disk.
-The doctor never restarts services, signals processes, repairs Steam, changes
-WoWLAN/standby settings, takes keep-awake ownership, installs anything or writes
-a report. Nothing needs restoring after its checks. Manual/device tests must
-follow the [shared-device lock and battery procedure](testing.md#headset-smoke-test).
-
-## Privacy and verification
-
-Only fixed diagnostic summaries leave the remote probe. Raw journals, process
-arguments, environment variables, SSH errors, account IDs, network addresses,
-SSIDs, keys and tokens are not printed. No telemetry or HTTP request is sent;
-the only pairing-service probe is a TCP connection. SSH produces normal access
-logs. Review summaries before sharing them; feature availability can still be
-personal information. Redirecting stdout saves a report only if you choose it.
-
-Unit tests use mocked boundaries. `scripts/e2e.sh test_doctor` covers asleep,
-disk-full, SSH/devkit-off and missing-key faults against the fake Frame. Its
-stable restart counters are explicitly simulated, not proof about SteamOS.
-On 2026-10-24 the script ran read-only against a real Frame, SteamOS build
-`20261015.6141207`. It verified the configured SSH alias and key login,
-then reported `WARN Restart safety`: nonempty health-check trackers. It
-correctly skipped all eleven deeper sections and exited 1. No raw logs,
-addresses or keys were printed, and no repair or restart was attempted.
-This verifies the safety stop on that device; the deeper checks are not
-claimed as headset-tested.

docs/game-storage.md

@@ -1,91 +0,0 @@
-# Game storage
-
-Open **Tools → Game storage** for a read-only snapshot of the headset's user
-filesystem and Steam libraries. Refresh after an installation, download or move.
-The page never moves, deletes or modifies content, starts Steam, requests root,
-or recursively scans game files. It works through the existing SSH connection.
-
-## What the numbers mean
-
-- **Total, free and used** come from `statvfs` on the headset user's home and
-  each library path. Free is space available to that user; reserved blocks mean
-  used + free can be less than total. These are filesystem sizes, not advertised
-  drive capacity, and do not include separate system partitions.
-- Libraries come from `~/.local/share/Steam/steamapps/libraryfolders.vdf` plus
-  the default Steam library. Modern nested and older numbered-path records are
-  accepted; canonical duplicate paths are shown once. No drive is mounted.
-- Two paths can share one filesystem. Their capacity must **not** be added.
-  An unmounted drive whose mount directory still exists can report the parent
-  filesystem's capacity: the page labels this as the filesystem containing the
-  path, rather than claiming the removable drive is connected.
-- Game sizes are Steam's `SizeOnDisk` records in `appmanifest_<appid>.acf`, sorted
-  largest first, with unknown sizes last. A missing, negative or invalid size
-  is **Unknown**, while an explicit zero remains zero. Records may be stale,
-  including during downloads or moves; they do not measure allocated blocks.
-- Games/apps and runtimes/tools have separate subtotals of **known recorded**
-  sizes. Runtime classification uses names (Proton, Steam Linux Runtime,
-  Steamworks Common, FEX and Lepton Development), so it is only a convenience.
-  Additional apps or runtimes may fall in the game/app group.
-- Saves, Proton prefixes, shaders, workshops, downloads, Android apps,
-  sideloaded games, media and OS files are **unmeasured other usage**. The page
-  does not subtract manifest totals from filesystem usage to invent a size for
-  them. Recorded content is not an exhaustive storage breakdown.
-
-Permission denied, missing/disconnected paths, unavailable filesystem reads,
-invalid metadata and partial inventories are reported separately. A failed read
-is never proof of an empty library. If library discovery fails, other libraries
-may be missing from the view. Refresh clears the old results immediately; a
-headset switch clears the snapshot and ignores late replies from the old device.
-
-## Moving a game safely
-
-Use Steam's own **Settings → Storage** on the headset (or in desktop Steam):
-choose the source drive, select the games and choose **Move**, then pick a
-Steam-supported destination. A second Steam library must already be available.
-Steam may withhold Move or a destination when it cannot perform the operation.
-Let Steam finish, follow Steam's errors/recovery prompts, then Refresh here.
-Do not manually delete files to make room or interrupt an in-progress move.
-
-[Valve's moving guide](https://help.steampowered.com/en/faqs/view/4BD4-4528-6B2E-8327#move)
-was read in a browser on 2026-10-24 and documents this UI. This is an instructional
-handoff: the page does not send a URI or silently open a UI on the headset.
-The guide's separate Windows instructions for moving the entire Steam client
-are outside this feature's scope.
-
-### Why Frame Control does not automate moving
-
-The repository's Valve devkit tools register and launch developer titles; no
-supported game-move operation is provided there. The existing Steam CEF bridge
-uses internal client APIs, which are not a verified supported contract for a
-move transaction. [Valve's public ISteamApps reference](https://partner.steamgames.com/doc/api/ISteamApps) provides install-directory
-and installed-depot queries but no documented move transaction with completion,
-cancellation, rollback and error guarantees. The public support guide describes
-the user-operated Storage UI, rather than such an automation interface.
-
-Consequently this feature adds no move endpoint or guessed internal Steam call,
-manifest rewrite, copy/delete fallback, or custom rollback. Automating a move
-requires a supported interface and verified behaviour for full disks, disconnects,
-running games, downloads, cancellation and Steam restart first.
-
-## Verification and limits
-
-`tests/test_storage.py` runs the actual probe against temporary Steam metadata
-and filesystem/error fixtures. It covers multiple libraries, duplicate paths,
-zero/unknown/invalid sizes, corrupt manifests, unreadable directories and files,
-missing discovery/drives, reserved capacity and read-only file preservation.
-A loopback HTTP test executes the real guarded endpoint with SSH mocked.
-`tests/storage.cjs` runs the production renderer, navigation and refresh handlers
-with DOM/transport boundaries faked, including escaping, offline errors,
-out-of-order refreshes and headset switches. It runs through unittest discovery.
-
-The production storage component was rendered with synthetic data at 390px and
-900px widths; both fit without horizontal overflow. This checks component
-layout, not the full connected application or headset browser.
-
-On 2026-10-24 the uninstalled storage parser was piped read-only over SSH
-to a real Frame running SteamOS build `20261015.6141207`. It reported
-710.4 GiB free on the user filesystem, one available Steam library, 29
-readable app manifests, zero unknown sizes and zero parse/permission issues.
-No game names or raw metadata were printed in the test report. The
-connected UI, removable media, Steam's Move UI and an actual game move were
-not tested. UI and error-state fixtures remain synthetic.

docs/how-the-frame-works.md

@@ -52,7 +52,6 @@ Lepton (Android 11, podman container "lepton-dev") ← its own panel, app 305600
 | The Steam client runs with `-cef-enable-debugging`, so its UI answers Chrome DevTools on loopback `127.0.0.1:8080`. The `SharedJSContext` page has `appStore` (owned apps), `downloadsStore` and `SteamClient.*`. `steam steam://install/<appid>` over SSH installs an owned game; when the options dialog shows (state 7), `SteamClient.Installs.ContinueInstall()` accepts it. **Verified 2026-09-25** with Balatro and Broforce. The Frame rating is `steam_hw_compat_category_packed >> 8 & 3`. | [steam-games.md](steam-games.md), `ui/frame_steam.py` |
 | Chromium Flatpak 154 has **no immersive WebXR**: `navigator.xr` exists, but `isSessionSupported("immersive-vr")` returns `false`. Web VR180 players (DL8/DeoVR embeds) still play video inline as a flat, pannable view, and their VR button opens a tab on immersiveweb.dev. Forcing it doesn't help. `--enable-features=OpenXR,WebXR --force-webxr-runtime=openxr`, with `/opt/steamvr` and `XR_RUNTIME_JSON` exposed to the Flatpak, still returns `false`. The aarch64 Linux binary has no OpenXR code at all (no `XR_RUNTIME_JSON`, `xrGetInstanceProcAddr` or loader strings), even though `chrome://flags` lists `#webxr-runtime` → OpenXR. **Why (verified against source 2026-09-25):** M154 is the first release that compiles OpenXR on Linux (`enable_openxr` includes `is_linux`, `checkout_openxr` is true in Flathub's tarball, and Flathub's GN args don't turn it off). But `content/services/isolated_xr_device/xr_runtime_provider.cc` only creates an OpenXR device under `ENABLE_OPENXR && IS_WIN`, on 154, 155 and `main`. Nothing on Linux calls the OpenXR code, so the linker drops it. The missing pieces are two unmerged Gerrit CLs (bug 506004811): [8132979](https://chromium-review.googlesource.com/c/chromium/src/+/8132979) wires the provider on Linux (with `kOpenXR` still off by default, so it needs `--enable-features=OpenXR`), and [8441736](https://chromium-review.googlesource.com/c/chromium/src/+/8441736) runs the XR service in a sandbox that allows SteamVR's sockets. The Frame does have an aarch64 runtime: `~/.config/openxr/1/active_runtime.json` → SteamVR `bin/linuxarm64/vrclient.so`. To watch in 3D, use a native player, or a Chromium built with those two CLs ([webxr-chromium.md](webxr-chromium.md)). That build (156.0.8071.0, arm64) reports `immersive-vr` as supported and starts a session that SteamVR takes as its scene app. With the headset on, the WebXR samples scene and three.js's stereo 360 video demo showed in 3D (verified 2026-09-26, seccomp sandbox off). Started with `--remote-debugging-port=9222`, Chromium answers DevTools on loopback. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | Web video, [panels.md](panels.md) |
 | **DeoVR (Steam app 837380, Windows/Unity) runs immersively** under Proton ARM64 + FEX: Unity's OpenVR XR plugin finds `OpenVR Headset(Steam Frame)` and the `frame_controller`, the GPU shows as Turnip Adreno 750, and AVPro Video decodes through `MF-MediaEngine-Hardware`. It played 7680×3840 and 8192×4096 H.265 VR180 SBS streams in dome/fisheye mode (`FirstFrameReady`). Unity's own `VideoPlayer` (used for grid thumbnails) fails with `0xc00d36bb`, so thumbnail previews stay blank. The first launch takes about 45 s (`ComputeShaders: InitAsync`). Log: `compatdata/837380/pfx/drive_c/users/steamuser/AppData/LocalLow/Deo VR/Deo VR/Player.log`. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | [vr-video.md](vr-video.md) |
-| **A second Windows program can join a running Proton game.** Copy `WINEPREFIX`, `WINEDLLPATH`, `WINEDLLOVERRIDES`, `PATH` (Proton's `files/bin-arm64` comes first) and `DISPLAY` from `/proc/<game pid>/environ`, keeping your own `HOME` and the rest, and run `wine prog.exe` from an ordinary SSH shell. It shares the game's wineserver (outside the pressure-vessel container). Don't copy `WINESERVERSOCKET`, which is an inherited fd. A game's windows live on gamescope's X display for that app (`:1` for Gravitas), where the full-screen game keeps the pointer and focus: XTest clicks and restacking don't reach other windows, but `XSendEvent` button events sent to a window do. `xwd` captures WPF/DXVK windows but shows Vulkan game windows as black. **Verified 2026-09-29**, BUILD_ID 20260925.6191901, Proton 11.0-2c ARM64. | [mods.md](mods.md) |
 | **Wolvic (VR browser APK) runs in Lepton against SteamVR's OpenXR**, with limits. The stock Lynx build aborts (`Runtime doesn't support selected swapChain color format`: it wants `GL_RGBA8`), and the stock Quest build fails with `XR_ERROR_API_VERSION_UNSUPPORTED`. Patching `DeviceDelegateOpenXR::GetSwapChainCreateInfo` in the Lynx build's `libnative-lib.so` to `GL_SRGB8_ALPHA8` (0x8C43) and re-signing fixes start-up. The Gecko engine then segfaults in `libxul`. The Chromium-engine build (Lynx v1.3-chromium) browses fine as an immersive app. Its page reports `isSessionSupported("immersive-vr") == true`, and `requestSession` succeeds, running about 36 rAF/s, but the headset shows **black** for WebXR content, or Wolvic's loading spinner that never clears, until the session is ended. Video decodes on the software `OMX.google.h264.decoder`. Tapping the URL bar's selection menu crashes it (no clipboard service). Open URLs with `am start -a VIEW -n com.igalia.wolvic/.VRBrowserActivity -d <url>` over the instance's ADB. DevTools is at `localabstract:content_shell_devtools_remote`. **Verified 2026-09-25**, BUILD_ID 20260922.6101926. | Web VR video, [apks.md](apks.md) |
 | Tailscale runs without root as a userspace `tailscaled` user service (static arm64 build in `~/.local/share/tailscale`, lingering on). In userspace mode, inbound tailnet connections reach the Frame's **loopback**, so every port, including DevTools on 8080, is reachable from the tailnet. **Verified 2026-09-25.** | [tailscale.md](tailscale.md), `scripts/tailscale-on-frame.sh` |
 | **T3 Code desktop runs natively.** The stock release `T3-Code-0.0.42-arm64.AppImage` in `~/Applications/T3CodeDesktop/` starts with no extra setup: glibc 2.39, `libfuse.so.2`, GTK 3, NSS and libsecret are on the image. `panel-on-frame.sh --name t3code-desktop -- '~/Applications/T3CodeDesktop/T3-Code.AppImage'` gives it its own panel (`valve.steam.desktopgame.2000281357`, `--ozone-platform=x11`). Its bundled server listens on `127.0.0.1:3773` and shows up in onboarding as the `frame` computer, with `passwordStore: gnome-libsecret`. The image has no agent CLI and no `node`. Agents run through the LAN CLIProxyAPI (`llm-proxy.lan:8317`, which resolves on the Frame). Claude Code 2.1.283 comes from `claude.ai/install.sh`, and Codex 0.157.1 from the `codex-aarch64-unknown-linux-musl` release tarball, both into `~/.local/bin`. `with-cliproxy` and a mode-600 `~/.config/cliproxyapi/secrets.env` are copied from the Mac. The wrappers `claude-cliproxy` and `codex-cliproxy` (a `-c model_provider=cliproxy`, `wire_api="responses"`, `env_key="CLIPROXY_API_KEY"`) are set as `providers.claudeAgent.binaryPath` and `providers.codex.binaryPath` in `~/.t3/userdata/settings.json`, and T3 picked that up without a restart. Through the wrappers, `claude auth status` reports `loggedIn: true` (`oauth_token`), and both CLIs answered a prompt with `kimi-k3`. `gamescopectl screenshot` captured another layer (the Lepton T3 app) rather than this panel. `DISPLAY=:0 xwd -id <win>` piped to `ffmpeg` captures the window itself (1920×1080). **Verified 2026-09-26**, BUILD_ID 20260922.6101926. | Running T3 Code as a host on the Frame |
@@ -96,6 +95,5 @@ ssh frame 'cat /opt/steamvr/resources/webinterface/dashboard/localization/dashbo
 - Remote access from anywhere: [tailscale.md](tailscale.md)
 - Floating windows in space: [panels.md](panels.md)
 - Recovery images, what's in them, testing without the headset: [recovery-and-images.md](recovery-and-images.md)
-- Backing up saves and settings, restoring after a reset, leaving Desktop Mode: [backup-and-recovery.md](backup-and-recovery.md)
 - Frame Control on iPhone (the server running on the Frame itself): [iphone.md](iphone.md)
 - What's still unverified: [open-questions.md](open-questions.md)

docs/iphone.md

@@ -26,10 +26,7 @@ as its transport too), so the desktop and phone share one code path. Android
 display settings use `podman exec` into each Lepton container instead of adb,
 which the Frame doesn't have.
 
-The app server stops after the phone disconnects. An explicitly started
-[comfort session](family-comfort.md) keeps its timer and headset reminders running
-until the session ends or is cancelled; phone notifications require the app to
-remain connected and running. The copied
+Nothing is left running on the Frame after the phone disconnects; the copied
 files stay in `~/.cache/frame-control` (delete it any time).
 
 ## Pairing
@@ -102,9 +99,8 @@ app installed opens its App Store page.
 Things iOS asks the first time: **Local Network** (tap Allow, or the app can't
 see the Frame), and **Paste** when you send the iPhone's clipboard (tap Allow
 Paste, or set Settings → Apps → Frame Control → Paste from Other Apps → Allow).
-Sending text to the Frame's clipboard, or copying the Frame's to the phone
-(**Type on the headset → Copy the headset's clipboard**), needs the desktop
-panel open in the headset, as on the desktop app.
+Sending text to the Frame's clipboard needs the desktop panel open in the
+headset, as on the desktop app.
 
 Not yet exercised: Android display changes through podman (no Android app was
 running), a real sleep/restart/shut down on the Frame, and a physical iPhone.
@@ -112,11 +108,3 @@ running), a real sleep/restart/shut down on the Frame, and a physical iPhone.
 Debug builds have Simulator test hooks (`FRAME_TEST_HOST`, `FRAME_TEST_PAGE`,
 `FRAME_TEST_JS`, and the tunnel URL in the app's Caches folder); release builds
 don't.
-
-## Family and comfort
-
-The shared Home card sets session limits, breaks and check-ins; **Cast to this
-screen** is in Home's **Right now** card. **Enable / test notifications** requests iOS notification
-permission and sends a local test. These are local notifications, not APNs push;
-iOS background suspension can interrupt phone alerts. The headset timer still
-runs. See [the behavior and verification limits](family-comfort.md).

docs/linux-vr-streaming.md

@@ -38,33 +38,6 @@ after its container exited. No headset was worn and no host was connected.
 All test app files, compatdata, shortcuts and containers were removed afterwards.
 SteamVR's original process remained running. No global settings changed.
 
-### Locked repeat, 2026-09-29 (verified)
-
-Acquired `/tmp/frame-test.lock` before installing or launching anything and
-released it after cleanup. Battery was 44% and charging at preflight, 46–47%
-during the launches, and 47% at cleanup. The SteamOS version/build was unchanged.
-
-Reinstalled and launched both original APKs in immersive Lepton instances.
-WiVRn again failed at OpenXR 1.1 and 1.0 with the missing timespec extension;
-ALVR again panicked on `ERROR_EXTENSION_NOT_PRESENT`. This repeats the
-unmodified-client test, not the newer installer's automatic compatibility-layer
-path. Neither reached a session that could be paired or exercised further.
-Fresh [journal excerpts and cleanup evidence](evidence/linux-vr/2026-09-29.txt)
-record the failures.
-
-SteamVR's screenshot API returned a 1920×1080 headset capture after each
-launch. Both are uniformly dark: [WiVRn](evidence/linux-vr/2026-09-29-wivrn.png)
-and [ALVR](evidence/linux-vr/2026-09-29-alvr.png). These images do **not** prove
-rendering or a working client. The headset was unworn; visibility, controllers,
-frame rate and motion-to-photon latency could not be judged. The explicit
-OpenXR errors, rather than the dark captures, establish the client blocker.
-
-Both test installs, app data, shader caches, shortcuts, containers and temporary
-capture files were removed. The original Steam and SteamVR process IDs were
-unchanged. No reboot, power action or global setting change was used. Native
-clients remain untested, and no Linux gaming host was available for Valve's
-streaming path. The recommendation below is unchanged.
-
 ### Relation to the VR APK branch
 
 **Documented from source:** [PR #20](https://github.com/saphid/frame-control/pull/20)

docs/mac-in-headset.md

@@ -4,8 +4,7 @@ Frame Control can show any Mac window, or a whole Mac screen, as its own panel
 in the Steam Frame. You place each panel anywhere in the room with the SteamVR
 dashboard. The laser clicks and drags, the thumbstick scrolls, and you type on
 the Mac's own keyboard. Find it under **Tools → Mac in the headset** (macOS
-only). On Windows there's an experimental port,
-[PC in the headset](pc-in-headset.md).
+only).
 
 The confidence labels are the same as in [ssh.md](ssh.md).
 
@@ -469,18 +468,3 @@ versus on, medians of the runs, ms):
   window to the front first.
 - Ctrl stays Ctrl. On the Mac, copy is ⌘C, so use Meta+C on a keyboard paired
   with the Frame.
-
-## Switching panels and workspace limits
-
-**Tools → Panel switcher** lists open SteamVR panels, including Mac viewers.
-Use **Show** to request focus or **Open in headset** for Frame Control's own
-switcher panel. It uses SteamVR/gamescope and Chromium, with no third-party
-overlay app. [Device checks and limits](panels.md#frame-controls-panel-switcher)
-include the difference between a panel surviving a scene launch and staying
-visible over it.
-
-Saved spatial layouts are blocked on this build: the public OpenVR transform
-setter denies access to gamescope-owned panels. Reconnecting an existing viewer
-is supported; restoring its room position after a reboot is not. We do not
-save short-lived Mac window IDs or viewer access keys as if they were a durable
-workspace. See [the feasibility evidence](panels.md#saved-spatial-layouts-blocked-on-the-current-panel-route).

