Headset store: pending game data belongs to the installed package, in every view, and goes when the app does

From review round 6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/steam-frame/SKILL.md

@@ -22,6 +22,7 @@ desktop or panels.
 | See the Frame from the Mac, or the Mac inside the Frame | `docs/streaming.md` | `scripts/run-on-frame.sh mac-screen` |
 | Files and clipboard | `docs/file-transfer.md` | `scripts/push.sh`, `scripts/paste-to-frame.sh` |
 | Android apps (Lepton) | `docs/apks.md` | `scripts/install-apk.sh` |
+| Browse and install Android apps from inside the headset (APK Store panel) | `docs/apks.md` | `scripts/store-on-frame.sh` |
 | Reach the Frame off the home LAN (Tailscale) | `docs/tailscale.md` | `scripts/tailscale-on-frame.sh` |
 | Install or buy Steam games, Frame ratings | `docs/steam-games.md` | `ui/frame_steam.py` |
 | Flatpaks | `docs/streaming.md` | `scripts/install-apps.sh` |

README.md

@@ -213,8 +213,6 @@ Frame's software fits together, all checked against a real headset and labelled
 | [Scripts and headset setup](docs/scripts.md) | The command-line helpers, minimum typing, streaming options, floating panels |
 | [How the Frame works](docs/how-the-frame-works.md) | SteamVR → gamescope → Plasma, verified facts, debugging |
 | [Android apps (Lepton)](docs/apks.md) | Sideloading, the rated F-Droid catalogue, per-app instances |
-| [Import from my Quest](docs/quest-import.md) | Copy games you own off your Quest by USB; what runs, and why licence-checked games may not |
-| [My Meta library](docs/meta-library.md) | Experimental: install and test Quest games your Meta account owns, with your own token |
 | [Sideloading Linux and Windows games](docs/sideloading.md) | A .zip, folder or .exe as a Steam Devkit Game, runtime detection |
 | [Install links for websites](docs/web-install.md) | `frame-control://install` links and manifests, the rules, a button to paste |
 | [VR comfort and HUD](docs/vr-utilities.md) · [Steam games](docs/steam-games.md) · [VR video](docs/vr-video.md) · [WebXR in Chromium](docs/webxr-chromium.md) | Installing and buying, watching VR180/360, the Chromium build |

app/main.js

@@ -1,7 +1,7 @@
 // Frame Control as a desktop app (macOS, Windows, Linux): starts ui/server.py on
 // a free loopback port and shows it in a native window. The server does all the
 // work over the `frame` SSH alias; this file only hosts it.
-const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, session, shell } = require("electron");
+const { app, BrowserWindow, Menu, Notification, clipboard, dialog, ipcMain, nativeImage, shell } = require("electron");
 const { execFile, spawn } = require("child_process");
 const { promisify } = require("util");
 const fs = require("fs");
@@ -11,7 +11,6 @@ const os = require("os");
 const path = require("path");
 const { SCHEME, parseInstallLink, linkFromArgv } = require("./install-link");
 const updater = require("./updater");
-const { createMetaSignIn } = require("./meta-signin");
 
 const run = promisify(execFile);
 
@@ -349,47 +348,6 @@ ipcMain.handle("comfort:notify", (e, message) => {
   });
 });
 
-// ---- Sign in with Meta (app/meta-signin.js, docs/meta-library.md) ----
-// The token goes from the sign-in window's own session straight to the server's
-// connect path; the page asks for it and only hears the server's answer.
-function postApi(apiPath, body) {
-  return new Promise((resolve, reject) => {
-    if (!url) return reject(new Error("Frame Control's server isn't running."));
-    const data = JSON.stringify(body);
-    const req = http.request(new URL(apiPath, url), {
-      method: "POST", timeout: 60000,
-      headers: { "Content-Type": "application/json", "X-Frame-UI": process.env.FRAME_UI_KEY || "1",
-                 "Content-Length": Buffer.byteLength(data) },
-    }, (res) => {
-      let text = "";
-      res.setEncoding("utf8");
-      res.on("data", (c) => { text += c; });
-      res.on("end", () => {
-        let parsed = {};
-        try { parsed = JSON.parse(text); } catch {}
-        resolve({ status: res.statusCode, data: parsed });
-      });
-    });
-    req.on("error", reject);
-    req.on("timeout", () => req.destroy(new Error("the server didn't answer")));
-    req.end(data);
-  });
-}
-
-let metaSignIn = null;
-const meta = () => (metaSignIn ||= createMetaSignIn({
-  BrowserWindow, session, shell, parent: () => win,
-  // The page only offers sign-in after its "I understand" box is ticked (checked again below).
-  connect: (token, attempt) => postApi("/api/meta", { action: "connect", token, acknowledged: true, attempt }),
-  cancel: (attempt) => postApi("/api/meta", { action: "cancel-signin", attempt }),
-}));
-ipcMain.handle("meta:signin", (e, acknowledged) => {
-  if (!fromUi(e)) return null;
-  if (acknowledged !== true) return { ok: false, error: "My Meta library is experimental: tick that you understand the warning first." };
-  return meta().signIn();
-});
-ipcMain.handle("meta:signout", (e) => fromUi(e) ? meta().signOut() : false);
-
 // frame-control://install links from websites (docs/web-install.md). They can
 // arrive before the window or server exists (macOS open-url on a cold launch),
 // so they wait here until the page asks for them. The page checks the link with

app/meta-signin.js

@@ -1,252 +0,0 @@
-// "Sign in with Meta" for My Meta library (docs/meta-library.md), the way BSManager's
-// "Log in with Meta" works: Meta's own login page in a Frame Control window, then the
-// access token cookie (oc_ac_at) that page sets is handed to the local server's
-// existing connect path (format check, "who am I" with Meta, 0600 file).
-//
-// The window has its own persistent session (PARTITION), so the cookie is read only
-// from there: never from Frame Control's main window, never from any browser. It has
-// no preload and no Node, and it only navigates within Meta's login sites; anything
-// else opens in the system browser. Nothing here logs the token, and the page only
-// ever gets back the server's answer (connected, display name), never the token.
-// Electron is passed in, so app/test/meta-signin.test.js can run it with fakes.
-const crypto = require("crypto");
-
-const PARTITION = "persist:meta-signin";
-// BSManager's loginUrl (src/main/services/bs-version-download/bs-oculus-downloader.service.ts).
-const LOGIN_URL = "https://secure.oculus.com";
-const COOKIE = "oc_ac_at";
-// Sites the login can go through: the Oculus store web, Meta accounts, Facebook login,
-// and Instagram (Meta's login passes through www.instagram.com: seen live, 2026-10-14).
-const ALLOWED = ["oculus.com", "meta.com", "facebook.com", "instagram.com"];
-const TIMEOUT = 10 * 60 * 1000;  // as BSManager
-
-const underDomain = (host, domains) => {
-  host = String(host || "").replace(/^\./, "").toLowerCase();
-  return domains.some((d) => host === d || host.endsWith("." + d));
-};
-
-// Plain HTTPS on the default port, to one of the login sites.
-function allowedUrl(raw) {
-  let u;
-  try { u = new URL(String(raw)); } catch { return false; }
-  if (u.protocol !== "https:" || u.username || u.password || (u.port && u.port !== "443")) return false;
-  return underDomain(u.hostname, ALLOWED);
-}
-
-// Frames inside the page: any HTTPS address (Meta's login can embed captcha and CDN
-// frames from other sites), or an empty frame; never data:, blob:, javascript:, http:,
-// file: or any other scheme. Frames can't reach the cookie read or IPC (main process only).
-function allowedSubframeUrl(raw) {
-  if (/^about:(?:blank|srcdoc)$/.test(String(raw))) return true;
-  let u;
-  try { u = new URL(String(raw)); } catch { return false; }
-  return u.protocol === "https:" && !u.username && !u.password;
-}
-
-const onOculus = (raw) => { try { return underDomain(new URL(raw).hostname, ["oculus.com"]); } catch { return false; } };
-
-// A cheap first look, so a signed-out or app value is never sent anywhere; the server's
-// check_token (ui/frame_meta.py) has the final word.
-function looksLikeUserToken(v) {
-  return typeof v === "string" && /^(?:OC|FRL)[A-Za-z0-9+/=_-]{18,4093}$/.test(v)
-    && !/^OC\d{15}$/.test(v) && /[a-z]/.test(v);
-}
-
-const fingerprint = (v) => crypto.createHash("sha256").update(v).digest("hex");
-
-// Anything token-shaped out of a message, in case a server error ever carried one.
-function scrub(text, token) {
-  let s = String(text == null ? "" : text);
-  if (token) s = s.split(token).join("<redacted>");
-  return s.replace(/(?:OC|FRL)[A-Za-z0-9+/=_%|:-]{8,}/g, "<redacted>").slice(0, 600);
-}
-
-// deps: { BrowserWindow, session, shell, parent() -> BrowserWindow|null, timeout,
-//         connect(token, attempt) -> Promise<{status, data}>  (the server's connect action),
-//         cancel(attempt) -> Promise  (the server's cancel-signin: never save that attempt) }
-function createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent = () => null, timeout = TIMEOUT }) {
-  let active = null;  // { win, promise, finish }
-  const pending = new Set();  // cancels still to reach the server, from flows already finished
-  let signingOut = null;      // the sign-out under way; no sign-in starts while it runs
-  const SIGNING_OUT = "Frame Control is signing out of Meta; try again in a moment.";
-
-  const openOutside = (target) => {
-    if (/^https?:\/\//i.test(String(target))) shell.openExternal(String(target));
-  };
-
-  function signIn() {
-    if (signingOut) return Promise.resolve({ ok: false, error: SIGNING_OUT });
-    if (active) { active.win.focus(); return active.promise; }
-    const ses = session.fromPartition(PARTITION);
-    ses.setPermissionRequestHandler((_wc, _permission, callback) => callback(false));
-    ses.setPermissionCheckHandler(() => false);
-    // Electron adds its own name and the app's to the user agent; send a plain Chrome one.
-    if (ses.getUserAgent && ses.setUserAgent) {
-      ses.setUserAgent(ses.getUserAgent().replace(/\s(?:Electron|frame-control|Frame Control)\/\S+/g, ""));
-    }
-    const p = parent();
-    const win = new BrowserWindow({
-      width: 520, height: 760, title: "Sign in with Meta – Frame Control", autoHideMenuBar: true,
-      ...(p ? { parent: p } : {}),
-      webPreferences: { partition: PARTITION, contextIsolation: true, nodeIntegration: false, sandbox: true,
-                        nodeIntegrationInSubFrames: false, webviewTag: false, safeDialogs: true, devTools: false },
-    });
-    const wc = win.webContents;
-
-    let resolve;
-    const promise = new Promise((r) => { resolve = r; });
-    let done = false, busy = false, again = false, lastError = null, blocked = null;
-    const tried = new Set();  // fingerprints of values already sent, so each goes once
-    // The server refuses to save a connect from an attempt this window gave up on.
-    const attemptId = crypto.randomUUID();
-
-    const onCookie = (_e, cookie, _cause, removed) => {
-      if (!removed && cookie && cookie.name === COOKIE && underDomain(cookie.domain, ["oculus.com"])) attempt();
-    };
-    const timer = setTimeout(() => finish({ ok: false, error: "Sign-in timed out after 10 minutes. Try again." }), timeout);
-    if (timer.unref) timer.unref();
-
-    // Stops cookie intake first, then the window (destroy: a page's beforeunload can't
-    // keep it open), and answers the page. Unless it connected, and if it sent a token, it
-    // then has the server drop this attempt: only once the connect under way has settled,
-    // so the server always sees the cancel after the connect (and deletes the token if
-    // that connect saved it). The returned promise settles when that is done.
-    let finished = null;
-    let inflight = null;  // the last connect sent
-    function finish(result) {
-      if (done) return finished || Promise.resolve();  // destroy() below re-enters through "closed"
-      done = true;
-      ses.cookies.removeListener("changed", onCookie);
-      clearTimeout(timer);
-      if (active && active.win === win) active = null;
-      if (!win.isDestroyed()) win.destroy();
-      resolve(result);
-      if (result.ok || !inflight) return (finished = Promise.resolve());  // nothing sent: nothing to cancel
-      finished = Promise.resolve(inflight).catch(() => {}).then(() => cancel(attemptId)).catch(() => {});
-      pending.add(finished);
-      finished.then(() => pending.delete(finished));
-      return finished;
-    }
-
-    async function attempt() {
-      if (done) return;
-      if (busy) { again = true; return; }
-      busy = true;
-      try {
-        do {
-          again = false;
-          // Only this window's own session, and only Meta's Oculus cookie.
-          const cookies = await ses.cookies.get({ name: COOKIE });
-          const c = cookies.find((k) => underDomain(k.domain, ["oculus.com"]) && looksLikeUserToken(k.value));
-          if (!c || done) continue;
-          const key = fingerprint(c.value);
-          if (tried.has(key)) continue;
-          tried.add(key);
-          let r;
-          try {
-            inflight = connect(c.value, attemptId);
-            r = await inflight;
-          } catch {
-            lastError = "Frame Control's local server didn't answer.";
-            continue;
-          }
-          if (done) return;
-          const d = (r && r.data) || {};
-          if (r && r.status === 200 && d.connected) {
-            finish({ ok: true, connected: true, user: d.user && d.user.name ? { name: scrub(d.user.name, c.value).slice(0, 80) } : null,
-                     message: scrub(d.message || "Connected your Meta account (Experimental)", c.value) });
-            return;
-          }
-          lastError = scrub(d.error || `HTTP ${r && r.status}`, c.value);
-        } while (again && !done);
-      } catch {
-        // The session went away (the window closed); nothing to do.
-      } finally {
-        busy = false;
-      }
-    }
-
-    // Navigation stays on Meta's login sites. A link elsewhere opens in the system
-    // browser; a redirect elsewhere is just stopped (it may carry sign-in data).
-    // Every frame: the window itself stays on the list; frames inside it may load any
-    // HTTPS page (captchas), and one going anywhere else is just stopped.
-    wc.on("will-navigate", (e, target) => { if (!allowedUrl(target)) { e.preventDefault(); openOutside(target); } });
-    // A stopped page change in the window itself says where it went (the host only), so
-    // closing the stuck window explains why instead of "closed before you signed in".
-    const stopped = (to) => {
-      let host = "";
-      try { host = new URL(String(to)).hostname; } catch { /* not an address */ }
-      blocked = `Meta's sign-in went to ${scrub(host || "an address", null).slice(0, 80)}, which Frame Control doesn't allow.`;
-    };
-    wc.on("will-frame-navigate", (e) => {
-      if (e.isMainFrame ? allowedUrl(e.url) : allowedSubframeUrl(e.url)) return;
-      e.preventDefault();
-      if (e.isMainFrame) stopped(e.url);
-    });
-    // Redirects fire for frames too: the same rule per frame (details on the event in
-    // current Electron, positional arguments in older ones; unknown counts as the window).
-    wc.on("will-redirect", (e, target, _inPlace, isMainFrame) => {
-      const to = e && e.url !== undefined ? e.url : target;
-      const main = e && e.isMainFrame !== undefined ? e.isMainFrame : isMainFrame !== false;
-      if (main ? allowedUrl(to) : allowedSubframeUrl(to)) return;
-      e.preventDefault();
-      if (main) stopped(to);
-    });
-    // A page's beforeunload never keeps the window open.
-    wc.on("will-prevent-unload", (e) => e.preventDefault());
-    wc.setWindowOpenHandler(({ url: target }) => {
-      if (allowedUrl(target)) wc.loadURL(target).catch(() => {});
-      else openOutside(target);
-      return { action: "deny" };
-    });
-    // Signed in: the cookie changes, or the window lands back on Meta's store site.
-    ses.cookies.on("changed", onCookie);
-    wc.on("did-navigate", (_e, target) => { blocked = null; if (onOculus(target)) attempt(); });  // it recovered
-    wc.on("did-navigate-in-page", (_e, target) => { if (onOculus(target)) attempt(); });
-    win.on("closed", () => finish({ ok: false, cancelled: true,
-      error: lastError ? `The sign-in window closed before Frame Control could connect. ${lastError}`
-           : blocked ? `The sign-in window was closed before you signed in. ${blocked}`
-                     : "The sign-in window was closed before you signed in." }));
-
-    active = { win, promise, finish };
-    wc.loadURL(LOGIN_URL).catch(() => {});
-    return promise;
-  }
-
-  // Signs out of Meta in Frame Control: stops any sign-in under way (and has the server
-// refuse to save it), destroys the window, then clears everything
-  // the sign-in session stored (cookies, storage, cache), so the next sign-in starts fresh.
-  // One at a time (a second call joins the first), and no sign-in can start meanwhile.
-  // It goes round until no window is open and no connect or cancel is left, so nothing
-  // started before it can set a token after it (or after the Disconnect that follows).
-  function signOut() {
-    if (!signingOut) {
-      signingOut = (async () => {
-        for (;;) {
-          if (active) {
-            const { win, finish } = active;
-            await finish({ ok: false, cancelled: true, error: "Signed out of Meta in Frame Control." });
-            // Clear only once nothing can write to the session again.
-            if (!win.isDestroyed()) throw new Error("The Sign in with Meta window didn't close; try again.");
-          } else if (pending.size) {
-            // A connect under way settles and is cancelled before the caller (Disconnect)
-            // deletes the account, so it can't be saved afterwards.
-            await Promise.all([...pending]);
-          } else {
-            break;
-          }
-        }
-        const ses = session.fromPartition(PARTITION);
-        await ses.clearStorageData();
-        await ses.clearCache();
-        if (ses.clearAuthCache) await ses.clearAuthCache();
-        return true;
-      })().finally(() => { signingOut = null; });
-    }
-    return signingOut;
-  }
-
-  return { signIn, signOut, isOpen: () => !!active, isSigningOut: () => !!signingOut };
-}
-
-module.exports = { createMetaSignIn, allowedUrl, allowedSubframeUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE, ALLOWED };

