Fix Simple Timer cancellation and backend restarts

docs/evidence/framey-simple-timer-2026-10-26.json

@@ -0,0 +1,119 @@
+{
+  "timeUtc": "2026-10-26T23:23:16.239735+00:00",
+  "plugin": {
+    "id": 96,
+    "version": "1.0.0",
+    "sha256": "973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312"
+  },
+  "scope": "Silent private timer settings/events only; local Chromium with actual Frame ARM64 backend. No sound, physical power actions or worn VR.",
+  "runtime": {
+    "version": "v3.3.0",
+    "sha256": "8ef5dcf36cbbbb6e97201a6baed5d79c4cc44ec27789fc9af1c5b6ae8f0b25b6"
+  },
+  "realFrameLifecycle": {
+    "lifecycle": {
+      "freshCancel": true,
+      "replacementSuppressesOldCompletion": true,
+      "completionClearsEnd": true,
+      "activeRestartPreservesDeadlineAndRecents": true,
+      "canceledRestartIdle": true,
+      "expiredRestartIdle": true
+    },
+    "actualDecky330": true
+  },
+  "browser": {
+    "uiBegin300": true,
+    "uiCancel": true,
+    "liveCountdown": true,
+    "completionToast": true,
+    "subtleMode": true
+  },
+  "iframeSandbox": "allow-scripts allow-popups; no allow-same-origin",
+  "isolatedNativeAmd64": [
+    {
+      "discovered": [
+        {
+          "name": "Simple Timer",
+          "version": "1.0.0",
+          "load_type": 1,
+          "disabled": false
+        }
+      ],
+      "lifecycle": {
+        "freshCancel": true,
+        "replacementSuppressesOldCompletion": true,
+        "completionClearsEnd": true,
+        "lateExpiryEmitsWithoutSelfCancel": true,
+        "activeRestartPreservesDeadlineAndRecents": true,
+        "canceledRestartIdle": true,
+        "expiredRestartIdle": true
+      },
+      "result": "discovery, cancel, replace, completion and persistent restart passed"
+    },
+    {
+      "discovered": [
+        {
+          "name": "Simple Timer",
+          "version": "1.0.0",
+          "load_type": 1,
+          "disabled": false
+        }
+      ],
+      "lifecycle": {
+        "freshCancelError": {
+          "type": -1,
+          "id": 2,
+          "error": {
+            "name": "Exception",
+            "message": "'Plugin' object has no attribute 'timer_task'",
+            "traceback": "Traceback (most recent call last):\n  File \"decky_loader/wsrouter.py\", line 70, in _call_route\n  File \"decky_loader/loader.py\", line 232, in handle_plugin_method_call\n  File \"decky_loader/loader.py\", line 229, in handle_plugin_method_call\n  File \"decky_loader/plugin/plugin.py\", line 137, in execute_method\n  File \"decky_loader/plugin/messages.py\", line 44, in wait_for_result\nException: 'Plugin' object has no attribute 'timer_task'\n"
+          }
+        },
+        "cancelRetainsEnd": true,
+        "replacedTimerStillFires": true,
+        "expiredRestartError": true
+      },
+      "result": "upstream timer lifecycle regressions reproduced"
+    }
+  ],
+  "fakeFrame": "Pinned official archive installed and removed through real HTTP/SSH harness; backend execution stubbed.",
+  "before": {
+    "arch": "aarch64",
+    "decky": "failed",
+    "panel": "inactive",
+    "battery": [
+      99
+    ]
+  },
+  "after": {
+    "arch": "aarch64",
+    "decky": "failed",
+    "panel": "inactive",
+    "battery": [
+      99
+    ]
+  },
+  "cleanup": {
+    "baseAbsent": true,
+    "unitAbsent": true,
+    "sharedLockAbsent": true,
+    "service": "MainPID=0\nLoadState=not-found\nActiveState=inactive",
+    "testProcesses": []
+  },
+  "lockReleased": true,
+  "limits": [
+    "Sound and suspend unsupported",
+    "No alert delivery while Framey panel is closed",
+    "Worn VR, controller and keyboard unverified",
+    "UI recents after asynchronous reopen not asserted; persisted recents verified through actual backend restart"
+  ],
+  "localValidation": {
+    "pythonTestsRun": 1648,
+    "pythonSkipped": 16,
+    "pythonResult": "OK",
+    "actualDeckyNativeAmd64Cases": 6,
+    "fakeFramePinnedInstallRemove": "PASS",
+    "officialStoreEntriesRefreshed": 116,
+    "officialStoreDigestsChanged": 0
+  }
+}

docs/evidence/framey-simple-timer-2026-10-26.md

@@ -0,0 +1,58 @@
+# Simple Timer lifecycle on Frame
+
+The exact official Simple Timer 1.0.0 archive (store ID 96, SHA-256
+`973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312`)
+now qualifies as **works for silent in-panel session timers** after a managed
+update/reinstall. The upstream BSD license and API1 manifest remain unchanged.
+[Redacted observations](framey-simple-timer-2026-10-26.json) accompany this report.
+
+## Reproduced failures and repair
+
+The unmodified archive, discovered and called by the actual published Decky
+3.3.0 loader, fails cancel before its first timer and expired-deadline startup
+with an annotation-only `timer_task` attribute. Cancel leaves `timer_end` saved,
+so canceled timers resume after restart. Starting a replacement leaves the first
+task alive; it still sends its own completion event.
+
+The managed installer repairs only this exact ID/digest/folder. Lifecycle state
+is initialized before startup cancellation. A lock and cancellation/join give one
+task ownership of the timer. Explicit cancel and completion clear the persisted
+deadline. Backend unload stops the task while preserving an active deadline;
+startup resumes that exact deadline without duplicating recent timers. Late
+expiry emits its silent notice without canceling itself midway. Older installed
+copies remain partial until their receipt includes `simple-timer-lifecycle`.
+
+## Verification
+
+- **Actual published Decky 3.3.0, isolated native amd64:** production managed
+  install, API1 discovery and public instance RPC/events; fresh cancel,
+  replacement suppression, one completion, clearing persisted end, active
+  restart preserving deadline/recents, canceled restart and expired restart.
+  A separate unmodified-archive case must reproduce the original failures.
+  The same gate runs on native ARM64 CI; this report does not preclaim its result.
+- **Real Frame ARM64, Frame OS 0.5.6:** the same lifecycle assertions through
+  Steam CEF's existing `DeckyBackend`, with a bounded private Decky 3.3.0 user
+  service and private settings. No plugin class was manually instantiated.
+- **Local Chromium:** actual headset host and official frontend in a sandbox
+  without `allow-same-origin`; method/event bridge relayed to that real ARM64
+  backend. Begin created a 300-second timer; Cancel returned to idle. A safe
+  five-second backend timer updated the panel and produced the visible silent
+  completion toast. Backend tests verify persisted recents across restart;
+  asynchronous UI recents after reopen were not asserted.
+- **Fake Frame:** exact pinned archive installed and removed through the real
+  HTTP/SSH store harness; execution is stubbed, so this verifies packaging only.
+
+Only private settings and silent timers changed. The shared `/tmp/frame-test.lock`
+was held for execution and then released. Successful run battery was 99 → 99;
+normal Decky remained failed and the headset panel remained inactive as found.
+An independent audit confirmed the private base/unit/archive absent, MainPID 0,
+unit not found and no test client processes. Job-owned CEF event listeners and
+private Chromium were removed. Two earlier test-client attempts were cleaned up:
+one competed with Steam's single Decky websocket; the other lacked a bounded
+quiet-event wait. Battery across those attempts was 100 → 99. These were test
+adapter failures; the final run used CEF and passed.
+
+Sound and suspend are unsupported. Alerts require the plugin panel to remain
+open. Worn VR, physical controller/keyboard and sleep/wake notification delivery
+remain unverified. A resumed timer is persisted backend behavior, not a promise
+of notification delivery while the panel is closed.