docs/meta-library.md

@@ -1,371 +0,0 @@
-# My Meta library (Experimental)
-
-Install Quest games your Meta account owns straight from Meta, test whether
-they run on the Steam Frame, and add the result to the shared compatibility
-reports. It is off until you connect, and it lives in **Android → My Meta
-library**.
-
-**Read this first.** My Meta library uses Meta's undocumented internal API
-with your own Meta access token, as the open-source tools QAVS, DownQuest and
-BSManager do. It may stop working whenever Meta changes things, and using it
-may be against Meta's terms. Your account is your responsibility. Frame
-Control is unofficial and not made or endorsed by Meta or Valve.
-
-What it will and won't do:
-
-- It lists and downloads only games your account owns (its active
-  entitlements). It never downloads anything else.
-- It installs games as Meta ships them. There is **no licence-check bypass**:
-  no patching, no stub libraries, no OVRPort or FramePort. A game that
-  enforces Meta's licence check may quit or hang on the Frame, because that
-  check needs Meta's services, which the Frame doesn't have.
-- Game files go only to a cache folder on your computer and then to your
-  Frame. They are deleted from the cache after each install, and never
-  uploaded or shared. Reports carry results only (below), never files or your
-  token.
-
-## Your token
-
-Frame Control never reads your browser's cookies. There are two ways to give
-it your token.
-
-**Sign in with Meta** (desktop app only; a plain browser doesn't show it).
-Tick **I understand…**, then choose **Sign in with Meta…**. Meta's own login
-page (`https://secure.oculus.com`, the address BSManager's "Log in with Meta"
-opens) appears in a Frame Control window. Sign in there as usual. When Meta's
-site sets its access token cookie (`oc_ac_at`), Frame Control takes it from
-that window, connects with it exactly as if you had pasted it (below), and
-closes the window. The window:
-
-- has its own storage (the Electron session `persist:meta-signin`), separate
-  from Frame Control's main window and from every browser on your computer;
-  the cookie is read only from there, and only for `oculus.com`;
-- runs Meta's page sandboxed, with no access to Frame Control (no preload, no
-  Node, context isolation on, no developer tools) and every permission request
-  or check (camera, notifications…) refused;
-- only goes to `https://` pages on `oculus.com`, `meta.com`, `facebook.com` and
-  `instagram.com` (and their subdomains; Meta's login passes through Instagram).
-  A link anywhere else opens in your system browser; a redirect anywhere else
-  is stopped, and closing the window then says where it went. Pop-ups on those sites open in the same
-  window. Frames inside the page may load any `https://` page (Meta's login
-  can embed captcha and CDN frames from other sites, such as Arkose Labs,
-  hCaptcha, reCAPTCHA or fbcdn) or an empty frame (`about:blank`,
-  `about:srcdoc`); a frame going to any other scheme (`http:`, `data:`,
-  `blob:`, `javascript:`, `file:`…) is just stopped. Redirects follow the same
-  rule for the frame they happen in. Frames can't reach the
-  token: the cookie is read by Frame Control's main process, and the window
-  has no IPC;
-- sends a cookie value on only if it looks like a user token (`OC` or `FRL`,
-  mixed case, no `%`, `|` or `:`), and each value once. If the server refuses
-  it, the window stays open; close it to see why;
-- gives up after 10 minutes, as BSManager does;
-- when it is closed, times out or is signed out of, stops reading cookies
-  first, then is destroyed (a page's "leave this page?" can't keep it open),
-  and, if it had sent a token, tells the server to drop that sign-in: each
-  sign-in has a random attempt id. The cancel is sent only once the connect
-  under way has finished (saved, refused or failed), so the server always
-  gets it after the connect; with nothing sent, there is nothing to cancel.
-  The server lists an attempt only while its
-  connect is being checked: cancelled then, it isn't saved; cancelled just
-  after its token was saved (even before the connect has finished tidying
-  up), that token is deleted (as a disconnect). A cancel
-  never removes an account a later sign-in or a pasted token saved, and one
-  for an unknown attempt changes nothing.
-
-The page never sees the token: the desktop app hands it straight to the local
-server's connect path and tells the page only the answer (connected, and your
-Meta display name). It isn't logged anywhere.
-
-The window keeps you signed in to Meta (in `persist:meta-signin` only) until
-you **Disconnect**, which also signs out of Meta in Frame Control: it clears
-that window's cookies, storage and cache, so the next sign-in starts fresh.
-**Sign out of Meta in Frame Control** next to the sign-in button does just
-that part, for a sign-in that didn't connect.
-
-**Paste a token.** You copy your own token and paste it in. The two ways
-BSManager's guide describes
-([How to obtain your Oculus Token](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token)):
-
-1. **From the Meta website.** Sign in at `https://secure.oculus.com`. Open the
-   browser's developer tools, then **Application** (Chrome, Edge) or
-   **Storage** (Firefox) → **Cookies** → `https://secure.oculus.com`. Copy the
-   value of `oc_ac_at`. It starts with `OC`.
-2. **From the Meta Quest PC app** (Windows). Press **Ctrl+Shift+I**, open
-   **Network**, press **Ctrl+R**, type `graph` in the filter, open the first
-   request, and copy the access token from its **Payload**. It starts with
-   `FRL`.
-
-Treat it like a password: anyone with it can act as your Meta account. Signing
-out of the Meta website or app usually ends it; then connect again with a new
-one.
-
-Frame Control refuses values that can't be a user token before sending them
-anywhere: anything not starting with `OC` or `FRL`, URL-encoded copies (with
-`%`), app tokens (with `|` or `:`), cut-off values (under 20 characters), and
-anything with characters other than letters, digits and `+ / = - _` (the
-base64 and URL-safe base64 sets), or with no lower-case letter (real tokens are
-mixed case). The public tools only describe tokens made
-of letters and digits; if a real token needs another character, it has to be
-added in one place (`TOKEN_CHARS` in `ui/frame_meta.py`), which also makes
-the redaction look for it.
-
-## Using it
-
-1. Tick **I understand…**, then either choose **Sign in with Meta…** (desktop
-   app) or paste your token and choose **Connect**. Frame Control asks Meta
-   "who am I" with it (a read-only query); only a token Meta accepts is kept.
-2. Your Quest games are listed with their version, size, game data, and the
-   community verdict from the compatibility database when there is one.
-3. **Install** downloads the game and installs it on the Frame, as [Import
-   from my Quest](quest-import.md) does. A game with OBB game data then needs
-   a second **Install** while you have it open on the Frame: Frame Control
-   downloads the data, copies it in and closes the game.
-4. **Install and test** does the same, then starts the game itself (twice if
-   it has game data to add: once to add it, once for the test), watches it for
-   about 30 seconds, and records what happened. **Test again** repeats only
-   the test.
-5. Choose **Install** on as many games as you like: they wait in the
-   **Install queue** and install one after another, with Quest imports and
-   Android store installs. **Remove** takes one out before it starts.
-6. **Disconnect** deletes the token from your computer and, in the desktop
-   app, signs out of Meta in Frame Control (clears the sign-in window's
-   storage). Games already on the Frame stay.
-
-From a terminal (the token is read from standard input, never an argument):
-
-```sh
-python3 ui/frame_meta.py connect --token-stdin      # paste the token, press Enter
-python3 ui/frame_meta.py status
-python3 ui/frame_meta.py list [--refresh]           # owned Quest games, with community verdicts
-python3 ui/frame_meta.py download APP_ID            # into the local install cache (a later download clears it after 6 hours)
-python3 ui/frame_meta.py install APP_ID [--test] [--allow-downgrade]
-python3 ui/frame_meta.py test com.example.game [--wait 30] [--no-report]
-python3 ui/frame_meta.py disconnect
-```
-
-The local API: `GET /api/meta` (connected or not, never the token),
-`GET /api/meta?library=1[&refresh=1]` (the games), and `POST /api/meta` with
-`{"action": "connect", "token": "...", "acknowledged": true}`,
-`{"action": "disconnect"}`, `{"action": "cancel-signin", "attempt": "..."}`, `{"action": "install", "app": "APP_ID", "test": false,
-"allowDowngrade": false}` or `{"action": "test", "package": "..."}`. Install and
-test return a background job (`/api/job`); an install waits its turn in the
-install queue (`/api/queue`, see [Import from my Quest](quest-import.md#using-it)). Sign in with Meta uses the same
-`connect` action: the desktop app's main process (`app/meta-signin.js`) posts
-it with the cookie's value and an `"attempt"` id (8 to 64 letters, digits or
-`-`) once the page's acknowledgement box is ticked. A connect whose attempt
-was cancelled while it was checked answers 409 and saves nothing;
-`cancel-signin` for an attempt whose token is the saved account deletes it.
-
-## What an install does
-
-1. Checks the game is in your library (by its Meta app id), and that there's
-   room on this computer for the APK, a patched copy of it and the game data.
-2. Downloads the APK from Meta's download server, within the size Meta
-   declared (and at most 2 GB), checking its SHA-256 if Meta gives one, and
-   that it is an APK of the package and version Meta said.
-3. Runs Import from my Quest's checks. Refused: 32-bit-only builds (no
-   `arm64-v8a`), and apps that need an Android newer than Lepton's (API 30).
-   Installed with a warning: games that use Meta's licence check
-   (`libovrplatformloader.so`), and VrApi-only games ("may not run").
-4. Installs it with `frame_android.install` (VR detection, the launcher fix,
-   the OpenXR compatibility layer, artwork, a Steam library entry). An older
-   copy never silently replaces a newer one on the Frame unless you tick
-   **Allow replacing a newer version**.
-5. Game data: the app's OBB (saved as Meta names it when that is a standard
-   `main|patch.<version>.<package>.obb` name, otherwise as
-   `main.<version code>.<package>.obb`) and any *required* asset files with
-   standard OBB names, at most 8 GB each. One install downloads at most 16 GB
-   in all, APK included, counted as the bytes arrive (so files whose size Meta
-   doesn't give count too); a file that goes past it is stopped and removed.
-   The data is copied into the
-   running game by the same two-step helper Import from my Quest uses. Other
-   asset files (DLC packs, `.pak` files a game fetches through Meta's
-   Platform SDK) aren't downloaded; the result lists them.
-6. Deletes everything it downloaded, whether the install worked or not.
-   Downloads left by a crash are removed after six hours.
-
-## The test, and the report
-
-The test starts the game, waits for its Lepton instance, then looks every 10
-seconds for 30 seconds: is the game's process alive, and what does its Android
-log (main, system and crash buffers) say. It recognises:
-
-| In the log | Cause given |
-|---|---|
-| "entitlement check failed", "not entitled", `ovr_Entitlement…` or `IsUserEntitledToApplication` reporting a failure (a call that passes doesn't count) | Meta's licence check failed |
-| Platform SDK initialisation errors | Meta's Platform SDK couldn't start |
-| `Failed to launch SystemActivities`, "device not supported" | The game checks it is on a Meta Quest |
-| `vrapi_… was called before…`, VrApi load errors | Legacy VrApi |
-| `XR_ERROR_EXTENSION_NOT_PRESENT` (with the extension's name) | An OpenXR feature the Frame lacks |
-| `XR_ERROR_API_VERSION_UNSUPPORTED`, runtime/initialisation failures | OpenXR version or session problems |
-| `VK_ERROR_DEVICE_LOST`, `zink`, `libgallium_dri.so`, `GL_INVALID_…`, shader failures | Graphics driver errors |
-| `ClipboardManager` | Lepton's missing clipboard service |
-| `NoSuchMethodError`, `UnsatisfiedLinkError`, `dlopen failed` | Android or library features Lepton lacks |
-| `FATAL EXCEPTION`, `Fatal signal`, `SIGSEGV` | A crash |
-| `ANR in …`, "Input dispatching timed out" | Not responding |
-| `XR_SESSION_STATE_SYNCHRONIZED/VISIBLE/FOCUSED`, `xrEndFrame` | The VR scene started |
-
-The outcome is one of **runs** or **runs with issues** (its VR scene
-started), **quits** (closed by itself), **crashes**, **hangs** (Android
-reported it not responding; Frame Control then closes it, and says so if it
-couldn't), **didn't start** (its instance never came up), or **no clear
-result**: it stayed open but its log never showed its VR scene starting. That
-can be a game still loading, or one stuck after a failed check; Frame Control
-can't tell, so it doesn't record it. A game already open is closed first, so
-the test starts clean; if it can't be closed, nothing is tested. If the Frame
-fails while the test reads the game or its log, the test says only that it
-couldn't read the log: a failed command's output can be the game's log, so it
-is never shown. Signatures look at the first 4 KB of each log line and are
-bounded, so a huge or hostile log can't make the test slow. They
-are written for Frame Control from the research in [vr-apks.md](vr-apks.md);
-they are not copied from other tools.
-
-The result goes through the same path as **Test** and **Report**
-(`frame_catalog.add_report`): `via` probe, source `meta-store`, the result
-(`runs`, `crashes` or `instance_failed`, the values the database accepts), and
-notes with the outcome, the cause, the names of the matched signals and the
-version code, all fixed texts. Nothing else: no token, account name, file or
-log text. The page may show a short name from the log next to the cause (an
-OpenXR extension, a library, an exception class or a signal), taken from the
-log line after the token is removed from it, and left out unless it looks like
-a real name (64 characters at most, no long mixed letter-and-digit runs);
-reports never carry it. It is always kept on this
-computer; it reaches the shared database only if **Share compatibility
-results** is on in Privacy settings, as for every report. The panel offers to
-turn that on.
-
-## Your token and privacy
-
-- Kept in `meta-account.json` in Frame Control's per-user data folder
-  (`~/Library/Application Support/Frame Control` on macOS,
-  `%APPDATA%\Frame Control` on Windows, `~/.local/share/frame-control` on
-  Linux), written owner-only (0600) through a temporary file. Never on the
-  Frame.
-- Sent only to `graph.oculus.com` (in the POST body) and
-  `securecdn.oculus.com` (in the download address, which is how that server
-  takes it), over HTTPS. A download that redirects elsewhere (Meta's CDN) is
-  followed only to a plain HTTPS address on port 443 that doesn't carry the
-  token in any form, anywhere (host, path, query or fragment; literal,
-  recased, percent-encoded, or 8+ characters of it), nor an `access_token`
-  parameter. That is checked before any lookup or connection, and a redirect
-  that fails it is refused. API answers that redirect are refused.
-- Every connection goes to an address checked to be public (an allow-list:
-  no private, local, shared, reserved, multicast, NAT64, 6to4 or Teredo
-  addresses), and to exactly that address, with TLS checked for the host
-  name, so a second DNS answer can't swap in another. System proxy settings
-  aren't used. This is the same design as the itch.io purchases branch.
-- Never in logs, error messages, API answers, the page or reports: every
-  message is cleaned first, matching the token (or any start of it of 8+
-  characters) in any letter case, with each character written literally or
-  percent-encoded once or twice (%XX, %25XX) in either case, and any other
-  token-shaped value, before it is shortened.
-- Disconnect deletes the file and the library Frame Control holds in memory,
-  and stops a download under way. A connect still being checked when you
-  disconnect is not saved. In the desktop app, before the token is deleted, it
-  also stops any sign-in under way, destroys the sign-in window, waits for a
-  connect still under way to finish and cancels its attempt (deleting its
-  token if it was just saved), and only then clears the `persist:meta-signin` session
-  (cookies, storage, cache); no other session is touched. Sign in with Meta
-  stays off from the moment you press Disconnect until the token is deleted,
-  and the app refuses a sign-in while it is signing out.
-- With Sign in with Meta, a second copy of your Meta sign-in lives in that
-  session's storage, in Electron's per-user data folder (`Partitions/meta-signin`),
-  until you disconnect or sign out of Meta in Frame Control.
-
-## Where the protocol comes from
-
-Frame Control's code is its own (MIT). These public sources describe the
-protocol; Frame Control takes only facts from them (addresses, query ids,
-field names), not code. QAVS and BSManager are GPL-3.0; OculusGraphQLApiLib,
-DownQuest and Oculus-downgrader state no licence.
-
-| Fact | Source |
-|---|---|
-| GraphQL at `https://graph.oculus.com/graphql`, POST, form fields `access_token`, `doc_id`, `variables`; `OAuthException` / code 190 for a bad token | [OculusGraphQLApiLib `GraphQLClient.cs`](https://github.com/ComputerElite/OculusGraphQLApiLib/blob/866081e2/OculusGraphQLApiLib/GraphQL/GraphQLClient.cs), [DownQuest `DownQuest.js`](https://github.com/ptrpaws/DownQuest/blob/50f5d558/DownQuest.js) |
-| "Who am I": `doc_id` 4149322231793299, `data.viewer.user {id, alias}` | OculusGraphQLApiLib `GraphQLClient.cs` and `Results/User.cs` |
-| Owned apps: `doc_id` 4850747515044496, `data.viewer.user.active_entitlements.nodes[].item` | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/Entitlement.cs`, `Results/Application.cs`; used by [QAVS `GameDownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/GameDownloadManager.cs) |
-| One binary: `doc_id` 4734929166632773 with `binaryID`; fields `package_name`, `version`, `version_code`, `size`, `obb_binary`, `asset_files` (`file_name`, `size`, `is_required`) | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/OculusBinary.cs`, `Results/AssetFile.cs` |
-| Downloads: `https://securecdn.oculus.com/binaries/download/?id=<id>&access_token=<token>`, the same for the APK, `obb_binary` and asset files; QAVS takes the OBB and required asset files | OculusGraphQLApiLib `Game/GameDownloader.cs`, [QAVS `DownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/DownloadManager.cs), DownQuest `DownQuest.js` |
-| Token checks (`OC`/`FRL`, no `%`, `|`, `:`, not `OC` + 15 digits) | OculusGraphQLApiLib `GraphQL/TokenTools.cs`, [BSManager `oculus.helpers.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/shared/helpers/oculus.helpers.ts) |
-| How users get a token (`oc_ac_at` cookie, or the PC app's `FRL` token) | [BSManager wiki](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token) |
-| Sign in with Meta: open `https://secure.oculus.com` in an app window, and once it reaches `https://secure.oculus.com/my/profile` read the `oc_ac_at` cookie from that window's session (checked on `did-navigate`, `did-navigate-in-page`, `did-stop-loading`); 10-minute timeout | [BSManager `bs-oculus-downloader.service.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/main/services/bs-version-download/bs-oculus-downloader.service.ts) (`getUserTokenFromMetaAuth`) |
-
-**Assumed, not seen in those sources:** that the entitlement and binary
-answers carry the fields above in the shapes the libraries' models describe
-(the stored queries are opaque); that the list isn't paginated (none of the
-tools page it); that `ANDROID_6DOF` marks Quest apps; where downloads redirect
-to (the tools let their HTTP client follow redirects; Frame Control follows
-up to five, to any public HTTPS host, and refuses one carrying the token); and
-a `sha256`
-field (none was seen, so in practice only sizes are checked). The log
-signatures for the test are inferred from the compatibility research, not
-from a real Frame.
-
-## Evidence and limits
-
-**Verified locally** with a fake Meta and a fake Frame (`tests/test_meta.py`):
-token checks; storage owner-only through a temporary file; redaction (the
-stored token recased and percent-encoded in either case, starts of it, other
-token-shaped values, and redaction before cutting); HTTPS-only URLs; the
-public-address allow-list, resolving once and connecting only to a checked
-address within one deadline; redirects off Meta's hosts refused when they
-carry the token anywhere, before any lookup; the token never sent to the
-CDN; GraphQL redirects refused; disconnect beating a connect in flight and
-stopping a download; library parsing (Quest apps only, nothing expired or
-inactive, details from the binary query); downloads with an OBB; size, length
-and checksum limits and the whole-install budget with nothing left behind;
-refusing apps not in the
-library; the handoff to Import from my Quest's checks, install and data step;
-the licence-check warning instead of a refusal; test outcomes from log
-fixtures (a passing licence check isn't a failure; no VR scene is no clear
-result, not recorded); closing before a test and saying when a close failed;
-reports carrying only fixed texts, no token, log text or file names. The
-real TLS connection code is the same as the itch.io branch's and is exercised
-here only with a fake connection.
-
-**Sign in with Meta, verified locally** with fake Electron windows, sessions
-and cookies (`app/test/meta-signin.test.js`): the window's options (its own
-partition, sandbox, context isolation, no Node, no preload) and Meta's login
-address, no developer tools; permission requests and checks refused; the
-navigation allow-list (links elsewhere open in the system browser, redirects
-elsewhere are stopped, pop-ups never become windows); frames allowed any
-HTTPS page but no other scheme, the window itself only Meta's sites; a
-page's beforeunload not keeping the window open; the cookie read only from
-`persist:meta-signin` and only for `oculus.com`, even when the default
-session and another partition hold one; signed-out values ignored; a value
-sent once, a refused one keeping the window open; the window closing after a
-connect, with the page getting the answer and never the token; nothing
-logged, and a server error that echoed the token scrubbed; closing the window
-or signing out ending the wait; closing, timing out or signing out during a
-connect cancelling that attempt (with its own id) after cookie intake stops
-and only after that connect settles (saved, refused or failed), and no cancel
-when nothing was sent; sign-out (Disconnect's first step) waiting for a
-connect under way, even from a window closed earlier, before it finishes;
-sign-out destroying the window before clearing only that partition; no
-sign-in starting while a sign-out runs (it is refused: "try again in a
-moment"), a second sign-out joining the first, and a sign-out waiting for
-every window and connect started before it. The
-frame redirects held to the frame rule, the window's to Meta's sites. The
-server side (`tests/test_meta.py`): an attempt cancelled while Meta is
-answering not saved, even after 300 other cancels; a cancel just after the
-save deleting that token; a cancel never removing a later sign-in's or a
-pasted token's account; unknown attempts changing nothing; no attempt left
-listed after a connect, refused or not; attempt ids checked.
-
-**Differences from BSManager:** BSManager uses its app's default session (and
-clears only `.oculus.com` cookies afterwards); Frame Control uses a session of
-its own and clears all of it on disconnect. BSManager waits for
-`/my/profile`; Frame Control also reacts to the cookie changing, and to any
-`oculus.com` page, and lets the server decide whether the value is a
-working token.
-
-**Not verified:** Sign in with Meta against Meta's real login page (no real
-Meta account was used, and nothing was sent to Meta): whether Meta's login
-still goes only through `oculus.com`, `meta.com` and `facebook.com`, whether
-it uses pop-ups (they open in the same window here, which would break a
-pop-up that reports back to its opener), whether `oc_ac_at` is still set on
-`oculus.com` after login, and whether Meta accepts the window (Frame Control
-removes Electron's name from the user agent as a precaution). A real Meta token and Meta's real answers (none was
-available; nothing was sent to Meta), real downloads and their redirects,
-real Quest games installed or tested on a real Frame, and whether the log
-signatures match what real games print in Lepton.

docs/mods.md

@@ -1,14 +1,11 @@
 # Flat-to-VR mods and Beat Saber songs
 
-**Status: UEVR works from Frame Control for Unreal Engine games; Beat Saber
-songs are blocked.** Installed games have a **VR mod** button. It installs
-UEVR, starts the game with UEVR injected, and removes UEVR again. That whole
-loop was run on a real Frame on 2026-09-29 with Gravitas, from the app's own
-UI ([evidence](evidence/mods-2026-09-29.md)). The headset was unworn, so
-the VR image, head tracking and controls haven't been seen yet. Beat Saber
-custom songs need an owned Beat Saber on the Frame, which there isn't
-([below](#beat-saber-songs-first)).
-[Issue #26](https://github.com/saphid/frame-control/issues/26) stays open for those.
+**Status: feasibility work, not an installer.** Frame Control does not yet
+manage mods or Beat Saber songs. [Issue #26](https://github.com/saphid/frame-control/issues/26)
+stays open: neither UEVR injection nor Beat Saber custom-song playback has
+been verified on this Frame. Alex has an owned copy on a Quest 2; that copy
+has not been inspected. There is no Mods button until the underlying
+install, playback and removal have been checked.
 
 The mod manager must be Frame Control's own implementation. Mods and songs
 are permitted third-party content; BSManager, ModsBeforeFriday, MO2 and other
@@ -18,87 +15,27 @@ unofficial mod mirrors are part of this work.
 
 ## Per-game support
 
-Checked 2026-09-28 and 2026-09-29 on SteamOS **0.4.1**, BUILD_ID
-**20260925.6191901**, aarch64, with **Proton 11.0-2c ARM64** and SteamVR **2.18.1**. “Verified” describes only
+Checked 2026-09-28 on SteamOS **0.4.1**, BUILD_ID **20260925.6191901**, aarch64,
+with **Proton 11.0-2c ARM64** and SteamVR **2.18.1**. “Verified” describes only
 the observation stated, not a promise that the game is playable. “Documented”
 means an upstream source describes it; “inferred” means it still needs a test.
 
 | Game / build | Mod or content | Evidence and support status | Next check |
 |---|---|---|---|
 | Half-Life 2: VR Mod – Episode One, Steam 2177750, build 25413453 | Official Steam community mod, shared base depot 658920 build 25413418 | **Verified: startup only.** Already installed; launched through Proton ARM64. The stereo headset capture showed its first-time setup, and SteamVR loaded `bindings_frame.json`. Gameplay, controller interaction, fresh installation and removal are unverified. | Complete first-time setup and play a level before offering a tested install shortcut. |
-| Gravitas, Steam 1067310, Windows, Unreal Engine 4 | UEVR 1.05, from Frame Control | **Verified 2026-09-29: installs, injects, SteamVR receives frames, removes cleanly.** Twelve cold **Play in VR** runs (33–35 s each), and the full cycle from the app's UI, all loaded `UEVRBackend.dll` into the game, with UEVR logging `Hooked DirectX 11` and `Requested runtime: openvr_api.dll`. SteamVR's compositor counted frame submits for `steam.app.1067310`. Remove restored the prefix to its pre-install file listing. **Not seen:** the stereo image, head tracking and controls (headset unworn). | Wear the headset: check the image, tracking, UEVR's in-headset menu and controller input. |
+| Gravitas, Steam 1067310, Windows | UEVR 1.05 | **Verified: prerequisites and windows only.** Free Steam install completed. The game produced a `SkyArk (64-bit, PCD3D_SM5)` window. UEVR needed .NET; with official .NET 6.0.36 libraries it produced a `UEVR` window. A combined run exited 1 with X11 errors before injection was verified. **Inferred: compatibility remains unknown**, not proven broken. | Retry during a stable headset session; verify injection, stereo scene output, controls and removal. |
 | Beat Saber, Steam 620980, Windows / Proton | Basic custom songs; later SongCore and version-matched mods | **Verified: absent from the 868-game library returned by this Frame.** Store metadata lists Windows, not Linux. **Documented:** the PC game reads basic maps from `Beat Saber_Data/CustomLevels` without a mod manager. Playback on Frame is unverified. | An already-owned, legitimately installed copy is required. Do not buy it as part of this task. |
 | Beat Saber, claimed native ARM64 build | Custom songs / native mods | **Inferred: unverified.** The research mentions this build but supplies no verified official distributable or tested layout. CPU architecture alone does not identify Android versus Linux, the game version or the mod ABI. | Establish official provenance, ownership, binary type and version before touching files. Do not apply Quest patches to an unidentified build. |
-| Beat Saber, Alex's Quest 2 copy | Custom songs / Android mods | **Documented: owner-reported copy on Quest 2.** Not reachable on 2026-09-29 (no device on `adb` from the Mac). No APK, version or installed mods inspected; no Frame playback verified. A Quest copy is a Meta store purchase; copying it to another headset would need its entitlement check to pass there, which this work won't work around. This does not establish ownership of the Steam build. | When the Quest is available, inspect the owned copy's version and supported transfer path, then test Lepton/OpenXR compatibility without bypassing entitlement checks. |
+| Beat Saber, Alex's Quest 2 copy | Custom songs / Android mods | **Documented: owner-reported copy on Quest 2**, currently charging. No APK, version or installed mods inspected; no Frame playback verified. This does not establish ownership of the Steam build. | When the Quest is available, inspect the owned copy's version and supported transfer path, then test Lepton/OpenXR compatibility without bypassing entitlement checks. |
 | Hogwarts Legacy, Steam 990080 | R.E.A.L. | **Verified: listed in this Frame's owned library, not installed.** Official release access and redistribution permission were not established; the referenced author Patreon page returned HTTP 403. No archive downloaded or game tested. | Obtain a current free release from the author and confirm its terms before any test. A news report saying “free” is not a redistribution grant. |
 | Horizon Zero Dawn, Steam 1151640; Horizon Forbidden West, Steam 2420110 | R.E.A.L. | **Verified: both listed as owned, neither installed.** Same source/permission blocker as above; runtime support is unverified. | Check each game's supported version against an accessible official release. |
 | Half-Life 2 VR / other OpenVR games | OpenComposite, per-game replacement | **Documented:** forwards OpenVR calls to OpenXR. **Inferred: Frame compatibility unknown.** Not installed or tested. HL2 VR reached setup with the shipped OpenVR path already. | Test a specific game and replacement DLL only if needed; preserve its original DLL. Never switch the shared headset's runtime globally. |
 | Doom / Quake / Half-Life Team Beef ports | Author's VR ports plus separately owned or free game data | **Inferred: untested.** Android ARM64 support does not establish OpenXR extension or controller compatibility on Lepton. | Choose an official release and legally usable data set, then test that exact port. |
 | Skyrim VR, Steam 611670 | SKSEVR / HIGGS / PLANCK stack | **Verified: Skyrim VR is absent from this library.** Owning flat Skyrim or Special Edition is not the VR game's entitlement. Runtime and mod support are unverified. | An already-owned VR copy and version-matched official mod releases are required. |
 
-The test records ([2026-09-28](evidence/mods-2026-09-28.md),
-[2026-09-29](evidence/mods-2026-09-29.md)) distinguish process startup,
-visible output, injection and failures.
-
-## UEVR from Frame Control
-
-![The VR mod dialog while UEVR runs in Gravitas](img/uevr-dialog.png)
-
-**Get games → an installed game → VR mod.** The dialog says whether the game
-can take UEVR, then offers **Install UEVR**, **▶ Play in VR** and **Remove
-UEVR**. The server route is `POST /api/mods {"action": "status" | "install" |
-"start" | "uninstall", "appid": …}`, and the work happens on the Frame in
-[`ui/frame_mods.py`](../ui/frame_mods.py). It uses only the standard library,
-like `frame_steam.py`.
-
-- **Which games.** Unreal Engine games, recognised by their
-  `…/Binaries/Win64/*-Win64-Shipping.exe` (inferred as the general rule; checked
-  with Gravitas, and HL2 VR is correctly refused). The game needs a Proton
-  prefix, so it must have been played once.
-- **Install.** Downloads praydog's [UEVR 1.05 release](https://github.com/praydog/UEVR/releases/tag/1.05)
-  and python.org's [Windows x64 embeddable Python 3.14.7](https://www.python.org/downloads/release/python-3147/).
-  Each is checked against a pinned SHA-256; Python's comes from python.org's
-  release-file API. Archives are unpacked into a staging folder, rejecting
-  entries that escape it, symlinks and oversized contents, then moved into
-  `<prefix>/drive_c/frame-control/` (about 47 MB). Nothing goes into the
-  game's own folder. A receipt in `~/.local/share/frame-control/mods/` lists
-  what to remove, including UEVR's own settings folders only if they didn't
-  exist before. Install and remove refuse while the game is running, and only
-  one mod action runs at a time.
-- **Play in VR.** Launches the game through Steam if it isn't running and
-  waits for its window. It then runs a short script under that Python, with
-  the game's Proton, prefix and Wine settings read from the game process, so
-  both share one Wine session. The script repeats what UEVR's own injector does
-  when you press Inject with OpenVR chosen: load `UEVRPluginNullifier.dll` and
-  call its `nullify`, load `openvr_api.dll`, set `Frontend_RequestedRuntime` in
-  UEVR's per-game `config.txt`, then load `UEVRBackend.dll`. Each load is a
-  `LoadLibraryW` remote thread, as in the frontend's `Injector.cs`. `start`
-  then checks that `UEVRBackend.dll` is mapped into the game and reads
-  SteamVR's frame count for the app (`vrcmd --stats`).
-- **Remove.** Deletes what the receipt lists, then the download cache once
-  no game uses it. Verified: the prefix's file listing matched its
-  pre-install state afterwards.
-
-Why not UEVR's own injector (verified 2026-09-29):
-
-- It's a .NET 6 WPF app, so it needs Microsoft's .NET runtimes (about 70 MB
-  of downloads) in the prefix.
-- Under gamescope, the full-screen game keeps the pointer and focus. XTest
-  clicks, raising or refocusing the injector window don't change that, so in
-  the headset you can't click it. Sending X `ButtonPress`/`ButtonRelease`
-  events straight to its window does work.
-- `--attach=<process>` didn't inject under Wine, and it didn't restore its
-  saved OpenVR choice.
-- Driven that way, it injected in 6 of 8 cold starts. In a bad session every
-  new injector ignored input or never showed its window, even after
-  relaunching. Its process list reads each process's main window title, a
-  cross-process window message; a window that isn't answering would block its
-  UI thread (inferred from the frontend's source, not proven). Without a
-  `HOME` it also died in .NET at startup.
-- Frame Control's own script injected in 12 of 12 cold starts through the API, in 33–35 s, and again from the UI.
-- UEVR's DirectX 12 probing logs errors before it settles on DirectX 11 for
-  Gravitas, and some of its Unreal engine scans fail on this older UE4 game.
-  Neither stopped the injection.
+The [test record](evidence/mods-2026-09-28.md) distinguishes process startup,
+visible output and failures. It also records a SteamVR restart during the
+shared session, which prevents attributing the failed UEVR attempt to FEX.
 