app/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "frame-control",
-  "version": "0.4.7",
+  "version": "0.4.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "frame-control",
-      "version": "0.4.7",
+      "version": "0.4.6",
       "license": "MIT",
       "devDependencies": {
         "electron": "^44.4.5",

app/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frame-control",
   "productName": "Frame Control",
-  "version": "0.4.7",
+  "version": "0.4.6",
   "description": "Desktop app for managing a Valve Steam Frame over SSH",
   "private": true,
   "main": "main.js",
@@ -39,7 +39,6 @@
       "preload.js",
       "install-link.js",
       "updater.js",
-      "meta-signin.js",
       "package.json",
       "build/icon.png"
     ],

app/preload.js

@@ -6,8 +6,7 @@
 // the headset can't be reached, and keeps the Frame menu's list of headsets up to date.
 // It also receives frame-control://install links (docs/web-install.md): only
 // what the link asked for, never an install; the page asks the user first.
-// And it passes update state both ways: see app/updater.js. It opens the Sign in
-// with Meta window and signs out of it (app/meta-signin.js).
+// And it passes update state both ways: see app/updater.js.
 const { contextBridge, ipcRenderer, webUtils } = require("electron");
 
 contextBridge.exposeInMainWorld("frameApp", {
@@ -40,12 +39,6 @@ contextBridge.exposeInMainWorld("frameApp", {
     ipcRenderer.removeAllListeners("report:open");
     ipcRenderer.on("report:open", () => cb());
   },
-  // Sign in with Meta (app/meta-signin.js): Meta's login page in its own window. The
-  // answer is the server's (connected, display name), never the token.
-  meta: {
-    signIn: (acknowledged) => ipcRenderer.invoke("meta:signin", acknowledged === true),
-    signOut: () => ipcRenderer.invoke("meta:signout"),
-  },
   onInstallLink: (cb) => {
     ipcRenderer.removeAllListeners("install-link");
     ipcRenderer.on("install-link", (_e, req) => cb({ kind: req.kind, target: req.target }));