docs/evidence/v0449-release-2026-10-26.md

@@ -1,59 +0,0 @@
-# v0.4.49 tagged release verification, 26 October 2026
-
-The annotated `v0.4.49` tag dereferences to merged main commit
-`38db6a284696c3bb86bf97f6b853af7e97681701`. This is the same tree as
-the reviewed [candidate PR #348](https://github.com/saphid/frame-control/pull/348).
-Its [main checks run](https://github.com/saphid/frame-control/actions/runs/40417275314)
-passed all seven jobs, including e2e, iOS, macOS, Windows and Linux.
-The [native Decky 3.3.0 run](https://github.com/saphid/frame-control/actions/runs/40417275256)
-passed on AMD64 and ARM64. The regression gate includes an expected failure
-for v0.4.48's bad legacy calling convention.
-
-The exact-tag [release workflow](https://github.com/saphid/frame-control/actions/runs/40418177330)
-passed all six jobs on its first attempt: draft, Linux, Windows, Apple Silicon
-Mac, Intel Mac, and checksums. No tagged build failed, was cancelled, or was
-skipped. The draft contained exactly ten installers and `SHA256SUMS` before
-publication. Every asset had a GitHub SHA-256 digest. A fresh download of
-`SHA256SUMS` had SHA-256
-`8a04f81f3b1efea9903e9acbba2c61b67f275869c160e0c6fa1d388a4803b42a`;
-it matched a list regenerated from the ten GitHub installer digests byte for
-byte. All ten installers were independently downloaded and passed
-`sha256sum -c SHA256SUMS`.
-
-## Independent package checks
-
-| Package | Check |
-| --- | --- |
-| Linux x86_64 AppImage | SHA-256 `0ef192e6f13aed39469392c22b971b311d911a0bebae16cbbabbfa729b95ced0`; isolated Xvfb launch returned HTTP 200 with `FrameControl/1`, then its server stopped. The first local launch attempt hit the workspace sandbox's `Operation not permitted` restriction; the same downloaded bytes passed outside that sandbox. Tagged Linux CI also launched the AppImage. |
-| Linux arm64 DEB | SHA-256 `a8e448b8b8f10b2813546cb9d8fea6bbe424e14dc3a739df86daa69bfd4023c1`; declares version 0.4.49 and arm64. |
-| Linux amd64 DEB | SHA-256 `10bb554cc761c61c99d059ae3601f4889187d7f18bdc8f9eb3cf768822b5765d`; declares version 0.4.49 and amd64. |
-| Mac arm64 ZIP | SHA-256 `c43c1017b3d244fcf59ab8f5bd35dbad17af4562b2aca3baf65908814f2ae4c3`; ZIP CRC, bundle version 0.4.49 and main Mach-O arm64 CPU passed. |
-| Mac x64 ZIP | SHA-256 `0dd838a1322107928893ff5efce817719867a5db1af2fa09124b6bb03018a19d`; ZIP CRC, bundle version 0.4.49 and main Mach-O x86_64 CPU passed. |
-| Windows x64 Setup | SHA-256 `386d99fd15314e1caef577f7cdf21e9e9f572d1c0dbaa65c369e5a5b0c047d31`; downloaded file is a PE/Nullsoft installer. Tagged Windows CI installed it and checked its packaged resources and Python libraries. |
-| Windows x64 ZIP | SHA-256 `2c201a8d1115dd1a07ba7b9293f7e05c319bd802f574a4b2f9565268a7f5cf8b`; ZIP CRC passed. |
-
-The remaining three packages (both Mac DMGs and the ARM64 AppImage) also
-matched `SHA256SUMS`; tagged CI built and checked their platform bundles.
-Physical launch of these exact Mac and Windows installers was not performed.
-
-## Publication and real Frame scope
-
-The [candidate evidence](v0449-candidate-2026-10-26.md) records a unique-lock
-real Frame smoke on the version-bumped source: **12 passed, one optional
-x86_64 launch skipped, zero failed**, followed by an independent locked audit
-with no test-title folders or processes. The optional runtime was absent; no
-x86_64 launch is claimed. SteamVR stayed in standby, no wearer was confirmed,
-and neither a worn test nor physical controller check was run.
-
-`scripts/publish-release.sh --dry-run v0.4.49` passed the exact main, native
-Decky and tagged release job gates, ten installer hashes, regenerated
-`SHA256SUMS`, draft notes and update manifest. The real publisher repeated
-those gates, attached `update.json`, and published
-[v0.4.49](https://github.com/saphid/frame-control/releases/tag/v0.4.49) at
-**23:25:45 UTC**. GitHub's latest-release API returned `draft=false`,
-`prerelease=false`, ten installers, `SHA256SUMS` and `update.json`. A fresh
-public latest-download of `update.json` reported version 0.4.49, the correct
-page, ten hashed assets, the v0.4.48 repair note and the worn-VR limit.
-The v0.4.48 release remains a withdrawn draft; its notice points to v0.4.49.
-Existing v0.4.48 installations do not auto-downgrade, and affected installed
-Music Control plugins need managed Update or Remove and reinstall.