 ## Beat Saber: songs first
 
@@ -125,10 +62,7 @@ or dependency for Frame Control.
 
 ## Requirements for our manager
 
-For UEVR, items 1–5 are implemented in `frame_mods.py` and covered by
-fake-library tests (`tests/test_mods.py`), apart from checking ownership
-through Steam; item 6 is met for Gravitas. Beat Saber songs would need the
-same, and none of it is built for them:
+These are **planned**, not implemented or verified:
 
 1. Resolve the selected Steam game's real library, installed build, executable
    architecture and Proton prefix. Confirm ownership through Steam; a directory
@@ -157,11 +91,7 @@ same, and none of it is built for them:
 - [UEVR 1.05 official release](https://github.com/praydog/UEVR/releases/tag/1.05)
   and [author's usage instructions](https://github.com/praydog/UEVR#getting-started).
 - [Microsoft .NET 6 release metadata](https://builds.dotnet.microsoft.com/dotnet/release-metadata/6.0/releases.json),
-  including the SHA-512 hashes used for the injector tests.
-- [UEVR frontend source](https://github.com/praydog/UEVR-Frontend): `UEVR/MainWindow.xaml.cs`
-  (`Inject_Clicked`) and `UEVR/Injector.cs`, the steps `frame_inject.py` follows.
-- [python.org release-file API](https://www.python.org/api/v2/downloads/release_file/) for the
-  embeddable Python's `sha256_sum`.
+  including the SHA-512 hashes used for the test runtimes.
 - [OpenComposite's OpenXR branch](https://gitlab.com/znixian/OpenOVR/-/tree/openxr),
   including per-game installation and the need to preserve original DLLs.
 - [R.E.A.L. author post referenced by the research](https://www.patreon.com/realvr/posts/but-wheres-link-165840151)

docs/open-questions.md

@@ -143,15 +143,6 @@ check in the headset:
 - Keys from SteamVR's on-screen keyboard.
 - Whether Flathub Chromium decodes H.264 (otherwise use Compatible).
 
-## Battery charge limit (2026-10-23)
-
-Can an 80% charge limit be set over SSH or adb? **Not safely yet.** SteamOS
-Manager's `BatteryChargeLimit1` (the interface Steam's own setting uses) has
-no backend in the Frame's device config, and the battery node is a
-`max1720x` fuel gauge with no `charge_control_end_threshold`. Research and
-read-only headset checks are in [charge-limit.md](charge-limit.md). Not tested
-on a headset.
-
 ## Unconfirmed claims made in these docs
 
 - `/home` and `/etc` persist across Frame OS updates. This is inferred from

docs/panels.md

@@ -121,165 +121,8 @@ a limit on the number of floating panels.
   script needed.
 - **Inside the desktop panel**: KWin tiling (Meta+arrow keys with a Bluetooth
   keyboard) or virtual desktops arrange windows within the 1280×800 rectangle.
-- **Optional overlay tools:** Desktop+, OVR Toolkit and similar software are
-  separate from Frame Control. Public reports describe some Proton support;
-  Windows-only does not by itself prove a Frame app cannot run. Local status
-  and sources are in [VR utilities](vr-utilities.md).
-- **Our performance HUD:** Home → VR performance (unfold it) → Open HUD in
-  headset creates its own gamescope panel using built-in tools. It needs no
-  third-party overlay app. [Metrics and verification](vr-utilities.md).
-
-## Frame Control's panel switcher
-
-**Verified 2026-09-28**, SteamOS 0.4.1, BUILD_ID `20260925.6191901`,
-SteamVR 2.18.1: **Tools → Panel switcher** lists SteamVR's open main panels,
-including panels that are currently hidden. **Show** asks SteamVR to bring one
-forward. **Open in headset** opens the same switcher as its own panel; choose
-it again from Steam's dashboard after switching away. Refresh updates the list.
-This is a list, not thumbnail Exposé.
-
-![Frame Control's switcher rendered on the Frame](img/panel-switcher.png)
-
-This is our own Python/HTML implementation (`ui/frame_panels.py`), using the
-Frame's shipped `vrcmd` OpenVR client and gamescope. The headset page uses
-Chromium (Chromium XR when present, then system Chromium, then the existing
-Chromium Flatpak). No XSOverlay, OVR Toolkit, WayVR or other overlay application
-is needed. This dependency boundary also applies to future layout and panel
-persistence work: platform APIs and bundled libraries are fine; another app
-must not implement the feature for us.
-
-The companion runs the helper over SSH. Opening it in the headset installs a
-copy under `~/.local/share/frame-control/panels/` and starts a loopback HTTP
-server and an isolated Chromium profile. There is no startup service or global
-setting change. Close the switcher to stop its server and browser. Other
-Chromium profiles, Steam and SteamVR are left alone. If the window or runtime
-closes, use **Open in headset** again.
-
-The page carries a random, per-process access key in its URL fragment, removes
-it from the address bar, keeps it in tab session storage for page reloads, and
-sends it in a header. Panel lists and actions need
-that key; Host and Origin checks reject other sites. The key permits only
-listing panels, requesting focus and closing this switcher. Like Mac viewer
-launch tickets, it is initially readable by another process running as the
-same Frame user. Panel titles are rendered as text, never HTML. The companion
-retains its existing request guards. No Mac capture credentials cross this API.
-
-**Verified:** the real headset page rendered its panel list (image above), its
-HTTP focus request changed `GAMESCOPE_FOCUSED_APP` to `2000999030`, a request
-without the key returned HTTP 403, and Close stopped the helper and its browser.
-Opening an already running switcher requests its focus rather than creating a
-second one. The companion uses the same list/focus helper. **Unverified:** laser
-selection while wearing the headset, physical placement, and non-XR Chromium.
-The API reports that focus was *requested*: another action can take focus before
-we observe the result. Closed panels are rejected after re-enumeration.
-
-### Shared-device recheck, 2026-09-29
-
-**Verified:** the follow-up's atomic `mkdir /tmp/frame-test.lock` attempts
-failed because another thread held the lock. The existing lock was left alone;
-no applications were installed, launched or stopped in this follow-up. The last
-read-only battery check showed 62%, charging. The 180 Python and 8 website tests
-passed again locally.
-
-**Unverified in this follow-up:** the prepared browser-button test (Refresh,
-selection, reload and Close) and repeated OpenXR transition could not run under
-the shared lock. The device results elsewhere in this page are the earlier
-2026-09-28 observations, not results from this blocked recheck. In particular,
-HTTP focus is not evidence of worn-headset laser input. Follow the
-[shared-device test procedure](testing.md#headset-smoke-test) for the next run.
-
-## Saved spatial layouts: blocked on the current panel route
-
-**Verified 2026-09-28**, same build, using a temporary xterm panel with
-`STEAM_GAME=2000999031` and `FnTable:IVROverlay_028` from
-`/opt/steamvr/bin/linuxarm64/libopenvr_api.so`:
-
-| OpenVR call | Result |
-|---|---|
-| `FindOverlay("valve.steam.desktopgame.2000999031")` | Success |
-| `GetOverlayWidthInMeters` | Success, 2.67 m |
-| `SetOverlayWidthInMeters` (same width) | Success |
-| `GetOverlayTransformType` | Success, type 5 (`VROverlayTransform_DashboardTab`) |
-| `GetOverlayTransformAbsolute` | 18 (`WrongTransformType`) |
-| `SetOverlayTransformAbsolute` (identity rotation, 1.2 m up, 1.5 m forward) | 12 (`PermissionDenied`); type remained 5 |
-
-The public interface names type 5 **DashboardTab**; SteamVR's dashboard code
-places these panels through its scene graph. It owns the frame/docking
-transforms. A successful width setter does not grant permission to restore the
-position. `vrcmd --dock-overlay world <key>` dispatched a docking request but
-the dashboard logged `Failed to get SGTransform in setInitialTransformForLocation.
-Invalid transform ID`. This does not establish working world placement.
-
-**Inferred:** saving X11 pixel rectangles or Mac window IDs would not restore
-this spatial arrangement. Mac window IDs also change when an application
-reopens; viewer tickets and reconnect keys must not go into a layout file.
-The base Mac stream reconnects after a network break, but that is different
-from recreating windows and their room positions after a reboot.
-
-There is consequently no Save/Restore control yet. A durable layout needs a
-working transform restore path, stable source identity, and a fresh capture
-permission/ticket flow. The tested gamescope-owned overlay route denies that
-transform operation. A future Frame Control-owned overlay renderer, or a
-supported platform API for dashboard frame transforms, needs its own device
-proof before building layout UI. This is a blocker for the current approach,
-not a claim that all possible implementations are impossible. Reboot recovery
-was not tested: the shared headset was not rebooted.
-
-## Panels during an immersive session
-
-**Verified 2026-09-28**, same build: our Chromium switcher panel remained in
-OpenVR's overlay list before, during and after the Frame's shipped `helloxr -g
-Vulkan` sample. During the test `vrcmd --stats` identified
-`system.generated.openxr.helloxr.helloxr`, with 242 frame submissions. The test
-ended only its own sample process; no SteamVR, Steam, power or global settings
-were changed. The switcher was still selectable afterwards.
-
-This proves survival of that panel across an OpenXR scene session, **not** that
-it stayed visibly composited over the scene: OpenVR reported it `not_visible`
-before, during and after. **Verified:** calling `ShowOverlay` on our
-*gamescope-owned* switcher overlay returns 12 (`PermissionDenied`). A helper
-cannot force that panel visible using the public overlay call. Use the
-switcher/dashboard to request access to it; we do not fight the runtime with a
-repeated force-focus loop.
-
-**Verified in a second controlled run:** a live H.264 test-pattern stream from
-this checkout's Mac helper, through its own SSH tunnel and a temporary Chromium
-profile, survived the same OpenXR sample (257 scene-frame submissions). Its
-panel `2000999032` changed from `visible` before launch to `not_visible` during
-and after the scene. The Mac helper still reported the same `test` stream;
-captured frames increased from 35 to 232, with 29.5 decoded/drawn fps afterwards.
-The test did not capture personal Mac windows or inject Mac input. The sample,
-viewer, temporary profile, tunnel and Mac helper were cleaned up. This proves
-stream survival, and also shows why it must not be advertised as always visible.
-
-**Unverified:** persistent visible placement while playing a Steam-launched VR
-game, Plasma desktop and real Mac-window behavior during that launch, and worn
-headset input. Other threads were launching games and changing the runtime on
-the shared device, so those transitions were not treated as controlled evidence.
-A runtime/X-server restart can destroy the viewer windows; a network reconnect
-cannot recreate them. No “always visible during games” guarantee is shipped.
-
-## Keyboard passthrough feasibility
-
-**Verified 2026-09-28**, same build, using `FnTable:IVRTrackedCamera_006`:
-`HasCamera(0)` returned success and true. `GetCameraFrameSize` returned 100
-(`OperationFailed`), with zero dimensions, for all three public frame types
-(distorted, undistorted and maximum-undistorted), including after acquiring the
-video service. Acquisition returned success and a handle; release returned 101
-(`InvalidHandle`). The probe shut down its OpenVR client afterwards. No camera
-frames were captured and no camera settings were changed.
-
-**Documented:** the public OpenVR camera interface provides camera frame sizes,
-intrinsics, projections and streaming handles; these are prerequisites for a
-spatially aligned camera cutout. See Valve's
-[OpenVR C API](https://github.com/ValveSoftware/openvr/blob/master/headers/openvr_capi.h).
-
-**Inferred:** camera presence alone does not establish access to camera pixels.
-The failed frame-size path blocks a keyboard cutout in our current panel
-implementation. We have not established a keyboard detector or a calibrated
-camera-to-panel mapping. Built-in full-room passthrough is not proof of a
-public, selectively masked camera stream. No keyboard cutout is offered, and
-no third-party camera/overlay app is substituted for it.
+- **Windows-only overlay tools** (Desktop+, OVR Toolkit, OVRdrop) do this for a
+  PC's desktop in SteamVR. They don't run on the Frame's standalone Linux.
 
 ## Frame Control's media theatre
 

docs/pc-in-headset.md

@@ -1,155 +0,0 @@
-# PC in the headset (Experimental)
-
-**Tools → PC in the headset**, on Windows only. It's the Windows version of
-[Mac in the headset](mac-in-headset.md): a whole screen on your PC
-becomes its own SteamVR panel in the Frame. Individual windows are available only
-with streaming libraries built with Windows Graphics Capture (WGC); the shipped
-MSYS2 libraries disable WGC, so this build explains that limitation and offers
-whole screens. Place the panel with the dashboard's Float
-in World, Move and Size, point and click with the laser, scroll with the
-thumbstick, and type on the PC's keyboard.
-
-**It's experimental.** A Windows 11 VM has captured its real desktop with
-Desktop Duplication and encoded it with Media Foundation and JPEG. Physical PCs,
-hardware encoding and physical laser input remain unverified. See
-[the dated evidence](evidence/windows-vm-2026-10-24.md) for results and limits.
-Reports are welcome through the
-[feedback form](https://frame-control.pages.dev/feedback/).
-
-## Turning it on
-
-It's off by default. Until you tick **Turn on PC in the headset** on the card,
-Frame Control starts no helper, loads none of the streaming libraries and lists
-no windows. The choice is remembered on this computer. Turning it off ends
-every stream, closes the viewers in the headset and stops the helper.
-
-The card and its Tools link only appear in the Windows app. On macOS the card
-is Mac in the headset, as before; on Linux and the iPhone app there's no card.
-
-## How it works
-
-The ported pieces are from [PR #38](https://github.com/saphid/frame-control/pull/38).
-Frame Control owns the host helper, input, authentication, streaming protocol,
-panel launcher and adaptation. It doesn't need Sunshine, OBS or any other
-streaming app. GStreamer is bundled as ordinary libraries.
-
-| | Windows |
-|---|---|
-| Capture | GStreamer's `d3d11screencapturesrc`: Desktop Duplication for whole screens in the shipped build; Windows.Graphics.Capture by window (HWND) or screen (HMONITOR) when that implementation is present |
-| Encoding | Media Foundation's H.264 encoder (`mfh264enc`), low latency, no B-frames. Whether it uses the GPU depends on the PC; **not verified** |
-| Input | `SendInput`, mapped through the source's bounds, with per-monitor DPI awareness |
-
-API references:
-[Windows capture](https://learn.microsoft.com/en-us/windows/uwp/audio-video-camera/screen-capture),
-[GStreamer WGC](https://gstreamer.freedesktop.org/documentation/d3d11/d3d11screencapturesrc.html),
-[Media Foundation encoder](https://gstreamer.freedesktop.org/documentation/mediafoundation/mfh264enc.html).
-
-It needs Windows 10 or 11 with Desktop Duplication and a Media Foundation
-H.264 encoder (Windows "N" editions need the Media Feature Pack). WGC-enabled
-builds can also capture individual windows. Clicks and
-keys can't reach administrator apps or the sign-in screen, which an ordinary
-process can't drive. If Windows won't bring the chosen window to the front,
-input is refused rather than sent to the app covering it: bring the window
-forward, then Stop and Show again. Minimised or closed windows stop sending
-pictures. Protected video isn't supported. Mac in the headset's "own display
-per window" is Mac-only.
-
-The pieces it shares with Mac in the headset:
-
-- `ui/frame_macview.py` owns the SSH tunnel, reconnects, quality presets and
-  panel launch. `ui/frame_pcview.py` picks the Windows helper
-  (`ui/frame_pc_agent.py`, `ui/frame_pc_capture.py`, `desktop/capture.c`) and
-  holds the on/off switch. `/api/macview` is the endpoint for both.
-- `ui/mac-view.html` is the one viewer in the headset. Its frame header, H.264
-  and JPEG payloads, reconnect handshake, clock sync, timing reports and input
-  messages are unchanged.
-- `desktop/controller.c` is a C port of the Mac helper's Swift rate controller,
-  for the Windows helper. The Mac keeps its Swift original;
-  `tests/test_pc_controller.py` checks the port against a frozen 600-state
-  trace from it. Capture is gated before encoding, so encoded frames are never
-  dropped, and an idle window's last picture still goes out once the link
-  clears.
-- Stream records use the Mac helper's JSON schema (`ui/frame_stream_stats.py`),
-  so the benchmark's analysis is shared.
-
-## Packaging
-
-The Windows installer carries `resources/desktop/bundle`: `pc-host.dll` (our
-adapter and the controller), the GStreamer plugins it uses (`coreelements`,
-`videotestsrc`, `videoconvertscale`, `app`, `jpeg`, `videoparsersbad`,
-`d3d11`, `mediafoundation`) and the DLLs they depend on, all from MSYS2's
-UCRT64 packages. `libraries.json` records the GStreamer version, the plugins,
-each copied DLL and the exact package versions; licence texts are in
-`licenses/`.
-
-MSYS2's `gst-plugins-bad` build disables `d3d11-wgc`. The presence of
-`d3d11screencapturesrc` alone does not prove WGC support: its `capture-api`,
-`window-handle` and `show-border` properties are conditional. The helper queries
-those properties on the instantiated element, advertises only supported
-sources, and omits all three properties for the DXGI whole-screen pipeline.
-It never substitutes a screen crop for an unavailable window capture.
-
-The x264 encoder is **not** in the installer. It's GPL, and Windows encodes
-with Media Foundation, so only CI's test builds include it
-(`desktop/build.py --with-x264`). The macOS and Linux installers are unchanged.
-
-From a source checkout on Windows, build the bundle from an MSYS2 UCRT64 shell
-with the packages listed in `.github/workflows/pc-host.yml`:
-
-```sh
-python desktop/build.py              # what the installer ships
-python desktop/build.py --with-x264  # for the native tests
-```
-
-A missing bundle is reported on the card; nothing is downloaded on first use.
-
-The Linux adapter from #38 (desktop portal, PipeWire, VA-API) is in the tree,
-because it shares `capture.c` and the controller, and CI still builds and tests
-it. The app never offers it and the Linux installers don't include it.
-
-## Measuring
-
-The Mac benchmark accepts the PC host:
-
-```sh
-python scripts/macview-bench.py run --pc --scenario test --label pc-test
-python scripts/macview-bench.py run --pc --scenario capture --source window:12345 --label windows-window
-```
-
-`capture` needs a window or screen id from the helper's `/windows` or
-`/displays`. CPU sampling isn't available on PC hosts. See
-[Mac in the headset](mac-in-headset.md) for the targets and shaping options.
-
-## What's verified
-
-- **Verified in CI, this PR:** on `windows-latest`, the native adapter builds
-  and a real x264 synthetic stream passes the ticket, reconnect, timing and
-  input-echo tests through the helper. The Windows installer builds with the
-  bundle, and its bundled Python loads the bundle, starts the helper and
-  confirms x264 isn't in it. Unit tests check the Windows-only, off-by-default
-  gating, the card and the Tools link on macOS, Windows and Linux.
-- **Verified, #38, 2026-09-28, real Frame on SteamOS BUILD_ID 20260925.6191901:**
-  the PC helper (ARM64, on the Frame itself, x264 test pattern) streamed
-  through a Mac SSH relay into the shared viewer: 400 frames at 39.3 fps,
-  content latency p50/p95 15.1/28.6 ms, synthetic input p50 76.6 ms, at
-  revision `cd20243`. The frame-rate and late-frame targets failed. This
-  proves the helper and the viewer work together; it isn't Windows capture or
-  a real PC link.
-  [Raw result](../bench/results/2026-09-28-cd20243-pc-agent-frame-arm64-final.json),
-  [earlier probe](../bench/results/2026-09-28-c5fc552-dirty-pc-agent-frame-arm64-hairpin.json).
-- **Verified, #38, on a Mac:** the C controller matched all 600 states of the
-  Swift controller's congestion and recovery trace.
-- **Verified, 2026-10-24:** Windows 11 VM build 26200.8037 on lxso2, using
-  the v0.4.10 installer with this fix, captured its actual desktop and streamed
-  H.264 to Frame BUILD_ID `20261015.6141207`: 219 sent frame records, 215 decoded
-  and drawn before the snapshot. The own-panel screenshot shows the Windows
-  desktop. This short, mostly idle run does not establish performance targets.
-  [Evidence, raw traces and cleanup](evidence/windows-vm-2026-10-24.md).
-- **Not verified:** Windows.Graphics.Capture, physical-PC capture, hardware
-  Media Foundation encoding, encoder restarts when the bitrate
-  changes, mixed-DPI and multi-monitor input alignment, window resize and
-  minimise, non-US keyboard layouts, physical laser input, and how it performs
-  in a worn headset. No numbers are claimed for these. Not tested with a
-  worn headset. See the dated VM evidence for the separate automated checks.
-- **Not reviewed independently.** #38 tried an independent review that never
-  completed.

docs/privacy.md

@@ -33,46 +33,23 @@ computer, exactly as they were sent.
   yours.
 - Every event includes the app version, OS name (macOS, Windows or Linux),
   CPU architecture and Python version.
-- `app_installed`, `app_updated` and `app_opened` carry `country`: a
-  two-letter code such as `DE`, worked out on your computer from its time zone
-  setting (`Europe/Berlin` becomes `DE`), so we can see roughly where Frame
-  Control is used without knowing your address. The time zone itself isn't
-  sent, and a setting that isn't a country's zone (such as UTC) sends nothing.
-  Copies that showed the first-run notice before it mentioned this (before
-  0.4.6) show it again, and don't send a country until it has been seen.
-- `frame_connected` carries `headset_id`: the first 16 hex digits of a
-  SHA-256 hash of the headset's `/etc/machine-id`, worked out on the headset,
-  so the machine-id itself never leaves it. It is the same for one headset on
-  every computer, which lets us count headsets rather than installs; it can't
-  be turned back into the machine-id or a serial number. `headsets_saved` is how
-  many headsets this copy of Frame Control has set up.
 
 ## Usage events
 
 | Event | When | Properties besides the common ones |
 |---|---|---|
-| `app_installed` | First run | `country` |
-| `app_updated` | First run of a new version | `from_version`, `country` |
-| `app_opened` | At most once a day | `country` |
-| `frame_connected` | The first time a SteamOS build is seen on each headset | `steamos_build`, `steamos_version`, `headset_id`, `headsets_saved` |
+| `app_installed` | First run | |
+| `app_updated` | First run of a new version | `from_version` |
+| `app_opened` | At most once a day | |
+| `frame_connected` | The first time a SteamOS build is seen | `steamos_build`, `steamos_version` |
 | `tab_viewed` | The first click on each tab in a session | `tab` |
-| `install_finished` | Any install finishes, working or not | `kind` (apk, flatpak, steam, title, web), `ok`, `seconds`, `error_category` (only when `ok` is false), `installer_code`, `xr_layer_missing`, and see below |
+| `install_finished` | Any install finishes, working or not | `kind` (apk, flatpak, steam, title, web), `ok`, `seconds`, `error_category`, `installer_code`, and see below |
 | `update_offered`, `update_started`, `update_failed` | The update banner | `to_version`, `error_category` |
 
 `install_finished` never includes a file name, path or error message. An
-error becomes one category from this fixed list, plus Android's own
-`INSTALL_FAILED_…` code (`installer_code`) when there is one:
-`android_installer`, `apk_needs_newer_android`, `apk_wrong_abi`,
-`layer_missing`, `apk_repack_failed`, `tool_missing`, `apk_unreadable`,
-`cant_run_on_frame`, `steam_shortcut`, `steam_not_running`,
-`steam_not_responding`, `steam_js_error`, `artwork_failed`, `copy_timeout`,
-`frame_not_set_up`, `frame_auth`, `frame_unreachable`, `frame_disk_full`,
-`copy_failed`, `download_failed`, `flatpak`, `cancelled`, `lepton`,
-`internal_error` (a mistake in Frame Control's own code) or `other`. A VR
-APK that installed without Frame Control's OpenXR compatibility layer,
-because this copy of the app is missing it, carries `xr_layer_missing: true`;
-otherwise that field is left out. It names what was installed only when
-that's already public:
+error becomes one category from a fixed list (for example `apk_wrong_abi` or
+`frame_unreachable`), plus Android's own `INSTALL_FAILED_…` code when there
+is one. It names what was installed only when that's already public:
 
 - F-Droid catalogue apps: `package`. Never the version, since a local build can reuse a
   catalogue app's package name
@@ -90,21 +67,13 @@ SteamOS and Lepton builds. Before sending:
 
 - the notes, app name and version are scrubbed like error messages (see
   below)
-- the APK's source is kept only if it's `F-Droid`, `meta-store` (a test
-  from [My Meta library](meta-library.md)) or the public host name of a
-  download link (`https://example.com/…`). File names, user names,
+- the APK's source is kept only if it's `F-Droid` or the public host name of
+  a download link (`https://example.com/…`). File names, user names,
   passwords, ports, paths, IP addresses and local host names are dropped
 
 When you turn this on, reports you made earlier on this computer are shared
 too.
 
-My Meta library (Experimental) keeps your Meta access token in
-`meta-account.json` in this data folder, owner-only, and sends it only to
-Meta's API and download hosts. It is never in analytics, reports, error
-details or logs; its test reports carry the package, version, version code,
-title, result and the reason, nothing from your account. See
-[meta-library.md](meta-library.md#your-token-and-privacy).
-
 The maintainer's `python3 ui/frame_compat_db.py sync` copies these events
 into the compatibility database, marked `via=community…`. It takes at most
 30 per reporter per day.
@@ -124,32 +93,19 @@ scrubbed:
   names, passwords, ports, paths and queries are dropped
 - `token=`, `key=`, `password=` and similar values are replaced
 
-The same error is sent at most once every 10 minutes. When ssh reports that
-it couldn't reach the Frame (asleep, away, or not set up yet), or that ssh and
-the Frame refused each other's keys (a changed host key, or this computer's
-key not accepted), that is sent at most once per kind each time Frame Control
-runs.
+The same error is sent at most once every 10 minutes.
 