app/test/meta-signin.test.js

@@ -1,578 +0,0 @@
-// Run: node --test app/test/
-// "Sign in with Meta" (app/meta-signin.js) with fake Electron windows, sessions and cookies.
-const nodeTest = require("node:test");
-// A broken flow can leave a sign-in waiting forever; fail it instead of hanging.
-const test = (name, fn) => nodeTest(name, { timeout: 5000 }, fn);
-const assert = require("node:assert");
-const { EventEmitter } = require("node:events");
-const { createMetaSignIn, allowedUrl, looksLikeUserToken, scrub, PARTITION, LOGIN_URL, COOKIE } = require("../meta-signin");
-
-const TOKEN = "OCAbcdefghijklmnopQRSTUVwxyz0123456789abcdEFGH";
-const OTHER = "OCzyxwvutsrqponmlkJIHGFEDcba9876543210zyxwVUTS";
-
-class FakeCookies extends EventEmitter {
-  constructor() { super(); this.store = []; this.reads = 0; }
-  async get(filter) {
-    this.reads++;
-    return this.store.filter((c) => !filter.name || c.name === filter.name);
-  }
-  set(cookie) {  // as the page would: store it, then tell listeners
-    this.store = this.store.filter((c) => !(c.name === cookie.name && c.domain === cookie.domain)).concat(cookie);
-    this.emit("changed", {}, cookie, "explicit", false);
-  }
-}
-
-class FakeSession {
-  constructor(name, log) { this.name = name; this.log = log; this.cookies = new FakeCookies(); this.cleared = []; this.permission = null; }
-  setPermissionRequestHandler(fn) { this.permission = fn; }
-  setPermissionCheckHandler(fn) { this.permissionCheck = fn; }
-  getUserAgent() { return "Mozilla/5.0 Chrome/140.0 frame-control/0.4.4 Electron/44.4.5 Safari/537.36"; }
-  setUserAgent(ua) { this.ua = ua; }
-  async clearStorageData(opts) { this.log.push("clear"); this.cleared.push(["storage", opts]); }
-  async clearCache() { this.cleared.push(["cache"]); }
-  async clearAuthCache() { this.cleared.push(["auth"]); }
-}
-
-function fakes({ timeout } = {}) {
-  const log = [];  // the order things happened in
-  const sessions = new Map();
-  const defaultSession = new FakeSession("default", log);
-  const session = {
-    defaultSession,
-    fromPartition(name) {
-      if (!sessions.has(name)) sessions.set(name, new FakeSession(name, log));
-      return sessions.get(name);
-    },
-  };
-  const windows = [];
-  class BrowserWindow extends EventEmitter {
-    constructor(opts) {
-      super();
-      this.opts = opts;
-      this.destroyed = false;
-      this.veto = false;  // a page whose beforeunload keeps the window open on close()
-      this.focused = 0;
-      const wc = new EventEmitter();
-      wc.loaded = [];
-      wc.loadURL = async (u) => { wc.loaded.push(u); };
-      wc.setWindowOpenHandler = (fn) => { wc.openHandler = fn; };
-      // Deliberately a different session: the code must read the partition's, not guess.
-      wc.session = defaultSession;
-      this.webContents = wc;
-      windows.push(this);
-    }
-    isDestroyed() { return this.destroyed; }
-    focus() { this.focused++; }
-    close() { if (this.destroyed || this.veto) return; this.destroy(); }
-    destroy() { if (this.destroyed) return; this.destroyed = true; log.push("destroyed"); this.emit("closed"); }
-  }
-  const opened = [];
-  const shell = { openExternal: (u) => { opened.push(u); } };
-  const calls = [], attempts = [], cancels = [];
-  let answer = () => ({ status: 200, data: { connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" } });
-  const connect = async (token, attempt) => { calls.push(token); attempts.push(attempt); log.push("connect"); return answer(token); };
-  const cancel = async (attempt) => {
-    cancels.push(attempt);
-    log.push(`cancel (cookie listeners: ${session.fromPartition(PARTITION).cookies.listenerCount("changed")})`);
-  };
-  const flow = createMetaSignIn({ BrowserWindow, session, shell, connect, cancel, parent: () => null, ...(timeout ? { timeout } : {}) });
-  return { flow, session, sessions, windows, opened, calls, attempts, cancels, log, setAnswer: (fn) => { answer = fn; },
-           meta: () => session.fromPartition(PARTITION) };
-}
-
-const tick = () => new Promise((r) => setImmediate(r));
-async function settle() { for (let i = 0; i < 10; i++) await tick(); }
-
-function navigate(wc, event, target) {
-  let prevented = false;
-  wc.emit(event, { preventDefault: () => { prevented = true; } }, target);
-  return prevented;
-}
-
-test("only plain HTTPS addresses on Meta's login sites are allowed", () => {
-  for (const ok of ["https://secure.oculus.com", "https://secure.oculus.com/my/profile", "https://auth.meta.com/login/",
-                    "https://www.meta.com/", "https://www.facebook.com/login.php", "https://oculus.com:443/",
-                    "https://www.instagram.com/accounts/login/"]) {
-    assert.ok(allowedUrl(ok), ok);
-  }
-  for (const bad of ["http://secure.oculus.com/", "https://oculus.com.evil.example/", "https://evil-oculus.com/",
-                     "https://notmeta.com/", "https://example.com/", "javascript:alert(1)", "file:///etc/passwd",
-                     "https://secure.oculus.com:8443/", "https://user:pw@secure.oculus.com/", "https://evil.example/?u=https://www.meta.com",
-                     "data:text/html,hi", "not a url"]) {
-    assert.ok(!allowedUrl(bad), bad);
-  }
-});
-
-test("the window is isolated: its own partition, no preload, no Node, sandboxed, on Meta's login page", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const [w] = f.windows;
-  const wp = w.opts.webPreferences;
-  assert.strictEqual(wp.partition, PARTITION);
-  assert.strictEqual(PARTITION, "persist:meta-signin");
-  assert.strictEqual(wp.contextIsolation, true);
-  assert.strictEqual(wp.nodeIntegration, false);
-  assert.strictEqual(wp.sandbox, true);
-  assert.strictEqual(wp.preload, undefined);
-  assert.strictEqual(wp.devTools, false);
-  assert.deepStrictEqual(w.webContents.loaded, [LOGIN_URL]);
-  assert.strictEqual(LOGIN_URL, "https://secure.oculus.com");
-  // Permission prompts (camera, notifications...) are refused.
-  let granted = null;
-  f.meta().permission(null, "media", (v) => { granted = v; });
-  assert.strictEqual(granted, false);
-  assert.strictEqual(f.meta().permissionCheck(null, "notifications", "https://secure.oculus.com"), false);
-  assert.ok(!/Electron|frame-control/.test(f.meta().ua));
-  w.close();
-});
-
-test("navigation stays on Meta's sites; other links open in the system browser", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(navigate(wc, "will-navigate", "https://auth.meta.com/login/"), false);
-  assert.strictEqual(navigate(wc, "will-navigate", "https://www.facebook.com/login.php"), false);
-  assert.strictEqual(navigate(wc, "will-navigate", "https://example.com/help"), true);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help"]);
-  // A redirect elsewhere is stopped and not opened anywhere (it may carry sign-in data).
-  assert.strictEqual(navigate(wc, "will-redirect", "https://evil.example/cb?x=1"), true);
-  assert.strictEqual(navigate(wc, "will-redirect", "https://auth.meta.com/next"), false);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help"]);
-  // New windows: never created. Meta's own load in this window; others go outside; non-web schemes nowhere.
-  assert.deepStrictEqual(wc.openHandler({ url: "https://www.meta.com/legal/terms/" }), { action: "deny" });
-  assert.deepStrictEqual(wc.openHandler({ url: "https://example.org/" }), { action: "deny" });
-  assert.deepStrictEqual(wc.openHandler({ url: "file:///etc/passwd" }), { action: "deny" });
-  await settle();
-  assert.deepStrictEqual(wc.loaded, [LOGIN_URL, "https://www.meta.com/legal/terms/"]);
-  assert.deepStrictEqual(f.opened, ["https://example.com/help", "https://example.org/"]);
-  f.windows[0].close();
-});
-
-test("the cookie is read only from the sign-in partition, only for Meta's Oculus domain", async () => {
-  const f = fakes();
-  // The same cookie elsewhere: the default session and another partition. Never read.
-  f.session.defaultSession.cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  f.session.fromPartition("persist:other").cookies.store.push({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  const done = f.flow.signIn();
-  const w = f.windows[0];
-  // A cookie with the right name on another site, and a signed-out value: ignored.
-  f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: OTHER });
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: "OC123456789012345" });
-  w.webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(f.session.defaultSession.cookies.reads, 0);
-  assert.strictEqual(f.session.fromPartition("persist:other").cookies.reads, 0);
-  assert.ok(f.sessions.get(PARTITION).cookies.reads > 0);
-});
-
-test("landing on the logged-in page picks up a cookie set earlier", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.store.push({ name: COOKIE, domain: "secure.oculus.com", value: TOKEN });  // no change event
-  f.windows[0].webContents.emit("did-navigate", {}, "https://auth.meta.com/login/");  // not Meta's store site yet
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");
-  assert.strictEqual((await done).ok, true);
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("after a connect the window closes, and the page gets the answer, never the token", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.ok(f.windows[0].isDestroyed());
-  assert.ok(!f.flow.isOpen());
-  assert.deepStrictEqual(r, { ok: true, connected: true, user: { name: "Alex" }, message: "Connected your Meta account (Experimental)" });
-  assert.ok(!JSON.stringify(r).includes(TOKEN));
-  // The cookie listener is gone: a later change sends nothing.
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("a token the server refuses keeps the window open, is sent once, and the next one connects", async () => {
-  const f = fakes();
-  f.setAnswer((t) => t === TOKEN ? { status: 400, data: { error: "Meta didn't accept this token." } }
-                                 : { status: 200, data: { connected: true, user: null } });
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].webContents.emit("did-navigate", {}, "https://secure.oculus.com/my/profile");  // same value again
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  assert.ok(!f.windows[0].isDestroyed());
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  const r = await done;
-  assert.deepStrictEqual(f.calls, [TOKEN, OTHER]);
-  assert.strictEqual(r.ok, true);
-  assert.strictEqual(r.user, null);
-});
-
-test("the token is never logged, and an error that echoed it is scrubbed", async () => {
-  const seen = [];
-  const names = ["log", "info", "warn", "error", "debug", "trace"];
-  const saved = Object.fromEntries(names.map((n) => [n, console[n]]));
-  const writes = [process.stdout.write, process.stderr.write];
-  for (const n of names) console[n] = (...a) => { seen.push(a.map(String).join(" ")); };
-  process.stdout.write = (c, ...rest) => { seen.push(String(c)); return writes[0].call(process.stdout, c, ...rest); };
-  process.stderr.write = (c, ...rest) => { seen.push(String(c)); return writes[1].call(process.stderr, c, ...rest); };
-  let r;
-  try {
-    const f = fakes();
-    f.setAnswer((t) => ({ status: 500, data: { error: `RuntimeError: bad ${t} and ${t.slice(0, 12)}` } }));
-    const done = f.flow.signIn();
-    f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-    await settle();
-    f.windows[0].close();  // the user gives up
-    r = await done;
-  } finally {
-    for (const n of names) console[n] = saved[n];
-    [process.stdout.write, process.stderr.write] = writes;
-  }
-  assert.strictEqual(r.ok, false);
-  assert.strictEqual(r.cancelled, true);
-  assert.ok(!r.error.includes(TOKEN) && !r.error.includes(TOKEN.slice(0, 12)), r.error);
-  assert.match(r.error, /<redacted>/);
-  assert.ok(!seen.some((s) => s.includes(TOKEN.slice(0, 12))), "token in output");
-  assert.strictEqual(scrub(`x FRL${"a".repeat(30)} y`), "x <redacted> y");
-});
-
-test("closing the window before signing in reports it, and a second click reuses the open window", async () => {
-  const f = fakes();
-  const a = f.flow.signIn();
-  const b = f.flow.signIn();
-  assert.strictEqual(a, b);
-  assert.strictEqual(f.windows.length, 1);
-  assert.strictEqual(f.windows[0].focused, 1);
-  f.windows[0].close();
-  const r = await a;
-  assert.deepStrictEqual(r, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." });
-  assert.deepStrictEqual(f.calls, []);
-});
-
-test("disconnect's sign-out closes the window and clears only the sign-in partition", async () => {
-  const f = fakes();
-  f.session.fromPartition("persist:other");
-  const pending = f.flow.signIn();
-  await f.flow.signOut();
-  const r = await pending;
-  assert.strictEqual(r.ok, false);
-  assert.ok(f.windows[0].isDestroyed());
-  assert.deepStrictEqual(f.meta().cleared, [["storage", undefined], ["cache"], ["auth"]]);
-  assert.deepStrictEqual(f.session.defaultSession.cleared, []);
-  assert.deepStrictEqual(f.session.fromPartition("persist:other").cleared, []);
-  // The next sign-in starts with a new window.
-  f.flow.signIn();