docs/frame-plugin-author.md

@@ -74,13 +74,10 @@ none of these frontend controls has passed a worn-headset check yet.
 | API v1/v2 `addEventListener` / `removeEventListener` | Plugin-scoped real backend events while panel is open; bounded queue, about one-second polling, subscription expiry | Real ARM64 Simple Timer countdown, start/cancel and completion toast via local Chromium; scope/bounds/reconnect tests. No closed-panel notifications. |
 | `toaster.toast` | Visible toast inside the plugin panel; plain text or React nodes for title, body, icon, logo and subtext; `dismiss` and optional `onClick` | Host unit test; no Steam system notification or worn VR check |
 | `localStorage` | Synchronous, per-plugin cache backed by the Frame Control panel origin. Up to 64 keys, 64 KiB per value and 128 KiB total; `clear()` removes only this plugin's cache. Falls back to memory if panel storage is denied. | Parent/iframe round-trip and reopen in the local host test; real headset persistence remains unverified. |
-| `SteamClient.Storage.GetJSON` / `SetObject` | Uses the same bounded per-plugin cache; a missing key rejects with `Not found`. It cannot read Steam account or global storage. | Host contract tests and local Chromium settings views; headset persistence after reopen remains unverified. |
 | IndexedDB / localForage | IndexedDB is deliberately absent inside the opaque iframe so feature detection chooses the bounded localStorage driver. Plugins requiring IndexedDB directly remain unsupported. | HLTB official frontend in local Chromium: its previous `IDBFactory.open` SecurityError disappeared. No live HLTB data request was run. |
 | `routerHook.addRoute` / `removeRoute`, `Navigation.Navigate` / `NavigateBack`, `useParams` | Local routes inside this plugin panel, with named segments such as `/plugin/game/:appid/:view?`; `useParams()` reads the current segment values | Host unit test; VR navigation unverified |
 | `routerHook.addPatch`, global components | No-op; cannot patch Steam routes | Not applicable |
-| `findModule`, `findModuleChild`, `findModuleExport`, class lookup and module mapping | Searches a finite registry of Framey controls and CSS maps. Unknown Steam modules return `undefined` or an empty mapping. The optional UI-audio export cannot play sound. | Host contract tests; pinned TabMaster 2.15.1 QAM and documentation render in local Chromium. Steam library editing and worn VR remain unverified. |
-| `Navigation.CloseSideMenus` | Returns to this plugin's main panel | Pinned HLTB for Deck 2.0.12 shallow settings view in local host test. Live HLTB search remains unverified. |
-| `Focusable.onActivate`, `showModal`, `ConfirmModal` | Pointer and Enter/Space activation, disabled state, and local confirmation dialogs with cancel/close and nested-dialog focus | Host tests and official AlarMe 1.6.3 timer/preset controls with a real ARM64 backend in local Chromium. Sound, suspend and worn VR remain unverified. |
+| `findModuleChild`, `Navigation.CloseSideMenus` | Steam module lookup returns `null`; close returns to this plugin's main panel | Pinned HLTB for Deck 2.0.12 entry point and shallow settings view in local host test. Steam library patch and live HLTB search remain unverified. |
 | Steam library/store patches, CEF tab injection | Unavailable; no matching target in the isolated panel | Frame CEF inspection |
 | `fetchNoCors`, file picker, root calls | Unavailable | Not supported by Framey |
 
@@ -91,17 +88,6 @@ Optional route segments must be at the end. Framey accepts local path segments
 only; query strings, external URLs, Steam library routes and duplicate parameter
 names are rejected. Removing an active route returns to the plugin panel.
 Toasts stay inside the panel, so keep essential errors in the plugin UI too.
-Treat module lookup results as Framey-local exports. Do not depend on Steam
-webpack IDs, function-source signatures, or Steam-only CSS class names; a
-lookup that works in the Steam Deck QAM can still return `undefined` here.
-Use a local control or a visible unsupported message when it does. For a
-confirmation, call `showModal` with a `ConfirmModal` and keep any irreversible
-operation behind its OK action. `Focusable.onActivate` accepts pointer and
-Enter/Space input in Framey, but only a worn-headset test can establish how a
-physical controller reaches it. See the
-[module lookup evidence](evidence/framey-module-lookup-2026-10-26.md) and
-[dialog control evidence](evidence/framey-dialog-controls-2026-10-26.md) for
-the exact tested official versions.
 An API v1 manifest does not guarantee a working Framey panel. Test the exact
 store archive and do not assume SteamClient app details, library patches, or
 destructive actions work in VR. The

docs/framey-compatibility.md

@@ -4,7 +4,7 @@ Snapshot: 2026-10-26T06:10:58.537029+00:00; 116 current visible official plugins
 
 This table and both store views use [`ui/framey-compatibility.json`](../ui/framey-compatibility.json). Results apply only to the exact store ID, version and SHA-256. A changed digest/version is **unverified**. Regenerate this document with `python3 scripts/framey-compatibility-doc.py`; use `--check` in review.
 
-**Works: 4 · Partial: 52 · Broken: 49 · N/A: 11.**
+**Works: 5 · Partial: 51 · Broken: 49 · N/A: 11.**
 
 - **Works** requires verified useful plugin behavior with its real backend. Read the reason for the verified scope and remaining limits; it does not imply worn-VR verification.
 - **Partial** means only a subset or a local fixture scope was verified, often just frontend/settings initialization. The remaining backend/device functionality is unverified; read the reason for the exact scope.
@@ -29,7 +29,7 @@ A [Free Loader duplicate-entry follow-up](evidence/framey-free-loader-duplicates
 
 The current published digests are pinned in the JSON; if the store changed, retain/download those exact archives for reproduction. Audit downloads permit larger ZIPs for inspection; production installer limits remain 50 MiB ZIP / 150 MiB unpacked / 30 MiB per member.
 
-After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. Simple Timer remains partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSS, the optional Line truncated
+After the VR job released the shared lock, this audit acquired it and used a private temporary Decky 3.3.0 ARM64 user service. Read-only ProtonDB `get_setting` and Steam Status `get_settings` calls succeeded through the live Steam CEF websocket. The service and private base were removed and the lock released; normal managed services stayed inactive, battery was 100 → 99, and no power setting was changed. [Redacted results](evidence/framey-official-backend-2026-10-25.json) record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, countdown/completion events, a visible toast and persisted recents/subtle mode. Only private test settings were written. That initial pass left Simple Timer partial because its own expired-timer startup raises a missing `timer_task` error; sound/suspend are unsupported. A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, independent server readbacks and Mixer filter persistence across a runtime restart passed. An [ARM64 audio follow-up](evidence/framey-audio-arm64-2026-10-26.md) verified the unmodified official backends in actual Decky 3.3.0 on the Frame user audio session. Volume Mixer and Mixer now qualify as works for per-app volume: Chromium controls changed only a named silent stream, with independent Pulse readbacks. That run left Volume Boost partial because sink writes were denied. A [Volume Boost follow-up](evidence/framey-volume-boost-arm64-2026-10-26.md) now verifies linked/separate channel controls, re-link and reopen through the actual ARM64 backend. Independent Pulse reads confirmed 125%/150% gain writes while the default sink stayed muted; exact original volume/mute was restored. Volume Boost qualifies as works for sink controls. Audible output, Bluetooth playback and worn VR remain unverified. A [running-context follow-up](evidence/framey-running-context-2026-10-26.md) supplies detached running-app/main-app reads and relays actual Steam lifetime callbacks while a panel is open. Real Frame checks verified an empty list, registration/cleanup and the exact Discord Status ARM64 backend reporting no IPC connection. Nonempty games and transitions were synthetic fixtures; real game events, Discord activity and worn VR remain unverified. Discord Status moves to partial; no new works claim is made. A [library context follow-up](evidence/framey-library-context-2026-10-26.md) read 1,106 app overviews, 895 game IDs and the current public Steam ID from real Frame CEF under the shared lock. Local Chromium replayed this detached snapshot to render Deck Settings game selection, Steamback's empty save panel and PlayTime statistics/settings. Steamback and PlayTime used actual Decky 3.3.0 amd64 backends in an isolated container; their ARM64 backends and automatic game hooks remain unverified. Shotty's frontend now starts, but its published backend fails on missing `click`; it stays broken. A [chunked frontend follow-up](evidence/framey-deck-shelves-browser-2026-10-26.md) loaded Deck Shelves 2.0.0 through a managed JavaScript module route and rendered its settings in an opaque local Chromium panel. Its backend was denied; Steam Home shelves and worn VR remain unverified. A [local module lookup follow-up](evidence/framey-module-lookup-2026-10-26.md) supplies a finite registry of Framey-local controls and CSS. TabMaster QAM/docs now render; Steam library-tab editing remains unavailable. That pass exposed Junk-Store executable-script extraction failures; the follow-up below repairs them. SteamGridDB still requires Steam context-menu internals and DeckSP still fails its published MobX fallback. That pass tested TabMaster/Junk-Store in actual isolated amd64 Decky, without ARM64 or worn-VR coverage. A [script entrypoint follow-up](evidence/framey-script-entrypoints-2026-10-26.md) grants owner execute to shebang scripts and ZIP-declared executables without copying archive privilege/write bits. Junk-Store now passes static menu/backend calls in actual Decky 3.3.0 ARM64 and local Chromium Games/Epic navigation, back and reopen. It moves to partial: About still crashes on missing installed-app metadata, Legendary is absent, and login/game operations remain unverified. Existing installations require update/reinstall to repair permissions. A [read-only installed-metadata follow-up](evidence/framey-installed-context-2026-10-26.md) now repairs the About crash. The library snapshot copies only Steam-supplied installed booleans into detached metadata, preserving unknown values as undefined. Junk-Store About/Dependencies, Back and reopen render in local Chromium with actual Frame library data and the official ARM64 backend. It remains partial: dependency/login/game operations, RSSLine truncated
 