 ## Report a problem
 
-**Report a problem** is the speech-bubble button in the header, also in the
-Settings page (**Privacy & updates**) and under **Help → Report a Problem…**. It sends the report
+**Report a problem** is the warning-sign button in the header, also in the
+Privacy panel and under **Help → Report a Problem…**. It sends the report
 privately to Frame Control's PostHog project as a `problem_report` event, the
 same way as the analytics above, so only the maintainer can read it and
 nothing is published. It works whatever the analytics settings are, because
 the person sends it deliberately. The report has the kind, title and text you
-wrote, a short reference shown after sending, and the diagnostics below. Your
-email address goes with it only if you tick **The maintainer may contact me
-with follow-up questions** (the report then carries `contact_followup: true`);
-it's filled in from **Contact email** below when you've agreed there. It has its own random id, so it isn't linked to
-your analytics events. With that box ticked, the address also becomes your
-**Contact email** below with follow-up questions ticked, so you remove it there
-like any other. If it's a different address from the one saved there, it
-replaces it, and update notices stop until you turn them on again (they were
-agreed for the old address); the form says so before you send. The report then also
-carries this copy's contact id and change number (`contact_id`, `contact_rev`,
-see below), so removing or changing the address later takes back the
-follow-up permission given with the report too.
+wrote, how to reach you if you gave it, a short reference shown after sending,
+and the diagnostics below. It has its own random id, so it isn't linked to
+your analytics events.
 
 With **Include diagnostics** ticked (the default), the report adds:
 
@@ -157,56 +113,10 @@ With **Include diagnostics** ticked (the default), the report adds:
 - the OS, its release and CPU, and the Python version
 - the Frame's SteamOS build, if it has connected since the app started
 - which analytics levels are on
-- a short connection summary, so "the app can't find the headset" can be
-  diagnosed. It is made of fixed words and counts only; no text from an
-  error message or from ssh, and no name you chose, goes in it:
-  - the connector's state (idle, connecting, connected or failed), the stage
-    it failed at (network, find, ssh, identity or login), the attempt number
-    and why it started (such as "Starting up" or "Trying again")
-  - how many headsets are saved; whether the active one's ssh alias is the
-    default `frame` or a custom one (a custom alias itself is never named);
-    whether it's saved or a bare ssh alias; and its number of addresses
-  - for the current error and the last failure: the stage and an error
-    category (the same fixed names as error details, such as
-    `frame_unreachable`, `frame_not_set_up`, `frame_auth` or `other`), and
-    how long ago the last failure was. The category is decided when the
-    failure happens
-  - for each address tried, only its kind (`.local`, `ipv4`, `ipv6`,
-    `ipv6 link-local`, `tailscale`, `hostname`, `alias` for one read from
-    `~/.ssh/config`, and what a name resolved to, such as
-    `.local->ipv6 link-local`) and how the try went (answered, unresolved,
-    timeout, refused, unreachable, sshfailed). Never the address itself
-  - when connected, the kind of address used and its round trip in ms
-  - whether this computer has a network gateway, and whether Tailscale is on,
-    off or not installed
-  - which kind of `ssh` the app runs (Windows OpenSSH in System32, OpenSSH in
-    Program Files, Git for Windows, MSYS2/Cygwin, Homebrew or /usr/local,
-    Nix, the system one, or "other"), never its path; its version, rebuilt
-    from the numbers in the banner `ssh -V` prints (such as
-    `OpenSSH for Windows 9.5p1, LibreSSL 3.8.2`; anything that isn't a
-    plain OpenSSH banner is reported as `unknown`); and the kinds of any
-    other `ssh` on the PATH.
-    This is looked up once in the background after the app starts, so a
-    report sent straight away may say "still being checked"
-  - whether `~/.ssh/config` exists, whether it has Set Up Connection's
-    managed block for the active alias, how many managed blocks it has, and
-    whether a hand-written `Host` line also names the alias (yes or no; the
-    alias isn't named)
 
 **Also include recent activity and the server log** is off by default,
 because those lines can name files and apps. When ticked, it adds the newest
-Activity lines and server log lines, without the request lines. The server
-log has a line for each failed connection attempt: its stage, the message
-shown on the connection pill, ssh's last line about it, and the address kinds
-above. That free text is scrubbed when the line is written: the addresses, ssh alias
-and display name of the headset being tried (whole, whatever their case), and
-then any name ssh gives after "hostname", "host" or "to", become `<host>`; a Windows home folder's
-whole name (spaces and apostrophes included) becomes `<user>`, and ssh's
-whole `user@host:` field (spaces, `DOMAIN\user` and full domain names
-included) becomes `<user>@<host>:`; then the scrubbing below. A host name ssh mentions
-in some other wording can still get through, so check the log lines in **Show
-exactly what's included** before sending. A failure that repeats on every
-retry is written at most once every 5 minutes.
+Activity lines and server log lines, without the request lines.
 
 Everything is scrubbed like error details and limited to what fits in the
 report. Environment details are kept first, then the newest lines. **Show
@@ -218,67 +128,11 @@ The maintainer reads reports on the Frame Control dashboard in PostHog, or
 with `python3 ui/frame_report.py inbox [days]`, which uses the same personal
 API key as `frame_compat_db.py sync`.
 
-## Contact email (optional)
-
-Frame Control never needs an email address. If you'd like to leave one, there
-are two separate choices, both off until you tick them:
-
-| Choice | What it's for |
-|---|---|
-| **Email me about Frame Control updates** | Occasional notices about new releases and updates |
-| **The maintainer may contact me with follow-up questions** | Questions about problem reports you send, mostly |
-
-You're asked once, in a bar at the top of the page, after the Frame has
-connected for the first time, and never in the same visit as the first-run
-privacy notice. **No thanks** hides it for good, and it isn't
-shown again even if you ignore it. **Contact email** in **Privacy & updates**
-is where you add, change or remove the address and either choice at any time.
-
-**What's sent, and where.** The address and the two choices go privately to
-Frame Control's PostHog project, the same place as problem reports, as a
-`contact_consent` event with `email`, `updates`, `followup`, `action` (`set`
-or `withdraw`) and the common properties above. Only the maintainer can read
-that project, and nothing in it is published or shared. It's sent only when
-you save, or when you send a problem report with follow-up questions ticked,
-whatever the analytics settings are, because you chose to. With a report, the
-address and choices are saved before the report is sent and stay saved if it
-fails; like any change, they're sent as soon as PostHog can be reached. It
-carries its own random contact id, not the analytics id, so it isn't linked
-to your usage events, and a `rev` number that goes up with each change, so
-the newest choice always wins. Like everything else sent, it's listed under
-**Show what's been sent**. On this computer the address and choices are kept in
-`contact/contact.json` in Frame Control's data folder. An address is only
-kept with at least one choice ticked.
-
-**Removing it.** **Remove my email** (or clearing the address and saving)
-deletes it from this computer, including from the **Show what's been sent**
-log (in earlier contact events and problem reports), and sends a `withdraw`
-event with no address in it. The maintainer's list only uses the newest event from each copy, so from
-then on the address isn't listed for either choice. Unticking one choice
-works the same way for that choice. This also covers problem reports you sent
-from this copy with follow-up questions ticked: if your newest choice since the
-report (by change number, not the clock) no longer agrees to follow-up
-questions at that address, the maintainer's inbox shows the permission as
-withdrawn and leaves the address out. If you're offline, the change waits on
-this computer and is sent when PostHog can be reached. The earlier event
-stays in PostHog until its data retention removes it; to have it deleted
-sooner, ask the maintainer (for example in a problem report).
-
-Nothing sends email yet: this only records who agreed to what. The
-maintainer lists the addresses with
-`python3 ui/frame_report.py contacts [updates|followup]`, which uses the same
-personal API key as `inbox`.
-
 ## Turning it all off
 
 Untick the boxes, or set `DO_NOT_TRACK=1` or `FRAME_CONTROL_TELEMETRY=0` in
 the environment that starts Frame Control. A copy run from a source checkout
-never sends analytics unless `FRAME_CONTROL_TELEMETRY=1` is set.
-
-These switches cover the analytics above. A problem report or a contact email
-is sent only because you pressed its Send or Save button, so those still go
-when you choose to send them (a contact change saved while offline is sent
-by itself once PostHog can be reached); if you don't, nothing is sent.
+never sends anything unless `FRAME_CONTROL_TELEMETRY=1` is set.
 
 ## Update checks
 
@@ -287,12 +141,3 @@ then every 6 hours: the latest release's `update.json` on GitHub, or
 `api.github.com/repos/saphid/frame-control/releases/latest` if that fails.
 Those requests carry no id. To stop it, set
 `FRAME_CONTROL_NO_UPDATE_CHECK=1`. See [releasing.md](releasing.md).
-
-## Screenshots and clips
-
-Copying screenshots and Steam clips to your computer, by hand or with
-**Settings → Copy to this computer**, goes straight from the headset to your
-computer over the same SSH connection as everything else. Nothing is uploaded
-anywhere. What automatic copying has copied is listed, by file id, in
-`auto-sync.json` in Frame Control's data folder; see
-[recording.md](recording.md#copying-new-ones-automatically).

docs/quest-import.md

@@ -1,219 +0,0 @@
-# Import from my Quest
-
-Move games you own from your own Meta Quest onto the Steam Frame. Plug the
-Quest into your computer by USB; Frame Control copies the game off it with
-adb, checks it can run in Lepton, and installs it on the Frame like any other
-APK, with its own Lepton instance and Steam library entry
-([apks.md](apks.md), [vr-apks.md](vr-apks.md)).
-
-There is no licence-check bypass, and there won't be. A game that uses Meta's
-licence check installs with a warning: on the Frame that check can't reach
-Meta, so the game may quit, hang, or run without online features. See
-[What won't run](#what-wont-run-and-why) below. To install games you own
-straight from Meta instead, without a Quest, see [My Meta library
-(Experimental)](meta-library.md).
-
-## Before you start: developer mode on the Quest
-
-adb only reaches a Quest with developer mode on:
-
-1. Make a free Meta developer organisation at
-   [developers.meta.com](https://developers.meta.com/horizon/) on a **verified**
-   Meta account (Meta asks for a phone number or payment card to verify).
-2. In the Meta Horizon phone app, open the headset's settings and switch
-   **Developer Mode** on. Restart the Quest.
-3. Plug the Quest into the computer that runs Frame Control with a USB cable
-   that carries data (some charging cables don't).
-4. Put the headset on. Accept **Allow USB debugging**, and tick **Always allow
-   from this computer**.
-
-Frame Control uses the adb it already uses for the Frame (an adb you
-installed, else the one it bundles). On Linux, adb also needs permission to
-open the Quest: add a udev rule for Meta's USB vendor id `2833`, for example
-`SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0660", GROUP="plugdev"`, and
-be in that group. Then unplug and replug.
-
-The Frame's own adb connections (Frame Control's SSH tunnels to Lepton,
-`127.0.0.1:<port>`) are never touched. Only a device that reports itself as
-Oculus or Meta, or a Quest model, counts as a Quest.
-
-## Using it
-
-In the app: **Android → On your Frame → Import from my Quest**. Choose **Look
-for my Quest**, then **Import** next to a game. Tick **Also copy each game's
-files in Android/data** to bring the game's external files too (some games
-keep saves there). Progress shows in the panel; the result and any reason it
-stopped appear in the message log.
-
-You can choose **Import** on several games at once: they wait in the **Install
-queue** (above the Quest panel) and import one after another, together with
-installs from the Android store and My Meta library. **Remove** takes a game
-out of the queue before it starts. Each queued import runs on the headset that
-was selected when you queued it; if you switch headsets first, it stops with a
-message instead.
-
-A game with game data (an OBB folder, or Android/data when ticked) takes two
-imports, because Android can only take that data while the game's Lepton
-instance is running, and there is no way to start the instance without the
-game. Frame Control never starts the game itself:
-
-1. **Import** installs the game and says it has data to add.
-2. Start the game from the Steam library and leave it on its first screen.
-3. **Import** again. Frame Control sees the game open with the same version,
-   copies the data in, and closes the game. Start it again to play.
-
-A game that quits straight away without its data can't take it this way.
-
-From a terminal:
-
-```sh
-python3 ui/frame_quest.py devices                      # what adb sees, and which is the Quest
-python3 ui/frame_quest.py list                         # apps on the Quest: split or not, OBB and data sizes
-python3 ui/frame_quest.py import com.example.game      # copy one to the Frame
-python3 ui/frame_quest.py import com.example.game --data --serial 1WMHH000XXXXXX
-```
-
-The API is `GET /api/quest` (the Quest, or guidance when there isn't one, and
-its apps) and `POST /api/quest` with
-`{"action": "import", "package": "...", "serial": "...", "data": false}`,
-which returns a background job (`/api/job`) with a stage and percentage. The
-job waits in the install queue first (`"queued": true`, stage `Queued: N
-installs before it`). `GET /api/queue` lists the running install and those
-waiting; `POST /api/queue` with `{"action": "remove", "job": "..."}` removes a
-waiting one (409 once it has started).
-
-## What an import does
-
-1. Finds the Quest (`adb devices -l`, then `ro.product.manufacturer` and
-   `ro.product.model`). If none is ready it says why: nothing connected, not
-   authorised yet (the **Allow USB debugging** prompt), no USB permission
-   (Linux), offline, another Android device, or several Quests.
-2. Lists third-party apps (`pm list packages -3`), each with `pm path` (one
-   line is a single APK, several a split APK) and the size of
-   `/sdcard/Android/obb/<package>` and `/sdcard/Android/data/<package>`.
-   Labels aren't shown before import: reading them means copying the APK.
-3. Checks there is room on the computer (the APKs, a merged and a patched copy
-   of them counted uncompressed, the OBB folder and the Android/data folder
-   once, since that is streamed to the Frame), then copies the APK and its splits
-   into a per-user cache folder (`Frame Control/quest-import` under the
-   system's cache folder).
-4. **Checks the APK before anything else is copied**, refusing:
-   - 32-bit-only builds (native code but no `arm64-v8a`);
-   - apps that need an Android newer than Lepton's (API 30);
-   - split APKs Frame Control can't merge (below).
-   Installed with a warning:
-   - games that use Meta's licence check (Meta's Platform SDK,
-     `libovrplatformloader.so`, in the base or any split): "uses Meta's
-     licence check; it may quit, hang, or run without online features on the
-     Frame. Frame Control won't remove the check." Linking the SDK doesn't
-     mean a game enforces the check: Meta's store requirement for it
-     (VRC.Quest.Security.1) has only been *Recommended* since 2021, and what
-     a game does when the check fails is up to the game;
-   - VrApi-only builds (`libvrapi.so`, no OpenXR loader), flagged as for any
-     APK: the Frame has no VrApi, so they may not run.
-5. If the game isn't open on the Frame: installs it through the normal APK
-   install (`frame_android.install`: VR detection, the launcher fix, the
-   OpenXR compatibility layer, artwork), and says whether it has game data
-   to add. An older Quest copy never replaces a newer version on the Frame
-   (compared by version code, which installs now record; for installs made
-   before that, it is read from the installed APK on the Frame) unless you
-   tick **Allow replacing a newer version** (`--allow-downgrade`,
-   `"allowDowngrade": true`). If the installed version can't be read at all,
-   that permission is needed too.
-6. If the game is open on the Frame (the second import): refuses unless
-   Frame Control's install record is for this package, in this package's own
-   instance, at the Quest's exact version code (an open game is never
-   replaced), otherwise copies the OBB folder (and `Android/data` if ticked)
-   from the Quest, waits for Android to have finished booting, copies standard
-   `main|patch.<version>.<package>.obb` files with the existing OBB helper
-   (checked by SHA-256 inside Android, [sidequest.md](sidequest.md#obb-files))
-   once Android's own `dumpsys package` in that instance shows the same
-   package at the same version code,
-   streams the `Android/data` files in as a tar written straight into the SSH
-   transfer, then closes the game so its next start reads them, and checks
-   its instance has stopped; if it hasn't, or the check itself fails (a
-   failed `podman ps` never reads as "stopped"), the result says so. The game
-   is closed whatever happens during the copy, including a local read error
-   or Ctrl-C, and a failed close is reported without hiding the original
-   error. Everything
-   from the second check of the install record (after the pulls, which can
-   be long) to closing the game holds the same lock as installs and removals.
-   Other files in the OBB folder are listed as not copied.
-7. Deletes the cache folder, whether the import worked or not. A folder left
-   by a crash is removed by a later import after six hours.
-
-Only one import runs at a time. If copying game data fails, the game is
-closed and the message says so; start it and import again.
-
-### Split APKs
-
-Lepton runs one APK per instance, so the shared install path now merges a
-split APK into one (`frame_android.install(base, splits=[...])`, or
-`python3 ui/frame_android.py install base.apk split1.apk ...`). Merging copies
-each split's native libraries and assets into the base, drops the base
-manifest's `isSplitRequired` flag, and re-signs with Frame Control's key, as
-the launcher fix already does. Only splits that hold nothing but
-`lib/<abi>/*.so`, `assets/` and their own signature, manifest and an empty
-resource table are merged. Refused, with the reason, before anything reaches
-the Frame: splits with resources (screen density or language), code
-(`classes*.dex`), any other file, a manifest that declares components or
-libraries (`<service>`, `<uses-library>`...), feature splits, and splits of
-another package. The merged files are held in memory while the APK is
-repacked and signed (as for every patched APK), so a merge adds at most
-512 MB per file and 1 GB in all. Each file is read from its raw bytes and
-checked against both of its ZIP headers: the local header must name the same
-file with the same method, sizes and checksum as the central directory (or a
-data descriptor must carry them; ZIP64 sizes are understood), the data must
-end before the next entry, a stored file must be exactly its declared size, a
-compressed one must end exactly at the end of its data with nothing after it,
-and its checksum must match. So a forged header can't truncate a file or fill
-memory. A resource table counts as empty only
-if it defines nothing at all (styles and other complex entries included). A merged, re-signed APK can't update a
-copy signed by the publisher.
-
-## What won't run, and why
-
-- **Games that enforce their Meta store licence.** Many store games link
-  Meta's Platform SDK (`libovrplatformloader.so`), for the licence check and
-  for user ids, achievements, multiplayer, cloud saves or DLC. On the Frame the
-  SDK can't reach Meta's services, which only exist on Meta headsets. A game
-  that enforces the check then quits or hangs; one that doesn't may run
-  without its online features. Frame Control can't tell which from the APK, so
-  it installs these with a warning and **won't remove or work around the
-  check**, and doesn't bundle, call or link to any tool that does. If yours
-  quits, ask the developer for a build without the check, or get the game from
-  Steam or itch.io. Most SideQuest, itch.io and open-source games don't link
-  the SDK.
-- **32-bit games** (Quest 1 era): the Frame runs 64-bit ARM only. Refused.
-- **VrApi-only games**: the Frame has OpenXR, not Meta's older VrApi. They
-  install with a warning, but may not run.
-- **Anything else that needs Meta**: avatars, Quest-only device checks,
-  passthrough and other `XR_FB_*` features SteamVR lacks
-  ([vr-apks.md](vr-apks.md#what-steamvrs-android-runtime-supports-verified)).
-- **Private app data** (`/data/data/<package>`) can't be read over adb without
-  root, so only saves in `Android/data` come across.
-
-What usually works: OpenXR games without Meta's licence check, for example
-open-source and itch.io builds you sideloaded onto the Quest.
-
-Only import games you own, for your own use.
-
-## Evidence and limits
-
-**Verified locally** with a fake adb (`tests/fakeadb.py`, `tests/test_quest.py`):
-device detection (Quest, the Frame's tunnel, the Frame over USB, other
-Android devices, unauthorised, no permissions, offline, none, several),
-package listing and split detection, the refusals and the licence-check warning, the order of copies
-(APK checked before the OBB is copied), the two-step install then data copy
-(the game is never started by Frame Control, never replaced while open, and
-closed after its data is copied), split merging and signing, the split
-refusals and size limits (including a forged zip bomb), the space estimate,
-and cache clean-up after success and failure.
-
-**Not verified:** a real Quest (none was available), Quest system apps in
-`pm list packages -3`, real split APKs from the Meta Store, OBB and
-`Android/data` writes into a running Lepton instance on a real Frame
-(the OBB helper itself is also unverified there), whether games stay open
-without their OBB long enough for the second import, and the Linux udev rule.
-Large games are copied into memory while being merged or patched, as every
-patched APK already is.

docs/recording.md

@@ -1,165 +0,0 @@
-# Recording and Steam clips
-
-Frame Control can record what the headset shows, with its sound, and save it as
-an `.mp4` on your computer. It can also export the clips and background
-recordings from Steam's own game recording, at any length, as one `.mp4` each.
-Both are on **Tools → Capture & Live**. Everything is saved to
-`~/Videos/SteamFrame`, next to the screenshots in `~/Pictures/SteamFrame`.
-Nothing needs installing on the computer or on the Frame: the work is done by
-the `ffmpeg` that SteamOS ships.
-
-**Recording is tested on a headset; Steam clip export isn't yet.** On a Frame
-running SteamOS 0.5.6 (build 20261015.6141207), Record and Stop saved an
-8-second 1080p H.264 recording with AAC sound to the computer, Stop took about a
-second, and nothing was left running or stored on the Frame. That Frame had no
-Steam recordings, so the clip list came back empty and export has only been
-tested with files in Steam's format made by `ffmpeg`. The parts we're least sure
-of are listed under [What hasn't been checked](#what-hasnt-been-checked).
-
-## Record
-
-Press **Record** next to **Live**. The button turns into **Stop**, and a line
-under the viewer counts the time. Press **Stop**: the recording is finished on
-the Frame, converted to `.mp4` there (without re-encoding) and copied to
-`~/Videos/SteamFrame/rec-<date>-<time>.mp4`. The line says when it's saved.
-
-- **What's in it**: the same picture as **Live**, SteamVR's copy of the headset
-  view (one undistorted 1920×1080 eye, from `/dev/video99`), at 30 fps and
-  8 Mbit/s, encoded with x264 (the Frame's hardware encoder crashes `ffmpeg`).
-  The sound is what the headset plays: the monitor of PipeWire's default
-  output, read through its PulseAudio server (`-f pulse -i @DEFAULT_MONITOR@`).
-  The microphone isn't recorded.
-- **Without sound**: before each recording Frame Control checks for a fraction
-  of a second that `ffmpeg` can read that audio. If it can't, the recording goes
-  ahead as video only, and the page and the saved message say so.
-- **Limits**: a recording stops by itself after 20 minutes and is saved as if
-  you'd pressed Stop. It needs about 2.9 GB free on the Frame to start (room for
-  a full-length recording twice, while it's converted), and checks the space on
-  your computer before copying. One recording runs at a time.
-- **Where it waits on the Frame**: `~/.cache/frame-control/video/`, not `/tmp`,
-  which is a RAM disk on SteamOS. It's deleted once copied.
-- **If the connection drops or the app quits** while recording, the Frame
-  stops `ffmpeg` cleanly when the SSH channel closes: it types `q` into
-  `ffmpeg`'s input, as at its keyboard, and kills it if it's still there 10
-  seconds later. Not a signal: SteamOS's `ffmpeg` 7.0 catches SIGTERM and
-  SIGINT and carries on recording. A recording that was never copied is
-  deleted when the next one starts.
-
-Recording and **Live** can run together; both read the same device.
-
-## Steam clips
-
-**Steam clips** lists what Steam's game recording has kept on the Frame: saved
-clips and background recordings, newest first, with the game, length and size.
-**Export** joins one into a single `.mp4` in `~/Videos/SteamFrame`, named after
-its folder (for example `clip_620_20261020_202134.mp4`), however long it is.
-Steam's own export is reported to stop at about 60 seconds. Exports run in the
-background; ones already on your computer are marked.
-
-How it works: Steam keeps each recording as MPEG-DASH segments, one folder per
-recording session.
-
-```
-~/.local/share/Steam/userdata/<account>/gamerecordings/
-  video/bg_<appid>_<YYYYMMDD>_<HHMMSS>/                 background recording
-  clips/clip_<appid>_<YYYYMMDD>_<HHMMSS>/video/bg_<...>/ a saved clip
-      session.mpd
-      init-stream0.m4s  chunk-stream0-00001.m4s  chunk-stream0-00002.m4s ...
-      init-stream1.m4s  chunk-stream1-00001.m4s ...
-```
-
-Each stream's `init-stream` segment followed by its chunks, in number order, is
-a playable fragmented MP4 of that stream. On the Frame, `ui/frame_clips.py`
-builds those files and has `ffmpeg` put the video and audio into one `.mp4`
-with `-c copy`, so nothing is re-encoded and it takes seconds. The result is
-copied to the computer and deleted from the Frame. The export needs free space
-on the Frame of about twice the recording's size while it runs.
-
-The listing doesn't rely on the folder names: any folder under `clips/` or
-`video/` (up to four levels down) holding `init-stream*.m4s` counts. A stream
-missing its init segment or its chunks is left out. Missing chunk numbers are
-shown as "pieces missing"; the rest still exports.
-
-## Copying new ones automatically
-
-**Settings → Copy to this computer** copies new screenshots and Steam clips
-here on their own. It's off until you turn it on, with a switch each for
-screenshots and Steam clips. While a headset is connected, Frame Control looks
-about once a minute and copies what's new with the same code as **Save** and
-**Export**: screenshots to `~/Pictures/SteamFrame`, clips to
-`~/Videos/SteamFrame`.
-
-- **Only what's new.** It copies what you take after turning it on, so the
-  shots and clips already on the headset don't all arrive at once. **Copy
-  everything now** copies everything that isn't on this computer yet, once.
-- **Deleted stays deleted.** What it has copied is remembered, per headset, in
-  `auto-sync.json` in Frame Control's data folder, so a file you delete here
-  isn't copied again (**Copy everything now** would bring it back).
-- **Saved clips only.** Steam's background recording is a rolling buffer, not
-  something you chose to keep, so it isn't copied; export it by hand. A clip
-  Steam wrote to in the last 30 seconds is still being saved and waits for the
-  next look.
-- **It gives way.** It waits while an install, an export, a recording or
-  anything else is running on the headset, and stops between files if one
-  starts. While a copy is running, switching headsets waits for it, as it does
-  for an export. When the headset can't be reached it waits longer each time,
-  up to 15 minutes, and starts over once it answers.
-- **When this computer is full** (under 512 MB free, or a copy runs out of
-  space) it pauses and says so in Settings and above the lists. Free some space
-  and press **Resume**.
-- **With several headsets** it copies from the one you're connected to.
-
-Settings shows when it last checked, how many files it last copied and when,
-and the last problem it had. The screenshot and clip lists say when it's on.
-
-## For developers
-
-`ui/frame_clips.py` holds the logic, so other features can reuse it (automatic
-copying, in `ui/frame_autosync.py`, does):
-
-- `list_clips(run_frame)` and `export_clip(id, run_frame, run, fetch)` are the
-  computer's side; the server passes how to reach the Frame.
-- `list_recordings(userdata)` and `export(userdata, id)` are the Frame's side,
-  run as `python3 - list` / `python3 - export ID` with the file on stdin.
-- `Recorder` runs one recording from Start to the copy.
-- `parse_id` checks a clip id (`<account>/<clips|video>/<folder>...`, plain
-  names only, no `.` or `..`) before it reaches a path or a shell.
-
-The API, with the same guards as every other request:
-
-| Request | Does |
-|---|---|
-| `GET /api/record` | The recording's state: `idle`, `starting`, `recording` (with `elapsed`, `audio`, `limit`), `stopping`, `saving`, `saved` (with `file`) or `failed` (with `error`) |
-| `POST /api/record {"action": "start"\|"stop"}` | Start or stop |
-| `GET /api/clips` | Steam's recordings on the Frame, each with `saved` |
-| `POST /api/clips/export {"id"}` | Starts an export; poll `/api/job` |
-| `POST /api/open {"what": "videos"}` | Opens `~/Videos/SteamFrame` |
-| `GET /api/autosync` | Automatic copying: `screenshots`, `clips`, `since` (the watermark), `checked`, `copied`, `copied_time`, `error`, `paused`, `waiting` (clips still being written) |
-| `POST /api/autosync {"action": "settings", "screenshots", "clips"}` | Turn either on or off; turning it on sets `since` to now |
-| `POST /api/autosync {"action": "now"\|"resume"}` | Copy everything not here yet, once; or resume after running out of space |
-
-They aren't available when the server runs on the Frame itself (the iPhone
-app), since they save to a computer.
-
-Tests: `tests/test_clips.py`, and `tests/test_autosync.py` for automatic
-copying (with a fake headset). They run the recording's shell under bash with a
-stand-in `ffmpeg`, so Stop, the time limit and the clean-up are tested as they
-run on the Frame. Where `ffmpeg` is installed, they also make a 65-second DASH
-recording with Steam's file names and export it with the real `ffmpeg`.
-
-## What hasn't been checked
-
-The 2026-10-24 read-only clip list on build `20261015.6141207` again returned
-zero clips: its `gamerecordings` directory held only `gamerecording.pb`. No
-Steam recording was created during that check, so a real Steam clip export is
-still unverified. The recording and Stop path were verified earlier on that
-build, as described above. Remaining checks:
-
-- Audio and video sync. Both inputs are stamped with the wall clock, because
-  the camera device and the audio server otherwise count from different clocks.
-- The exact layout of `gamerecordings` on the Frame's SteamOS build, and
-  whether a clip's segments start mid-recording. The parser is deliberately
-  loose about the layout.
-- How much x264 at 1080p30 costs the Frame while a game is running.
-- Automatic copying: that 30 seconds without a write is a safe sign Steam has
-  finished saving a clip, and how a once-a-minute listing feels on the Frame.

docs/recovery-and-images.md

@@ -4,9 +4,6 @@ Where to get the Steam Frame's operating system, what's inside it, and how to
 run it for testing without the headset. For recovering a Frame that won't boot,
 see the boot menu and boot-loop entries in
 [how-the-frame-works.md](how-the-frame-works.md#facts-worth-knowing).
-To keep your game saves, settings and Android app data through a factory reset
-(`Erase User Data`) or a re-image, and to get out of Desktop Mode, see
-[backup-and-recovery.md](backup-and-recovery.md).
 
