Keep Framey store job recoverable without session storage

Test managed shims in actual Decky 3.3.0 runtime

docs/evidence/v0448-release-2026-10-26.md

@@ -0,0 +1,85 @@
+# v0.4.48 release verification and withdrawal, 26 October 2026
+
+The annotated [`v0.4.48` tag](https://github.com/saphid/frame-control/releases/tag/v0.4.48)
+dereferences to main commit `5438e1d9d05ca472f200dcde50799c8ae882fafb`,
+which contains the version bump and [candidate evidence](v0448-candidate-2026-10-26.md).
+The exact-commit [main checks run](https://github.com/saphid/frame-control/actions/runs/40356645911)
+finished successfully: all seven jobs passed, including e2e, iOS, Windows,
+macOS and Linux tests. Its first two attempts had an iOS job stuck in the
+runner queue and were cancelled; attempt 3 ran that job and ended with all
+seven required checks successful. The later documentation-only main commit
+`1ddb6278b8ae0a98ecc79a181bba4d3cc67a52b6` also passed all seven
+[main checks](https://github.com/saphid/frame-control/actions/runs/40406851705).
+
+The exact-tag [release workflow](https://github.com/saphid/frame-control/actions/runs/40406781383)
+finished successfully. Its draft, Linux, Windows, Apple Silicon Mac, Intel
+Mac and checksum jobs all passed; no tagged installer build failed or was
+cancelled. Tagged CI launched the Linux x86_64 AppImage on Xvfb, checked both
+Mac bundles against their runner architecture, installed the Windows Setup
+and compared its installed resources with the unpacked build, and tested its
+packaged Python and native PC libraries.
+
+An earlier [release-PR preview run](https://github.com/saphid/frame-control/actions/runs/40352797572/attempts/1)
+was not a passing gate: its Apple Silicon Mac build was cancelled and its
+checksum job was skipped. [Attempt 2](https://github.com/saphid/frame-control/actions/runs/40352797572/attempts/2)
+completed all four preview installer builds successfully. Publication used the
+separate exact-tag workflow above, whose six jobs all succeeded.
+
+The draft had exactly ten installers and `SHA256SUMS`, each with a GitHub
+SHA-256 digest. An independently downloaded `SHA256SUMS` matched a fresh
+ten-line list generated from GitHub's asset metadata byte for byte. Both
+its downloaded SHA-256 and GitHub's own asset digest were
+`8cf7d8808f0b0b9da08e2590461e83ef557412a0ce2cc780c8e1d02e34ce1a60`.
+Independent downloads on lxso1 matched `SHA256SUMS` for these packages:
+
+| Package | SHA-256 and independent check |
+| --- | --- |
+| Linux x86_64 AppImage | `7c0cbef7c0330c48ecb69f6fcee027a8b45fe84b0458985db31d16b09fc45cbe`; isolated Xvfb launch served HTTP 200 with `FrameControl/1`, then its server stopped. |
+| Linux arm64 DEB | `d3c2cdc4310fc3fed11460ad970a3ff6da8b80a6ec566acf1bcaa5a9570efc3e`; package declares version 0.4.48 and arm64 architecture. |
+| Mac arm64 ZIP | `3c5b0ad0877e4c1e1adbac17a9eb4f1114294a25576330050ac9ce338e0b1c00`; ZIP CRC, bundle version 0.4.48 and main Mach-O arm64 CPU passed. |
+| Mac x64 ZIP | `3bb90246794f0082fd4f34d86113e292ae543671ff8bea4096d888a9273a529c`; ZIP CRC, bundle version 0.4.48 and main Mach-O x86_64 CPU passed. |
+| Windows x64 Setup | `def654c238575778120c6f2a4df1af319b0cd169f64c2fceebe26ddc5e3c68ff`; downloaded file is a PE/Nullsoft installer; tagged Windows CI installed and tested its contents. |
+
+After attaching the final release notes,
+`scripts/publish-release.sh --dry-run v0.4.48` passed the exact tag, ten
+installer digests, checksum asset and update-manifest checks.
+`scripts/publish-release.sh v0.4.48` published the release at
+**21:53:29 UTC**. GitHub's latest-release API read back tag `v0.4.48`,
+`draft=false`, `prerelease=false`, ten installers, `SHA256SUMS` and
+`update.json`. Immediately after publication, a fresh public latest-download
+of `update.json` reported version 0.4.48, the release page, ten hashed
+installers and the worn VR limit in its notes. This is historical evidence,
+not the current update-channel state.
+
+## Withdrawn after a real Decky regression was confirmed
+
+The all-green release gate did not include Music Control's actual Decky 3.3.0
+legacy class calling convention. [PR #338](https://github.com/saphid/frame-control/pull/338)
+reproduced a regression in the #335 digest-scoped Music Control 1.1.7 install
+shim: it removes explicit `self` from calls that the real legacy runtime needs,
+so player discovery fails with `_get_dbus_env() missing 1 required positional
+argument: 'self'`. The earlier fixture had instantiated `Plugin()` and missed
+this behavior. A passing CI run therefore did not prove this plugin path worked.
+
+At **22:01:20 UTC**, v0.4.48 was returned to draft and the previously green
+v0.4.47 was marked latest. The v0.4.48 tag and build artifacts were preserved;
+no tag or installer was deleted. The preserved draft's notes now begin with a
+withdrawal notice. GitHub's latest-release API and a fresh public
+`releases/latest/download/update.json` now both point to **v0.4.47** with ten
+hashed installers. Existing v0.4.48 installations do not auto-downgrade.
+The repair in #338 merged at `04cde721c862c80a18dad17c2aab0c86ca8d3082`.
+It requires green post-merge main checks, a new release candidate and all
+release gates before any replacement version is offered. An app update alone
+does not rewrite the bad installed plugin shim: affected users need an explicit
+managed plugin update or remove/reinstall after the repair ships.
+
+The [candidate smoke](v0448-candidate-2026-10-26.md) on the real Frame passed
+**12 / one optional x86_64 launch skipped / zero failed**. The optional launch
+needed Steam Linux Runtime 4, which was absent; no x86_64 headset launch was
+claimed. Owned test titles and processes were removed, the lock was released,
+and a fresh locked check found standby and no test-title leftovers. A later
+read-only locked check found SteamVR activity 3 (standby), proximity raw
+3.0625 and battery 100%, then released its own lock. No wearer was confirmed,
+so neither the worn-check script nor physical controller input was run.
+Official-plugin wearer visibility, controller use, VR keyboard, optical comfort
+and physical launch of these exact Mac/Windows installers remain unverified.