-  assert.strictEqual(f.windows.length, 2);
-  f.windows[1].close();
-});
-
-test("the first look at a cookie value matches the server's token rules", () => {
-  assert.ok(looksLikeUserToken(TOKEN));
-  assert.ok(looksLikeUserToken("FRL" + "aB3".repeat(10)));
-  for (const bad of [undefined, "", "OC123456789012345", "OC|123|abc", "OCabc%2Fdef" + "x".repeat(20), "OCshort",
-                     "XY" + "a".repeat(30), "OC" + "A".repeat(30)]) {
-    assert.ok(!looksLikeUserToken(bad), String(bad));
-  }
-});
-
-function frameNav(wc, url, isMainFrame) {
-  let prevented = false;
-  wc.emit("will-frame-navigate", { url, isMainFrame, preventDefault: () => { prevented = true; } });
-  return prevented;
-}
-
-test("the window stays on Meta's sites; frames inside it may load any HTTPS page, nothing else", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  // Frames: captcha and CDN frames from other sites load; other schemes are stopped.
-  for (const ok of ["https://client-api.arkoselabs.com/fc/gc/", "https://newassets.hcaptcha.com/captcha/v1/x",
-                    "https://www.google.com/recaptcha/api2/anchor", "https://static.xx.fbcdn.net/x",
-                    "https://www.facebook.com/plugin", "about:blank", "about:srcdoc"]) {
-    assert.strictEqual(frameNav(wc, ok, false), false, ok);
-  }
-  for (const bad of ["http://www.facebook.com/plugin", "data:text/html,<script>x</script>", "blob:https://evil.example/1",
-                     "javascript:alert(1)", "file:///etc/passwd", "ftp://example.com/", "https://u:p@evil.example/",
-                     "chrome://settings", "not a url"]) {
-    assert.strictEqual(frameNav(wc, bad, false), true, bad);
-  }
-  // The window itself: Meta's sites only.
-  assert.strictEqual(frameNav(wc, "about:blank", true), true);
-  assert.strictEqual(frameNav(wc, "https://evil.example/", true), true);
-  assert.strictEqual(frameNav(wc, "https://client-api.arkoselabs.com/", true), true);
-  assert.strictEqual(frameNav(wc, "https://auth.meta.com/login/", true), false);
-  assert.deepStrictEqual(f.opened, []);  // stopped, never opened outside
-  f.windows[0].destroy();
-});
-
-function redirect(wc, url, isMainFrame, style) {
-  let prevented = false;
-  const e = { preventDefault: () => { prevented = true; } };
-  if (style === "details") wc.emit("will-redirect", Object.assign(e, { url, isMainFrame }));
-  else wc.emit("will-redirect", e, url, false, isMainFrame);
-  return prevented;
-}
-
-test("redirects follow the same rule per frame", async () => {
-  const f = fakes();
-  f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  for (const style of ["details", "positional"]) {
-    // A captcha frame redirected within HTTPS loads; a frame redirected to data: or http: doesn't.
-    assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", false, style), false, style);
-    assert.strictEqual(redirect(wc, "https://newassets.hcaptcha.com/x", false, style), false, style);
-    assert.strictEqual(redirect(wc, "data:text/html,<b>x</b>", false, style), true, style);
-    assert.strictEqual(redirect(wc, "http://www.facebook.com/x", false, style), true, style);
-    assert.strictEqual(redirect(wc, "javascript:alert(1)", false, style), true, style);
-    // The window: Meta's sites only.
-    assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/v2/next", true, style), true, style);
-    assert.strictEqual(redirect(wc, "https://auth.meta.com/next", true, style), false, style);
-  }
-  // Without frame information it is treated as the window.
-  assert.strictEqual(redirect(wc, "https://client-api.arkoselabs.com/", undefined, "positional"), true);
-  assert.deepStrictEqual(f.opened, []);
-  f.windows[0].destroy();
-});
-
-test("a redirect the window stops is named when the window is closed", async () => {
-  const f = fakes();
-  const p = f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(redirect(wc, "https://www.instagram.com/x?next=1", true, "details"), false);  // Meta's login goes here
-  assert.strictEqual(redirect(wc, "https://login.evil.example/cb?code=SECRET", true, "details"), true);
-  f.windows[0].close();
-  const r = await p;
-  assert.strictEqual(r.ok, false);
-  assert.match(r.error, /went to login\.evil\.example, which Frame Control doesn't allow/);
-  assert.doesNotMatch(r.error, /SECRET|code=/);
-});
-
-test("a stopped redirect is forgotten once the window loads a page again", async () => {
-  const f = fakes();
-  const p = f.flow.signIn();
-  const wc = f.windows[0].webContents;
-  assert.strictEqual(redirect(wc, "https://login.evil.example/cb", true, "details"), true);
-  wc.emit("did-navigate", {}, "https://auth.meta.com/login/");  // the user carried on
-  f.windows[0].close();
-  assert.deepStrictEqual(await p, { ok: false, cancelled: true, error: "The sign-in window was closed before you signed in." });
-});
-
-test("a page's beforeunload can't keep the window open", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  const w = f.windows[0];
-  let prevented = false;
-  w.webContents.emit("will-prevent-unload", { preventDefault: () => { prevented = true; } });
-  assert.ok(prevented);
-  // Even if close() would be vetoed, finishing destroys the window.
-  w.veto = true;
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  assert.strictEqual((await done).ok, true);
-  assert.ok(w.isDestroyed());
-});
-
-test("closing during a connect: the cancel goes to the server only after that connect settles", async () => {
-  for (const outcome of ["saved", "refused", "failed"]) {
-    const f = fakes();
-    let release, fail;
-    f.setAnswer(() => new Promise((r, j) => { release = r; fail = j; }));
-    const done = f.flow.signIn();
-    f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-    await settle();
-    assert.deepStrictEqual(f.calls, [TOKEN]);
-    f.windows[0].close();  // the user gives up while the server and Meta are answering
-    const r = await done;  // the page hears at once
-    assert.strictEqual(r.ok, false);
-    await settle();
-    assert.deepStrictEqual(f.cancels, [], outcome);  // not before the connect has settled
-    if (outcome === "saved") release({ status: 200, data: { connected: true } });
-    else if (outcome === "refused") release({ status: 400, data: { error: "no" } });
-    else fail(new Error("socket hang up"));
-    await settle();
-    // The same attempt id the connect carried, after it settled and after cookie intake stopped.
-    assert.deepStrictEqual(f.cancels, [f.attempts[0]], outcome);
-    assert.match(f.cancels[0], /^[A-Za-z0-9-]{8,64}$/);
-    assert.deepStrictEqual(f.log, ["connect", "destroyed", "cancel (cookie listeners: 0)"], outcome);
-    assert.deepStrictEqual(f.calls, [TOKEN]);
-  }
-});
-
-test("closing before any connect needs no cancel", async () => {
-  const f = fakes();
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".evil.example", value: TOKEN });  // nothing usable
-  await settle();
-  f.windows[0].close();
-  assert.strictEqual((await done).ok, false);
-  await f.flow.signOut();
-  await settle();
-  assert.deepStrictEqual(f.calls, []);
-  assert.deepStrictEqual(f.cancels, []);
-});
-
-test("a timeout during a connect cancels after it settles", async () => {
-  const f = fakes({ timeout: 50 });
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));  // Meta is slow
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  const r = await done;
-  assert.match(r.error, /timed out/);
-  assert.ok(f.windows[0].isDestroyed());
-  assert.deepStrictEqual(f.cancels, []);
-  release({ status: 400, data: { error: "no" } });
-  await settle();
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("disconnect during a connect waits for it, cancels it, then clears, before the page deletes the account", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.log.length = 0;
-  let signedOut = false;
-  const out = f.flow.signOut().then(() => { signedOut = true; });  // the page's Disconnect, step one
-  assert.strictEqual((await done).ok, false);
-  await settle();
-  assert.strictEqual(signedOut, false);  // still waiting for the connect
-  assert.deepStrictEqual(f.cancels, []);
-  release({ status: 200, data: { connected: true } });  // it saved, just now
-  await out;
-  // Only now would the page post its disconnect: the cancel (which deletes what that
-  // connect saved) has reached the server, and the session is cleared.
-  assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]);
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("a later disconnect still waits for a closed window's connect", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const done = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();
-  await done;
-  let signedOut = false;
-  const out = f.flow.signOut().then(() => { signedOut = true; });
-  await settle();
-  assert.strictEqual(signedOut, false);
-  release({ status: 400, data: { error: "no" } });
-  await out;
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-});
-
-test("nothing sent means nothing to cancel; sign-out destroys the window, cancels, then clears", async () => {
-  const f = fakes();
-  // Nothing sent: closing cancels nothing.
-  const a = f.flow.signIn();
-  f.windows[0].close();
-  await a;
-  assert.deepStrictEqual(f.cancels, []);
-  // Something sent, then signed out: the attempt is cancelled before the session is cleared.
-  f.setAnswer(() => ({ status: 400, data: { error: "Meta didn't accept this token." } }));
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[1].veto = true;  // and its page tries to stay open
-  f.log.length = 0;
-  await f.flow.signOut();
-  assert.strictEqual((await b).ok, false);
-  assert.ok(f.windows[1].isDestroyed());
-  assert.deepStrictEqual(f.log, ["destroyed", "cancel (cookie listeners: 0)", "clear"]);
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-  // After sign-out a new cookie in the partition sends nothing.
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-});
-
-test("each sign-in has its own attempt id", async () => {
-  const f = fakes();
-  f.setAnswer(() => ({ status: 400, data: { error: "no" } }));
-  const a = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();
-  await a;
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  f.windows[1].close();
-  await b;
-  await settle();
-  assert.strictEqual(f.attempts.length, 2);
-  assert.notStrictEqual(f.attempts[0], f.attempts[1]);
-  assert.deepStrictEqual(f.cancels, f.attempts);
-});
-
-test("no sign-in can start while a sign-out waits on an earlier connect", async () => {
-  const f = fakes();
-  let release;
-  f.setAnswer(() => new Promise((r) => { release = r; }));
-  const first = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  const out = f.flow.signOut();  // Disconnect pressed while that connect is under way
-  assert.strictEqual((await first).ok, false);
-  assert.ok(f.flow.isSigningOut());
-  // The page answered, so the user tries again at once: refused, no window, nothing sent.
-  const second = await f.flow.signIn();
-  assert.deepStrictEqual(second, { ok: false, error: "Frame Control is signing out of Meta; try again in a moment." });
-  assert.strictEqual(f.windows.length, 1);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  assert.deepStrictEqual(f.calls, [TOKEN]);
-  // A second sign-out joins the first.
-  assert.strictEqual(f.flow.signOut(), out);
-  release({ status: 200, data: { connected: true } });
-  await out;
-  assert.deepStrictEqual(f.cancels, [f.attempts[0]]);
-  assert.strictEqual(f.meta().cleared.filter(([k]) => k === "storage").length, 1);
-  assert.ok(!f.flow.isSigningOut());
-  // Once it is done, signing in works again.
-  f.setAnswer(() => ({ status: 200, data: { connected: true } }));
-  const third = f.flow.signIn();
-  assert.strictEqual(f.windows.length, 2);
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  assert.strictEqual((await third).ok, true);
-});
-
-test("sign-out goes round until no window and no connect or cancel is left", async () => {
-  const f = fakes();
-  let releaseA;
-  f.setAnswer(() => new Promise((r) => { releaseA = r; }));
-  const a = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: TOKEN });
-  await settle();
-  f.windows[0].close();  // window A closed; its cancel waits on its connect
-  await a;
-  // Window B is open, with its own connect under way, when sign-out starts.
-  let releaseB;
-  f.setAnswer(() => new Promise((r) => { releaseB = r; }));
-  const b = f.flow.signIn();
-  f.meta().cookies.set({ name: COOKIE, domain: ".oculus.com", value: OTHER });
-  await settle();
-  let finished = false;
-  const out = f.flow.signOut().then(() => { finished = true; });
-  await b;
-  releaseB({ status: 400, data: { error: "no" } });
-  await settle();
-  assert.strictEqual(finished, false);  // A's connect is still under way
-  releaseA({ status: 200, data: { connected: true } });
-  await out;
-  assert.deepStrictEqual([...f.cancels].sort(), [...f.attempts].sort());
-  assert.strictEqual(f.attempts.length, 2);
-  assert.strictEqual(f.log[f.log.length - 1], "clear");
-});