 ## Downloads
 

docs/releasing.md

@@ -24,20 +24,13 @@ count. So a build reaches people only when you publish it, after testing it.
 4. Publish:
 
    ```sh
-   scripts/publish-release.sh --dry-run v0.4.0   # checks and shows update.json, changes nothing
    scripts/publish-release.sh v0.4.0
    ```
 
-   The script checks that the tag is on GitHub and that all eight installers
-   are attached, each with the SHA-256 digest GitHub records. It attaches
-   `update.json` (the version, the notes, the release page and each
-   installer's digest), then publishes the release and marks it latest. It
-   uses only the REST API: `gh release view` can't find a draft whose
-   `tag_name` still reads `untagged-…`, and GraphQL is often rate-limited.
-   Such a draft is found by its exact title (`Frame Control 0.4.0`, or that
-   followed by `: subtitle`) and tied to the tag when it's published. The release page in `update.json` is always
-   `releases/tag/<tag>`, because a draft's own address (`releases/tag/untagged-…`)
-   stops working once it's published. From then on, running copies see the update. They check about 8
+   The script checks that all eight installers are attached, each with the
+   SHA-256 digest GitHub records. It attaches `update.json` (the version, the
+   notes and each installer's digest), then publishes the release and marks it
+   latest. From then on, running copies see the update. They check about 8
    seconds after starting, then every 6 hours, and anyone can use **Check for
    Updates…** (the app menu on macOS, the Help menu elsewhere).
 

docs/scripts.md

@@ -7,10 +7,6 @@ run on Linux. On Windows, use the app.
 
 ## Minimum typing on the headset
 
-If setup or pairing fails, run `scripts/frame-doctor.sh` from this checkout.
-It checks existing SSH access without requesting passwords, pairing or applying
-repairs. See the [Frame doctor guide](frame-doctor.md) for results and next steps.
-
 Valve's own developer docs say SSH, ADB, and RDP are all turned on through a
 **UI toggle**. You don't need a terminal, `passwd`, or `systemctl`. The only
 thing you type on the headset is a password you choose.
@@ -93,7 +89,6 @@ controls to place each panel. See [docs/panels.md](panels.md).
 | Script | Runs on | Purpose |
 |---|---|---|
 | `scripts/tailscale-on-frame.sh` | Mac → Frame | Install Tailscale in `~` as a userspace user service so `frame` works from anywhere; `--uninstall` (**verified** on the LAN) |
-| `scripts/store-on-frame.sh` | Mac → Frame | Open the APK Store (Frame Control's Android store) as a panel in the headset; installs run on the Frame (**inferred**; see [docs/apks.md](apks.md)) |
 | `scripts/connect.sh` | Mac | Discover, set up key and `~/.ssh/config`, copy key, optional `--harden` (**verified**; `--harden` untested) |
 | `scripts/install-apps.sh` | Mac → Frame | Install Flatpaks (Remmina, Moonlight, …) on the Frame over SSH as `--user` (**verified** with Remmina) |
 | `scripts/paste-to-frame.sh` | Mac → Frame | Send the Mac clipboard (or stdin) to the Frame clipboard (**verified**) |

docs/sideloading.md

@@ -30,8 +30,7 @@ it.) A dialog shows:
 
 Install copies it to the Frame and registers it with Steam; progress shows in
 the bar and the activity log. **Sideloaded titles** lists what's installed,
-with Launch, Remove and, for a game that has stopped responding, **Force
-quit…** in its ⋯ menu ([how](steam-games.md#force-quitting-a-running-game)). **Copy to ~/Downloads instead** keeps the old
+with Launch and Remove. **Copy to ~/Downloads instead** keeps the old
 behaviour for a zip that isn't a game.
 
 From a terminal:

docs/sidequest.md

@@ -1,147 +0,0 @@
-# SideQuest and Frame Control
-
-Researched 2026-09-28. SideQuest is both a Quest discovery website and a desktop
-sideloading/device-management app. Its Quest labels are **not** evidence that a
-game works on Lepton: inspect the APK for arm64/OpenXR, Android API requirements,
-VrApi and Meta services (see [VR APKs](vr-apks.md)).
-
-## Features worth borrowing
-
-Desktop evidence is the public [SideQuest source at af2ac70](https://github.com/SideQuestVR/SideQuest/tree/af2ac7043db122bca3c8db18f2b58f1660e9befb),
-especially [ADB operations](https://github.com/SideQuestVR/SideQuest/blob/af2ac7043db122bca3c8db18f2b58f1660e9befb/desktop-app/src/app/adb-client.service.ts),
-[drag and drop](https://github.com/SideQuestVR/SideQuest/blob/af2ac7043db122bca3c8db18f2b58f1660e9befb/desktop-app/src/app/drag-and-drop.service.ts),
-and the [legacy repository index](https://github.com/SideQuestVR/SideQuest/blob/af2ac7043db122bca3c8db18f2b58f1660e9befb/desktop-app/src/app/packages/package.service.ts).
-Website evidence: [SideQuest](https://sidequestvr.com/) and its public Angular
-bundle `main-4MMXZRXL.js`, inspected locally without browser automation.
-No SideQuest implementation code was copied.
-
-| SideQuest feature | Frame Control before this change | Borrow? / effort |
-|---|---|---|
-| Store descriptions, screenshots, banners, trailers, ratings | F-Droid names, icons, compatibility verdicts and reports; no equivalent rich VR store | Yes, from authorised sources; medium. Search and library workers own presentation/artwork. |
-| OBB expansion-file install | APK-only install | **Implemented helper and CLI**, medium. Essential for games whose assets are separate from the APK. |
-| App-data backup/restore | Persistent instances and optional keep-data uninstall, no portable save archive | **Implemented private-data helper and CLI**, medium. Back up before updates or experiments. |
-| File manager (list, upload, download, remove) | General Send to Frame, no Android file browser | Useful later, medium; requires clear instance selection and scoped paths. |
-| Installed-app management (launch, uninstall, backup) | List, launch, stop, remove, probe | Already mostly covered. Backup added here. |
-| Update notices / account library | Compatible-version lookup; no source-aware installed update notices | Useful later, medium; needs original version code and source identity recorded on install. |
-| Custom repositories | Built-in F-Droid catalogue and compatible-version indexes | Separate user-repos worker. Legacy SideQuest source has a fixed SideQuestRepos index; arbitrary current custom-repo support was not verified. |
-| Drag-and-drop APK/OBB install | APK drag-and-drop already works | The [Android backup importer](android-backups.md) now groups the APK and matching OBBs, detects desktop siblings and guides installation and data setup. |
-| Tags, price, headset filters, reviews | Text search and Lepton verdicts, not Quest headset metadata | Useful, medium; search worker owns filters. Keep source headset claims distinct from tested Frame compatibility. |
-| Screenshot/video capture and streaming | Frame screenshots/VR capture already present | Reuse existing tools; do not port Quest capture commands. |
-| Device settings and ADB utilities | Frame/Android display settings, SSH and own-instance tools | Borrow selectively; Quest CPU/GPU presets and wireless-ADB setup do not map directly to Lepton. |
-
-Priority: expansion files, then save backup/restore. Rich discovery and update
-notices follow once a permitted metadata source and source/version persistence
-are available. This patch deliberately exposes CLI/backend operations, leaving
-shared UI, install(), Steam artwork and launch behavior to sibling work.
-
-## SideQuest as a source: page-only
-
-[Terms](https://sidequestvr.com/terms), “Prohibited Activities”, (i) prohibits
-copying/distributing/disclosing the Service including automated or non-automated
-“scraping”; (xi) prohibits content access through means other than those provided
-or authorised by the Service; (xii) prohibits bypassing access restrictions.
-The terms describe downloading developer-posted games through the Service, but
-do not establish permission for this third-party API integration.
-
-[robots.txt](https://sidequestvr.com/robots.txt) requests a three-second crawl
-delay and disallows `/search/`, `/user/*` and `/sideload/*`. Robots permission
-would not override the terms. The API host's robots request returned HTTP 403;
-a request for the first shared website JS chunk also returned 403. No bypass,
-account token, cookies, browser session or private endpoint was used.
-
-The homepage publishes `https://api.sidequestvr.com` and
-`https://cdn.sidequestvr.com`. The website bundle calls `searchApps(...)` and
-`getApp(id, null)`; their actual HTTP search/detail routes could not be established
-from the retrieved bundle. Do not invent endpoints. The open-source desktop
-[install flow](https://github.com/SideQuestVR/SideQuest/blob/af2ac7043db122bca3c8db18f2b58f1660e9befb/electron/app.ts)
-POSTs `{token: ...}` to `/install-from-key`. It consumes
-`data.apps[].urls[]`, with `provider` values including `APK`, `OBB`,
-`Github Release` and `Mod`, and `link_url`. This is a website-issued install-key
-flow, not evidence of an anonymous download API. It is not implemented here.
-
-`ui/apk_sources/sidequest.py` implements the shared interface conservatively:
-
-- `sources()` marks SideQuest `page_only` and explains why.
-- `search()` raises a user-readable `SourceError` with the browse URL (zero
-  limit returns no rows). It does not invent app results or report a false
-  “no matching games”. The aggregate search UI should surface this source error.
-  In the app, Discover doesn't link to it; the **Sources** dialog lists SideQuest
-  with a link to its website instead of an on/off switch.
-- `details()` accepts a numeric listing id and returns its canonical page link,
-  `downloadable: False`, empty versions/tags/headsets and the `images` shape
-  `{icon: None, banner: None, screenshots: []}`. Name is explicitly a listing id;
-  unknown facts, including free/VR status, stay `None`.
-- `download()` refuses with that page link. Paid/external listings cannot be
-  downloaded by this adapter either. No downloads means no verification claim.
-
-The JSON fixture records policy evidence, **not a purported live app response**.
-No listing metadata, artwork URLs, or OBB download URLs were scraped.
-The requested real SideQuest → OpenXR APK → `frame_android.py info` test is
-**blocked by the terms**, and was not performed. No alternate source is silently
-substituted. A future integration needs SideQuest's permission or an expressly
-supported third-party API, plus recorded search/detail/download fixtures,
-free/direct-download classification, and size/hash verification. A calculated
-local SHA-256 alone must not be called publisher verification.
-
-## OBB files
-
-For the app's guided APK and OBB import, see [Import an Android game backup](android-backups.md).
-The CLI helper below remains available for a running instance.
-
-```sh
-python3 ui/frame_android.py install-obb org.example.game main.42.org.example.game.obb
-python3 ui/frame_android.py install-obb org.example.game main.42.org.example.game.obb patch.42.org.example.game.obb
-```
-
-Install the APK first. The named instance must already be running; the helper
-never launches an app or uses Lepton Development. It requires standard
-`main|patch.<versionCode>.<package>.obb` filenames and nonempty files, validates
-the entire batch before transfer, streams each file through SSH into that
-instance, checks its SHA-256 **inside Android**, then renames it into
-`/sdcard/Android/obb/<package>/`. `verified: True` here means transfer integrity
-against the local input, not publisher authentication. Publication is atomic per
-file, not for the whole batch; retry after a partial batch failure. Existing OBBs
-with different version codes remain. The filename version must match the game;
-the current install metadata does not expose its version code for comparison.
-Restart the game yourself after the transfer if it cached missing expansion data.
-
-Both read-only SSH attempts to the Frame timed out. Therefore the exact
-host-side `/sdcard` mapping and persistence of expansion data were **not verified**.
-`compatdata/<instance>/internal/<package>` is documented as `/data/data/<package>`;
-it must not be mistaken for `/sdcard`. Using Android's path avoids guessing a
-host layout, but device verification across restart/update is still required.
-No OBB file was installed on the Frame during this work.
-
-## Private app-data backups
-
-```sh
-python3 ui/frame_android.py stop org.example.game
-python3 ui/frame_android.py backup-data org.example.game ./game-save.tar.gz
-python3 ui/frame_android.py restore-data org.example.game ./game-save.tar.gz
-```
-
-Keep the instance stopped throughout either operation; do not launch it from
-Steam concurrently. The remote guard fails if Podman cannot enumerate containers
-or reports that instance running. The helpers use `podman unshare` to read/write
-Android's mapped ownership without changing the live data's permissions.
-
-The archive covers **only** `compatdata/<instance>/internal/<package>`, not the
-APK, external `/sdcard/Android/data`, OBBs, keystore, or the full Android snapshot.
-It contains a package/instance manifest and regular files/directories. Backups
-are private (0600), validated before publication, and never overwrite an existing
-backup. Keep them safe: app data can contain credentials and is not encrypted.
-
-Restore checks the package and instance, rejects absolute/traversing/duplicate
-paths, links and devices, caps files at 100,000 and content at 20 GiB, and validates
-again on the Frame. It extracts into a separate directory, preserves numeric
-ownership, ordinary modes and timestamps, then swaps the private-data directory.
-Setuid/setgid bits are not restored. The previous directory remains beside it as
-`.<package>.before-restore-<timestamp>`; the returned `previous` path identifies
-it. This is an additional recovery copy, not an automatic deletion policy.
-
-Locally verified: archive round trip including recovery copy, malformed archive
-rejection, transfer command construction and failure handling. Not verified:
-real Frame UID mappings/permissions, Android app-level recovery, live FUSE OBB
-writes or persistence. Backups reject symlinks/special files; an app requiring
-those needs a separately designed backup format. These CLI features still need
-a real-device acceptance pass before being exposed as a polished UI workflow.

docs/steam-games.md

@@ -4,9 +4,9 @@ Frame Control's **Get games** section lists the games you own with each one's
 Steam Frame rating, installs them on the Frame, and searches the Steam store.
 This page covers how it works underneath, so you can do the same from a shell.
 
-Installed Unreal Engine games also have a **VR mod** button that installs,
-starts and removes UEVR; see [VR mods](mods.md) for how it works and the
-per-game table. Mod support is separate from Steam's Frame rating.
+For flat-to-VR mods and Beat Saber custom songs, see the
+[per-game feasibility table](mods.md). Mod support is separate from Steam's
+Frame rating; there is no mod installer yet.
 
 ## How it works
 
@@ -101,62 +101,6 @@ Store search uses `store.steampowered.com/api/storesearch/?term=…&cc=…`. It
 returns nothing without `cc`, so Frame Control takes the country from
 `SteamClient.User.GetIPCountry()` on the Frame.
 
-## Force quitting a running game
-
-**Running now**, at the top of Games, lists what's running on the Frame: Steam
-games, sideloaded titles, non-Steam shortcuts and Android apps. A game's library
-tile, a sideloaded title's ⋯ menu and the Control Center's **Force quit a game**
-card have **Force quit…** too. Each asks first ("Unsaved progress will be
-lost"); from a game's own menu it checks that the game is running and says so if
-it isn't. SteamVR (app 250820, and its beta 1009850) is never listed or quit:
-on the Frame it shows the headset view, so quitting it isn't a way out of a game.
-
-`ui/frame_running.py` does the work on the Frame, piped over SSH with
-`frame_steam.py` as its DevTools client:
-
-```sh
-scp ui/frame_steam.py ui/frame_running.py frame:/tmp/
-ssh frame 'python3 /tmp/frame_running.py list'       # {"running": [{appid, gameid, name, kind, ...}]}
-ssh frame 'python3 /tmp/frame_running.py quit 620'   # {"name", "method", "message"}
-```
-
-1. **What's running.** Steam starts every game, shortcut and devkit title under
-   its `reaper`, as `reaper SteamLaunch AppId=<id> -- <command>`, and the reaper
-   stays the parent of the game's processes. So a running game is one of your
-   own processes whose program is named `reaper`, with `SteamLaunch` and an
-   `AppId=` before `--`; the game is that reaper's process tree. Steam's own list
-   (`SteamUIStore.RunningApps`) and Android apps whose Lepton container is up
-   (`podman ps`) are added. Names come from `appStore`, else the app manifest,
-   the Android app's `meta.json` or the devkit title's folder.
-2. **Steam first.** `SteamClient.Apps.TerminateApp(<game id>, false)`, the
-   call Steam's own Stop makes for Android apps ([vr-apks.md](vr-apks.md)). The
-   game id is the appid, or `(appid << 32) | 0x02000000` for a non-Steam
-   shortcut. An Android app's container is also stopped, as the Apps tab's Stop
-   does (`podman stop -t 5 lepton-steamlaunch-<instance>`).
-3. **Then signals.** If the game's processes are still there after 5 seconds,
-   they get SIGTERM, deepest first; whatever is left 3 seconds later gets
-   SIGKILL, the reaper last, so nothing it holds is orphaned unsignalled. A pid
-   is only signalled while its start time still matches, so a reused pid is safe.
-
-Nothing is found by name. These are never signalled, even inside a game's tree:
-init, the helper itself and every process above it (the SSH session), other
-users' processes, and anything named `steam`, `steamwebhelper`, `gamescope`,
-`gamescope-wl`, `gamescopereaper`, `gamescope-session`, `sshd`, `sshd-session`,
-`ssh-agent`, `systemd`, `dbus-daemon`, `dbus-broker`, `pipewire`,
-`pipewire-pulse`, `wireplumber`, `plasmashell`, `kwin_wayland`, `kwin_x11`,
-`Xwayland`, `sddm`, `vrserver`, `vrcompositor`, `vrmonitor`, `vrdashboard`,
-`vrwebhelper` or `vrstartup`, with everything under them.
-
-**Not tested on a headset.** The reaper command line is how Steam launches games
-on Linux desktops and the Steam Deck, **inferred** for the Frame.
-`SteamUIStore.RunningApps` comes from Steam's client code as plugin loaders use
-it and hasn't been seen on the Frame's build; without it, the reapers alone
-decide. `TerminateApp` with a shortcut's game id is the call Steam's Stop was
-seen making for an Android app (docs/vr-apks.md); for Steam games it is
-**inferred**. Unit tests (`tests/test_force_quit.py`) cover the parsing, the
-process selection and the escalation; the fake Frame launches its games under a
-stand-in `reaper` so `tests/e2e/test_running.py` force quits a real process tree.
-
 ## Not yet checked
 
 - Free-to-play games: `steam://install` should stop at state 3 (free license)
@@ -166,11 +110,3 @@ stand-in `reaper` so `tests/e2e/test_running.py` force quits a real process tree
 - Installing when there's more than one library folder, such as a microSD card.
 - Uninstalling. `steam://uninstall/<appid>` should open a confirmation in the
   headset.
-
-## Optional VR software
-
-The [VR utilities list](vr-utilities.md#optional-software) is separate from our
-controls and HUD. It checks software ownership as well as games; paid utilities
-are installable only when already in the loaded Frame account library. No
-purchase flow is added. Public reports, local results and ownership are shown
-separately, and untested tools remain untested.

docs/streaming.md

@@ -21,38 +21,10 @@ The confidence labels are the same as in [ssh.md](ssh.md).
 | **ADB + scrcpy (Lepton only)** | A mirror of the Android container | **Guess** | `brew install scrcpy android-platform-tools`, then `adb connect frame.local:5555` while Lepton Development is running ([adb_lepton](https://partner.steamgames.com/doc/steamhardware/steamframe/adb_lepton)), then `scrcpy`. This only shows Android apps, not SteamOS. |
 | VNC server on the Frame (krfb / wayvnc) | A mirror of the Plasma desktop | **Inferred (SteamOS)** | Deck users run krfb in Desktop Mode ([one.vg](https://one.vg/blog/remote-control-your-steam-deck)). On the Frame, the in-headset desktop is a virtual screen, and krfb isn't known to be preinstalled. RDP and Steam Link cover this case, so it's not recommended. |
 
-**RDP from Windows, verified 2026-09-30:** Windows 11 25H2's Remote Desktop
-(`mstsc`) against BUILD_ID 20260925.6191901. xrdp picks TLS, not NLA, so
-Remote Desktop never asks for a user or password. It warns that the certificate
-(`www.xrdp.org`) can't be verified. After **Yes**, xrdp shows its own "Login to
-frame" box with the username blank. Any user but `steamos` gets "User does not
-exist, or could not be authenticated". Signing in as `steamos` with the
-Developer Mode password opens a Plasma (X11) desktop within about 6 seconds.
-It's a new session on display `:10`, separate from what the headset shows,
-and it uses about 1.3 GB of the Frame's memory. Closing Remote Desktop leaves
-it running, and the next sign-in reconnects to it. To end it, find its
-session with `loginctl list-sessions` over SSH (its leader is `xrdp-sesexec`)
-and run `loginctl terminate-session <id>`; the headset's own session keeps
-running.
-
 **Recommendation for A:** start with Steam Link for macOS, because Valve
 documents it. Use Windows App (RDP) when you want a proper Linux desktop on the
 Mac with keyboard, mouse, and clipboard.
 
-**Verified 2026-09-30** (Frame BUILD_ID 20260925.6191901, Windows 11 25H2,
-Remote Desktop Connection): signing in to xrdp as `steamos` with the Developer
-Mode password opens a Plasma (X11) desktop within about 6 seconds.
-
-- xrdp has no NLA, so the client shows a certificate warning (xrdp's own
-  `www.xrdp.org` certificate) and then xrdp's own login box. Frame Control
-  fills in `steamos` there on Windows, Remmina and FreeRDP.
-- The desktop is a separate login session (Xorg on display `:10`), not the
-  headset's view. It uses about 1.3 GB of the Frame's memory.
-- Closing the client leaves the session running, and the next login
-  reconnects to it. To end it over SSH, find it with `loginctl list-sessions`
-  and run `loginctl terminate-session <id>`. That doesn't touch the headset's
-  gamescope or SteamVR session.
-
 ## B. Show the Mac's desktop inside the Frame
 
 The Frame's VR streaming uses **SteamVR** on the host. Linux hosts had
@@ -144,7 +116,7 @@ capture it.
 