docs/framey-loader.md

@@ -204,6 +204,10 @@ browser session, so **Check result** can resume polling after a navigation or
 temporary connection error. After a polling error, Install, Update, and Remove
 stay disabled while the saved job's result is unknown; use **Check result**
 before starting another change.
+If Chromium denies session storage, the open panel keeps the accepted job ID in
+memory and **Check result** still works after a connection error. A page reload
+loses that memory fallback; wait for the old job to finish and refresh installed
+status before starting another change.
 Refresh the installed list before starting another
 operation after an error. The headset panel and desktop app send the hash of
 the version you saw; if the official store changes that version before the job

tests/page/framey_store.mjs

@@ -244,3 +244,46 @@ vm.runInContext('api=mockApi',ctx);
 await vm.runInContext('refreshDecky()',ctx);
 assert.equal(el('frameyPanel').hidden,true);
 assert.match(el('deckyState').textContent,/panel was closed until status can be refreshed/);
+
+// A denied sessionStorage must not lose an accepted job in the current panel.
+// Keep Update/Remove disabled after a polling outage and allow Check result.
+for(const method of ['getItem','setItem','removeItem'])
+  ctx.sessionStorage[method]=()=>{throw Error('storage denied');};
+let accepted=0;
+ctx.mockApi=async path => {
+  if(path==='/api/decky/plugin'){accepted++;return {job:'memory-job'};}
+  if(path.startsWith('/api/job'))throw Error('connection lost');
+  if(path==='/api/decky')return {managed:true,running:true,
+    plugins:[{storeId:2,name:'Plugin 2',version:'1.0'}]};
+  throw Error(`unexpected ${path}`);
+};
+vm.runInContext('api=mockApi;deckyState={managed:true,running:true,plugins:[]};' +
+  'deckyStore=[{id:2,name:"Plugin 2",version:"1.0",description:"A panel",root:false}];showDeckyStore()',ctx);
+await vm.runInContext('deckyChange("install",{id:2,name:"Plugin 2",sha256:"a".repeat(64)})',ctx);
+assert.equal(accepted,1);
+assert.equal(vm.runInContext('deckyJobPending()',ctx),true);
+assert.equal(el('deckyJobCheck').hidden,false);
+assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,true);
+await vm.runInContext('deckyChange("remove",{id:2,name:"Plugin 2"})',ctx);
+assert.equal(accepted,1);
+ctx.mockApi=async path => {
+  if(path.startsWith('/api/job'))return {done:true,message:'Installed Plugin 2'};
+  if(path==='/api/decky')return {managed:true,running:true,
+    plugins:[{storeId:2,name:'Plugin 2',version:'1.0'}]};
+  throw Error(`unexpected ${path}`);
+};
+vm.runInContext('api=mockApi',ctx);
+await vm.runInContext('checkDeckyJob()',ctx);
+assert.equal(vm.runInContext('deckyJobPending()',ctx),false);
+assert.equal(el('deckyJobCheck').hidden,true);
+assert.equal(el('deckyInstalled').children[0].children.find(child=>child.textContent==='Remove').disabled,false);
+
+// Opening the headset panel with a key in its URL must survive denied storage.
+const deniedDocument={getElementById:id=>new Element(id),createElement:()=>new Element()};
+const deniedBoot=vm.createContext({document:deniedDocument,
+  location:{hash:'#private-key',pathname:'/'},history:{replaceState(){}},
+  sessionStorage:{getItem(){throw Error('storage denied');},setItem(){throw Error('storage denied');}},
+  window:{addEventListener(){}},setInterval(){},setTimeout(){},confirm:()=>true,console,
+  fetch(){throw Error('No network expected');}});
+vm.runInContext(script,deniedBoot);
+assert.equal(vm.runInContext('key',deniedBoot),'private-key');