 ## Every current plugin
 
@@ -104,7 +104,7 @@ The API column shows manifest / actual bundled frontend API. Many manifests say
 | 93: Deck Settings 1.2.6 | 1 / 2 | partial | Game picker renders with detached real Frame library/install-folder reads; search modal opens in local Chromium. Snapshot refreshes on panel reopen. Remote reports/proxy fetch, settings changes and ARM64 backend remain unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 94: Decky DoT DNS 0.0.2 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |
 | 95: Decky-SpoofDPI 0.12.0 | 1 / 2 | broken | Plugin contains a non-ARM64 Linux binary: decky-spoof-dpi/bin/spoofdpi. | static archive, local browser, fake-Frame |
-| 96: Simple Timer 1.0.0 | 1 / 2 | partial | Live start/cancel, countdown events, completion toast, persisted recents/subtle mode verified in Chromium with real ARM64 Decky. Upstream expired-timer restart raises missing timer_task. Audio/suspend unsupported; alerts require an open panel; worn VR unverified. | static archive, local browser, fake-Frame, real Frame SSH |
+| 96: Simple Timer 1.0.0 | 1 / 2 | works | Verified for silent in-panel session timers: Chromium Begin/Cancel/countdown/toast with real ARM64 Decky 3.3.0; repaired cancel, replace, completion and active/canceled/expired restarts pass actual loader RPC/events. Update/reinstall required. Sound and suspend unsupported; alerts require an open panel; worn VR unverified. | static archive, local browser, fake-Frame, real Frame SSH |
 | 97: Decky-Framegen 0.11.15 | 1 / 2 | broken | Plugin archive size or SHA-256 did not match the store. | static archive, local browser, fake-Frame |
 | 98: Decky-Lookup 0.1.0 | 1 / 2 | partial | Initializer succeeds; game-page context actions and live lookups remain unverified. | static archive, local browser, fake-Frame |
 | 99: Decky Zerotier 0.3.1 | 1 / 2 | broken | This plugin needs root and is not supported by the Frame user service. | static archive, local browser, fake-Frame |

docs/framey-loader.md

@@ -70,9 +70,13 @@ The [26 October live checks](evidence/framey-events-backend-2026-10-26.json)
 used the actual official Notebook and Simple Timer Python backends in a private
 removable ARM64 Decky service. Notebook's default notebook saved a pointer stroke
 and loaded it after a backend restart. Simple Timer's start/cancel controls,
-countdown, completion toast and persisted recents/subtle mode worked. Simple
-Timer remains partial: its own expired-timer startup raises a missing
-`timer_task` error, sound/suspend are unsupported, and worn VR was not checked.
+countdown, completion toast and persisted recents/subtle mode worked. The
+[Simple Timer lifecycle repair](evidence/framey-simple-timer-2026-10-26.md) now
+fixes cancellation, replacement and active/canceled/expired backend restarts,
+verified through actual Decky 3.3.0 on amd64 and the ARM64 Frame. Managed
+update/reinstall is required. Silent in-panel session timers qualify as works;
+sound/suspend are unsupported, alerts require an open panel, and worn VR remains
+unverified.
 
 DFL module and class lookup searches a finite registry of Framey's own controls,
 CSS maps and an explicitly unsupported optional UI-audio player. It follows DFL's

scripts/framey-compatibility-doc.py

@@ -50,7 +50,7 @@ def render(data):
         'record exactly what ran. A [2026-10-26 follow-up](evidence/framey-events-backend-2026-10-26.json) '
         'verified default Notebook drawing/save/reopen across a real backend restart and Simple Timer start/cancel, '
         'countdown/completion events, a visible toast and persisted recents/subtle mode. '
-        'Only private test settings were written. Simple Timer remains partial because its own expired-timer startup '
+        'Only private test settings were written. That initial pass left Simple Timer partial because its own expired-timer startup '
         'raises a missing `timer_task` error; sound/suspend are unsupported. '
         'A [local audio follow-up](evidence/framey-audio-backends-2026-10-26.md) exercised Volume Mixer, Volume Boost and Mixer '
         'through real Decky 3.3.0 amd64 backends on private silent virtual audio targets. Sliders, numeric volume entry, '
@@ -85,7 +85,14 @@ def render(data):
         'Exact managed installs also restore the system library path for D-Bus subprocesses, repairing a real Frame OS libtinfo/glibc failure in MusicControl 1.1.6. '
         'Both official entries pass transport/seek/volume, Info and reopen in local Chromium with actual Decky 3.3.0 amd64 and a private silent MPRIS service. '
         'Actual ARM64 Decky on the Frame passes read-only empty-player discovery for both. Existing copies need remove/reinstall or an explicit managed update. '
-        'Actual media playback on ARM64, artwork and worn VR remain unverified; both stay partial.', '',
+        'Actual media playback on ARM64, artwork and worn VR remain unverified; both stay partial. '
+        'A [Simple Timer lifecycle follow-up](evidence/framey-simple-timer-2026-10-26.md) repairs fresh/expired startup cancellation, '
+        'canceled deadlines that resumed and replaced tasks that still notified. Exact managed installs retain the API1 instance convention. '
+        'Published Decky 3.3.0 discovery/RPC/events verify cancel, replacement, completion and active/canceled/expired restarts in isolation; '
+        'the real ARM64 Frame repeats those lifecycle checks under the shared lock. Local Chromium with that live backend verifies '
+        'Begin/Cancel, countdown and a silent completion toast. Simple Timer qualifies as works for silent in-panel session timers. '
+        'Update/reinstall is required; old receipts stay partial. Sound/suspend are unsupported, closed-panel alerts and worn VR unverified. '
+        'The private service, files, test listeners and processes were removed; independent cleanup audit passed and battery stayed 99 → 99.', '',
         '## Every current plugin', '',
         'The API column shows manifest / actual bundled frontend API. Many manifests say v1 while their bundle connects API2. '
         'Missing manifest API is labelled legacy; an unrecognized bundle is unknown. Globals and hardware are static signals, not exhaustive dependencies.', '',