docs/apks.md

@@ -39,12 +39,6 @@ section below), instead of going into Lepton Development:
    run at once alongside Lepton Development, each in its own container
    (`lepton-steamlaunch-<id>`, ADB on 5556, 5557, …).
 
-Split APKs (a base plus `split_*.apk` files) install as one app:
-`python3 ui/frame_android.py install base.apk split1.apk …`. Lepton runs one
-APK, so splits that add native libraries or assets are merged into the base
-and re-signed; density and language splits are refused. See
-[quest-import.md](quest-import.md#split-apks). Not yet tried on a real Frame.
-
 Verified with AntennaPod and Tabletop Tools: installed in about 7 s, launched
 from the shortcut, stopped, and relaunched with their data intact. ADB and
 Lepton Development aren't involved.
@@ -183,6 +177,63 @@ See
 [compat-db/README.md](../compat-db/README.md) and
 [apk-catalog/README.md](../apk-catalog/README.md).
 
+## Store and Library in Frame Control
+
+The Android tab has two views. **Store** finds apps across the sources (F-Droid,
+IzzyOnDroid, curated GitHub releases, itch.io). **Library** shows the apps on the
+Frame as cards, with Play and a menu for Test, Report and Remove; the display
+settings and recent reports are below it.
+
+The store groups apps by what a headset is good for, not by F-Droid's list:
+VR, Games, Emulators, Watch & listen, Read & learn, Create, Work, Web & chat
+and Tools (`ui/apk_sources/_categories.py`). A VR app is always in VR. Otherwise
+F-Droid's own categories decide, the finer one first (an app in *Multimedia* and
+*Social Network* is Web & chat).
+
+Apps built around a phone are hidden from browsing unless **Show phone-only
+apps** is on; a search always finds them, labelled *Phone app*. Hidden: apps in
+a category that only makes sense in a phone's own system (launchers, keyboards,
+wallpapers, Xposed modules), apps in a phone-side category (calls and SMS, VPNs,
+fitness, alarms, system tools) unless a useful category says otherwise
+(FluffyChat is in Phone & SMS, but it's a messenger), apps named for a phone
+part (a widget, a launcher, a battery tool), and apps that need hardware the
+Frame lacks (an IR blaster, a watch, NFC, root). They would install and run in
+Lepton, but do nothing useful on the Frame. In the October 2026 indexes that is
+about 1,600 of F-Droid's 4,500 apps and 550 of IzzyOnDroid's 1,300.
+
+Without a search, each source offers its best 300 for the chosen category:
+apps with a banner first, then with screenshots, then the newest.
+
+## The store in the headset: Frame Control's store as a panel (inferred, not yet run on the Frame)
+
+The **APK Store** panel is the Store above, drawn for the laser: the same
+sources, categories and artwork, with Install, Open, Stop and Remove, opened as
+its own floating panel:
+
+```sh
+scripts/store-on-frame.sh open     # copy the server over if it changed, start it, open the panel
+scripts/store-on-frame.sh close
+```
+
+`open` copies the same bundle the iPhone app uses
+(`ios/scripts/make_frame_bundle.py`) to
+`~/.local/share/frame-control/store-server/<version>` on the Frame. It then
+starts `ui/server.py` there with `FRAME_LOCAL=1` on `127.0.0.1:47812`, with a
+fresh `X-Frame-UI` key. Chromium XR (or the `org.chromium.Chromium` Flatpak)
+opens `/store` (`ui/store.html`) in a 1280×800 app window, tagged as panel
+`2001947812` ([panels.md](panels.md)). Downloads, SHA-256 checks and installs
+all run on the Frame, so the Mac can go away after `open`.
+
+The page has a category rail (Home, the store's categories, Installed), eight
+art cards a page, and a featured VR app on Home. It turns pages instead of
+scrolling, because a tagged panel gets mouse clicks and a drag would select
+text; the thumbstick (a mouse wheel) turns pages, and an on-screen keyboard is
+there for search. **Checked on the Mac only** (2026-10-14, 1280×800, against
+the real sources): Home, categories, Installed, the detail sheet. **Still to
+check in the headset:** that the panel opens and takes laser clicks, that an
+install completes when run on the Frame, and that **Open** brings up the app's
+panel.
+
 ## In-headset app store: F-Droid 1.17 (verified 2026-09-25)
 
 F-Droid 1.23 uses an old Compose and crashes on launch. **F-Droid 1.17.2**, the

docs/frame-control.md

@@ -133,7 +133,7 @@ rejects invalid types, out-of-range levels and invalid mute states before SSH.
 Other settings link to the existing forms and their validation, progress,
 confirmations and reset behavior: per-instance Android resolution/density/text,
 comfort sessions and alerts, media layouts, Mac streaming quality, privacy,
-sources and artwork. Android display links reveal **On your Frame** before
+sources and artwork. Android display links reveal the **Library** before
 scrolling to the form. Mac streaming remains searchable on all platforms, with
 its action shown only when the server is on macOS.
 