tests/test_frame_android_library.py

@@ -276,12 +276,29 @@ class ArtworkTests(unittest.TestCase):
         import threading
         from apk_sources import _images
         gate = threading.Event()
-        with patch.object(_images.socket, 'getaddrinfo', side_effect=lambda *a, **k: gate.wait(5) and []):
-            start = time.monotonic()
-            with self.assertRaisesRegex(_images.SourceError, 'too long'):
-                _images.get('https://example.org/a.png', deadline=start + 0.1)
-            self.assertLess(time.monotonic() - start, 0.4)
-        gate.set()
+        real_join = threading.Thread.join
+        waits = []
+
+        def bounded_join(worker, timeout=None):
+            waits.append(timeout)
+            return real_join(worker, timeout)
+
+        try:
+            with patch.object(_images.socket, 'getaddrinfo', side_effect=lambda *a, **k: gate.wait(5) and []), \
+                    patch.object(_images.threading.Thread, 'join', bounded_join):
+                start = time.monotonic()
+                deadline = start + 0.1
+                with self.assertRaisesRegex(_images.SourceError, 'too long'):
+                    _images.get('https://example.org/a.png', deadline=deadline)
+            # Check the requested wait, not elapsed runner time: a loaded CI
+            # host can deschedule this test after the bounded join returns.
+            self.assertEqual(len(waits), 1)
+            self.assertIsNotNone(waits[0])
+            self.assertGreaterEqual(waits[0], 0)
+            self.assertLessEqual(waits[0], deadline - start)
+        finally:
+            gate.set()
+        wait_for_idle_resolvers()
         with self.assertRaisesRegex(_images.SourceError, 'too long'):
             _images.get('https://example.org/a.png', deadline=time.monotonic() - 1)
 