 ## Input: type and point in the Frame from the Mac or iPhone
 
-**Built: Home → Type on the headset** (or press `T`), in every version of Frame Control
+**Built: Home → Keyboard and trackpad**, in every version of Frame Control
 (Mac, Windows, Linux, iPhone and iPad), with nothing to install on the device
 you're holding. On a phone the panel is a trackpad (drag to move, tap to click,
 two fingers to scroll, two-finger tap to right-click) plus a text field that
@@ -275,16 +247,6 @@ How (**verified 2026-09-29**, SteamOS 0.4.1, build 20260925.6191901):
   -window_id <window> -i :<display>` works on gamescope's redirected windows,
   while grabbing the root gives black. It streams as H.264 like the headset view
   (about 30 fps at 720p).
-- **When no panel is found**, `frame_touch.py panels` says why (`"why"`), and the
-  Desktop view shows that instead of a bare "no app panel": X tools missing,
-  gamescope listing windows that aren't X11 windows on any display, the desktop
-  running but not listed, or nothing open. It reads gamescope's properties from
-  `:0` first (one `xprop` call) and probes the other displays, 2 s each, only if `:0`
-  has none. A whole run stops after 12 s, inside the server's 20 s, and says the headset
-  was too slow. Added for
-  [#73](https://github.com/saphid/frame-control/issues/73) (SteamOS 0.4.5, desktop
-  open but not found). The likely cause there was the page itself: a second
-  `loadPanels` (the panel switcher's) replaced the Desktop view's, fixed in #84.
 - Tested from the iPhone app (Simulator): a tap on the Desktop view focused a
   text box in the panel and the text field typed into it; a trackpad move went
   exactly (+40, +25).

docs/testing.md

@@ -8,7 +8,6 @@ A fourth, a SteamOS VM, may come later ([issue #6](https://github.com/saphid/ste
 | Unit tests (`tests/*.py`) | `python3 -m unittest discover -s tests` | Nothing | Parsing, validation, request guards; SSH and HTTP are mocked |
 | Fake Frame (`tests/e2e`) | `scripts/e2e.sh` | Linux with Docker | The real server and scripts against a container that behaves like a Frame |
 | Headset smoke test | `scripts/frame-smoke.sh` | A Frame on the `frame` alias | Install, launch and remove on the real device, recorded with its BUILD_ID |
-| [Windows test VM](#windows-test-vm) | `scripts/windows-vm.sh` | A Linux machine with KVM and Docker | The Windows build on a real Windows desktop, against a real Frame when needed |
 
 ## Unit tests
 
@@ -16,48 +15,11 @@ A fourth, a SteamOS VM, may come later ([issue #6](https://github.com/saphid/ste
 python3 -m unittest discover -s tests
 ```
 
-The Control Center is covered by `tests/test_control_center.py` and its Node
-behavior suite `tests/control_center.cjs` (also run by unittest discovery).
-They exercise production search, metrics, navigation and action handlers with
-mocked API/DOM boundaries: volume Apply/mute/readback, offline and failed reads,
-stale samples, selected-headset capture, duplicate actions and validation before
-SSH. Integration regressions run the production shared refresh, Home renderer,
-host callback and Control Center bootstrap: a pre-command status request must be
-drained before audio readback starts, and delayed startup retains sample receipt
-age, failed-read state and early host capabilities. The actual Flatpak install
-redraw cannot revive a failed sample; a new successful poll restores metrics and
-audio after either redraw or delayed mount. Draft regressions cover a pending headset
-switch and mute followed by Apply. Static asset HTTP tests and desktop/iPhone bundle checks catch missing CSS
-or JavaScript. A focused run is:
-
-```sh
-python3 -m unittest discover -s tests -p test_control_center.py -v
-node --test tests/control_center.cjs
-node --check ui/control-center.js
-```
-
-Responsive layout, actual browser rendering and keyboard/touch behavior still
-need browser verification. No Control Center test connects to a real headset.
-
 About 120 tests, a few seconds, on Python 3.9 and newer. GitHub Actions runs
 them on macOS, Windows and Linux. They don't pick up `tests/e2e`.
 
 ## The fake Frame
 
-Frame doctor has focused offline tests in `tests/test_frame_doctor.py` and
-fake-Frame fault tests in `tests/e2e/test_doctor.py`:
-
-```sh
-python3 -m unittest discover -s tests -p test_frame_doctor.py -v
-scripts/e2e.sh test_doctor
-```
-
-They cover privacy filtering, host-key preservation, restart safety and missing
-journal evidence, plus asleep, full-title-storage, SSH/devkit-off and missing-key
-faults. The fake's doctor-only `systemctl show` responses assume stable restart
-counters and inactive keep-awake; unsupported queries fail. These tests do not
-exercise a real SteamOS user manager or touch a headset.
-
 `tests/fakeframe/` builds a container that stands in for the headset, and a
 second one for the computer Frame Control runs on. `scripts/e2e.sh` builds
 both, starts them with `docker compose`, runs `tests/e2e` in the host
@@ -90,8 +52,8 @@ its guards want.
 | `sshd` with key and password logins, `rsync`, `python3` | Real |
 | Valve's steamos-devkit-service on port 32000 and its hooks, vendored unmodified in `tests/fakeframe/steamos-devkit-service` | Real; only its `dbus` import (for mDNS through systemd-resolved) is a stand-in that logs the registration |
 | Valve's devkit-utils, copied over by Frame Control itself | Real |
-| **fakesteam**: `~/.steam/steam.pid`, `steam.token` and the `steam.pipe` FIFO; answers `approve-ssh-key`, `create-shortcut`, `run-game`, `list-shortcuts` and `delete-shortcut` with the response files devkit-utils waits for; takes `steam://rungameid`, `install` and `store` URLs. Games it really runs start under a stand-in `reaper SteamLaunch AppId=<id> -- <command>` (bash with that command line), so force quit finds a real process tree | Fake |
-| DevTools on `127.0.0.1:8080` with a `SharedJSContext` target. The JavaScript Frame Control sends runs for real in Node against stand-in `SteamClient`, `appStore` and `downloadsStore` objects (`cef_shim.js`), so async functions, optional chaining and `Map`s behave as in Steam's CEF. `SteamUIStore.RunningApps` lists launches that haven't exited; `TerminateApp` ends only launches that never ran a process, so a running program needs Frame Control's signals | The JS engine is real; the objects are fake |
+| **fakesteam**: `~/.steam/steam.pid`, `steam.token` and the `steam.pipe` FIFO; answers `approve-ssh-key`, `create-shortcut`, `run-game`, `list-shortcuts` and `delete-shortcut` with the response files devkit-utils waits for; takes `steam://rungameid`, `install` and `store` URLs | Fake |
+| DevTools on `127.0.0.1:8080` with a `SharedJSContext` target. The JavaScript Frame Control sends runs for real in Node against stand-in `SteamClient`, `appStore` and `downloadsStore` objects (`cef_shim.js`), so async functions, optional chaining and `Map`s behave as in Steam's CEF | The JS engine is real; the objects are fake |
 | `steam`, `wpctl`, `flatpak`, `podman`, `nmcli`, `qdbus6`, `gamescopectl`, SteamOS's `steamos-enable-sshd` helper, and Lepton's launcher | Stubs that record their calls |
 | Battery, charger and thermal zones under `/sys/class` | Files the supervisor writes. `/sys` is read-only in a container and Docker's AppArmor profile refuses writes under it, so each folder is a volume mounted twice: over `/sys/class/...` for `frame_status.py` to read, and under `/var/lib/fakeframe/sys` for the supervisor to write |
 | `vrserver` and `plasmashell` | Renamed `sleep` processes, so the status page and the clipboard find them |
@@ -142,20 +104,6 @@ switch while SSH is down:
 
 ## Headset smoke test
 
-**Documented shared-device procedure:** before a test installs, launches or
-stops an application, acquire `ssh frame 'mkdir /tmp/frame-test.lock'`. If it
-fails, leave that lock alone and continue offline work. Only the thread that
-acquired it releases it with `ssh frame 'rmdir /tmp/frame-test.lock'`, after
-cleanup. Keep each device session to a few minutes.
-
-Check battery capacity and charging state under `/sys/class/power_supply`
-before and after; keep capacity above 20%. Stop only processes started by the
-test, remove temporary installs and profiles, and restore the prior dashboard
-state. Leave Steam and SteamVR running. Do not reboot or change global settings.
-Record the build, actual interaction results, cleanup and any unworn-headset
-limits alongside screenshots or logs. These are caller responsibilities; the
-smoke script below does not acquire this shared lock itself.
-
 ```sh
 scripts/frame-smoke.sh           # needs `ssh frame` to work without a password
 scripts/frame-smoke.sh --pair    # also pairs a throwaway key: approve it in the headset
@@ -178,43 +126,6 @@ does). A cleanup that fails counts as a failed step. Results go to
 screen; it exits 0 when every step passed, 1 if one failed, 2 if the headset
 isn't reachable.
 
-Smoke process cleanup runs before and after title removal and during the
-initial/final leftover sweeps. It targets only the reserved `fc_smoke_arm64`,
-`fc_smoke_x86_64`, `fc_smoke_exe` IDs and their legacy `fc-smoke-` equivalents.
-On the target, `tests/smoke/stop_processes.py` requires the SSH user's uid and
-an exact title directory in `/proc` cwd/exe or an individual absolute command
-argument; similarly named folders and shell command substrings do not count.
-Deleted cwd/exe paths still count, so a process left after file removal can be
-found. It sends SIGTERM, waits up to three seconds, then uses SIGKILL with
-another three-second bound, rescanning for survivors. PID handles prevent PID
-reuse from signalling another process. Linux Python 3.9+ with pidfd support
-is required; missing support, signal errors and survivors fail the
-cleanup step. Stopped PIDs are recorded in the results JSON.
-If the initial leftover cleanup fails, the run skips installs and pairing and
-records the failure instead of overwriting an active test title.
-
-This deliberately does not stop shared Wine/Proton services by name or prefix,
-Steam, SteamVR, process groups or arbitrary descendants. A process that drops
-all title-path evidence cannot safely be attributed and is outside this
-check. Unreadable `/proc` fields provide no ownership evidence; other readable
-fields are still checked, and a wholly unattributable process is left alone.
-Real Frame verification, 2026-10-24, SteamOS build `20261015.6141207`: the
-fixed Python smoke entry point passed all 13 steps under the shared device lock.
-The `fc_smoke_exe` launch ran under Proton Experimental (ARM64), and its
-remove step stopped five test-owned wrapper/Proton PIDs before removing the
-title; the following process sweep found none. The final cleanup found no
-test titles or processes, the test desktop was closed, and the battery
-remained at 99%. The `scripts/frame-smoke.sh` zsh wrapper could not run
-on lxso2 because zsh is absent; `python3 tests/smoke/frame_smoke.py` ran
-the same entry point instead.
-The local regression suite runs real Linux processes in temporary fake title
-directories (including deleted folders and a TERM-resistant wrapper); it checks
-exit, escalation and survival of unrelated processes without SSH or a headset:
-
-```sh
-python3 -m unittest discover -s tests -p test_smoke_cleanup.py -v
-```
-
 `--pair` asks the devkit service to pair a new RSA key, which needs someone
 in the headset to open **Settings → Developer → Pair new host** and approve
 it; the key is checked and then taken out of `authorized_keys` again.
@@ -238,129 +149,6 @@ refuses ids with a hyphen (`missing/invalid arguments`), which the fake had
 accepted. The fake now refuses them the same way, and Frame Control makes ids
 Steam accepts.
 
-## PC panel host tests
-
-PC in the headset (Experimental, Windows only). `tests/test_pcview.py` checks
-that only Windows gets the PC host and that it starts nothing until turned on,
-the Tools link and card wording, source-bound tickets, reconnect/Stop
-revocation, input release, source-coordinate mapping and use of the existing
-panel launcher. `tests/test_pc_controller.py` checks the C rate controller
-against a frozen trace of the Mac's Swift one.
-
-The `PC host libraries` workflow builds the native adapter on Windows (and
-the unshipped Linux adapter on Ubuntu x64 and ARM64), then runs a real x264
-synthetic stream through the HTTP/WebSocket agent. x264 is GPL, so only these
-CI builds include it (`desktop/build.py --with-x264`); the release workflow
-tests the installer's own bundle with its bundled Python and checks x264 isn't
-in it. `FRAME_PC_REQUIRE_NATIVE=1` and `FRAME_PC_REQUIRE_X264=1` make a missing
-bundle or encoder fail CI instead of skipping.
-
-These automated CI checks do not capture a desktop, exercise Media Foundation
-or a GPU, or check laser alignment. A [Windows test VM](#windows-test-vm) run
-on 2026-10-24 captured its actual desktop with Desktop Duplication, encoded
-with Media Foundation and streamed to a real Frame. It found MSYS2 disables
-WGC: an element name alone does not prove its optional capture properties
-exist. Native property-probe tests and source-selection regressions now cover
-that boundary. [Dated evidence and limits](evidence/windows-vm-2026-10-24.md);
-[what's verified](pc-in-headset.md#whats-verified).
-
-## Windows test VM
-
-Windows CI runs the unit tests and checks installer contents. Desktop capture,
-installer launch and interactive behavior need a Windows machine. This is a Windows 11 VM in a
-[dockur/windows](https://github.com/dockur/windows) container on a Linux machine
-with KVM, driven from the Mac with `scripts/windows-vm.sh`.
-
-Setting it up, once, on the Linux machine:
-
-- **Windows comes from Microsoft.** The container downloads the Windows 11
-  image from Microsoft on first start. Windows runs unactivated, which is fine
-  for testing. Don't use activation workarounds or third-party Windows images.
-- **Publish its ports on loopback only.** Map `127.0.0.1:2222:22` (SSH),
-  `127.0.0.1:8006:8006` (the web console) and, if you need it,
-  `127.0.0.1:13389:3389`. The Mac reaches them through `ssh -J`. Use
-  `restart: "no"` and `stop_grace_period: 2m` so it only runs when someone is
-  testing, and a `docker stop` shuts Windows down cleanly.
-- **Give it SSH on first sign-in.** The container runs `/oem/install.bat`
-  once. Have it add the OpenSSH Server capability, start `sshd`, set PowerShell
-  as its default shell, and put a dedicated public key (for example
-  `~/.ssh/id_ed25519_winvm` on the Mac) in
-  `C:\ProgramData\ssh\administrators_authorized_keys`.
-- Give it 4 cores, 8 GB of memory and a 32 GB disk. That's enough for the app
-  and the tests. Inspect free memory/disk, KVM access and existing VMs before
-  starting; leave other VMs alone. The first install can take tens of minutes
-  (the 2026-10-24 run took about 16 minutes to reach the desktop), rather than
-  the 1–2 minute startup of an already installed guest.
-- For PC streaming, check the actual bundled capture properties. MSYS2's
-  GStreamer build disables WGC: this app falls back to Desktop Duplication for
-  whole screens and explains why individual windows are unavailable. A VM
-  capture test does not prove physical GPU encoding or laser alignment.
-
-Using it, with `WINVM_HOST` set to the Linux machine's ssh alias:
-
-```sh
-scripts/windows-vm.sh up                        # start it and wait for SSH (1-2 minutes)
-scripts/windows-vm.sh put Frame-Control-Setup-x64.exe
-scripts/windows-vm.sh ps 'Start-Process "$env:USERPROFILE\Downloads\Frame-Control-Setup-x64.exe" /S -Wait'
-scripts/windows-vm.sh shot screen.png            # what's on its screen
-scripts/windows-vm.sh click 723 359              # screen pixels, as in the screenshot
-scripts/windows-vm.sh keys s t e a m o s ret     # QEMU key names
-scripts/windows-vm.sh down                       # shut Windows down
-```
-
-- **Clicks go through a scheduled task.** Commands over SSH run in a
-  session with no desktop, so `click` and `scroll` write the position to a
-  file, and a scheduled task running as the signed-in user replays it. The
-  VM's screen must be signed in; it is after `up`. Clicks and scrolls sent at
-  the same time run one after another. QEMU's own `mouse_move` is relative
-  and drifts, so the script doesn't use it.
-- **Screenshots may not show the pointer.** Check the result of a click (a
-  menu that opens, a button that changes) rather than the pointer's position.
-- **Windows' `ssh` waits for stdin.** The script closes it for every command.
-  Do the same if you run `ssh` in the VM by hand.
-- **Starting the app.** Run Frame Control in the signed-in session, not over
-  SSH. Use its Start-menu shortcut via `click`, or a scheduled task like the
-  one `click` uses.
-
-**Testing against a real Frame.** The VM reaches the headset on the LAN like
-any other computer. Run **Set Up Connection** in the VM's Frame Control once;
-that makes the VM's keys. So the VM doesn't keep access between test runs,
-afterwards take the lines it added out of the headset's
-`~/.ssh/authorized_keys`: the ones matching the VM's
-`~/.ssh/id_ed25519_frame.pub` and, if pairing made one,
-`~/.ssh/id_rsa_frame_devkit.pub`. Check that `ssh -o BatchMode=yes frame true`
-in the VM now fails. Then, around each run:
-
-```sh
-scripts/windows-vm.sh frame-key add       # let the VM's key into the headset
-# ... test ...
-scripts/windows-vm.sh frame-key remove    # and take it out again
-```
-
-`add` appends the VM's key tagged `windows-vm-test`, unless the headset
-already trusts that key through another line. `remove` deletes only the exact
-line `add` wrote, so it doesn't undo what Set Up Connection did, and it leaves
-the file alone if it can't rewrite it. Follow the shared-device
-procedure in [Headset smoke test](#headset-smoke-test) before installing or
-launching anything on the headset.
-
-**Verified 2026-09-30:** Windows 11 Pro 25H2 (build 26200) against a Frame on
-BUILD_ID 20260925.6191901. The script was used to install Frame Control 0.4.0,
-connect it to the Frame and follow Remote Desktop through to the Frame's
-desktop ([what it does](streaming.md#a-see-and-control-the-frame-from-the-mac)).
-`frame-key` left `authorized_keys` byte-for-byte as it was.
-
-## Force quit
-
-`tests/test_force_quit.py` feeds `ui/frame_running.py` made-up process tables:
-the `reaper SteamLaunch AppId=` parsing, naming from Steam, manifests, Android
-`meta.json` and devkit folders, and a Frame's worth of Steam, gamescope, SteamVR,
-sshd and session processes that must never be signalled. Processes that ignore
-SIGTERM, survive SIGKILL or exit and have their pid reused check the escalation.
-The Control Center's confirmation, duplicate and headset-switch handling run in
-`tests/control_center.cjs`. `tests/e2e/test_running.py` force quits real process
-trees on the fake Frame. None of it has run on a headset.
-
 ## Owned media player
 
 `tests/test_media.py` covers layout evidence and overrides, OU eye ordering,
@@ -382,58 +170,3 @@ assistant against an in-process HTTP endpoint with canned responses (no keys or
 external calls). `tests/e2e/test_agents.py` runs the MCP/HTTP/SSH path against the
 fake Frame for approved installs, clipboard and file transfer. Headset Chromium
 rendering and real screenshots still need a device; see [agent evidence](agents.md#evidence-and-limits).
-
-## Family and comfort
-
-`tests/test_comfort.py` uses an injected clock, fake headset sensor readings and
-actions, plus a Node fake of Steam's Home API. It covers warnings before Home,
-late/suspended sessions, cancellation, failed actions, duplicate alerts, reboot
-invalidation, per-zone thermal trips and shared on-headset state. The server
-guards reject invalid session settings before SSH. See
-[real-device evidence and limits](family-comfort.md#verification).
-
-## Panel switcher
-
-`tests/test_panels.py` supplies fake-Frame `vrcmd --overlays` output, checks
-main-panel filtering (including hidden panels), revalidates closed panels before
-focus, and drives the headset helper's real loopback HTTP server to test access
-keys, Host/Origin guards, malformed requests, offline errors and Close. It runs
-in the normal unit suite without OpenVR or a headset. The fixture format comes
-from SteamVR 2.18.1, BUILD_ID `20260925.6191901`; it does not simulate rendering.
-
-On the Frame, run `python3 -` over SSH with `ui/frame_panels.py` on stdin to
-list panels. `--focus <key>` rechecks the list and requests focus. In Frame
-Control, **Tools → Panel switcher → Open in headset** exercises installation,
-Chromium rendering and the same helper through HTTP. Close the switcher after
-testing. [The recorded device checks](panels.md#frame-controls-panel-switcher)
-cover actual focus, HTTP guards and an OpenXR sample transition, and separately
-identify the unverified Steam-game, spatial layout, reboot and laser behaviors.
-
-## Backup and recovery kit
-
-`tests/test_backup.py` runs the headset-side script `ui/frame_backup_remote.py`
-for real against a temporary folder laid out like the Frame's home, with only
-SSH faked: path selection and the secrets it must never copy, the manifest and
-checksums, restore checks after a reset, restore writing only its own files,
-unsafe archives and backup names, and the exact Game Mode command.
-`tests/e2e/test_recovery_kit.py` backs up and restores a Proton save on the fake
-Frame through the server. See [backup-and-recovery.md](backup-and-recovery.md#verification).
-A full backup and an identical-file Proton save restore were checked on a
-real Frame running build `20261015.6141207`; an after-reset restore and
-Android data restore remain unverified. See the linked device evidence.
-
-## Game storage
-
-`python3 -m unittest discover -s tests -p test_storage.py -v` exercises the
-read-only metadata probe, guarded HTTP endpoint and Node renderer/navigation
-regressions. All headset reads are temporary fixtures or mocked SSH. See
-[game storage](game-storage.md#verification-and-limits) for coverage and device
-verification limits. This suite does not move games or contact a headset.
-
-## Battery monitoring
-
-`tests/test_battery.py` covers real file parsing with temporary sysfs-like
-files, source preference, missing/invalid sensors and permission errors.
-`tests/control_center.cjs` covers charging states and optional health fields,
-alongside existing stale/offline handling. No headset is used. See
-[battery monitoring](battery-health.md) for sources, units and limitations.

docs/vr-apks.md

@@ -84,146 +84,13 @@ not being worn, so it did not reach `FOCUSED`).
 The loader was never the problem: Wolvic's Quest `libopenxr_loader.so` is a
 Khronos-style loader and found SteamVR through `/vendor`.
 
-## In the Steam library
-
-Every successful APK install goes through the same mandatory artwork writer:
-CLI (including `scripts/install-apk.sh`), upload, catalogue, version finder,
-web download and source modules calling `frame_android.install`. Native
-Linux/Windows sideloads also use it, preserving their devkit runtime wiring.
-A new shortcut is rolled back if artwork fails; failure is never reported as
-an installed app with a blank tile.
-
-Artwork preference is **SteamGridDB → source images → generated fallback**.
-Set the optional free key in Frame Control's **Settings → Library artwork**, or
-`STEAMGRIDDB_API_KEY` (`FRAME_STEAMGRIDDB_API_KEY` also works). Environment
-settings override the saved key. Without a key there are no provider calls or
-warnings. Saved keys stay in host app data, mode 0600 on POSIX, and are never
-returned by the settings API or copied to the headset. Exact title matches
-(including a trailing “VR” variant) use the highest-scored returned static,
-non-NSFW image in each slot. Provider failures use the next source.
-
-Sources pass `install(apk_path, artwork={...})`: keys are `grid`, `wide`,
-`hero`, `logo`, `icon`, `banner`, `feature_graphic`, `screenshot`, or a list
-`screenshots`. Values are PNG/JPEG bytes or HTTP(S) URLs (12 MiB and
-4096×4096 pixels maximum; any PNG depth or interlace, since the Frame's
-Chromium decodes them). URLs must resolve to public addresses, follow at most
-three redirects and share one deadline per install. Any source that fails,
-for any reason, becomes a warning and generated art. Banners and feature graphics supply hero/wide art;
-screenshots are the next fallback. Source images are cached for refresh.
-All images are fitted to 600×900 portrait, 920×430 wide, 3840×1240 hero,
-1280×480 logo and 256×256 icon. Explicit logos retain transparency.
-Photo-based portrait, wide and hero slots are JPEG: Steam takes at most
-12 MiB per slot, and on the Frame (2026-09-28) a noise-heavy 3840×1240 hero
-came to more than 12 MiB as PNG, 3.7 MB as JPEG (2.7 s to render); a
-landscape photo hero 5.6 MB as PNG, 0.76 MB as JPEG (0.75 s). A render that
-still fails is retried once with generated art. Steam keeps a slot's `.png`
-and `.jpg` side by side, so each slot is cleared before it is set.
-
-Generated art uses the APK icon, a dominant-colour gradient, a blurred
-backdrop and large foreground icon with shadow. Steam's Chromium canvas and
-Motiva Sans render real text consistently regardless of the host OS; no
-Pillow, host font installation or bitmap font is needed. The hero has no
-title; the generated logo is a transparent title. APKs with no usable icon
-get a typographic monogram. The desktop package includes the renderer.
-
-Backfill installed Android apps without reinstalling or stopping them:
-
-```sh
-python3 ui/frame_android.py refresh-art org.godotengine.open_saber_plus
-python3 ui/frame_android.py refresh-art --all
-```
-
-Devkit titles installed by Frame Control have the same command,
-`python3 ui/frame_titles.py refresh-art ID|--all`. The settings panel's
-refresh covers both. The API is `POST /api/android` with
-`{"action":"refresh-art","all":true}` (apps and titles) or a `package`, and
-`POST /api/titles` with `{"action":"refresh-art","id":…}`; each returns a
-background job. Batch results retain per-item errors, and the CLIs exit
-nonzero if any failed. Apps and titles without complete artwork show **Add
-artwork** and `list` prints the command. Only entries marked `art_pending` at
-install (a title Steam registered after an install made while it wasn't
-running) are backfilled automatically, when Frame Control lists them with
-Steam running (at most every five minutes), and that backfill only fills
-slots Steam has no art for: names, icons, flags and any art the user set are
-kept. Older installs without the flag are refreshed only on request.
-
-Steam's app overviews carry no `devkit_gameid` (checked 2026-09-28, build
-20260925.6191901, on every non-Steam shortcut). A title's shortcut is found by
-its saved id, or by an executable or start folder inside
-`~/devkit-game/<id>/`, read from `appDetailsStore`; never by display name.
-That the devkit shortcut's exe/start folder sit inside the title folder is
-inferred from `docs/sideloading.md` (`proton waitforexitandrun
-"/home/steamos/devkit-game/<id>/<exe>"`), not yet seen in app details.
-Devkit titles keep the VR flag Steam gave them.
-
-**Verified on build 20260925.6191901, SteamVR 2.18.1 (2026-09-28):** both
-Open Saber Plus and SuperTux were backfilled. Steam's cached portrait, wide,
-hero and logo PNGs have the dimensions above; each shortcut points at its
-256×256 icon. This Frame client mishandles custom-art type 4 (documented as
-Icon), overwriting the wide capsule; the implementation uses custom types
-0–3 and **SetShortcutIcon** separately.
-
-Steam accepts display name, executable/start directory, icon, VR flag and
-sort-as name. Android apps join **Android**, immersive apps also **Android
-VR**; native sideloads join **Sideloaded**. Existing collection members and
-unrelated collections are preserved (both games retained **Played**).
-Dynamic/read-only collection conflicts produce warnings. The native notes
-API supports a managed **Installation details** note (package, version and
-source) while preserving other notes. Notes are keyed by sanitized shortcut
-name, so Steam itself cannot distinguish equal-name shortcut notes. No
-supported shortcut description/store-page, developer/publisher, release
-metadata or custom achievement API was found; these are not fabricated.
-
-The launcher supervises Lepton and handles TERM/INT/HUP and normal exit by
-stopping its own container and child process group. A lock refuses duplicate launches;
-a container still running while the lock is free was orphaned by a killed
-launcher and is stopped before the new launch. Lepton doesn't inherit the
-lock. Orphan recovery only stops the app's own, deterministically named
-container; a Lepton host process whose launcher was killed before it created
-the container may linger briefly. Removing an app or title still deletes its files when Steam isn't
-running; tidying Steam's collections and artwork is best effort. Steam Stop uses `TerminateApp` with the exact
-64-bit game ID string. Frame Control's Stop additionally has a direct-container
-fallback. The stable instance ID and compatdata paths remain unchanged.
-
-Lepton normally forwards the instance `SteamAppId` to Android, causing
-SteamVR to associate the scene with a different, artwork-less app. The
-launcher uses Lepton's supported `LEPTON_ENV_SteamAppId` passthrough to send
-the actual shortcut ID to Android while retaining the stable container ID.
-**Verified:** Open Saber was alive 22 seconds after Steam Play, SteamVR
-identified `steam.app.3346865537`, and its scene appeared in the headset
-capture without the previous blank Resume tile. Steam Stop then removed its
-tracked process and stopped the container. An earlier 32-second session was
-also tracked until Steam Stop. No global standby or dashboard overrides were
-installed; wear detection and other user-opened overlays still apply.
-
-**SuperTux limitation:** Steam launched and tracked it, but SDL crashed during
-activity creation because Lepton lacks `ClipboardManager`. Its container
-cleaned up on exit after about 17 seconds. Consequently sustained SuperTux
-Play/Stop and its VR scene could not be verified. This is an APK/runtime
-compatibility failure, separate from library presentation.
-
-Evidence is under `/tmp/vrlib-evidence/` on the development Mac: final artwork
-preview and three design passes, `steam-cache-final.log`,
-`steam-details-targets.json`, `opensaber-identity-session.log`,
-`opensaber-identity-headset.png`, and `supertux-lepton.log`. The preview is
-rendered artwork, not a Steam UI screenshot; CDP screenshot capture timed
-out. Authenticated SteamGridDB, Windows/Linux packaged builds and the sibling
-source-search endpoint remain unverified (the public install seam is tested).
-
 ## Out of scope
 
 - **Meta entitlement.** Apps that call the Oculus Platform SDK
   (`libovrplatformloader.so`) to check the Quest store licence need Meta's
-  services. Frame Control won't work around that: no patching, no stub
-  libraries, no OVRPort or FramePort. Linking the SDK doesn't mean an app
-  enforces the check (Meta's VRC.Quest.Security.1 has only been
-  *Recommended* since 2021, and a failed check does nothing by itself; the app
-  decides), so [Import from my Quest](quest-import.md) and [My Meta
-  library](meta-library.md) install these with a warning: they may quit,
-  hang, or run without online features.
+  services. Frame Control won't work around that.
 - **VrApi-era apps** (`libvrapi.so`, before OpenXR) need an API translator,
-  not a patch. They install with a warning that they may not run: some
-  OpenXR games ship `libvrapi.so` without depending on it.
+  not a patch.
 
