Record v0.4.45 release verification

docs/evidence/v0445-release-2026-10-26.md

@@ -0,0 +1,61 @@
+# v0.4.45 tagged release, 26 October 2026
+
+The annotated `v0.4.45` tag dereferences to main merge commit
+`212f0af35c86eb651d5d23bfe0b1e6bf50c528b8` from PR #320. The app and
+lockfile both report 0.4.45. [Post-merge main checks](https://github.com/saphid/frame-control/actions/runs/40309949732)
+passed all seven jobs, including iOS and fake Frame end-to-end tests. The
+[tagged release workflow](https://github.com/saphid/frame-control/actions/runs/40310897979)
+passed its draft, Linux, Windows, Apple Silicon Mac, Intel Mac and checksum
+jobs. The tagged Linux builder launched its AppImage under isolated Xvfb;
+that does not verify a physical display, FUSE mount or headset connection.
+
+## Frame and package gates
+
+The [candidate evidence](v0445-candidate-2026-10-26.md) records two
+shared-lock real Frame smokes: one on the combined main code and one after
+the 0.4.45 version bump. Each finished **12 passed / 1 optional x86 launch
+skipped / 0 failed**, with owned cleanup and lock release. The optional
+x86_64 launch was skipped because Steam Linux Runtime 4 is absent. The
+candidate also records the unworn sample Framey exercise on the combined
+code. Synthetic OpenVR input, setting persistence and scroll-button
+movement passed; native synthetic wheel scrolling did not. The only change
+after the version-bumped smoke was its evidence paragraph.
+
+The draft had ten installers plus `SHA256SUMS`, each with a GitHub SHA-256
+digest. A fresh downloaded checksum list contained exactly those ten names
+and matching digests; its bytes matched GitHub's digest
+`d1d84f03c09881417610337cc48f0025535c8b0d227d55147f1f2b99592625fb`.
+`scripts/publish-release.sh --dry-run v0.4.45` passed the exact remote tag,
+installer and checksum gates after the release notes were attached.
+
+Freshly downloaded packages passed these independent checks:
+
+| Package | Result |
+| --- | --- |
+| Linux x86_64 AppImage | SHA-256 `478ea6535979f049930351d5c0abba14e3bcc4bcb5e695ee7ee945a5fd5bf72f`; launched under isolated Xvfb, bundled server returned HTTP 200 with `FrameControl/1`, and stopped on exit. |
+| Mac arm64 ZIP | SHA-256 `0204b445bc35596170d85f7a1e05e793f1c1b247f3129fadad6f8c92730cf3e2`; ZIP CRC valid, bundle version 0.4.45, main Mach-O CPU arm64. |
+| Mac x64 ZIP | SHA-256 `88ded8bc492501f467a9c51156661f3a25b0dc6347660caf0d2e230bda0f984e`; ZIP CRC valid, bundle version 0.4.45, main Mach-O CPU x86_64. |
+| Windows x64 Setup | SHA-256 `c512d322b2022a233ed26aaa03e038b9a735a2df654ec7a3ebefc1ba86b04334`; PE/Nullsoft installer format. The tagged Windows CI also checked its packaged files and Python libraries. |
+| Linux arm64 DEB | SHA-256 `d08cc96dd18b1a602bd0af33a8e6d1f380d94195aec0f83b2898098956aeedc3`; package version 0.4.45 and architecture arm64. |
+
+Tagged Mac and Windows packages were not launched on physical machines in
+this release gate. Earlier Intel Mac acceptance covers older bytes.
+
+## Publication and limits
+
+`scripts/publish-release.sh v0.4.45` published
+[v0.4.45](https://github.com/saphid/frame-control/releases/tag/v0.4.45) at
+2026-10-26 11:02:08 UTC. GitHub's latest-release API returned
+`draft=false`, `prerelease=false`, the expected tag, ten installers,
+`SHA256SUMS` and `update.json`. A fresh public latest-download of
+`update.json` reported version 0.4.45, the stable release page, ten hashed
+assets and the worn-VR limits in its notes.
+
+The official exact-version Decky catalog remains **4 works / 49 partial /
+52 broken / 11 N/A** out of 116. AlarMe's tested silent timer, preset and
+stopwatch workflows do not establish its audio, reminders, sleep controls,
+closed-panel notifications or VR panel. The real Frame exercise used the
+repository sample, not an official plugin. No wearer confirmation was
+available. Physical controller use, optical readability, official-plugin
+VR rendering, audible output and the VR keyboard remain unverified. The
+hourly shared-lock worn-check schedule stays enabled.