scripts/framey-test-decky-runtime.py

@@ -82,7 +82,8 @@ def main():
             loader = Path(temp)/'PluginLoader'
             loader.write_bytes(data)
             loader.chmod(0o644)  # Private container user copies/chmods its own executable.
-            probes = [(case['id'], False) for case in cases] + [(111, True)]
+            probes = [(case['id'], None) for case in cases] + [
+                (111, '--reproduce-bound-method-regression'), (96, '--reproduce-timer-regression')]
             for plugin_id, negative in probes:
                 name = 'framey-decky-'+uuid.uuid4().hex[:12]
                 command = ['docker', 'run', '--rm', '--name', name, '--network', 'none', '--read-only',
@@ -94,7 +95,7 @@ def main():
                     '--mount', f'type=bind,source={loader},target=/input/PluginLoader,readonly',
                     tag, str(plugin_id)]
                 if negative:
-                    command.append('--reproduce-bound-method-regression')
+                    command.append(negative)
                 try:
                     result = subprocess.run(command, capture_output=True, text=True, timeout=120)
                     if result.returncode:

tests/decky-runtime/cases.json

@@ -1,5 +1,22 @@
 [
-  {"id": 12, "shim": "music-control-system-dbus-env", "probe": "mpris"},
-  {"id": 111, "shim": "music-control-system-dbus-env", "probe": "mpris"},
-  {"id": 53, "shim": "shotty-click-app-dir", "probe": "screenshots"}
+  {
+    "id": 12,
+    "shim": "music-control-system-dbus-env",
+    "probe": "mpris"
+  },
+  {
+    "id": 111,
+    "shim": "music-control-system-dbus-env",
+    "probe": "mpris"
+  },
+  {
+    "id": 53,
+    "shim": "shotty-click-app-dir",
+    "probe": "screenshots"
+  },
+  {
+    "id": 96,
+    "shim": "simple-timer-lifecycle",
+    "probe": "timer-lifecycle"
+  }
 ]

tests/decky-runtime/check.py

@@ -11,6 +11,8 @@ import subprocess
 import sys
 import time
 import urllib.request
+import zipfile
+import io
 
 import websockets
 from websockets.exceptions import WebSocketException
@@ -57,6 +59,7 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('id', type=int)
     parser.add_argument('--reproduce-bound-method-regression', action='store_true')
+    parser.add_argument('--reproduce-timer-regression', action='store_true')
     args = parser.parse_args()
     assert os.getuid() == 1100 and ROOT.is_dir(), 'Run through framey-test-decky-runtime.py'
     record = next(p for p in PLUGINS if p['id'] == args.id)
@@ -83,10 +86,15 @@ def main():
     assert install.returncode == 0, install.stderr
     plugin = base/'plugins'/record['folder']
     receipt = json.loads((plugin/'.frame-control-store.json').read_text())
-    assert receipt['compatShims'] == [case['shim']], receipt
+    if not args.reproduce_timer_regression:
+        assert receipt['compatShims'] == [case['shim']], receipt
+    else:
+        assert record['id'] == 96
+        with zipfile.ZipFile(io.BytesIO(data)) as original:
+            (plugin/'main.py').write_bytes(original.read(record['folder']+'/main.py'))
     # Exercise the production manifest's API convention, never import Plugin ourselves.
     manifest = json.loads((plugin/'plugin.json').read_text())
-    assert 'api_version' not in manifest, manifest
+    assert manifest.get('api_version', 'legacy') == record['api_version'], manifest
     if args.reproduce_bound_method_regression:
         assert record['id'] == 111
         source = (plugin/'main.py').read_text()
@@ -131,7 +139,29 @@ def main():
                 report['calls'].append({'method': method, 'result': response['result']})
                 return response['result']
 
-            if args.reproduce_bound_method_regression:
+            if case['probe'] == 'timer-lifecycle':
+                from timer_lifecycle import probe
+
+                def restart(settings=None):
+                    nonlocal backend
+                    os.killpg(backend.pid, signal.SIGTERM)
+                    backend.wait(timeout=8)
+                    if settings is not None:
+                        path = base/'settings'/record['folder']/'settings.json'
+                        assert path.exists(), path
+                        path.write_text(json.dumps(settings))
+                    backend = subprocess.Popen([str(loader)], env=env, stdout=log, stderr=log,
+                                               start_new_session=True)
+                    processes.append(backend)
+                    until_ready(lambda: rpc('loader/get_plugins'), 'restarted Decky discovery')
+                    until_ready(lambda: rpc('loader/call_plugin_method', record['name'],
+                        'settings_getSetting', 'subtle_mode', False), 'restarted instance RPC')
+
+                report['lifecycle'] = probe(record['name'], restart, home/'runtime.log',
+                                            args.reproduce_timer_regression)
+                report['result'] = ('upstream timer lifecycle regressions reproduced' if args.reproduce_timer_regression
+                    else 'discovery, cancel, replace, completion and persistent restart passed')
+            elif args.reproduce_bound_method_regression:
                 response = rpc('loader/call_legacy_plugin_method', record['name'], 'sp_list_media_players', {})
                 assert response['success'] is False and 'self' in response['result'], response
                 report['expectedRegression'] = response