docs/meta-library.md

@@ -1,371 +0,0 @@
-# My Meta library (Experimental)
-
-Install Quest games your Meta account owns straight from Meta, test whether
-they run on the Steam Frame, and add the result to the shared compatibility
-reports. It is off until you connect, and it lives in **Android → My Meta
-library**.
-
-**Read this first.** My Meta library uses Meta's undocumented internal API
-with your own Meta access token, as the open-source tools QAVS, DownQuest and
-BSManager do. It may stop working whenever Meta changes things, and using it
-may be against Meta's terms. Your account is your responsibility. Frame
-Control is unofficial and not made or endorsed by Meta or Valve.
-
-What it will and won't do:
-
-- It lists and downloads only games your account owns (its active
-  entitlements). It never downloads anything else.
-- It installs games as Meta ships them. There is **no licence-check bypass**:
-  no patching, no stub libraries, no OVRPort or FramePort. A game that
-  enforces Meta's licence check may quit or hang on the Frame, because that
-  check needs Meta's services, which the Frame doesn't have.
-- Game files go only to a cache folder on your computer and then to your
-  Frame. They are deleted from the cache after each install, and never
-  uploaded or shared. Reports carry results only (below), never files or your
-  token.
-
-## Your token
-
-Frame Control never reads your browser's cookies. There are two ways to give
-it your token.
-
-**Sign in with Meta** (desktop app only; a plain browser doesn't show it).
-Tick **I understand…**, then choose **Sign in with Meta…**. Meta's own login
-page (`https://secure.oculus.com`, the address BSManager's "Log in with Meta"
-opens) appears in a Frame Control window. Sign in there as usual. When Meta's
-site sets its access token cookie (`oc_ac_at`), Frame Control takes it from
-that window, connects with it exactly as if you had pasted it (below), and
-closes the window. The window:
-
-- has its own storage (the Electron session `persist:meta-signin`), separate
-  from Frame Control's main window and from every browser on your computer;
-  the cookie is read only from there, and only for `oculus.com`;
-- runs Meta's page sandboxed, with no access to Frame Control (no preload, no
-  Node, context isolation on, no developer tools) and every permission request
-  or check (camera, notifications…) refused;
-- only goes to `https://` pages on `oculus.com`, `meta.com`, `facebook.com` and
-  `instagram.com` (and their subdomains; Meta's login passes through Instagram).
-  A link anywhere else opens in your system browser; a redirect anywhere else
-  is stopped, and closing the window then says where it went. Pop-ups on those sites open in the same
-  window. Frames inside the page may load any `https://` page (Meta's login
-  can embed captcha and CDN frames from other sites, such as Arkose Labs,
-  hCaptcha, reCAPTCHA or fbcdn) or an empty frame (`about:blank`,
-  `about:srcdoc`); a frame going to any other scheme (`http:`, `data:`,
-  `blob:`, `javascript:`, `file:`…) is just stopped. Redirects follow the same
-  rule for the frame they happen in. Frames can't reach the
-  token: the cookie is read by Frame Control's main process, and the window
-  has no IPC;
-- sends a cookie value on only if it looks like a user token (`OC` or `FRL`,
-  mixed case, no `%`, `|` or `:`), and each value once. If the server refuses
-  it, the window stays open; close it to see why;
-- gives up after 10 minutes, as BSManager does;
-- when it is closed, times out or is signed out of, stops reading cookies
-  first, then is destroyed (a page's "leave this page?" can't keep it open),
-  and, if it had sent a token, tells the server to drop that sign-in: each
-  sign-in has a random attempt id. The cancel is sent only once the connect
-  under way has finished (saved, refused or failed), so the server always
-  gets it after the connect; with nothing sent, there is nothing to cancel.
-  The server lists an attempt only while its
-  connect is being checked: cancelled then, it isn't saved; cancelled just
-  after its token was saved (even before the connect has finished tidying
-  up), that token is deleted (as a disconnect). A cancel
-  never removes an account a later sign-in or a pasted token saved, and one
-  for an unknown attempt changes nothing.
-
-The page never sees the token: the desktop app hands it straight to the local
-server's connect path and tells the page only the answer (connected, and your
-Meta display name). It isn't logged anywhere.
-
-The window keeps you signed in to Meta (in `persist:meta-signin` only) until
-you **Disconnect**, which also signs out of Meta in Frame Control: it clears
-that window's cookies, storage and cache, so the next sign-in starts fresh.
-**Sign out of Meta in Frame Control** next to the sign-in button does just
-that part, for a sign-in that didn't connect.
-
-**Paste a token.** You copy your own token and paste it in. The two ways
-BSManager's guide describes
-([How to obtain your Oculus Token](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token)):
-
-1. **From the Meta website.** Sign in at `https://secure.oculus.com`. Open the
-   browser's developer tools, then **Application** (Chrome, Edge) or
-   **Storage** (Firefox) → **Cookies** → `https://secure.oculus.com`. Copy the
-   value of `oc_ac_at`. It starts with `OC`.
-2. **From the Meta Quest PC app** (Windows). Press **Ctrl+Shift+I**, open
-   **Network**, press **Ctrl+R**, type `graph` in the filter, open the first
-   request, and copy the access token from its **Payload**. It starts with
-   `FRL`.
-
-Treat it like a password: anyone with it can act as your Meta account. Signing
-out of the Meta website or app usually ends it; then connect again with a new
-one.
-
-Frame Control refuses values that can't be a user token before sending them
-anywhere: anything not starting with `OC` or `FRL`, URL-encoded copies (with
-`%`), app tokens (with `|` or `:`), cut-off values (under 20 characters), and
-anything with characters other than letters, digits and `+ / = - _` (the
-base64 and URL-safe base64 sets), or with no lower-case letter (real tokens are
-mixed case). The public tools only describe tokens made
-of letters and digits; if a real token needs another character, it has to be
-added in one place (`TOKEN_CHARS` in `ui/frame_meta.py`), which also makes
-the redaction look for it.
-
-## Using it
-
-1. Tick **I understand…**, then either choose **Sign in with Meta…** (desktop
-   app) or paste your token and choose **Connect**. Frame Control asks Meta
-   "who am I" with it (a read-only query); only a token Meta accepts is kept.
-2. Your Quest games are listed with their version, size, game data, and the
-   community verdict from the compatibility database when there is one.
-3. **Install** downloads the game and installs it on the Frame, as [Import
-   from my Quest](quest-import.md) does. A game with OBB game data then needs
-   a second **Install** while you have it open on the Frame: Frame Control
-   downloads the data, copies it in and closes the game.
-4. **Install and test** does the same, then starts the game itself (twice if
-   it has game data to add: once to add it, once for the test), watches it for
-   about 30 seconds, and records what happened. **Test again** repeats only
-   the test.
-5. Choose **Install** on as many games as you like: they wait in the
-   **Install queue** and install one after another, with Quest imports and
-   Android store installs. **Remove** takes one out before it starts.
-6. **Disconnect** deletes the token from your computer and, in the desktop
-   app, signs out of Meta in Frame Control (clears the sign-in window's
-   storage). Games already on the Frame stay.
-
-From a terminal (the token is read from standard input, never an argument):
-
-```sh
-python3 ui/frame_meta.py connect --token-stdin      # paste the token, press Enter
-python3 ui/frame_meta.py status
-python3 ui/frame_meta.py list [--refresh]           # owned Quest games, with community verdicts
-python3 ui/frame_meta.py download APP_ID            # into the local install cache (a later download clears it after 6 hours)
-python3 ui/frame_meta.py install APP_ID [--test] [--allow-downgrade]
-python3 ui/frame_meta.py test com.example.game [--wait 30] [--no-report]
-python3 ui/frame_meta.py disconnect
-```
-
-The local API: `GET /api/meta` (connected or not, never the token),
-`GET /api/meta?library=1[&refresh=1]` (the games), and `POST /api/meta` with
-`{"action": "connect", "token": "...", "acknowledged": true}`,
-`{"action": "disconnect"}`, `{"action": "cancel-signin", "attempt": "..."}`, `{"action": "install", "app": "APP_ID", "test": false,
-"allowDowngrade": false}` or `{"action": "test", "package": "..."}`. Install and
-test return a background job (`/api/job`); an install waits its turn in the
-install queue (`/api/queue`, see [Import from my Quest](quest-import.md#using-it)). Sign in with Meta uses the same
-`connect` action: the desktop app's main process (`app/meta-signin.js`) posts
-it with the cookie's value and an `"attempt"` id (8 to 64 letters, digits or
-`-`) once the page's acknowledgement box is ticked. A connect whose attempt
-was cancelled while it was checked answers 409 and saves nothing;
-`cancel-signin` for an attempt whose token is the saved account deletes it.
-
-## What an install does
-
-1. Checks the game is in your library (by its Meta app id), and that there's
-   room on this computer for the APK, a patched copy of it and the game data.
-2. Downloads the APK from Meta's download server, within the size Meta
-   declared (and at most 2 GB), checking its SHA-256 if Meta gives one, and
-   that it is an APK of the package and version Meta said.
-3. Runs Import from my Quest's checks. Refused: 32-bit-only builds (no
-   `arm64-v8a`), and apps that need an Android newer than Lepton's (API 30).
-   Installed with a warning: games that use Meta's licence check
-   (`libovrplatformloader.so`), and VrApi-only games ("may not run").
-4. Installs it with `frame_android.install` (VR detection, the launcher fix,
-   the OpenXR compatibility layer, artwork, a Steam library entry). An older
-   copy never silently replaces a newer one on the Frame unless you tick
-   **Allow replacing a newer version**.
-5. Game data: the app's OBB (saved as Meta names it when that is a standard
-   `main|patch.<version>.<package>.obb` name, otherwise as
-   `main.<version code>.<package>.obb`) and any *required* asset files with
-   standard OBB names, at most 8 GB each. One install downloads at most 16 GB
-   in all, APK included, counted as the bytes arrive (so files whose size Meta
-   doesn't give count too); a file that goes past it is stopped and removed.
-   The data is copied into the
-   running game by the same two-step helper Import from my Quest uses. Other
-   asset files (DLC packs, `.pak` files a game fetches through Meta's
-   Platform SDK) aren't downloaded; the result lists them.
-6. Deletes everything it downloaded, whether the install worked or not.
-   Downloads left by a crash are removed after six hours.
-
-## The test, and the report
-
-The test starts the game, waits for its Lepton instance, then looks every 10
-seconds for 30 seconds: is the game's process alive, and what does its Android
-log (main, system and crash buffers) say. It recognises:
-
-| In the log | Cause given |
-|---|---|
-| "entitlement check failed", "not entitled", `ovr_Entitlement…` or `IsUserEntitledToApplication` reporting a failure (a call that passes doesn't count) | Meta's licence check failed |
-| Platform SDK initialisation errors | Meta's Platform SDK couldn't start |
-| `Failed to launch SystemActivities`, "device not supported" | The game checks it is on a Meta Quest |
-| `vrapi_… was called before…`, VrApi load errors | Legacy VrApi |
-| `XR_ERROR_EXTENSION_NOT_PRESENT` (with the extension's name) | An OpenXR feature the Frame lacks |
-| `XR_ERROR_API_VERSION_UNSUPPORTED`, runtime/initialisation failures | OpenXR version or session problems |
-| `VK_ERROR_DEVICE_LOST`, `zink`, `libgallium_dri.so`, `GL_INVALID_…`, shader failures | Graphics driver errors |
-| `ClipboardManager` | Lepton's missing clipboard service |
-| `NoSuchMethodError`, `UnsatisfiedLinkError`, `dlopen failed` | Android or library features Lepton lacks |
-| `FATAL EXCEPTION`, `Fatal signal`, `SIGSEGV` | A crash |
-| `ANR in …`, "Input dispatching timed out" | Not responding |
-| `XR_SESSION_STATE_SYNCHRONIZED/VISIBLE/FOCUSED`, `xrEndFrame` | The VR scene started |
-
-The outcome is one of **runs** or **runs with issues** (its VR scene
-started), **quits** (closed by itself), **crashes**, **hangs** (Android
-reported it not responding; Frame Control then closes it, and says so if it
-couldn't), **didn't start** (its instance never came up), or **no clear
-result**: it stayed open but its log never showed its VR scene starting. That
-can be a game still loading, or one stuck after a failed check; Frame Control
-can't tell, so it doesn't record it. A game already open is closed first, so
-the test starts clean; if it can't be closed, nothing is tested. If the Frame
-fails while the test reads the game or its log, the test says only that it
-couldn't read the log: a failed command's output can be the game's log, so it
-is never shown. Signatures look at the first 4 KB of each log line and are
-bounded, so a huge or hostile log can't make the test slow. They
-are written for Frame Control from the research in [vr-apks.md](vr-apks.md);
-they are not copied from other tools.
-
-The result goes through the same path as **Test** and **Report**
-(`frame_catalog.add_report`): `via` probe, source `meta-store`, the result
-(`runs`, `crashes` or `instance_failed`, the values the database accepts), and
-notes with the outcome, the cause, the names of the matched signals and the
-version code, all fixed texts. Nothing else: no token, account name, file or
-log text. The page may show a short name from the log next to the cause (an
-OpenXR extension, a library, an exception class or a signal), taken from the
-log line after the token is removed from it, and left out unless it looks like
-a real name (64 characters at most, no long mixed letter-and-digit runs);
-reports never carry it. It is always kept on this
-computer; it reaches the shared database only if **Share compatibility
-results** is on in Privacy settings, as for every report. The panel offers to
-turn that on.
-
-## Your token and privacy
-
-- Kept in `meta-account.json` in Frame Control's per-user data folder
-  (`~/Library/Application Support/Frame Control` on macOS,
-  `%APPDATA%\Frame Control` on Windows, `~/.local/share/frame-control` on
-  Linux), written owner-only (0600) through a temporary file. Never on the
-  Frame.
-- Sent only to `graph.oculus.com` (in the POST body) and
-  `securecdn.oculus.com` (in the download address, which is how that server
-  takes it), over HTTPS. A download that redirects elsewhere (Meta's CDN) is
-  followed only to a plain HTTPS address on port 443 that doesn't carry the
-  token in any form, anywhere (host, path, query or fragment; literal,
-  recased, percent-encoded, or 8+ characters of it), nor an `access_token`
-  parameter. That is checked before any lookup or connection, and a redirect
-  that fails it is refused. API answers that redirect are refused.
-- Every connection goes to an address checked to be public (an allow-list:
-  no private, local, shared, reserved, multicast, NAT64, 6to4 or Teredo
-  addresses), and to exactly that address, with TLS checked for the host
-  name, so a second DNS answer can't swap in another. System proxy settings
-  aren't used. This is the same design as the itch.io purchases branch.
-- Never in logs, error messages, API answers, the page or reports: every
-  message is cleaned first, matching the token (or any start of it of 8+
-  characters) in any letter case, with each character written literally or
-  percent-encoded once or twice (%XX, %25XX) in either case, and any other
-  token-shaped value, before it is shortened.
-- Disconnect deletes the file and the library Frame Control holds in memory,
-  and stops a download under way. A connect still being checked when you
-  disconnect is not saved. In the desktop app, before the token is deleted, it
-  also stops any sign-in under way, destroys the sign-in window, waits for a
-  connect still under way to finish and cancels its attempt (deleting its
-  token if it was just saved), and only then clears the `persist:meta-signin` session
-  (cookies, storage, cache); no other session is touched. Sign in with Meta
-  stays off from the moment you press Disconnect until the token is deleted,
-  and the app refuses a sign-in while it is signing out.
-- With Sign in with Meta, a second copy of your Meta sign-in lives in that
-  session's storage, in Electron's per-user data folder (`Partitions/meta-signin`),
-  until you disconnect or sign out of Meta in Frame Control.
-
-## Where the protocol comes from
-
-Frame Control's code is its own (MIT). These public sources describe the
-protocol; Frame Control takes only facts from them (addresses, query ids,
-field names), not code. QAVS and BSManager are GPL-3.0; OculusGraphQLApiLib,
-DownQuest and Oculus-downgrader state no licence.
-
-| Fact | Source |
-|---|---|
-| GraphQL at `https://graph.oculus.com/graphql`, POST, form fields `access_token`, `doc_id`, `variables`; `OAuthException` / code 190 for a bad token | [OculusGraphQLApiLib `GraphQLClient.cs`](https://github.com/ComputerElite/OculusGraphQLApiLib/blob/866081e2/OculusGraphQLApiLib/GraphQL/GraphQLClient.cs), [DownQuest `DownQuest.js`](https://github.com/ptrpaws/DownQuest/blob/50f5d558/DownQuest.js) |
-| "Who am I": `doc_id` 4149322231793299, `data.viewer.user {id, alias}` | OculusGraphQLApiLib `GraphQLClient.cs` and `Results/User.cs` |
-| Owned apps: `doc_id` 4850747515044496, `data.viewer.user.active_entitlements.nodes[].item` | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/Entitlement.cs`, `Results/Application.cs`; used by [QAVS `GameDownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/GameDownloadManager.cs) |
-| One binary: `doc_id` 4734929166632773 with `binaryID`; fields `package_name`, `version`, `version_code`, `size`, `obb_binary`, `asset_files` (`file_name`, `size`, `is_required`) | OculusGraphQLApiLib `GraphQLClient.cs`, `Results/OculusBinary.cs`, `Results/AssetFile.cs` |
-| Downloads: `https://securecdn.oculus.com/binaries/download/?id=<id>&access_token=<token>`, the same for the APK, `obb_binary` and asset files; QAVS takes the OBB and required asset files | OculusGraphQLApiLib `Game/GameDownloader.cs`, [QAVS `DownloadManager.cs`](https://github.com/ComputerElite/QuestAppVersionSwitcher/blob/36bebd5a/QuestAppVersionSwitcher/DownloadManager.cs), DownQuest `DownQuest.js` |
-| Token checks (`OC`/`FRL`, no `%`, `|`, `:`, not `OC` + 15 digits) | OculusGraphQLApiLib `GraphQL/TokenTools.cs`, [BSManager `oculus.helpers.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/shared/helpers/oculus.helpers.ts) |
-| How users get a token (`oc_ac_at` cookie, or the PC app's `FRL` token) | [BSManager wiki](https://github.com/Zagrios/bs-manager/wiki/How-to-obtain-your-Oculus-Token) |
-| Sign in with Meta: open `https://secure.oculus.com` in an app window, and once it reaches `https://secure.oculus.com/my/profile` read the `oc_ac_at` cookie from that window's session (checked on `did-navigate`, `did-navigate-in-page`, `did-stop-loading`); 10-minute timeout | [BSManager `bs-oculus-downloader.service.ts`](https://github.com/Zagrios/bs-manager/blob/00380c79/src/main/services/bs-version-download/bs-oculus-downloader.service.ts) (`getUserTokenFromMetaAuth`) |
-
-**Assumed, not seen in those sources:** that the entitlement and binary
-answers carry the fields above in the shapes the libraries' models describe
-(the stored queries are opaque); that the list isn't paginated (none of the
-tools page it); that `ANDROID_6DOF` marks Quest apps; where downloads redirect
-to (the tools let their HTTP client follow redirects; Frame Control follows
-up to five, to any public HTTPS host, and refuses one carrying the token); and
-a `sha256`
-field (none was seen, so in practice only sizes are checked). The log
-signatures for the test are inferred from the compatibility research, not
-from a real Frame.
-
-## Evidence and limits
-
-**Verified locally** with a fake Meta and a fake Frame (`tests/test_meta.py`):
-token checks; storage owner-only through a temporary file; redaction (the
-stored token recased and percent-encoded in either case, starts of it, other
-token-shaped values, and redaction before cutting); HTTPS-only URLs; the
-public-address allow-list, resolving once and connecting only to a checked
-address within one deadline; redirects off Meta's hosts refused when they
-carry the token anywhere, before any lookup; the token never sent to the
-CDN; GraphQL redirects refused; disconnect beating a connect in flight and
-stopping a download; library parsing (Quest apps only, nothing expired or
-inactive, details from the binary query); downloads with an OBB; size, length
-and checksum limits and the whole-install budget with nothing left behind;
-refusing apps not in the
-library; the handoff to Import from my Quest's checks, install and data step;
-the licence-check warning instead of a refusal; test outcomes from log
-fixtures (a passing licence check isn't a failure; no VR scene is no clear
-result, not recorded); closing before a test and saying when a close failed;
-reports carrying only fixed texts, no token, log text or file names. The
-real TLS connection code is the same as the itch.io branch's and is exercised
-here only with a fake connection.
-
-**Sign in with Meta, verified locally** with fake Electron windows, sessions
-and cookies (`app/test/meta-signin.test.js`): the window's options (its own
-partition, sandbox, context isolation, no Node, no preload) and Meta's login
-address, no developer tools; permission requests and checks refused; the
-navigation allow-list (links elsewhere open in the system browser, redirects
-elsewhere are stopped, pop-ups never become windows); frames allowed any
-HTTPS page but no other scheme, the window itself only Meta's sites; a
-page's beforeunload not keeping the window open; the cookie read only from
-`persist:meta-signin` and only for `oculus.com`, even when the default
-session and another partition hold one; signed-out values ignored; a value
-sent once, a refused one keeping the window open; the window closing after a
-connect, with the page getting the answer and never the token; nothing
-logged, and a server error that echoed the token scrubbed; closing the window
-or signing out ending the wait; closing, timing out or signing out during a
-connect cancelling that attempt (with its own id) after cookie intake stops
-and only after that connect settles (saved, refused or failed), and no cancel
-when nothing was sent; sign-out (Disconnect's first step) waiting for a
-connect under way, even from a window closed earlier, before it finishes;
-sign-out destroying the window before clearing only that partition; no
-sign-in starting while a sign-out runs (it is refused: "try again in a
-moment"), a second sign-out joining the first, and a sign-out waiting for
-every window and connect started before it. The
-frame redirects held to the frame rule, the window's to Meta's sites. The
-server side (`tests/test_meta.py`): an attempt cancelled while Meta is
-answering not saved, even after 300 other cancels; a cancel just after the
-save deleting that token; a cancel never removing a later sign-in's or a
-pasted token's account; unknown attempts changing nothing; no attempt left
-listed after a connect, refused or not; attempt ids checked.
-
-**Differences from BSManager:** BSManager uses its app's default session (and
-clears only `.oculus.com` cookies afterwards); Frame Control uses a session of
-its own and clears all of it on disconnect. BSManager waits for
-`/my/profile`; Frame Control also reacts to the cookie changing, and to any
-`oculus.com` page, and lets the server decide whether the value is a
-working token.
-
-**Not verified:** Sign in with Meta against Meta's real login page (no real
-Meta account was used, and nothing was sent to Meta): whether Meta's login
-still goes only through `oculus.com`, `meta.com` and `facebook.com`, whether
-it uses pop-ups (they open in the same window here, which would break a
-pop-up that reports back to its opener), whether `oc_ac_at` is still set on
-`oculus.com` after login, and whether Meta accepts the window (Frame Control
-removes Electron's name from the user agent as a precaution). A real Meta token and Meta's real answers (none was
-available; nothing was sent to Meta), real downloads and their redirects,
-real Quest games installed or tested on a real Frame, and whether the log
-signatures match what real games print in Lepton.