 ## Frame Control does this for you
 
@@ -256,10 +123,6 @@ the app wants 1.1 and enables the extensions that became 1.1 core; maps
 and keeps the current refresh rate when SteamVR refuses a requested one.
 `meta.json` records `"patched": ["openxr-compat"]`. Skip it with
 `install … --no-xr-compat`. Its decisions go to logcat under `FrameXrCompat`.
-If this copy of Frame Control is missing the layer's library (an incomplete
-install, or a file removed after installing), VR apps install without it and
-the install message says so; OpenXR 1.0 apps still run. Release builds fail
-to package without it (`app/build/check-resources.js`).
 
 Verified on the headset (2026-09-28):
 

docs/vr-utilities.md

@@ -1,139 +0,0 @@
-# VR comfort and performance
-
-Frame Control owns its HUD and telemetry. They use SteamVR/OpenVR, gamescope,
-Python and xterm already on the Frame, plus the Frame's sensors. No feature
-requires fpsVR, OVR Advanced Settings, XSOverlay or another third-party app.
-The software list is a separate, optional convenience.
-
-This is **part of [#25](https://github.com/saphid/frame-control/issues/25)**,
-not completion of the issue. Playspace controls remain blocked on the device
-checks below. The PR stays draft.
-
-## Our performance HUD
-
-On **Home → VR performance** (folded until you open it), the app shows a timestamped sample
-with each status refresh (30 seconds, or Refresh). **Open HUD in headset**
-starts our text HUD as a gamescope panel, refreshed every two seconds. In the
-SteamVR dashboard, select **Frame Control HUD**, then Float in World or dock
-it to a controller. **Close HUD**, or closing its terminal, ends it. Opening
-it twice reuses the existing process.
-
-| Value | Meaning and source |
-|---|---|
-| Compositor FPS / period | Differences between two `IVRCompositor_029::GetFrameTiming` frame indices and monotonic compositor timestamps, sampled 200 ms apart. Output cadence, not game FPS or a long-term average. |
-| Application FPS | Reciprocal of OpenVR's client frame interval. Unavailable if there is no positive interval; not inferred from refresh rate. |
-| Render GPU time | OpenVR total render GPU milliseconds, not GPU utilisation. |
-| Compositor CPU | OpenVR compositor render CPU milliseconds, not game CPU time. |
-| System CPU | `/proc/stat` busy-time delta across the sample, with guest time counted once and iowait treated as idle. |
-| GPU clock | `3d00000.gpu/cur_freq`, converted from Hz to MHz; frequency is not load. |
-| Hottest sensor / battery | Existing thermal-zone and battery sysfs reads from `frame_status.py`. In the headset HUD only: the app shows them once, in the battery menu at the top. |
-
-OpenVR uses background application mode, which does not start SteamVR or keep
-it running. This mode also returned live timing in a read-only device probe.
-
-Missing sensors, a stopped or incompatible SteamVR runtime, and non-advancing
-frame indices display **Unavailable**, never invented zero FPS. Failed status
-refreshes clear the HUD card rather than keeping a stale live-looking sample.
-The HUD itself adds CPU/GPU work; it is a diagnostic, not a zero-overhead benchmark.
-
-**Verified 2026-09-28**, SteamOS 0.4.1, build `20260925.6191901`, SteamVR
-2.18.1: the exact OpenVR interface and 192-byte timing layout returned advancing
-frame indices and live GPU/CPU timing. Sensor reads, creation of overlay
-`valve.steam.desktopgame.2000250025`, duplicate-open handling, and closing the
-HUD passed. The temporary probe overlay disappeared after its process closed.
-[Sanitized device sample](evidence/vr-utilities/device.json).
-
-**Unverified:** visual placement while wearing the headset, controller docking,
-and overhead during gameplay. The companion card was checked in the attached
-preview using live Frame data. Creating an overlay does not establish that it
-was visible to the wearer.
-
-The optional HUD copies only `frame_status.py` and `frame_vr.py` into
-`~/.local/share/frame-control/vr/`. It tags only the window whose X11 PID matches
-its own xterm, avoiding other threads' windows. Stop checks both PID and Linux
-process start time before sending SIGTERM. It does not stop Steam or SteamVR,
-edit their settings, install a service, or need sudo.
-
-## Playspace, seated height and recenter: paused
-
-**Verified 2026-09-28:** SteamVR exposes `IVRChaperoneSetup_006` and
-`IVRChaperone_004`. An initial 1 cm seated zero-pose translation committed,
-read back and restored numerically. A later trial, while the shared Frame was
-in use, changed universe IDs after commits and returned transforms that did
-not match the requested write or restore. Journal entries reported
-`CommitWorkingCopy`, `VREvent_ChaperoneUniverseHasChanged` and
-`VREvent_ChaperoneRoomSetupCommitted`. The collision-bound arrays and play-area
-size matched in the saved before/after records, but the origin matrices did not.
-
-Alex confirmed the headset was in use and asked to pause control tests. No
-further playspace writes were made. The exploratory control implementation was
-removed from the shipping API; `recenter`, `adjust` and `restore` are rejected.
-This is an **unresolved feasibility check**, not evidence that OpenVR controls
-cannot work. Concurrent use and the Frame driver's coordinate-system handling
-still need to be separated.
-
-The probe's original and last-read poses remain in the Frame's
-`~/.local/share/frame-control/vr/comfort.json` for investigation. This draft
-neither reads nor applies that baseline. Do not blindly replay it into a room
-that may have changed. No recenter test was reached in the later trial.
-
-Before adding controls, on an idle Frame:
-
-1. Establish current room and tracking state, and inspect the retained probe
-   evidence before considering any restoration.
-2. Prove seated and standing height/move operations in the Frame driver's
-   current coordinates, including delayed readback, coordinate rebasing and
-   recovery. Show that the physical safety boundary stays correct.
-3. Verify recenter independently, and test a full apply/restore cycle plus a
-   concurrent room-change refusal. Add a fake OpenVR test for those contracts.
-4. Check the apparent result in a seated and a standing app before exposing UI.
-
-**Documented:** seated and standing are tracking origins selected by an app;
-changing a seated origin cannot force every game to support seated play.
-
-**Inferred from the installed SteamVR defaults:** there is no generic snap-turn
-or locomotion-vignette setting. `dashboard.verticalOffsetCm_2` and
-`steamvr.panelMaskVignette` affect panels, not the player's height or game
-locomotion. The app gives game-setting hints for snap-turn, teleport movement
-and movement vignette instead of writing these unrelated settings.
-
-## Optional software
-
-**Verified 2026-09-28 (same build):** a read-only query of Steam's loaded
-`appStore.allApps` found none of these five apps on the Frame account. The query
-includes software, which the existing games-only library filter excludes.
-Steam's public app-details API listed only Desktop+ as free. No software was
-purchased, installed or launched during these ownership checks.
-
-| Utility | Local Frame status | Public evidence / optional source |
-|---|---|---|
-| OVR Advanced Settings (1009850) | **Untested**, not owned | Steam edition is paid. Developer's [free source and releases](https://github.com/OpenVR-Advanced-Settings/OpenVR-AdvancedSettings). No verified Frame result in this work. |
-| XSOverlay (1173510) | **Untested**, not owned | Supplied research attributes Proton support with tweaks to [Road to VR](https://www.roadtovr.com/valve-steam-frame-review/). This is a public report, not our verification. |
-| OVR Toolkit (1068820) | **Untested**, not owned | Same [public Frame report](https://www.roadtovr.com/valve-steam-frame-review/); no local verification. |
-| fpsVR (908520) | **Untested**, not owned | [Steam listing](https://store.steampowered.com/app/908520/). No Frame-specific result established in the supplied research. General PC VR reviews do not verify Frame support. |
-| Desktop+ (1494460) | **Untested**, free | [Developer source](https://github.com/elvissteinjr/DesktopPlus). No verified Frame result in this work. |
-
-**Documented (supplied research):** the XSOverlay/OVR Toolkit claims are kept as
-attributed leads. **Verified source check 2026-09-28:** fetching the linked
-review returned HTTP 200 and the expected review title, but neither utility name
-appeared in the fetched HTML or extracted text. The claims could not be
-corroborated from that page; this is not proof of incompatibility. They do not make those apps dependencies or mark them
-locally verified. No paid utility is auto-acquired. A server-side check blocks
-installation through the Steam endpoint if the paid utility is absent from the
-loaded Frame library; an empty/unavailable library fails closed. Desktop+ uses
-the existing free Steam install flow, which may need a license confirmation in
-the headset. None is advertised as known-good without local evidence.
-
-Compatibility reports reuse the existing `compat-db` storage and validation
-with `package: "steam:<appid>"`, rather than colliding with Android package IDs.
-The optional list shows the latest `works`, `issues` or `broken` report with its
-date, build and notes, separately from public sources and ownership. With no
-report the status stays **untested**. No shared database schema change or
-production deployment is needed; no reports were published by this work.
-
-## Validation and review
-
-166 unit tests and 8 website tests passed locally. The new fake-Frame cases
-passed in GitHub CI (Docker was unavailable locally). Desktop and phone-width
-preview checks passed. The two independent review attempts did not produce a
-verdict; [commands, real exit statuses and limitations](evidence/vr-utilities/review.md).

docs/vr-video.md

@@ -6,7 +6,7 @@ is required.** Chromium and immersive WebXR are not in this playback path.
 
 ## Use it
 
-In **Tools → Media player** (or **Play a video or photo** on Home), send a file, choose its layout and press
+In **Tools → Media in the headset**, send a file, choose its layout and press
 **Play**. **Theatre** gives it a larger screen and an 85% black surround.
 **Stop** removes both. Refresh reads the library and the player's state.
 The screen follows your head; it isn't a saved world-space panel.

frame/android/app-data.py

@@ -1,168 +0,0 @@
-"""Private-data archives, run under podman unshare on the Frame. Stdlib only."""
-import contextlib
-import json
-import os
-from pathlib import Path, PurePosixPath
-import shutil
-import sys
-import tarfile
-import tempfile
-import time
-
-MAX_BYTES = 20 * 1024 ** 3
-MAX_FILES = 100000
-MAX_MANIFEST = 1024 * 1024
-
-
-def inspect_archive(path, package, instance):
-    names, total, manifest = set(), 0, None
-    with tarfile.open(path, 'r:gz') as archive:
-        for member in archive:
-            name = member.name
-            parts = PurePosixPath(name).parts
-            if (not parts or name.startswith('/') or '..' in parts or
-                    name != '/'.join(parts) or name in names or '\\' in name):
-                raise ValueError('unsafe or duplicate archive path')
-            if name == 'data' and not member.isdir():
-                raise ValueError('data root must be a directory')
-            names.add(name)
-            if len(names) > MAX_FILES or not (member.isdir() or member.isfile()):
-                raise ValueError('archive has too many files, links or special files')
-            if member.uid < 0 or member.gid < 0 or member.uid > 65535 or member.gid > 65535:
-                raise ValueError('archive owner outside Android user namespace')
-            total += member.size
-            if total > MAX_BYTES:
-                raise ValueError('archive exceeds 20 GiB')
-            if name == 'manifest.json' and member.isfile() and member.size <= MAX_MANIFEST:
-                manifest = json.load(archive.extractfile(member))
-            elif parts[0] != 'data':
-                raise ValueError('unexpected archive member')
-        if (not isinstance(manifest, dict) or manifest.get('format') != 1 or
-                manifest.get('package') != package or manifest.get('instance') != instance or
-                'data' not in names):
-            raise ValueError('backup does not match this package and instance')
-    return {'files': len(names) - 1, 'bytes': total, 'package': package, 'instance': instance,
-            'skipped_links': manifest.get('skipped_link_count', 0)}
-
-
-def backup(root, package, instance, output):
-    import io
-    source = root / package
-    if source.is_symlink() or not source.is_dir():
-        raise ValueError('private app data does not exist or is a symlink')
-    count, total, links, skipped = 0, 0, [], 0
-
-    def checked(member):
-        nonlocal count, total, skipped
-        if member.issym():  # never followed or restored; listed in the manifest instead
-            skipped += 1
-            if len(links) < 1000:
-                links.append({'path': member.name[:512], 'target': member.linkname[:256]})
-            return None
-        if member.islnk():  # a second name for a file already archived: store its content again
-            member.type, member.linkname = tarfile.REGTYPE, ''
-            member.size = os.lstat(str(source / member.name[len('data/'):])).st_size
-        count += 1
-        total += member.size
-        if not (member.isdir() or member.isfile()) or count > MAX_FILES or total > MAX_BYTES:
-            raise ValueError('private data contains special files or exceeds backup limits')
-        return member
-
-    with tarfile.open(fileobj=output, mode='w|gz', dereference=False) as archive:
-        archive.add(str(source), arcname='data', filter=checked)
-        # Written last so that it can list what was skipped.
-        manifest = json.dumps({'format': 1, 'package': package, 'instance': instance,
-                               'skipped_links': links, 'skipped_link_count': skipped}).encode()
-        member = tarfile.TarInfo('manifest.json')
-        member.size, member.mode = len(manifest), 0o600
-        archive.addfile(member, io.BytesIO(manifest))
-
-
-def restore(root, package, instance, input_stream):
-    source = root / package
-    if source.is_symlink() or not source.is_dir():
-        raise ValueError('private app data does not exist or is a symlink')
-    with tempfile.TemporaryDirectory(prefix='.frame-restore-', dir=str(root)) as work:
-        work = Path(work)
-        archive_path = work / 'backup.tar.gz'
-        with archive_path.open('wb') as output:
-            size = 0
-            while True:
-                chunk = input_stream.read(1024 * 1024)
-                if not chunk:
-                    break
-                size += len(chunk)
-                if size > MAX_BYTES:
-                    raise ValueError('compressed backup exceeds 20 GiB')
-                output.write(chunk)
-        result = inspect_archive(archive_path, package, instance)
-        stage = work / 'stage'
-        stage.mkdir(mode=0o700)
-        with tarfile.open(archive_path, 'r:gz') as archive:
-            directories = []
-            for member in archive:
-                if member.name == 'manifest.json':
-                    continue
-                target = stage / member.name
-                if member.isdir():
-                    target.mkdir(parents=True, exist_ok=True)
-                    directories.append((target, member))
-                else:
-                    target.parent.mkdir(parents=True, exist_ok=True)
-                    with archive.extractfile(member) as src, target.open('xb') as dst:
-                        shutil.copyfileobj(src, dst, 1024 * 1024)
-                    apply_metadata(target, member)
-            for target, member in reversed(directories):
-                apply_metadata(target, member)
-        with package_lock(root, package):  # another restore of this package must not delete our copy
-            previous = root / ('.' + package + '.before-restore-' + str(time.time_ns()))
-            source.rename(previous)
-            try:
-                (stage / 'data').rename(source)
-            except BaseException:
-                previous.rename(source)
-                raise
-            # Keep only the newest pre-restore copy of this package's data.
-            for old in root.glob('.' + package + '.before-restore-*'):
-                if old != previous and not old.is_symlink():
-                    shutil.rmtree(str(old), ignore_errors=True)
-        result['previous'] = str(previous)
-        return result
-
-
-@contextlib.contextmanager
-def package_lock(root, package):
-    import fcntl
-    fd = os.open(str(root / ('.' + package + '.restore.lock')), os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW, 0o600)
-    try:
-        fcntl.flock(fd, fcntl.LOCK_EX)
-        yield
-    finally:
-        os.close(fd)  # releases the lock
-
-
-def apply_metadata(path, member):
-    os.chown(str(path), member.uid, member.gid)
-    os.chmod(str(path), member.mode & 0o777)
-    os.utime(str(path), (member.mtime, member.mtime))
-
-
-def main():
-    action, package, instance = sys.argv[1:]
-    instance = int(instance)
-    root = Path.home() / '.local/share/Steam/steamapps/compatdata' / str(instance) / 'internal'
-    if root.is_symlink() or root.resolve() != root.absolute():
-        raise ValueError('private-data directory traverses a symlink')
-    if action == 'backup':
-        backup(root, package, instance, sys.stdout.buffer)
-    elif action == 'restore':
-        print(json.dumps(restore(root, package, instance, sys.stdin.buffer)))
-    else:
-        raise ValueError('unknown app-data action')
-
-
-if __name__ == '__main__':
-    try:
-        main()
-    except (OSError, ValueError, tarfile.TarError) as error:
-        sys.exit(str(error))

frame/android/lepton-app.sh

@@ -19,25 +19,6 @@ done
 
 # A number that isn't a real Steam app; it names this app's Lepton context.
 export SteamAppId="$(cat "$DIR/instance.id")"
-[[ "$SteamAppId" =~ ^[0-9]+$ ]] || { echo "invalid instance.id" >&2; exit 1; }
-# Keep the stable Lepton context, but identify the Android VR client as its
-# actual Steam shortcut. Lepton applies LEPTON_ENV_* after its own passthrough.
-if [[ -f "$DIR/shortcut.id" ]]; then
-  shortcut="$(cat "$DIR/shortcut.id")"
-  [[ "$shortcut" =~ ^[0-9]+$ ]] || { echo "invalid shortcut.id" >&2; exit 1; }
-  export LEPTON_ENV_SteamAppId="$shortcut"
-fi
-exec 9>"$DIR/launch.lock"
-flock -n 9 || { echo "Android app is already running" >&2; exit 1; }
-CONTAINER="lepton-steamlaunch-$SteamAppId"
-# Holding the lock means no launcher owns a running container: it was orphaned
-# (this script SIGKILLed), so stop it rather than refuse every later Play. The
-# name is this app's alone. A Lepton host process whose launcher was killed
-# before it made the container may linger briefly; nothing else is killed.
-if [[ "$(podman inspect --format '{{.State.Running}}' "$CONTAINER" 2>/dev/null || true)" == true ]]; then
-  echo "Stopping orphaned $CONTAINER" >&2
-  podman stop -t 5 "$CONTAINER" >/dev/null 2>&1 || true
-fi
 export STEAM_COMPAT_INSTALL_PATH="$DIR"
 # Must be under ~/.local/share/Steam: only that tree is mounted in the container.
 export STEAM_COMPAT_DATA_PATH="$HOME/.local/share/Steam/steamapps/compatdata/$SteamAppId"
@@ -48,29 +29,4 @@ mkdir -p "$STEAM_COMPAT_DATA_PATH" "$STEAM_FOSSILIZE_DUMP_PATH"
 # Lepton's setpgid --foreground re-exec needs a terminal that Steam shortcuts
 # and SSH don't have; give it its own session instead.
 export IS_PARENT=true
-# Keep this shell in Steam's process tree; setsid alone has no container cleanup.
-child=""
-cleanup() {
-  trap '' TERM INT HUP
-  if [[ -n "$child" ]]; then
-    kill -TERM -- "-$child" 2>/dev/null || true
-    kill -TERM "$child" 2>/dev/null || true
-  fi
-  podman stop -t 5 "$CONTAINER" >/dev/null 2>&1 || true
-  if [[ -n "$child" ]]; then
-    kill -KILL -- "-$child" 2>/dev/null || true
-    kill -KILL "$child" 2>/dev/null || true
-    wait "$child" 2>/dev/null || true
-  fi
-}
-trap cleanup EXIT
-trap 'exit 143' TERM
-trap 'exit 130' INT
-trap 'exit 129' HUP
-# 9>&-: the lock is this launcher's alone; Lepton's tree mustn't keep it held.
-setsid --wait "$LEPTON" waitforexitandrun -- "$DIR/app.apk" 9>&- &
-child=$!
-rc=0
-wait "$child" || rc=$?
-child=""
-exit "$rc"
+exec setsid --wait "$LEPTON" waitforexitandrun -- "$DIR/app.apk"

frame/android/library_artwork.js

@@ -1,146 +0,0 @@
-// Runs in Steam's Chromium context: identical fonts/rendering from every host OS.
-async function renderLibraryArtwork(input) {
-  const sizes = {grid:[600,900], wide:[920,430], hero:[3840,1240], logo:[1280,480], icon:[256,256]};
-  const label = String(input.label || 'Untitled').trim().slice(0,180);
-  const font = '"Motiva Sans", "Noto Sans", Arial, sans-serif';
-  await document.fonts.load(`800 120px ${font}`, label);
-  const images = {}, warnings = [];
-  for (const [slot, item] of Object.entries(input.images || {})) {
-    try {
-      const img = new Image();
-      img.src = `data:image/${item[0]};base64,${item[1]}`;
-      await img.decode();
-      if (!img.width || !img.height || img.width*img.height > 16777216) throw Error('dimensions');
-      images[slot] = img;
-    } catch (_) { warnings.push(`${slot} could not be decoded; generated art used`); }
-  }
-  let icon = images.icon;
-  if (icon) {
-    // Remove only a near-black matte connected to the outside of an opaque icon.
-    const cut=document.createElement('canvas');cut.width=icon.width;cut.height=icon.height;
-    const c=cut.getContext('2d');c.drawImage(icon,0,0);
-    const pixels=c.getImageData(0,0,cut.width,cut.height), d=pixels.data, w=cut.width,h=cut.height;
-    const corners=[0,w-1,(h-1)*w,h*w-1];
-    if(corners.every(i=>d[i*4+3]>250 && Math.max(d[i*4],d[i*4+1],d[i*4+2])<24)) {
-      const seen=new Uint8Array(w*h), queue=corners.slice();
-      for(let q=0;q<queue.length;q++) {
-        const i=queue[q];if(seen[i])continue;seen[i]=1;
-        if(Math.max(d[i*4],d[i*4+1],d[i*4+2])>24)continue;
-        d[i*4+3]=0;
-        if(i%w)queue.push(i-1);if(i%w<w-1)queue.push(i+1);
-        if(i>=w)queue.push(i-w);if(i<w*(h-1))queue.push(i+w);
-      }
-      c.putImageData(pixels,0,0);icon=cut;
-    }
-  }
-  // Quantized, saturated dominant colors avoid white/black icon margins.
-  let colors = [[48,91,137], [24,36,63]];
-  if (icon) {
-    const sample = document.createElement('canvas'); sample.width=48; sample.height=48;
-    const s=sample.getContext('2d'); s.drawImage(icon,0,0,48,48);
-    const data=s.getImageData(0,0,48,48).data, bins=new Map();
-    for (let i=0;i<data.length;i+=4) {
-      const rgb=[data[i],data[i+1],data[i+2]], hi=Math.max(...rgb), lo=Math.min(...rgb);
-      if (data[i+3]<150 || hi<45 || lo>220 || hi-lo<25) continue;
-      const key=rgb.map(v=>Math.round(v/32)*32).join(',');
-      bins.set(key,(bins.get(key)||0)+1);
-    }
-    const ranked=[...bins].sort((a,b)=>b[1]-a[1]);
-    if (ranked.length) {
-      colors[0]=ranked[0][0].split(',').map(Number);
-      colors[1]=(ranked.find(([key])=>key.split(',').reduce((n,v,i)=>n+Math.abs(Number(v)-colors[0][i]),0)>170)||ranked[0])[0].split(',').map(Number);
-    }
-  }
-  // Preserve hue while lifting muted icon colors into a richer background palette.
-  colors=colors.map(c=>{const low=Math.min(...c),range=Math.max(...c)-low||1;
-    return c.map(v=>45+(v-low)/range*165);});
-  const rgb=(c,a=1)=>`rgba(${c.map(v=>Math.min(255,Math.round(v))).join(',')},${a})`;
-  function image(ctx,img,x,y,w,h,cover=false) {
-    const scale=cover?Math.max(w/img.width,h/img.height):Math.min(w/img.width,h/img.height);
-    const dw=img.width*scale,dh=img.height*scale;
-    ctx.save(); ctx.beginPath(); ctx.rect(x,y,w,h); ctx.clip();
-    ctx.drawImage(img,x+(w-dw)/2,y+(h-dh)/2,dw,dh); ctx.restore();
-  }
-  function title(ctx,w,h,top,bottom,maxSize) {
-    let lines=[],size=maxSize;
-    const maxWidth=w*.84;
-    for (;size>=18;size-=2) {
-      ctx.font=`800 ${size}px ${font}`;
-      lines=[]; let line='';
-      for (const word of label.split(/\s+/)) {
-        const next=line?line+' '+word:word;
-        if (line && ctx.measureText(next).width>maxWidth) {lines.push(line);line=word;} else line=next;
-      }
-      lines.push(line);
-      if (lines.length*size*1.08<=bottom-top && lines.every(l=>ctx.measureText(l).width<=maxWidth)) break;
-    }
-    if(lines.length===2) {
-      const words=lines[0].split(' ');
-      if(words.length>1) {
-        const first=words.slice(0,-1).join(' '), second=words.slice(-1)[0]+' '+lines[1];
-        if(ctx.measureText(second).width<=maxWidth &&
-           Math.abs(ctx.measureText(first).width-ctx.measureText(second).width)<
-           Math.abs(ctx.measureText(lines[0]).width-ctx.measureText(lines[1]).width)) lines=[first,second];
-      }
-    }
-    // A long unbroken label is still fitted, including scripts without spaces.
-    ctx.textAlign='center'; ctx.textBaseline='middle'; ctx.fillStyle='#fff';
-    ctx.shadowColor='rgba(0,0,0,.45)'; ctx.shadowBlur=size*.28; ctx.shadowOffsetY=size*.06;
-    let y=top+(bottom-top-lines.length*size*1.08)/2+size*.54;
-    for (const line of lines) {ctx.fillText(line,w/2,y,maxWidth); y+=size*1.08;}
-    ctx.shadowBlur=0; ctx.shadowOffsetY=0;
-  }
-  const result={};
-  for (const [slot,[w,h]] of Object.entries(sizes)) {
-    const canvas=document.createElement('canvas'); canvas.width=w; canvas.height=h;
-    const ctx=canvas.getContext('2d'); ctx.imageSmoothingQuality='high';
-    const direct=images[slot];
-    const feature=images.feature_graphic||images.banner;
-    const scene=direct || ((slot==='hero'||slot==='wide') && (feature||images.screenshot));
-    if (scene) {
-      if (slot==='logo'||slot==='icon') image(ctx,scene,0,0,w,h);
-      else image(ctx,scene,0,0,w,h,true);
-    } else if (slot==='logo') {
-      title(ctx,w,h,h*.08,h*.92,150);
-    } else {
-      const gradient=ctx.createLinearGradient(0,0,w,h);
-      gradient.addColorStop(0,rgb(colors[0].map(v=>v*.68)));
-      gradient.addColorStop(.6,rgb(colors[1].map(v=>v*.32)));
-      gradient.addColorStop(1,'#080c16'); ctx.fillStyle=gradient;ctx.fillRect(0,0,w,h);
-      if (icon) {
-        ctx.save();ctx.globalAlpha=.16;ctx.filter=`blur(${Math.round(w*.055)}px) saturate(1.4)`;
-        image(ctx,icon,-w*.15,-h*.15,w*1.3,h*1.3,true);ctx.restore();
-      }
-      const glow=ctx.createRadialGradient(w*.5,h*.32,0,w*.5,h*.32,w*.8);
-      glow.addColorStop(0,rgb(colors[0],.27));glow.addColorStop(1,rgb(colors[1],0));
-      ctx.fillStyle=glow;ctx.fillRect(0,0,w,h);
-      const vignette=ctx.createLinearGradient(0,h*.25,0,h);
-      vignette.addColorStop(0,'rgba(0,0,0,0)');vignette.addColorStop(1,'rgba(0,0,0,.56)');
-      ctx.fillStyle=vignette;ctx.fillRect(0,0,w,h);
-      const box=slot==='grid'?[w*.12,h*.14,w*.76,w*.76]:
-                slot==='wide'?[w*.36,h*.06,w*.28,h*.59]:
-                slot==='hero'?[w*.365,h*.12,w*.27,h*.78]:[w*.08,h*.08,w*.84,h*.84];
-      if (icon) {
-        ctx.save();ctx.shadowColor='rgba(0,0,0,.65)';ctx.shadowBlur=Math.min(w,h)*.055;
-        ctx.shadowOffsetY=Math.min(w,h)*.022;
-        // Opaque square icons read as deliberate app tiles, not pasted rectangles.
-        const [x,y,bw,bh]=box, side=Math.min(bw,bh);
-        if(slot!=='hero' && icon===images.icon) {
-          ctx.beginPath();ctx.roundRect(x+(bw-side)/2,y+(bh-side)/2,side,side,side*.14);ctx.clip();
-        }
-        image(ctx,icon,...box);ctx.restore();
-      } else if (slot !== 'hero') {
-        // A typographic monogram when the APK contains no usable image.
-        ctx.font=`800 ${Math.min(w,h)*.48}px ${font}`;ctx.fillStyle='rgba(255,255,255,.94)';
-        ctx.textAlign='center';ctx.textBaseline='middle';ctx.fillText([...label][0]||'A',w/2,h*.38);
-      }
-      if (slot==='grid') title(ctx,w,h,h*.7,h*.93,66);
-      if (slot==='wide') title(ctx,w,h,h*.69,h*.92,52);
-      // Hero intentionally has no title: Steam overlays the transparent logo.
-    }
-    // Photos as PNG can pass Steam's 12 MiB limit at hero size; the logo keeps its transparency.
-    const jpeg=scene && slot!=='logo' && slot!=='icon';
-    result[slot]=[jpeg?'jpg':'png', canvas.toDataURL(jpeg?'image/jpeg':'image/png',.9).split(',')[1]];
-  }
-  return {images:result,warnings,font};
-}