tests/decky-runtime/timer_lifecycle.py

@@ -0,0 +1,148 @@
+"""Simple Timer lifecycle through actual Decky instance dispatch, never Plugin()."""
+import asyncio
+import json
+import time
+import urllib.request
+
+import websockets
+
+
+class Client:
+    def __init__(self, name):
+        self.name = name
+        self.sequence = 0
+        self.events = []
+
+    async def __aenter__(self):
+        token = urllib.request.urlopen('http://127.0.0.1:1337/auth/token', timeout=2).read().decode()
+        self.ws = await websockets.connect('ws://127.0.0.1:1337/ws?auth='+token)
+        return self
+
+    async def __aexit__(self, *_):
+        await self.ws.close()
+
+    async def receive(self, timeout=8):
+        response = json.loads(await asyncio.wait_for(self.ws.recv(), timeout))
+        if response.get('type') == 5 and response.get('event') == 'loader/plugin_event':
+            event = response['args'][0]
+            if event['plugin'] == self.name:
+                self.events.append(event)
+        return response
+
+    async def call(self, method, *args, success=True):
+        self.sequence += 1
+        await self.ws.send(json.dumps({'type': 0, 'id': self.sequence,
+            'route': 'loader/call_plugin_method', 'args': [self.name, method, *args]}))
+        while True:
+            response = await self.receive()
+            if response.get('id') != self.sequence:
+                continue
+            await self.ws.send(json.dumps({'type': 3, 'id': self.sequence}))
+            if success:
+                assert response['type'] == 1, response
+                return response['result']
+            return response
+
+    async def seconds(self):
+        offset = len(self.events)
+        await self.call('load_remaining_seconds')
+        while not any(e['event'] == 'simple_timer_seconds_updated' for e in self.events[offset:]):
+            await self.receive()
+        return next(e['args'][0] for e in reversed(self.events)
+                    if e['event'] == 'simple_timer_seconds_updated')
+
+    async def drain(self, seconds):
+        deadline = time.monotonic()+seconds
+        while time.monotonic() < deadline:
+            try:
+                await self.receive(max(.01, deadline-time.monotonic()))
+            except TimeoutError:
+                break
+
+
+async def initial(name, negative):
+    async with Client(name) as client:
+        await client.call('set_subtle_mode', True)  # No sound or physical actions.
+        response = await client.call('cancel_timer', success=False)
+        if negative:
+            assert response['type'] == -1 and 'timer_task' in str(response), response
+        else:
+            assert response['type'] == 1, response
+        await client.call('start_timer', 60)
+        end = await client.call('settings_getSetting', 'timer_end', None)
+        assert end > time.time()
+        await client.call('cancel_timer')
+        saved = await client.call('settings_getSetting', 'timer_end', None)
+        assert (saved is not None) if negative else (saved is None), saved
+        await client.call('start_timer', 1)
+        await client.call('start_timer', 60)
+        await client.drain(6.5)  # Past upstream's 5-second tick and first timer's expiry.
+        completed = [e for e in client.events if e['event'] == 'simple_timer_event']
+        if negative:
+            assert completed, client.events
+        else:
+            assert not completed, completed
+            assert await client.seconds() > 45
+        await client.call('cancel_timer')
+        if negative:
+            return {'freshCancelError': response, 'cancelRetainsEnd': True,
+                    'replacedTimerStillFires': True}
+        await client.call('start_timer', 1)
+        client.events.clear()
+        await client.drain(5.5)
+        completed = [e for e in client.events if e['event'] == 'simple_timer_event']
+        assert len(completed) == 1 and completed[0]['args'] == ['Your session has ended!', True], completed
+        assert await client.seconds() == 0
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+        client.events.clear()
+        await client.call('start_timer', -20)  # An already expired, private silent deadline.
+        await client.drain(.3)
+        expired = [e for e in client.events if e['event'] == 'simple_timer_event']
+        assert len(expired) == 1 and expired[0]['args'] == ['Your timer has expired!', True], expired
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+        await client.call('start_timer', 60)
+        return {'end': await client.call('settings_getSetting', 'timer_end', None),
+                'recents': await client.call('settings_getSetting', 'recent_timers_seconds', [])}
+
+
+async def resumed(name, saved):
+    async with Client(name) as client:
+        assert 0 < await client.seconds() < 60
+        assert await client.call('settings_getSetting', 'timer_end', None) == saved['end']
+        assert await client.call('settings_getSetting', 'recent_timers_seconds', []) == saved['recents']
+        await client.call('cancel_timer')
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+
+
+async def idle(name):
+    async with Client(name) as client:
+        assert await client.seconds() == 0
+        assert await client.call('settings_getSetting', 'timer_end', None) is None
+        await client.call('cancel_timer')  # Idempotent before any new timer.
+        assert await client.call('settings_getSetting', 'subtle_mode', False) is True
+
+
+def probe(name, restart, log, negative=False):
+    saved = asyncio.run(initial(name, negative))
+    if negative:
+        restart({'timer_end': time.time()-60, 'subtle_mode': True})
+        asyncio.run(read_after_startup(name))
+        assert "has no attribute 'timer_task'" in log.read_text(), log.read_text()[-6000:]
+        return saved | {'expiredRestartError': True}
+    restart()
+    asyncio.run(resumed(name, saved))
+    restart()
+    asyncio.run(idle(name))
+    restart({'timer_end': time.time()-60, 'subtle_mode': True})
+    asyncio.run(idle(name))
+    return {'freshCancel': True, 'replacementSuppressesOldCompletion': True,
+            'completionClearsEnd': True, 'lateExpiryEmitsWithoutSelfCancel': True,
+            'activeRestartPreservesDeadlineAndRecents': True,
+            'canceledRestartIdle': True, 'expiredRestartIdle': True}
+
+
+async def read_after_startup(name):
+    async with Client(name) as client:
+        # _main is scheduled independently; allow it to finish before reading its journal.
+        await client.call('settings_getSetting', 'subtle_mode', False)
+        await client.drain(.3)

tests/e2e/test_framey.py

@@ -185,6 +185,9 @@ u=h/'.config/systemd/user/frame-control-decky.service'; u.parent.mkdir(parents=T
                     expected = hashlib.sha256(bundle.read(plugin['folder']+'/dist/index.js')).hexdigest()
                 self.assertEqual(ssh(f'sha256sum {installed}/dist/index.js').split()[0], expected)
                 self.assertEqual(json.loads(ssh(f'cat {installed}/plugin.json')).get('api_version', 'legacy'), plugin['api_version'])
+                if plugin['id'] == 96:
+                    self.assertEqual(found[0]['compatShims'], ['simple-timer-lifecycle'])
+                    self.assertEqual(found[0]['compatibility']['status'], 'works')
                 if plugin['id'] == 135:
                     chunk = 'chunks/pluginApi-B8sV7970.js'
                     with zipfile.ZipFile(io.BytesIO(official_archive(plugin))) as bundle:

tests/fixtures/framey-official/README.md

@@ -1,13 +1,14 @@
 # Pinned Decky store test archives
 
 These are unmodified ZIPs downloaded from the official Decky store CDN on
-2026-10-25, except `111.zip` downloaded on 2026-10-26. Each ZIP includes its
+2026-10-25, except `96.zip` and `111.zip` downloaded on 2026-10-26. Each ZIP includes its
 upstream `LICENSE`. They are test data, not plugins shipped or installed by
 Frame Control. The fake Frame tests serve them
 from a local fixture so CI does not depend on the store being online.
 
 | File | Official plugin | Version | Store SHA-256 |
 | --- | --- | --- | --- |
+| `96.zip` | Simple Timer | 1.0.0 | `973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312` |
 | `7.zip` | CSS Loader | 2.1.3 | `99beaf1374af82408e6d056e0b0147e5fca544e1035fa7ab88419231697bc231` |
 | `12.zip` | MusicControl | 1.1.6 | `246b89fd653c60a735b1cc401d1b0937d5cb969eea9024561661ff741f081d62` |
 | `111.zip` | Music Control | 1.1.7 | `3f56a3f56034b277ea74a2c37cc84133b69e382aa6bcb0b43876776aac737ed9` |
@@ -19,7 +20,7 @@ from a local fixture so CI does not depend on the store being online.
 | `36.zip` | SteamGridDB | 1.8.1 | `e84f5b1f111af8862b06218479491fbf61036e1bfd9f16f93f9901e9b9ebc5e0` |
 | `135.zip` | Deck Shelves | 2.0.0 | `b566280ad38fd3ecd584b5b46a855f301539eb9a86063834c64b7045f7063f91` |
 