docs/privacy.md

@@ -90,21 +90,13 @@ SteamOS and Lepton builds. Before sending:
 
 - the notes, app name and version are scrubbed like error messages (see
   below)
-- the APK's source is kept only if it's `F-Droid`, `meta-store` (a test
-  from [My Meta library](meta-library.md)) or the public host name of a
-  download link (`https://example.com/…`). File names, user names,
+- the APK's source is kept only if it's `F-Droid` or the public host name of
+  a download link (`https://example.com/…`). File names, user names,
   passwords, ports, paths, IP addresses and local host names are dropped
 
 When you turn this on, reports you made earlier on this computer are shared
 too.
 
-My Meta library (Experimental) keeps your Meta access token in
-`meta-account.json` in this data folder, owner-only, and sends it only to
-Meta's API and download hosts. It is never in analytics, reports, error
-details or logs; its test reports carry the package, version, version code,
-title, result and the reason, nothing from your account. See
-[meta-library.md](meta-library.md#your-token-and-privacy).
-
 The maintainer's `python3 ui/frame_compat_db.py sync` copies these events
 into the compatibility database, marked `via=community…`. It takes at most
 30 per reporter per day.

docs/quest-import.md

@@ -1,219 +0,0 @@
-# Import from my Quest
-
-Move games you own from your own Meta Quest onto the Steam Frame. Plug the
-Quest into your computer by USB; Frame Control copies the game off it with
-adb, checks it can run in Lepton, and installs it on the Frame like any other
-APK, with its own Lepton instance and Steam library entry
-([apks.md](apks.md), [vr-apks.md](vr-apks.md)).
-
-There is no licence-check bypass, and there won't be. A game that uses Meta's
-licence check installs with a warning: on the Frame that check can't reach
-Meta, so the game may quit, hang, or run without online features. See
-[What won't run](#what-wont-run-and-why) below. To install games you own
-straight from Meta instead, without a Quest, see [My Meta library
-(Experimental)](meta-library.md).
-
-## Before you start: developer mode on the Quest
-
-adb only reaches a Quest with developer mode on:
-
-1. Make a free Meta developer organisation at
-   [developers.meta.com](https://developers.meta.com/horizon/) on a **verified**
-   Meta account (Meta asks for a phone number or payment card to verify).
-2. In the Meta Horizon phone app, open the headset's settings and switch
-   **Developer Mode** on. Restart the Quest.
-3. Plug the Quest into the computer that runs Frame Control with a USB cable
-   that carries data (some charging cables don't).
-4. Put the headset on. Accept **Allow USB debugging**, and tick **Always allow
-   from this computer**.
-
-Frame Control uses the adb it already uses for the Frame (an adb you
-installed, else the one it bundles). On Linux, adb also needs permission to
-open the Quest: add a udev rule for Meta's USB vendor id `2833`, for example
-`SUBSYSTEM=="usb", ATTR{idVendor}=="2833", MODE="0660", GROUP="plugdev"`, and
-be in that group. Then unplug and replug.
-
-The Frame's own adb connections (Frame Control's SSH tunnels to Lepton,
-`127.0.0.1:<port>`) are never touched. Only a device that reports itself as
-Oculus or Meta, or a Quest model, counts as a Quest.
-
-## Using it
-
-In the app: **Android → On your Frame → Import from my Quest**. Choose **Look
-for my Quest**, then **Import** next to a game. Tick **Also copy each game's
-files in Android/data** to bring the game's external files too (some games
-keep saves there). Progress shows in the panel; the result and any reason it
-stopped appear in the message log.
-
-You can choose **Import** on several games at once: they wait in the **Install
-queue** (above the Quest panel) and import one after another, together with
-installs from the Android store and My Meta library. **Remove** takes a game
-out of the queue before it starts. Each queued import runs on the headset that
-was selected when you queued it; if you switch headsets first, it stops with a
-message instead.
-
-A game with game data (an OBB folder, or Android/data when ticked) takes two
-imports, because Android can only take that data while the game's Lepton
-instance is running, and there is no way to start the instance without the
-game. Frame Control never starts the game itself:
-
-1. **Import** installs the game and says it has data to add.
-2. Start the game from the Steam library and leave it on its first screen.
-3. **Import** again. Frame Control sees the game open with the same version,
-   copies the data in, and closes the game. Start it again to play.
-
-A game that quits straight away without its data can't take it this way.
-
-From a terminal:
-
-```sh
-python3 ui/frame_quest.py devices                      # what adb sees, and which is the Quest
-python3 ui/frame_quest.py list                         # apps on the Quest: split or not, OBB and data sizes
-python3 ui/frame_quest.py import com.example.game      # copy one to the Frame
-python3 ui/frame_quest.py import com.example.game --data --serial 1WMHH000XXXXXX
-```
-
-The API is `GET /api/quest` (the Quest, or guidance when there isn't one, and
-its apps) and `POST /api/quest` with
-`{"action": "import", "package": "...", "serial": "...", "data": false}`,
-which returns a background job (`/api/job`) with a stage and percentage. The
-job waits in the install queue first (`"queued": true`, stage `Queued: N
-installs before it`). `GET /api/queue` lists the running install and those
-waiting; `POST /api/queue` with `{"action": "remove", "job": "..."}` removes a
-waiting one (409 once it has started).
-
-## What an import does
-
-1. Finds the Quest (`adb devices -l`, then `ro.product.manufacturer` and
-   `ro.product.model`). If none is ready it says why: nothing connected, not
-   authorised yet (the **Allow USB debugging** prompt), no USB permission
-   (Linux), offline, another Android device, or several Quests.
-2. Lists third-party apps (`pm list packages -3`), each with `pm path` (one
-   line is a single APK, several a split APK) and the size of
-   `/sdcard/Android/obb/<package>` and `/sdcard/Android/data/<package>`.
-   Labels aren't shown before import: reading them means copying the APK.
-3. Checks there is room on the computer (the APKs, a merged and a patched copy
-   of them counted uncompressed, the OBB folder and the Android/data folder
-   once, since that is streamed to the Frame), then copies the APK and its splits
-   into a per-user cache folder (`Frame Control/quest-import` under the
-   system's cache folder).
-4. **Checks the APK before anything else is copied**, refusing:
-   - 32-bit-only builds (native code but no `arm64-v8a`);
-   - apps that need an Android newer than Lepton's (API 30);
-   - split APKs Frame Control can't merge (below).
-   Installed with a warning:
-   - games that use Meta's licence check (Meta's Platform SDK,
-     `libovrplatformloader.so`, in the base or any split): "uses Meta's
-     licence check; it may quit, hang, or run without online features on the
-     Frame. Frame Control won't remove the check." Linking the SDK doesn't
-     mean a game enforces the check: Meta's store requirement for it
-     (VRC.Quest.Security.1) has only been *Recommended* since 2021, and what
-     a game does when the check fails is up to the game;
-   - VrApi-only builds (`libvrapi.so`, no OpenXR loader), flagged as for any
-     APK: the Frame has no VrApi, so they may not run.
-5. If the game isn't open on the Frame: installs it through the normal APK
-   install (`frame_android.install`: VR detection, the launcher fix, the
-   OpenXR compatibility layer, artwork), and says whether it has game data
-   to add. An older Quest copy never replaces a newer version on the Frame
-   (compared by version code, which installs now record; for installs made
-   before that, it is read from the installed APK on the Frame) unless you
-   tick **Allow replacing a newer version** (`--allow-downgrade`,
-   `"allowDowngrade": true`). If the installed version can't be read at all,
-   that permission is needed too.
-6. If the game is open on the Frame (the second import): refuses unless
-   Frame Control's install record is for this package, in this package's own
-   instance, at the Quest's exact version code (an open game is never
-   replaced), otherwise copies the OBB folder (and `Android/data` if ticked)
-   from the Quest, waits for Android to have finished booting, copies standard
-   `main|patch.<version>.<package>.obb` files with the existing OBB helper
-   (checked by SHA-256 inside Android, [sidequest.md](sidequest.md#obb-files))
-   once Android's own `dumpsys package` in that instance shows the same
-   package at the same version code,
-   streams the `Android/data` files in as a tar written straight into the SSH
-   transfer, then closes the game so its next start reads them, and checks
-   its instance has stopped; if it hasn't, or the check itself fails (a
-   failed `podman ps` never reads as "stopped"), the result says so. The game
-   is closed whatever happens during the copy, including a local read error
-   or Ctrl-C, and a failed close is reported without hiding the original
-   error. Everything
-   from the second check of the install record (after the pulls, which can
-   be long) to closing the game holds the same lock as installs and removals.
-   Other files in the OBB folder are listed as not copied.
-7. Deletes the cache folder, whether the import worked or not. A folder left
-   by a crash is removed by a later import after six hours.
-
-Only one import runs at a time. If copying game data fails, the game is
-closed and the message says so; start it and import again.
-
-### Split APKs
-
-Lepton runs one APK per instance, so the shared install path now merges a
-split APK into one (`frame_android.install(base, splits=[...])`, or
-`python3 ui/frame_android.py install base.apk split1.apk ...`). Merging copies
-each split's native libraries and assets into the base, drops the base
-manifest's `isSplitRequired` flag, and re-signs with Frame Control's key, as
-the launcher fix already does. Only splits that hold nothing but
-`lib/<abi>/*.so`, `assets/` and their own signature, manifest and an empty
-resource table are merged. Refused, with the reason, before anything reaches
-the Frame: splits with resources (screen density or language), code
-(`classes*.dex`), any other file, a manifest that declares components or
-libraries (`<service>`, `<uses-library>`...), feature splits, and splits of
-another package. The merged files are held in memory while the APK is
-repacked and signed (as for every patched APK), so a merge adds at most
-512 MB per file and 1 GB in all. Each file is read from its raw bytes and
-checked against both of its ZIP headers: the local header must name the same
-file with the same method, sizes and checksum as the central directory (or a
-data descriptor must carry them; ZIP64 sizes are understood), the data must
-end before the next entry, a stored file must be exactly its declared size, a
-compressed one must end exactly at the end of its data with nothing after it,
-and its checksum must match. So a forged header can't truncate a file or fill
-memory. A resource table counts as empty only
-if it defines nothing at all (styles and other complex entries included). A merged, re-signed APK can't update a
-copy signed by the publisher.
-
-## What won't run, and why
-
-- **Games that enforce their Meta store licence.** Many store games link
-  Meta's Platform SDK (`libovrplatformloader.so`), for the licence check and
-  for user ids, achievements, multiplayer, cloud saves or DLC. On the Frame the
-  SDK can't reach Meta's services, which only exist on Meta headsets. A game
-  that enforces the check then quits or hangs; one that doesn't may run
-  without its online features. Frame Control can't tell which from the APK, so
-  it installs these with a warning and **won't remove or work around the
-  check**, and doesn't bundle, call or link to any tool that does. If yours
-  quits, ask the developer for a build without the check, or get the game from
-  Steam or itch.io. Most SideQuest, itch.io and open-source games don't link
-  the SDK.
-- **32-bit games** (Quest 1 era): the Frame runs 64-bit ARM only. Refused.
-- **VrApi-only games**: the Frame has OpenXR, not Meta's older VrApi. They
-  install with a warning, but may not run.
-- **Anything else that needs Meta**: avatars, Quest-only device checks,
-  passthrough and other `XR_FB_*` features SteamVR lacks
-  ([vr-apks.md](vr-apks.md#what-steamvrs-android-runtime-supports-verified)).
-- **Private app data** (`/data/data/<package>`) can't be read over adb without
-  root, so only saves in `Android/data` come across.
-
-What usually works: OpenXR games without Meta's licence check, for example
-open-source and itch.io builds you sideloaded onto the Quest.
-
-Only import games you own, for your own use.
-
-## Evidence and limits
-
-**Verified locally** with a fake adb (`tests/fakeadb.py`, `tests/test_quest.py`):
-device detection (Quest, the Frame's tunnel, the Frame over USB, other
-Android devices, unauthorised, no permissions, offline, none, several),
-package listing and split detection, the refusals and the licence-check warning, the order of copies
-(APK checked before the OBB is copied), the two-step install then data copy
-(the game is never started by Frame Control, never replaced while open, and
-closed after its data is copied), split merging and signing, the split
-refusals and size limits (including a forged zip bomb), the space estimate,
-and cache clean-up after success and failure.
-
-**Not verified:** a real Quest (none was available), Quest system apps in
-`pm list packages -3`, real split APKs from the Meta Store, OBB and
-`Android/data` writes into a running Lepton instance on a real Frame
-(the OBB helper itself is also unverified there), whether games stay open
-without their OBB long enough for the second import, and the Linux udev rule.
-Large games are copied into memory while being merged or patched, as every
-patched APK already is.

docs/scripts.md

@@ -89,6 +89,7 @@ controls to place each panel. See [docs/panels.md](panels.md).
 | Script | Runs on | Purpose |
 |---|---|---|
 | `scripts/tailscale-on-frame.sh` | Mac → Frame | Install Tailscale in `~` as a userspace user service so `frame` works from anywhere; `--uninstall` (**verified** on the LAN) |
+| `scripts/store-on-frame.sh` | Mac → Frame | Open the APK Store (Frame Control's Android store) as a panel in the headset; installs run on the Frame (**inferred**; see [docs/apks.md](apks.md)) |
 | `scripts/connect.sh` | Mac | Discover, set up key and `~/.ssh/config`, copy key, optional `--harden` (**verified**; `--harden` untested) |
 | `scripts/install-apps.sh` | Mac → Frame | Install Flatpaks (Remmina, Moonlight, …) on the Frame over SSH as `--user` (**verified** with Remmina) |
 | `scripts/paste-to-frame.sh` | Mac → Frame | Send the Mac clipboard (or stdin) to the Frame clipboard (**verified**) |

docs/vr-apks.md

@@ -214,16 +214,9 @@ source-search endpoint remain unverified (the public install seam is tested).
 
 - **Meta entitlement.** Apps that call the Oculus Platform SDK
   (`libovrplatformloader.so`) to check the Quest store licence need Meta's
-  services. Frame Control won't work around that: no patching, no stub
-  libraries, no OVRPort or FramePort. Linking the SDK doesn't mean an app
-  enforces the check (Meta's VRC.Quest.Security.1 has only been
-  *Recommended* since 2021, and a failed check does nothing by itself; the app
-  decides), so [Import from my Quest](quest-import.md) and [My Meta
-  library](meta-library.md) install these with a warning: they may quit,
-  hang, or run without online features.
+  services. Frame Control won't work around that.
 - **VrApi-era apps** (`libvrapi.so`, before OpenXR) need an API translator,
-  not a patch. They install with a warning that they may not run: some
-  OpenXR games ship `libvrapi.so` without depending on it.
+  not a patch.
 
