docs: record v0.4.53 release verification

docs/evidence/v0453-assets-2026-10-28.json

@@ -0,0 +1,76 @@
+{
+  "tag": "v0.4.53",
+  "releaseId": 427006429,
+  "tagNameAtAudit": "v0.4.53",
+  "draftAtAudit": true,
+  "sha256sumsSha256": "813441ac5c121e2c9effd274576aa6db1ff01187f811463a1014f86e0172608c",
+  "assets": [
+    {
+      "name": "Frame-Control-mac-arm64.dmg",
+      "size": 177629060,
+      "sha256": "8ae712108aa3fdfb5f40a2f205db65ffd7694914bab2ac0af7a85dafb1c8c31e",
+      "udifTrailer": "ok"
+    },
+    {
+      "name": "Frame-Control-mac-arm64.zip",
+      "size": 177452293,
+      "sha256": "f6f683e43b397d51432a8651d0b54d5d96cfd3e9d75e0fe4a9769cdd10ccf33b",
+      "zipCrc": "ok",
+      "members": 1673,
+      "bundleVersion": "0.4.53"
+    },
+    {
+      "name": "Frame-Control-mac-x64.dmg",
+      "size": 184700330,
+      "sha256": "7c25a0d6633aa5312c5e7a1abf8d1abd656e109cc78093a2c5bd29bf790d8e03",
+      "udifTrailer": "ok"
+    },
+    {
+      "name": "Frame-Control-mac-x64.zip",
+      "size": 184538726,
+      "sha256": "fe7c5b46ea718a5e8f5d8cc511813d420fdbdfea4858e4c4c20f92b7aaaed529",
+      "zipCrc": "ok",
+      "members": 1669,
+      "bundleVersion": "0.4.53"
+    },
+    {
+      "name": "Frame-Control-Setup-x64.exe",
+      "size": 151885488,
+      "sha256": "9bdbafc00fd170a4e31dbaafc73ce89c952c85a1cbad9198822ea2c473489597",
+      "peMachine": 332
+    },
+    {
+      "name": "Frame-Control-win-x64.zip",
+      "size": 198840858,
+      "sha256": "8360ea2427a84374a2106267d0440dbf5e4d9b22f9ef44e465d31f81c7ebfaff",
+      "zipCrc": "ok",
+      "members": 1517
+    },
+    {
+      "name": "Frame-Control-linux-x86_64.AppImage",
+      "size": 179997230,
+      "sha256": "7755621360a1aafb6e1bdf2b41838d172a3f6d7f5662d2b5217f6aae08486c2b",
+      "elfMachine": 62
+    },
+    {
+      "name": "Frame-Control-linux-arm64.AppImage",
+      "size": 171579370,
+      "sha256": "985b0a1c3e04af5cc1a41e2e7ad9e8481aac45762b369044bf314972e894dc64",
+      "elfMachine": 183
+    },
+    {
+      "name": "Frame-Control-linux-amd64.deb",
+      "size": 146412012,
+      "sha256": "2adbef7c1bec3e9e40244984598a2e2c9816eb2c21fdb21d6996f9d30f2d0fec",
+      "debVersion": "0.4.53",
+      "architecture": "amd64"
+    },
+    {
+      "name": "Frame-Control-linux-arm64.deb",
+      "size": 133498848,
+      "sha256": "0625dfdb1959f8eab52ac3f6c4bf909b7de3966c9ca959c391e43630516ff9c7",
+      "debVersion": "0.4.53",
+      "architecture": "arm64"
+    }
+  ]
+}