frame/android/steam_shortcuts.py

@@ -5,11 +5,9 @@ Python stdlib only; the Mac runs it with `ssh frame python3 - <args> < this`.
 
   steam_shortcuts.py add NAME EXE START_DIR [ICON]  -> prints the shortcut app id
   steam_shortcuts.py list                           -> JSON [{appid, name, exe}]
-  steam_shortcuts.py configure APPID NAME EXE START_DIR ICON VR ARTWORK_JSON
-  steam_shortcuts.py stop APPID
   steam_shortcuts.py remove APPID
 """
-import base64, glob, json, os, re, socket, struct, sys, urllib.request
+import base64, json, os, socket, struct, sys, urllib.request
 
 DEVTOOLS = 'http://127.0.0.1:8080/json'
 
@@ -24,10 +22,10 @@ def target_ws():
 class WS:
     """Just enough RFC 6455 for one CDP request/response on loopback."""
 
-    def __init__(self, url, timeout=20):
+    def __init__(self, url):
         host_port, path = url[len('ws://'):].split('/', 1)
         host, port = host_port.split(':')
-        self.s = socket.create_connection((host, int(port)), timeout=timeout)
+        self.s = socket.create_connection((host, int(port)), timeout=20)
         key = base64.b64encode(os.urandom(16)).decode()
         self.s.sendall((f'GET /{path} HTTP/1.1\r\nHost: {host_port}\r\nUpgrade: websocket\r\n'
                         f'Connection: Upgrade\r\nSec-WebSocket-Key: {key}\r\n'
@@ -71,8 +69,8 @@ class WS:
                 return msg.decode()
 
 
-def evaluate(js, timeout=20):
-    ws = WS(target_ws(), timeout)
+def evaluate(js):
+    ws = WS(target_ws())
     ws.send(json.dumps({'id': 1, 'method': 'Runtime.evaluate', 'params': {
         'expression': js, 'awaitPromise': True, 'returnByValue': True}}))
     while True:
@@ -85,206 +83,6 @@ def evaluate(js, timeout=20):
     return res.get('result', {}).get('value')
 
 
-# Steam's ELibraryAssetType (Capsule, Hero, Logo, Header, Icon).
-ASSETS = {'grid': 0, 'hero': 1, 'logo': 2, 'wide': 3, 'icon': 4}
-
-
-def collections_js(appid, wanted=()):
-    wanted = list(wanted)
-    return f'''async function syncCollections() {{
-      const wanted = {json.dumps(wanted)};
-      if (typeof collectionStore === "undefined" ||
-          typeof collectionStore.GetUserCollectionsByName !== "function" ||
-          typeof collectionStore.NewUnsavedCollection !== "function" ||
-          typeof collectionStore.SaveCollection !== "function")
-        return ["Steam collections API unavailable"];
-      const app = {{appid: {appid}}};
-      const warnings = [];
-      for (const name of ["Android", "Android VR", "Sideloaded"]) {{
-        const matches = collectionStore.GetUserCollectionsByName(name);
-        let collection = matches.find(c => !c.bIsDynamic && c.bAllowsDragAndDrop);
-        if (wanted.includes(name)) {{
-          if (!collection && matches.length) {{
-            warnings.push(name + " is an existing dynamic or read-only collection");
-            continue;
-          }}
-          if (!collection) {{
-            collection = collectionStore.NewUnsavedCollection(name, undefined, [app]);
-          }} else {{
-            collection.AsDragDropCollection().AddApps([app]);
-          }}
-          await collectionStore.SaveCollection(collection);
-        }} else if (collection) {{
-          collection.AsDragDropCollection().RemoveApps([app]);
-          await collectionStore.SaveCollection(collection);
-        }}
-      }}
-      return warnings;
-    }}'''
-
-
-
-def notes_js(name, details):
-    filename = 'notes_shortcut_' + re.sub(r'[!-/:-@ \[\\\]\^`]', '_', name.strip())
-    content = '\n'.join(str(details[k]) for k in ('package', 'version', 'source') if details.get(k))
-    return f'''if (SteamClient.GameNotes && typeof SteamClient.GameNotes.GetNotes === "function" &&
-                   typeof SteamClient.GameNotes.SaveNotes === "function") {{
-      try {{
-        const file = {json.dumps(filename)};
-        const previous = await SteamClient.GameNotes.GetNotes(file, file + "_images/");
-        if (previous.result !== 1 && previous.result !== 9) throw Error("read " + previous.result);
-        const data = previous.result === 1 ? JSON.parse(previous.notes) : {{notes: [], shortcut_name: {json.dumps(name)}}};
-        if (!Array.isArray(data.notes)) throw Error("unexpected notes format");
-        const id = "frame-control-library", now = Math.floor(Date.now()/1000);
-        const old = data.notes.find(n => n.id === id);
-        const note = {{id, shortcut_name: {json.dumps(name)}, title: "Installation details",
-                      content: {json.dumps(content)}, ordinal: old ? old.ordinal : data.notes.length,
-                      time_created: old ? old.time_created : now, time_modified: now}};
-        data.notes = data.notes.filter(n => n.id !== id).concat([note]);
-        const result = await SteamClient.GameNotes.SaveNotes(file, JSON.stringify(data));
-        if (result !== 1) throw Error("save " + result);
-      }} catch (e) {{ warnings.push("Steam notes: " + String(e)); }}
-    }}'''
-
-
-MAX_ART = 12 * 1024 * 1024  # Steam's custom artwork limit per slot
-
-
-def render(plan):
-    with open(plan) as f:
-        source = json.load(f)
-    images = {}
-    for slot, path in source['images'].items():
-        ext = os.path.splitext(path)[1][1:]
-        with open(path, 'rb') as f:
-            data = f.read(MAX_ART + 1)
-        if len(data) > MAX_ART:
-            raise ValueError('source artwork too large')
-        images[slot] = [ext, base64.b64encode(data).decode()]
-    renderer = globals().get('ART_RENDERER')
-    if renderer is None:
-        with open(os.path.join(os.path.dirname(__file__), 'library_artwork.js')) as f:
-            renderer = f.read()
-    try:
-        return _render(plan, renderer, source['label'], images)
-    except (ValueError, OSError, EOFError, SystemExit) as e:
-        # Generated art from the icon alone always fits; a photo that didn't must not fail the install.
-        result = _render(plan, renderer, source['label'], {k: v for k, v in images.items() if k == 'icon'})
-        result['warnings'].insert(0, 'Source artwork could not be rendered (' + str(e)[:120] + '); generated art used')
-        return result
-
-
-def _render(plan, renderer, label, images):
-    # A 4K photo takes seconds to decode and encode on the Frame; allow well beyond that.
-    result = evaluate(renderer + '\nrenderLibraryArtwork(' + json.dumps({'label': label, 'images': images}) + ')',
-                      timeout=75)
-    if not isinstance(result, dict) or set(result.get('images', {})) != set(ASSETS):
-        raise ValueError('incomplete artwork render')
-    paths = {}
-    for slot, (ext, encoded) in result['images'].items():
-        data = base64.b64decode(encoded, validate=True)
-        signature = {'png': b'\x89PNG\r\n\x1a\n', 'jpg': b'\xff\xd8\xff'}.get(ext)
-        if not signature or not data.startswith(signature) or len(data) > MAX_ART:
-            raise ValueError(slot + ' render is ' + str(len(data)) + ' bytes of ' + str(ext))
-        paths[slot] = os.path.join(os.path.dirname(plan), slot + '.' + ext)
-        with open(paths[slot] + '.tmp', 'wb') as f:
-            f.write(data)
-    for slot, path in paths.items():
-        os.replace(path + '.tmp', path)
-        for stale in ('png', 'jpg'):
-            other = os.path.join(os.path.dirname(plan), slot + '.' + stale)
-            if other != path and os.path.exists(other):
-                os.remove(other)
-    return {'paths': paths, 'warnings': list(result.get('warnings', []))}
-
-
-# Steam's own file for each custom-art type in userdata/*/config/grid/.
-GRID_FILES = {0: 'p', 1: '_hero', 2: '_logo', 3: ''}
-
-
-def custom_art(appid):
-    """The custom-art types this shortcut already has in Steam, for any local user."""
-    found = set()
-    for kind, suffix in GRID_FILES.items():
-        pattern = os.path.expanduser(f'~/.local/share/Steam/userdata/*/config/grid/{int(appid)}{suffix}.*')
-        if any(os.path.splitext(p)[1].lower() in ('.png', '.jpg', '.jpeg') for p in glob.glob(pattern)):
-            found.add(kind)
-    return found
-
-
-def configure(appid, name, exe, start_dir, icon, vr, artwork, options=None):
-    """options: category, details, fill_only (only empty slots and a missing icon; name and flags untouched)."""
-    options = options or {}
-    category = options.get('category', 'Android')
-    fill = bool(options.get('fill_only'))
-    existing = custom_art(appid) if fill else set()
-    if set(artwork) != set(ASSETS):
-        raise ValueError('all five Steam artwork slots are required')
-    images = []
-    for slot, path in artwork.items():
-        if slot not in ASSETS:
-            raise ValueError('unknown artwork slot')
-        ext = os.path.splitext(path)[1][1:]
-        if ext not in ('png', 'jpg'):
-            raise ValueError('artwork must be PNG or JPEG')
-        with open(path, 'rb') as f:
-            data = f.read(MAX_ART + 1)
-        if len(data) > MAX_ART:
-            raise ValueError('artwork is too large')
-        # Frame's custom-art API maps type 4 to Header; use SetShortcutIcon.
-        if slot != 'icon' and ASSETS[slot] not in existing:
-            images.append([ASSETS[slot], ext, base64.b64encode(data).decode()])
-    return evaluate(f'''(async () => {{
-      const id = {int(appid)}, warnings = [], fill = {json.dumps(fill)};
-      const overview = appStore.GetAppOverviewByAppID(id);
-      if (!fill) {{
-        SteamClient.Apps.SetShortcutName(id, {json.dumps(name)});
-        if ({json.dumps(exe)}) SteamClient.Apps.SetShortcutExe(id, {json.dumps(exe)});
-        if ({json.dumps(start_dir)}) SteamClient.Apps.SetShortcutStartDir(id, {json.dumps(start_dir)});
-        if (typeof SteamClient.Apps.SetShortcutSortAs === "function")
-          SteamClient.Apps.SetShortcutSortAs(id, {json.dumps(name)});
-      }}
-      if (!fill || !(overview && overview.icon_data)) SteamClient.Apps.SetShortcutIcon(id, {json.dumps(icon)});
-      // null (devkit titles) or filling gaps: leave the VR flag as Steam has it.
-      if ({json.dumps(vr)} !== null && !fill) {{
-        if (typeof SteamClient.Apps.SetShortcutIsVR === "function")
-          SteamClient.Apps.SetShortcutIsVR(id, {json.dumps(vr)});
-        else warnings.push("Steam VR shortcut flag API unavailable");
-      }}
-      if (typeof SteamClient.Apps.SetCustomArtworkForApp === "function") {{
-        for (const [type, ext, data] of {json.dumps(images)}) {{
-          // Steam keeps a slot's PNG and JPEG side by side; clear it so a stale one can't win.
-          if (!fill && typeof SteamClient.Apps.ClearCustomArtworkForApp === "function")
-            try {{ await SteamClient.Apps.ClearCustomArtworkForApp(id, type); }} catch (e) {{}}
-          await SteamClient.Apps.SetCustomArtworkForApp(id, data, ext, type);
-        }}
-      }} else throw new Error("Steam artwork API unavailable; installation is incomplete");
-      {collections_js(int(appid), [category] + (['Android VR'] if vr and category == 'Android' else []))}
-      try {{ warnings.push(...await syncCollections()); }}
-      catch (e) {{ warnings.push("Steam collections: " + String(e)); }}
-      {notes_js(name, options.get('details', {}))}
-      return {{warnings}};
-    }})()''', timeout=60)
-
-
-def remove(appid):
-    # Collections and artwork are tidy-up: only a missing RemoveShortcut may fail the removal.
-    return evaluate(f'''(async () => {{
-      const id = {int(appid)}, warnings = [];
-      {collections_js(int(appid))}
-      try {{ warnings.push(...await syncCollections()); }}
-      catch (e) {{ warnings.push("Steam collections: " + String(e)); }}
-      if (typeof SteamClient.Apps.ClearCustomArtworkForApp === "function") {{
-        for (const type of [0, 1, 2, 3]) {{
-          try {{ await SteamClient.Apps.ClearCustomArtworkForApp(id, type); }}
-          catch (e) {{ warnings.push("Steam artwork " + type + ": " + String(e)); }}
-        }}
-      }} else warnings.push("Steam artwork removal API unavailable");
-      SteamClient.Apps.RemoveShortcut(id);
-      return {{warnings}};
-    }})()''')
-
-
 def main():
     cmd, args = sys.argv[1], sys.argv[2:]
     if cmd == 'add':
@@ -299,30 +97,12 @@ def main():
         }})()'''
         print(evaluate(js))
     elif cmd == 'list':
-        # Overviews carry no exe or devkit id (checked 2026-09-28); app details do, once registered.
-        js = '''(async () => Promise.all(appStore.allApps.filter(a => a.app_type === 1073741824).map(async a => {
-          let d = typeof appDetailsStore !== "undefined" && appDetailsStore.GetAppDetails(a.appid);
-          if (!d && typeof SteamClient.Apps.RegisterForAppDetails === "function") d = await new Promise(ok => {
-            let reg;
-            const timer = setTimeout(() => { if (reg) reg.unregister(); ok(null); }, 3000);
-            reg = SteamClient.Apps.RegisterForAppDetails(a.appid, x => {
-              clearTimeout(timer); setTimeout(() => reg && reg.unregister()); ok(x); });
-          });
-          return {appid: a.appid, name: a.display_name, devkit_gameid: a.devkit_gameid,
-                  exe: d ? d.strShortcutExe || "" : "", start_dir: d ? d.strShortcutStartDir || "" : ""};
-        })))()'''
+        js = '''(() => appStore.allApps.filter(a => a.app_type === 1073741824)
+                  .map(a => ({appid: a.appid, name: a.display_name})))()'''
         print(json.dumps(evaluate(js)))
-    elif cmd == 'render':
-        print(json.dumps(render(args[0])))
-    elif cmd == 'configure':
-        vr = {'1': True, '0': False}.get(args[5])  # '' leaves Steam's VR flag alone
-        print(json.dumps(configure(int(args[0]), *args[1:5], vr, json.loads(args[6]),
-                                   json.loads(args[7]) if len(args) > 7 else None)))
-    elif cmd == 'stop':
-        evaluate(f'SteamClient.Apps.TerminateApp({json.dumps(str((int(args[0]) << 32) | 0x02000000))}, false)')
-        print('stopping')
     elif cmd == 'remove':
-        print(json.dumps(remove(int(args[0]))))
+        evaluate(f'SteamClient.Apps.RemoveShortcut({int(args[0])})')
+        print('removed')
     else:
         sys.exit(__doc__)
 

frame/openxr-compat/README.md

@@ -190,11 +190,8 @@ ctest --test-dir frame/openxr-compat/build-host --output-on-failure
 
 The script produces arm64-v8a / android-24, C++17, `-O2`, static libc++, hidden
 internal symbols, stripped output, and `-Wl,-z,max-page-size=16384`.
-The committed prebuilt is `prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz`,
-gzipped (`gzip -9 -n`) so the Windows installer carries it intact: electron-builder's
-7-Zip compresses a bare arm64 ELF with its ARM64 filter, which the installer's
-extractor skips. Frame Control decompresses it when injecting the layer. The
-SHA-256 of the uncompressed library is recorded below with the APK checks.
+The committed prebuilt is `prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so`.
+Its SHA-256 is recorded below with the APK checks.
 
 [Host test output](evidence/ctest.txt): two tests passed, covering pure logic
 and the actual layer with a fake next layer and host-only log/JNI shims.

frame/openxr-compat/build.sh

@@ -8,8 +8,5 @@ cmake -S "$here" -B "$here/build-android" -G Ninja \
   -DANDROID_STL=c++_static -DCMAKE_BUILD_TYPE=Release
 cmake --build "$here/build-android"
 mkdir -p "$here/prebuilt/arm64-v8a"
-# Committed and shipped gzipped: electron-builder's 7-Zip applies its ARM64
-# branch filter to a bare arm64 ELF, which the Windows installer's extractor
-# can't decode, so the installed app silently lacked the library.
-shasum -a 256 "$here/build-android/libXrApiLayer_FRAME_compat.so"
-gzip -9 -n -c "$here/build-android/libXrApiLayer_FRAME_compat.so" > "$here/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so.gz"
+cp "$here/build-android/libXrApiLayer_FRAME_compat.so" "$here/prebuilt/arm64-v8a/"
+shasum -a 256 "$here/prebuilt/arm64-v8a/libXrApiLayer_FRAME_compat.so"

ios/FrameControl.xcodeproj/project.pbxproj

@@ -7,8 +7,6 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
-		C1234567890ABCDEF0123456 /* NativeSessionTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = D1234567890ABCDEF0123456 /* NativeSessionTests.swift */; };
-		A1234567890ABCDEF0123456 /* NativeSessionState.swift in Sources */ = {isa = PBXBuildFile; fileRef = B1234567890ABCDEF0123456 /* NativeSessionState.swift */; };
 		0DEE50BD563B1D8C328C4C0A /* HeadsetServer.swift in Sources */ = {isa = PBXBuildFile; fileRef = EDC7BA8014DBC302D08FD397 /* HeadsetServer.swift */; };
 		12B21D3319BAF5AE79948560 /* FrameLink.swift in Sources */ = {isa = PBXBuildFile; fileRef = 16644E7FDA7ADD5B232EB700 /* FrameLink.swift */; };
 		1A07EC692B0FF723907EA77B /* WebShell.swift in Sources */ = {isa = PBXBuildFile; fileRef = D6C4E6C28315CA8729FCAAEA /* WebShell.swift */; };
@@ -19,7 +17,6 @@
 		78427FC66780623F31E7501E /* FrameControlApp.swift in Sources */ = {isa = PBXBuildFile; fileRef = 93C8E0D7C3F4F628941B3D5A /* FrameControlApp.swift */; };
 		84423CB45629465420180A64 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 8F2CB550FC81C01E6BDD5A71 /* Assets.xcassets */; };
 		9657F7BC23E3352E5AB30777 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = DB544223FC60A59CC3E8EF5F /* SetupView.swift */; };
-		A0C5B00E257230A38DBD9E54 /* ComfortNotificationTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = E81218B75FEEE47B8D8BAE20 /* ComfortNotificationTests.swift */; };
 		A8C7AED25A6280682FCE45DC /* Citadel in Frameworks */ = {isa = PBXBuildFile; productRef = 6BA549B6CC0A0CB847126456 /* Citadel */; };
 		DC043FB74BE2D23F3A5826BF /* FrameControlTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */; };
 		E6898C714A92D3979F73B6E1 /* FrameFinder.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2F288DF6636A417F0CA3A6CD /* FrameFinder.swift */; };
@@ -37,8 +34,6 @@
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXFileReference section */
-		D1234567890ABCDEF0123456 /* NativeSessionTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeSessionTests.swift; sourceTree = "<group>"; };
-		B1234567890ABCDEF0123456 /* NativeSessionState.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = NativeSessionState.swift; sourceTree = "<group>"; };
 		16644E7FDA7ADD5B232EB700 /* FrameLink.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameLink.swift; sourceTree = "<group>"; };
 		1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = FrameControlTests.swift; sourceTree = "<group>"; };
 		237D9AF04EEA257AB382F60E /* Keys.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Keys.swift; sourceTree = "<group>"; };
@@ -53,7 +48,6 @@
 		BF0FCA7117DA3ABA449B4EE0 /* InstallLink.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = InstallLink.swift; sourceTree = "<group>"; };
 		D6C4E6C28315CA8729FCAAEA /* WebShell.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = WebShell.swift; sourceTree = "<group>"; };
 		DB544223FC60A59CC3E8EF5F /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
-		E81218B75FEEE47B8D8BAE20 /* ComfortNotificationTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ComfortNotificationTests.swift; sourceTree = "<group>"; };
 		EDC7BA8014DBC302D08FD397 /* HeadsetServer.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = HeadsetServer.swift; sourceTree = "<group>"; };
 		F3E2F5607DD877272483D64E /* FrameControl.app */ = {isa = PBXFileReference; includeInIndex = 0; lastKnownFileType = wrapper.application; path = FrameControl.app; sourceTree = BUILT_PRODUCTS_DIR; };
 /* End PBXFileReference section */
@@ -104,7 +98,6 @@
 			isa = PBXGroup;
 			children = (
 				8A11F3431826A26B247C0695 /* AppModel.swift */,
-				B1234567890ABCDEF0123456 /* NativeSessionState.swift */,
 				93C8E0D7C3F4F628941B3D5A /* FrameControlApp.swift */,
 				BF0FCA7117DA3ABA449B4EE0 /* InstallLink.swift */,
 			);
@@ -114,9 +107,7 @@
 		75A17B1C79C8C3C60FEABBA6 /* FrameControlTests */ = {
 			isa = PBXGroup;
 			children = (
-				E81218B75FEEE47B8D8BAE20 /* ComfortNotificationTests.swift */,
 				1740B691F9C25E5FB6F9EFC3 /* FrameControlTests.swift */,
-				D1234567890ABCDEF0123456 /* NativeSessionTests.swift */,
 			);
 			path = FrameControlTests;
 			sourceTree = "<group>";
@@ -266,7 +257,6 @@
 			buildActionMask = 2147483647;
 			files = (
 				F94D0252F8CC5854314B84B2 /* AppModel.swift in Sources */,
-				A1234567890ABCDEF0123456 /* NativeSessionState.swift in Sources */,
 				78427FC66780623F31E7501E /* FrameControlApp.swift in Sources */,
 				E6898C714A92D3979F73B6E1 /* FrameFinder.swift in Sources */,
 				12B21D3319BAF5AE79948560 /* FrameLink.swift in Sources */,
@@ -284,9 +274,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				A0C5B00E257230A38DBD9E54 /* ComfortNotificationTests.swift in Sources */,
 				DC043FB74BE2D23F3A5826BF /* FrameControlTests.swift in Sources */,
-				C1234567890ABCDEF0123456 /* NativeSessionTests.swift in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};