-The matching source projects are
+The matching source projects include [Simple Timer](https://github.com/decktools-xyz/simple-timer) and
 [CSS Loader](https://github.com/suchmememanyskill/SDH-CssLoader),
 [MusicControl](https://github.com/nikurasu/MusicControl),
 [Music Control](https://github.com/martinpl/music-control),
@@ -41,3 +42,9 @@ Bluetooth result and limits are in
 Deck Shelves' chunked frontend renders its settings in local Chromium with
 backend/network calls denied. Its Steam Home shelves cannot be verified in the
 isolated VR panel; no worn-headset test is claimed.
+
+Simple Timer also runs through actual published Decky 3.3.0 discovery, instance
+RPC and events in the native isolated runtime gate. Cancel/replace/completion and
+active/canceled/expired backend restarts are regression checks; the unmodified
+archive must reproduce its historical lifecycle errors. Only private silent
+timers/settings are used. The upstream BSD license stays unchanged.

tests/framey_official.py

@@ -4,6 +4,8 @@ from pathlib import Path
 
 ROOT = Path(__file__).parent / 'fixtures/framey-official'
 PLUGINS = (
+    {'id': 96, 'name': 'Simple Timer', 'version': '1.0.0', 'api_version': 1,
+     'folder': 'simple-timer', 'sha256': '973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312'},
     {'id': 12, 'name': 'MusicControl', 'version': '1.1.6', 'api_version': 'legacy', 'folder': 'MusicControl', 'sha256': '246b89fd653c60a735b1cc401d1b0937d5cb969eea9024561661ff741f081d62'},
     {'id': 111, 'name': 'Music Control', 'version': '1.1.7', 'api_version': 'legacy',
      'folder': 'MusicControl', 'sha256': '3f56a3f56034b277ea74a2c37cc84133b69e382aa6bcb0b43876776aac737ed9'},

tests/test_frame_decky_store.py

@@ -161,6 +161,37 @@ class StoreTransaction(unittest.TestCase):
         self.assertNotEqual(result.returncode, 0)
         self.assertTrue(external.exists())
 
+    def test_exact_simple_timer_gets_lifecycle_repair_and_keeps_api1_and_license(self):
+        from framey_official import PLUGINS, archive as official_archive
+        plugin = next(p for p in PLUGINS if p['id'] == 96)
+        result = self.apply('install', official_archive(plugin), plugin_id=96,
+                            folder=plugin['folder'], version=plugin['version'])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        folder = self.folder.parent / plugin['folder']
+        self.assertEqual(json.loads((folder / '.frame-control-store.json').read_text())['compatShims'],
+                         ['simple-timer-lifecycle'])
+        self.assertEqual(json.loads((folder / 'plugin.json').read_text())['api_version'], 1)
+        with zipfile.ZipFile(io.BytesIO(official_archive(plugin))) as original:
+            self.assertEqual((folder / 'LICENSE').read_bytes(), original.read('simple-timer/LICENSE'))
+        # Backend behavior is verified separately by the real Decky lifecycle gate.
+        result = self.apply('remove', plugin_id=96, folder=plugin['folder'])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse(folder.exists())
+
+    def test_changed_simple_timer_digest_does_not_get_pinned_repair(self):
+        from framey_official import PLUGINS, archive as official_archive
+        plugin = next(p for p in PLUGINS if p['id'] == 96)
+        data = io.BytesIO(official_archive(plugin))
+        with zipfile.ZipFile(data, 'a') as changed:
+            original_main = changed.read('simple-timer/main.py')
+            changed.writestr('simple-timer/new-version.txt', 'unrecognized new payload')
+        result = self.apply('install', data.getvalue(), plugin_id=96,
+                            folder=plugin['folder'], version=plugin['version'])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        folder = self.folder.parent / plugin['folder']
+        self.assertEqual((folder / 'main.py').read_bytes(), original_main)
+        self.assertEqual(json.loads((folder / '.frame-control-store.json').read_text()).get('compatShims', []), [])
+
     def test_exact_shotty_archive_gets_isolated_click_import(self):
         from framey_official import PLUGINS, archive as official_archive
         plugin = next(p for p in PLUGINS if p['id'] == 53)

tests/test_framey_compatibility.py

@@ -59,6 +59,16 @@ class Compatibility(unittest.TestCase):
                 frame_decky_store.change(no_ssh, 'install', 42)
             download.assert_not_called()
 
+    def test_old_simple_timer_copy_requires_lifecycle_reinstall(self):
+        plugin = next(p for p in json.loads(compatibility.DATA.read_text())['plugins'] if p['id'] == 96)
+        installed = {'plugins': [dict(storeId=96, version=plugin['version'], sha256=plugin['sha256']),
+                                  dict(storeId=96, version=plugin['version'], sha256=plugin['sha256'],
+                                       compatShims=['simple-timer-lifecycle'])]}
+        result = frame_decky.status(lambda *a, **k: json.dumps(installed))['plugins']
+        self.assertEqual(result[0]['compatibility']['status'], 'partial')
+        self.assertIn('Update or reinstall', result[0]['compatibility']['reason'])
+        self.assertEqual(result[1]['compatibility']['status'], 'works')
+
     def test_missing_audit_data_is_unverified(self):
         with patch.object(compatibility, 'DATA', Path('/nonexistent/framey-audit.json')):
             self.assertEqual(compatibility.lookup(12, 'a'*64, '1.0')['status'], 'unverified')

tests/test_framey_decky_runtime.py

@@ -19,7 +19,7 @@ class RuntimeCoverage(unittest.TestCase):
         self.assertEqual(len(cases), len({case['id'] for case in cases}))
         for case in cases:
             self.assertIn(case['id'], official)
-            self.assertIn(case['probe'], ('mpris', 'screenshots'))
+            self.assertIn(case['probe'], ('mpris', 'screenshots', 'timer-lifecycle'))
 
     def test_new_shim_without_runtime_case_fails_coverage(self):
         import frame_decky_store

ui/frame_decky.py

@@ -40,7 +40,9 @@ def plugins(folder):
                               'author': str(data.get('author', ''))[:80],
                               'storeId': owned.get('storeId') if isinstance(owned.get('storeId'), int) else None,
                               'version': str(owned.get('version', ''))[:40],
-                              'sha256': str(owned.get('sha256', ''))[:64]})
+                              'sha256': str(owned.get('sha256', ''))[:64],
+                              'compatShims': [s[:100] for s in owned.get('compatShims', []) if isinstance(s, str)][:16]
+                                  if isinstance(owned.get('compatShims'), list) else []})
             except (ValueError, OSError, UnicodeError): pass
     return found
 os_release = {}
@@ -166,7 +168,8 @@ def status(ssh):
     result = json.loads(ssh('python3 -', stdin=PROBE, timeout=15))
     for plugin in result.get('plugins', []):
         plugin['compatibility'] = framey_compatibility.lookup(
-            plugin.get('storeId'), plugin.get('sha256'), plugin.get('version'))
+            plugin.get('storeId'), plugin.get('sha256'), plugin.get('version'),
+            installed_shims=plugin.get('compatShims', []))
     return result
 