docs/evidence/v0453-release-2026-10-28.md

@@ -0,0 +1,73 @@
+# v0.4.53 release verification, 28 October 2026
+
+The annotated `v0.4.53` tag dereferences to merged main commit
+`e4ce91d6868665e6689a4aa17a27a46bf9abd089`. Its tree matches reviewed
+[candidate PR #380](https://github.com/saphid/frame-control/pull/380) head
+`a1a376b4ee9464ac9d97426cce21e662e3a9bf1e`; the diff is empty.
+
+## Exact commit gates
+
+- [Main checks](https://github.com/saphid/frame-control/actions/runs/40739079630)
+  passed all seven jobs on the first attempt, including e2e, iOS, Windows,
+  macOS, Linux and aggregate checks.
+- [Native Decky runtime](https://github.com/saphid/frame-control/actions/runs/40739079822)
+  passed both published Decky 3.3.0 AMD64 and ARM64 jobs on the first attempt.
+- Tagged installer and checksum workflow:
+  [run 40740373224](https://github.com/saphid/frame-control/actions/runs/40740373224).
+  All six jobs passed on the first attempt: draft, Linux, Windows, Intel Mac,
+  Apple Silicon Mac and checksums. No tagged job failed, was cancelled,
+  skipped or overridden.
+
+Before publication the draft held exactly ten installers and `SHA256SUMS`.
+Every installer was independently downloaded by GitHub asset ID; each size
+and SHA-256 matched the asset metadata. The downloaded `SHA256SUMS` matched
+all ten entries byte for byte and had SHA-256
+`813441ac5c121e2c9effd274576aa6db1ff01187f811463a1014f86e0172608c`.
+The [sanitized asset audit](v0453-assets-2026-10-28.json) records names,
+sizes, hashes and package checks. It verified both Mac ZIP CRCs and bundle
+version `0.4.53`, both DMG UDIF trailers, Windows ZIP CRC and PE header,
+both AppImage ELF architectures, and both DEB version and architecture fields.
+
+## Real Frame and package checks
+
+The [candidate smoke evidence](v0453-candidate-2026-10-28.md)
+records a unique-lock source smoke: 12 passed, one optional x86_64 launch
+skipped because Steam Linux Runtime 4 was absent, zero failed. Independent
+fresh-lock cleanup found no reserved test titles or owned processes. The
+source tree changed only in documentation after the smoke, and the merged
+release tree matches the PR head. SteamVR was in standby; nobody was confirmed
+wearing the Frame, and no VR input was sent.
+The private smoke result had SHA-256
+`5a5bc8b1da1ef405235d660a2587c84204afd0816c80f8d9dfd9577dac72d547`;
+the fresh-lock cleanup audit had SHA-256
+`6ab884b6adffb14c4643e30ee2e5fe247b2ebba7a3ad5424515927cd40146e79`.
+
+The tagged x86_64 AppImage downloaded independently by asset ID had SHA-256
+`7755621360a1aafb6e1bdf2b41838d172a3f6d7f5662d2b5217f6aae08486c2b`.
+It launched under isolated Xvfb with a temporary profile, telemetry and update
+checks disabled; its bundled server returned HTTP 200 with `FrameControl/1`
+and stopped after app exit. No physical Mac or Windows launch of these exact
+installers was performed.
+
+## Publication
+
+`scripts/publish-release.sh --dry-run v0.4.53` passed exact-main, native
+runtime and tagged release jobs, all ten installer hashes, regenerated
+`SHA256SUMS`, draft notes and update-manifest checks. Its log had SHA-256
+`ddad938f25d4321a8d24b29ff895a20431ec6d1c2c6faf8fd42f939100c97bff`.
+The publisher repeated those gates, attached `update.json`, and published
+[v0.4.53](https://github.com/saphid/frame-control/releases/tag/v0.4.53) at
+**18:14:22 UTC**. Its log had SHA-256
+`b54cd7f87c0ba858cc61086fc6293287bdb7555c6a49d3f1c9b8216b39d0dcf3`.
+GitHub's latest-release API returned `draft=false`, `prerelease=false`, the
+correct tag, ten installers, `SHA256SUMS` and `update.json`. A fresh download
+from the public `releases/latest/download/update.json` route reported version
+`0.4.53`, the correct release page, all ten names, sizes and hashes matching
+the independent downloads, and the explicit 26.5 GB transfer limit. The
+public manifest had SHA-256
+`b873a3422e60e2fec2ff4a08f0a1fe610b9df18eb94a1a72e259beefb763bb38`.
+
+The exact-version Decky catalog remains **6 works / 54 partial / 45 broken /
+11 N/A**. A physical 26.5 GB transfer, wearer-visible VR, physical-controller
+use and the optional x86_64 title launch are unverified. The separate hourly
+worn check remains enabled.