ui/headset.html

@@ -64,8 +64,8 @@ iframe{display:block;width:100%;height:560px;background:#0d1925;border:1px solid
 <div id="extensionPanel" hidden><div class="row" style="margin-top:16px"><strong id="extensionTitle"></strong><button id="extensionClose" class="secondary">Close extension</button></div>
   <iframe id="extensionFrame" title="Frame Control extension" sandbox="allow-scripts" referrerpolicy="no-referrer"></iframe></div>
 <script>
-const key=location.hash.slice(1)||sessionStorage.getItem('frameHeadsetKey')||'';
-if(key)sessionStorage.setItem('frameHeadsetKey',key);
+const key=location.hash.slice(1)||(()=>{try{return sessionStorage.getItem('frameHeadsetKey')||'';}catch(_){return '';}})();
+if(key)try{sessionStorage.setItem('frameHeadsetKey',key);}catch(_){}
 history.replaceState(null,'',location.pathname);
 const byId=id=>document.getElementById(id);
 let latestStatus=null, activeExtension=null, recordBusy=false;
@@ -106,7 +106,23 @@ async function refreshGames(){const list=byId('games');try{const data=await api(
     row.append(name,quit);list.append(row);}if(!data.running.length)list.textContent='No games are running.';
   }catch(error){list.textContent=error.message;}}
 function compatibilityText(plugin){const c=plugin.compatibility;return c ? `${c.status === 'na' ? 'N/A' : c.status}: ${c.reason}${c.verification?.length ? ' Verified: '+c.verification.join(', ')+'.' : ''}` : 'Unverified on Frame';}
-function deckyJobPending(){return !!sessionStorage.getItem('frameyPluginJob');}
+// Some Chromium profiles deny sessionStorage. Keep the accepted job ID in
+// memory so this open panel can still reconnect instead of offering a second
+// install while the first one may be running.
+let deckyPendingJob=null;
+function savedDeckyJob(){
+  if(deckyPendingJob)return deckyPendingJob;
+  try{return JSON.parse(sessionStorage.getItem('frameyPluginJob')||'null');}catch(_){return null;}
+}
+function rememberDeckyJob(job){
+  deckyPendingJob=job;
+  try{sessionStorage.setItem('frameyPluginJob',JSON.stringify(job));}catch(_){}
+}
+function clearDeckyJob(){
+  deckyPendingJob=null;
+  try{sessionStorage.removeItem('frameyPluginJob');}catch(_){}
+}
+function deckyJobPending(){return !!savedDeckyJob();}
 let deckyState=null, deckyStore=[], deckyStoreIndex=0, deckyStoreRequest=0,
   deckyStatusRequest=0,
   activeFrameyId=null, activeFrameyReceipt=null, frameySession=null, deckyBusy=false;
@@ -174,7 +190,7 @@ function deckyJobView(title,message,percent,failed=false){
   byId('deckyJobPanel').hidden=false;byId('deckyJobTitle').textContent=title;
   byId('deckyJobStatus').textContent=message;
   const bar=byId('deckyJobProgress');if(Number.isFinite(percent))bar.value=percent;else bar.removeAttribute('value');
-  byId('deckyJobCheck').hidden=!failed||!sessionStorage.getItem('frameyPluginJob');
+  byId('deckyJobCheck').hidden=!failed||!deckyJobPending();
 }
 async function followDeckyJob(job,action,name){
   for(let n=0;n<180;n++){
@@ -182,12 +198,12 @@ async function followDeckyJob(job,action,name){
     try{progress=await api(`/api/job?id=${encodeURIComponent(job)}`);}
     catch(error){
       if(/no such job/i.test(error.message)){
-        sessionStorage.removeItem('frameyPluginJob');
+        clearDeckyJob();
         throw Error('The app restarted and lost this job result. Refresh installed plugins to see what changed.');
       }
       throw error;
     }
-    if(progress.done){if(progress.error){sessionStorage.removeItem('frameyPluginJob');throw Error(progress.error);}
+    if(progress.done){if(progress.error){clearDeckyJob();throw Error(progress.error);}
       deckyJobView(`${action} ${name}`,progress.message||`${action} complete`,100);return;}
     deckyJobView(`${action} ${name}`,progress.stage||'Waiting for Frame…',progress.percent);
     await new Promise(resolve=>setTimeout(resolve,1000));
@@ -210,18 +226,18 @@ async function deckyChange(action,plugin){if(deckyBusy)return;
   try{const started=await api('/api/decky/plugin',{action,id:plugin.id,
     sha256:action==='remove'?undefined:plugin.sha256,acknowledged:true});
     if(!started.job)throw Error('The server did not return a job ID');
-    sessionStorage.setItem('frameyPluginJob',JSON.stringify({job:started.job,action,name:plugin.name}));
+    rememberDeckyJob({job:started.job,action,name:plugin.name});
     await followDeckyJob(started.job,action,plugin.name);
-    sessionStorage.removeItem('frameyPluginJob');
+    clearDeckyJob();
     if(panelNote)byId('deckyJobStatus').textContent+=panelNote;
   }catch(error){deckyJobView(`${action} ${plugin.name}`,`Error: ${error.message}${panelNote}`,null,true);}
   finally{deckyBusy=false;await refreshDecky();}
 }
-async function checkDeckyJob(){let saved;try{saved=JSON.parse(sessionStorage.getItem('frameyPluginJob')||'null');}catch(_){saved=null;}
+async function checkDeckyJob(){const saved=savedDeckyJob();
   if(deckyBusy)return;
-  if(!saved||typeof saved.job!=='string'){sessionStorage.removeItem('frameyPluginJob');showDeckyStore();return;}
+  if(!saved||typeof saved.job!=='string'){clearDeckyJob();showDeckyStore();return;}
   deckyBusy=true;byId('deckyJobCheck').hidden=true;
-  try{await followDeckyJob(saved.job,saved.action,saved.name);sessionStorage.removeItem('frameyPluginJob');}
+  try{await followDeckyJob(saved.job,saved.action,saved.name);clearDeckyJob();}
   catch(error){deckyJobView(`${saved.action} ${saved.name}`,`Error: ${error.message}`,null,true);}
   finally{deckyBusy=false;await refreshDecky();}}
 byId('deckyJobCheck').onclick=checkDeckyJob;