 

ui/frame_decky_store.py

@@ -209,6 +209,100 @@ try:
             unpacked=stage/folder
             if not unpacked.is_dir(): raise RuntimeError('Missing plugin folder')
             compat_shims=[]
+            # Simple Timer 1.0.0 has annotation-only task state, orphaned
+            # replacement tasks and canceled deadlines that resume on restart.
+            # Preserve its API1 instance convention and upstream license.
+            if int(plugin_id)==96 and digest=='973d927e9d9a1feec04679c564af7e389a729b6735d2a988ffc2cb46ce4eb312' and folder=='simple-timer':
+                main=unpacked/'main.py'
+                source=main.read_text(encoding='utf-8')
+                start='    async def start_timer('; end='    async def load_recents('
+                if source.count(start)!=1 or source.count(end)!=1: raise RuntimeError('Simple Timer compatibility source changed')
+                a=source.index(start); b=source.index(end,a)
+                source=source[:a]+"""    async def _stop_timer(self):
+        # Call only under timer_lock. Joining prevents a replaced task from
+        # updating the new timer or sending a stale completion notification.
+        task, self.timer_task = self.timer_task, None
+        if task is not None and task is not asyncio.current_task():
+            task.cancel()
+            try:
+                await task
+            except asyncio.CancelledError:
+                pass
+
+    async def start_timer(self, seconds: int):
+        async with self.timer_lock:
+            await self._stop_timer()
+            recent = await self.settings_getSetting(settings_key_recent_timers, [])
+            await self.settings_setSetting(settings_key_recent_timers, [seconds] + recent[:4])
+            deadline = time.time() + seconds
+            await self.settings_setSetting(settings_key_timer_end, deadline)
+            await self.settings_commit()
+            self.seconds_remaining = seconds
+            self.timer_task = self.loop.create_task(self.timer_handler(datetime.fromtimestamp(deadline)))
+            await self.load_recents()
+            await self.load_remaining_seconds()
+
+    async def timer_handler(self, timer_end: datetime):
+        while True:
+            remaining = timer_end.timestamp() - time.time()
+            if remaining <= 0:
+                break
+            await asyncio.sleep(min(5, remaining))
+            self.seconds_remaining = max(0, timer_end.timestamp() - time.time())
+            await self.load_remaining_seconds()
+        async with self.timer_lock:
+            if self.timer_task is not asyncio.current_task():
+                return
+            self.timer_task = None
+            self.seconds_remaining = 0
+            await self.settings_setSetting(settings_key_timer_end, None)
+            await self.settings_commit()
+            await self.load_remaining_seconds()
+            subtle = await self.settings_getSetting(settings_key_subtle_mode, False)
+            if remaining <= -10:
+                await decky.emit("simple_timer_event", "Your timer has expired!", True)
+            else:
+                await decky.emit("simple_timer_event", "Your session has ended!", subtle)
+
+    async def cancel_timer(self):
+        async with self.timer_lock:
+            await self._stop_timer()
+            self.seconds_remaining = 0
+            await self.settings_setSetting(settings_key_timer_end, None)
+            await self.settings_commit()
+            await self.load_remaining_seconds()
+
+"""+source[b:]
+                start='    async def _main('; end='    async def _uninstall('
+                if source.count(start)!=1 or source.count(end)!=1: raise RuntimeError('Simple Timer compatibility source changed')
+                a=source.index(start); b=source.index(end,a)
+                source=source[:a]+"""    async def _main(self):
+        self.loop = asyncio.get_running_loop()
+        self.timer_task = None
+        self.timer_lock = asyncio.Lock()
+        self.seconds_remaining = 0
+        await self.settings_read()
+        deadline = await self.settings_getSetting(settings_key_timer_end, None)
+        if deadline is not None:
+            self.seconds_remaining = max(0, deadline - time.time())
+            if self.seconds_remaining > 0:
+                # Resume the exact deadline without adding another recent timer.
+                self.timer_task = self.loop.create_task(self.timer_handler(datetime.fromtimestamp(deadline)))
+            else:
+                await self.cancel_timer()
+        await self.load_recents()
+        await self.load_subtle_mode()
+        decky.logger.info("Simple Timer has been initialised.")
+
+    async def _unload(self):
+        async with self.timer_lock:
+            # Backend unload is a pause; only explicit cancel clears the deadline.
+            await self._stop_timer()
+        decky.logger.info("Simple Timer has been unloaded.")
+
+"""+source[b:]
+                main.write_text(source,encoding='utf-8')
+                compat_shims.append('simple-timer-lifecycle')
             # Shotty 0.1.0 imports click.get_app_dir but never calls it. Its
             # official ZIP omits click and Decky's bundled Python lacks it.
             # Supply the Linux function only inside this exact plugin's

ui/framey-compatibility.json

@@ -7612,8 +7612,8 @@
         "https://github.com/decktools-xyz/simple-timer",
         "https://github.com/decktools-xyz/simple-timer.git"
       ],
-      "status": "partial",
-      "reason": "Live start/cancel, countdown events, completion toast, persisted recents/subtle mode verified in Chromium with real ARM64 Decky. Upstream expired-timer restart raises missing timer_task. Audio/suspend unsupported; alerts require an open panel; worn VR unverified.",
+      "status": "works",
+      "reason": "Verified for silent in-panel session timers: Chromium Begin/Cancel/countdown/toast with real ARM64 Decky 3.3.0; repaired cancel, replace, completion and active/canceled/expired restarts pass actual loader RPC/events. Update/reinstall required. Sound and suspend unsupported; alerts require an open panel; worn VR unverified.",
       "blockInstall": false,
       "verification": [
         "static archive",
@@ -7661,6 +7661,22 @@
           "subscriptionsAfterPanelClose": 0
         },
         "method": "local Chromium + real Frame SSH; private actual Decky 3.3.0 ARM64 service"
+      },
+      "requiredShims": [
+        "simple-timer-lifecycle"
+      ],
+      "lifecycle": {
+        "evidence": "docs/evidence/framey-simple-timer-2026-10-26.md",
+        "actualDeckyVersion": "3.3.0",
+        "instanceApi": 1,
+        "backendRestarts": [
+          "active",
+          "canceled",
+          "expired"
+        ],
+        "realFrame": true,
+        "localBrowser": true,
+        "fakeFrame": true
       }
     },
     {

ui/framey_compatibility.py

@@ -12,7 +12,7 @@ def _records(path):
     return json.loads(path.read_text())['plugins']
 
 
-def lookup(plugin_id, digest, version):
+def lookup(plugin_id, digest, version, installed_shims=None):
     unknown = {'status': 'unverified', 'reason': 'This exact store version has not been audited on Frame.',
                'verification': [], 'blockInstall': False}
     if type(plugin_id) is not int or not isinstance(digest, str) or not isinstance(version, str):
@@ -23,6 +23,14 @@ def lookup(plugin_id, digest, version):
         if len(matches) != 1:
             return unknown
         record = matches[0]
-        return {key: record[key] for key in ('status', 'reason', 'verification', 'blockInstall')}
+        result = {key: record[key] for key in ('status', 'reason', 'verification', 'blockInstall')}
+        required = record.get('requiredShims', [])
+        if result['status'] in ('works', 'partial') and required and installed_shims is not None and (
+                not isinstance(installed_shims, list) or
+                any(shim not in installed_shims for shim in required)):
+            result['status'] = 'partial'
+            result['reason'] = ('Update or reinstall this managed plugin to add its missing Frame compatibility fix. '
+                                + result['reason'])
+        return result
     except (OSError, ValueError, KeyError, TypeError):
         return unknown