 ## Frame Control does this for you
 

ios/scripts/make_frame_bundle.py

@@ -18,7 +18,7 @@ import tarfile
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[2]
-PATTERNS = ["ui/*.py", "ui/*.html", "ui/*.js", "ui/*.css", "ui/local-bin/*", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py",
+PATTERNS = ["ui/*.py", "ui/*.html", "ui/*.js", "ui/*.css", "ui/local-bin/*", "ui/apk_sources/*.py", "ui/apk_sources/*.json", "scripts/*.sh", "frame/android/*.sh", "frame/android/*.py",
             "frame/devkit-utils/**/*", "apk-catalog/*.py", "apk-catalog/pins.json", "apk-catalog/site/apps.js",
             "frame/kdeconnect/packages.json", "frame/kdeconnect/NOTICE.md", "frame/kdeconnect/LICENSES/*/*",
             "frame/kdeconnect/packages/*.pkg.tar.zst", "LICENSE", "THIRD_PARTY_NOTICES.md"]

scripts/store-on-frame.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env zsh
+# Mac-side: the APK Store in the headset. Frame Control's Android catalogue
+# (the same rated F-Droid list, Install, Open and Remove) as its own floating
+# panel on the Steam Frame, so you can browse and install apps from inside.
+# See docs/apks.md → "The store in the headset".
+#
+# Frame Control's server runs on the Frame itself (FRAME_LOCAL=1, as the iPhone
+# app runs it) on the Frame's loopback, and Chromium opens ui/store.html as a
+# panel. Installs then download and verify the APK on the Frame; the Mac isn't
+# needed after `open`.
+#
+# Usage:
+#   scripts/store-on-frame.sh open     # copy the server over if it changed, start it, open the panel
+#   scripts/store-on-frame.sh close    # close the panel and stop the server
+#   scripts/store-on-frame.sh status
+set -euo pipefail
+
+FRAME_ALIAS=${FRAME_ALIAS:-frame}
+HERE=${0:A:h}
+ROOT=${HERE:h}
+PORT=47812           # the Frame's 127.0.0.1 only
+APPID=2001947812     # the panel's id (panel-on-frame.sh's range)
+# Not ~/.cache/frame-control: the iPhone app prunes other versions there.
+REMOTE=.local/share/frame-control/store-server
+
+cmd=${1:-}
+
+# Same bundle the iPhone app copies (ios/scripts/make_frame_bundle.py), so the
+# server on the Frame has exactly the files the desktop app ships.
+deploy() {
+  local tmp version
+  tmp=$(mktemp -d)
+  trap "rm -rf ${(q)tmp}" EXIT
+  version=$(python3 "$ROOT/ios/scripts/make_frame_bundle.py" "$tmp/bundle.tar.gz")
+  if ! ssh "$FRAME_ALIAS" "test -f $REMOTE/$version/ui/server.py"; then
+    print -u2 "==> Copying Frame Control ($version) to the Frame"
+    ssh "$FRAME_ALIAS" "set -e; mkdir -p $REMOTE; cd $REMOTE; rm -rf $version.tmp; mkdir $version.tmp
+      tar xzf - -C $version.tmp; rm -rf $version; mv $version.tmp $version" <"$tmp/bundle.tar.gz"
+  fi
+  # Older versions, unless a server is still running from one.
+  ssh "$FRAME_ALIAS" "cd $REMOTE && for d in */; do d=\${d%/}; [ \"\$d\" = $version ] && continue
+    pgrep -f \"\$PWD/\$d/\" >/dev/null && continue; rm -rf -- \"\$d\"; done"
+  print -r -- "$version"
+}
+
+# Runs on the Frame. Args: dir port appid key
+OPEN=$(cat <<'EOF'
+set -u
+dir=$HOME/$1 port=$2 appid=$3 key=$4
+export DISPLAY=:0 LC_ALL=C.UTF-8
+unset WAYLAND_DISPLAY
+xprop -root GAMESCOPE_FOCUSABLE_WINDOWS >/dev/null 2>&1 || { echo "The headset isn't showing anything (gamescope's :0 isn't up). Wake it and try again." >&2; exit 2; }
+if [ -x "$HOME/chromium-xr/chrome" ]; then
+  # Steam's overlay library crashes Chromium's zygote (docs/webxr-chromium.md).
+  browser=(env LD_PRELOAD= "$HOME/chromium-xr/chrome" --user-data-dir="$HOME/.local/share/frame-control/store")
+elif flatpak info org.chromium.Chromium >/dev/null 2>&1; then
+  browser=(flatpak run org.chromium.Chromium --user-data-dir="$HOME/.var/app/org.chromium.Chromium/frame-store")
+else
+  echo "The store needs a Chromium on the Frame: Chromium XR (docs/webxr-chromium.md) or the org.chromium.Chromium Flatpak (scripts/install-apps.sh)." >&2
+  exit 3
+fi
+# A fresh server each time, so it runs this version with this key.
+[ -f /tmp/frame-store-server.pid ] && kill "$(cat /tmp/frame-store-server.pid)" 2>/dev/null
+# Match the browser by its profile flag and the server by its script path: this
+# launcher's own command line holds the bundle path, so a looser pattern kills it.
+pkill -f '[-]-user-data-dir=[^ ]*/(frame-control/store|frame-store) ' || true
+pkill -f '[s]tore-server/[^/ ]*/ui/server[.]py' || true
+sleep 0.5
+cd "$dir" || exit 1
+FRAME_LOCAL=1 FRAME_UI_KEY=$key FRAME_DEVICE=headset setsid nohup python3 -I -u -B "$dir/ui/server.py" --port "$port" \
+  >/tmp/frame-store-server.log 2>&1 </dev/null &
+echo $! > /tmp/frame-store-server.pid
+up=
+for _ in $(seq 1 40); do
+  curl -s -o /dev/null "http://127.0.0.1:$port/store" && { up=1; break; }
+  sleep 0.25
+done
+[ -n "$up" ] || { echo "Frame Control's server didn't start on the Frame:" >&2; tail -n 15 /tmp/frame-store-server.log >&2; exit 1; }
+setsid nohup "${browser[@]}" --ozone-platform=x11 --force-device-scale-factor=1 --no-first-run --no-default-browser-check \
+  --password-store=basic --disable-session-crashed-bubble --noerrdialogs --disable-infobars \
+  --disable-features=Translate,MediaRouter --window-size=1280,800 \
+  "--app=http://127.0.0.1:$port/store?key=$key" >/tmp/frame-store.log 2>&1 </dev/null &
+# Tag the window so it's its own panel (docs/panels.md).
+for _ in $(seq 1 60); do
+  sleep 0.5
+  for win in $(xwininfo -root -children 2>/dev/null | awk '/^ +0x/ {print $1}'); do
+    xprop -id "$win" _NET_WM_NAME WM_NAME 2>/dev/null | grep -qF "APK Store" || continue
+    if xprop -id "$win" -f STEAM_GAME 32c -set STEAM_GAME "$appid" 2>/dev/null; then
+      echo "panel valve.steam.desktopgame.$appid window $win"
+      exit 0
+    fi
+  done
+done
+echo "Chromium started, but its window didn't appear within 30 s:" >&2
+tail -n 15 /tmp/frame-store.log >&2
+exit 1
+EOF
+)
+
+case "$cmd" in
+  open)
+    version=$(deploy | tail -n 1)
+    key=$(openssl rand -hex 16)
+    ssh "$FRAME_ALIAS" bash -s -- "$REMOTE/$version" "$PORT" "$APPID" "$key" <<<"$OPEN"
+    ;;
+  close)
+    ssh "$FRAME_ALIAS" 'pkill -f "[-]-user-data-dir=[^ ]*/(frame-control/store|frame-store) " || true
+      pkill -f "[s]tore-server/[^/ ]*/ui/server[.]py" || true
+      [ -f /tmp/frame-store-server.pid ] && kill "$(cat /tmp/frame-store-server.pid)" 2>/dev/null; rm -f /tmp/frame-store-server.pid; true'
+    ;;
+  status)
+    ssh "$FRAME_ALIAS" "ls $REMOTE 2>/dev/null; curl -s -o /dev/null http://127.0.0.1:$PORT/store && echo 'server up' || echo 'server down'
+      pgrep -af '[-]-user-data-dir=[^ ]*/(frame-control/store|frame-store) |[s]tore-server/[^/ ]*/ui/server[.]py' | head -n 1 | cut -c1-120"
+    ;;
+  *) sed -n '2,15p' "$0"; exit 2 ;;
+esac

tests/fakeadb.py

@@ -1,100 +0,0 @@
-#!/usr/bin/env python3
-"""A stand-in for Android's adb, for tests/test_quest.py: just enough of `devices -l`,
-`shell`, and `pull` for frame_quest.py, run as a real subprocess.
-
-$FAKEADB_STATE is a JSON file:
-  devices   [{"serial", "state", "extra" (the rest of the `devices -l` line), "props" {getprop name: value}}]
-  root      a folder standing in for each device's file system (remote /x/y is root/x/y)
-  packages  {package: [APK paths, as `pm path` prints them]}
-  fail_pull a remote path whose pull fails
-Every call is appended to $FAKEADB_LOG as a JSON line. Shell commands are the simple
-`; `-separated ones frame_quest sends, each answered here: no real shell runs.
-"""
-import json
-import os
-import shutil
-import sys
-
-args = sys.argv[1:]
-with open(os.environ['FAKEADB_LOG'], 'a') as f:
-    f.write(json.dumps(args) + '\n')
-with open(os.environ['FAKEADB_STATE']) as f:
-    state = json.load(f)
-root = state.get('root', '')
-serial = None
-if args[:1] == ['-s']:
-    serial, args = args[1], args[2:]
-
-
-def fail(message, code=1):
-    sys.stderr.write(message + '\n')
-    sys.exit(code)
-
-
-def local(remote):
-    return os.path.join(root, remote.lstrip('/'))
-
-
-def size_kb(path):
-    total = 0
-    for dirpath, _, files in os.walk(path):
-        total += sum(os.path.getsize(os.path.join(dirpath, n)) for n in files)
-    return max(4, total // 1024)
-
-
-if args == ['devices', '-l']:
-    print('List of devices attached')
-    for d in state.get('devices', []):
-        print(f"{d['serial']:<22} {d['state']} {d.get('extra', '')}".rstrip())
-    sys.exit(0)
-
-device = next((d for d in state.get('devices', []) if d['serial'] == serial), None)
-if serial is None or device is None:
-    fail(f"adb: device '{serial}' not found")
-if device['state'] == 'unauthorized':
-    fail('adb: device unauthorized.\nThis adb server\'s $ADB_VENDOR_KEYS is not set')
-if device['state'] != 'device':
-    fail(f"adb: device {device['state']}")
-
-if args[:1] == ['shell']:
-    out = []
-    for command in ' '.join(args[1:]).split('; '):
-        command = command.replace(' 2>/dev/null', '').strip()
-        words = command.split()
-        if not words or command == 'true':
-            continue
-        if words[0] == 'getprop':
-            out.append(device.get('props', {}).get(words[1], ''))
-        elif words[0] == 'echo':
-            out.append(' '.join(words[1:]))
-        elif command == 'pm list packages -3':
-            out += ['package:' + p for p in state.get('packages', {})]
-        elif words[:2] == ['pm', 'path']:
-            out += ['package:' + p for p in state.get('packages', {}).get(words[2], [])]
-        elif words[:2] == ['du', '-sk']:
-            if os.path.isdir(local(words[2])):
-                out.append(f'{size_kb(local(words[2]))}\t{words[2]}')
-        elif words[:3] == ['stat', '-c', '%s']:
-            out += [str(os.path.getsize(local(p.strip("'")))) for p in words[3:]]
-        else:
-            fail(f'/system/bin/sh: {words[0]}: inaccessible or not found', 127)
-    print('\n'.join(out))
-    sys.exit(0)
-
-if args[:1] == ['pull'] and len(args) == 3:
-    remote, dest = args[1], args[2]
-    if remote == state.get('fail_pull'):
-        fail(f"adb: error: failed to copy '{remote}' to '{dest}': remote Connection reset")
-    src = local(remote)
-    if not os.path.exists(src):
-        fail(f"adb: error: failed to stat remote object '{remote}': No such file or directory")
-    if os.path.isdir(dest):
-        dest = os.path.join(dest, os.path.basename(remote.rstrip('/')))
-    if os.path.isdir(src):
-        shutil.copytree(src, dest)
-    else:
-        shutil.copyfile(src, dest)
-    print(f'{remote}: 1 file pulled.')
-    sys.exit(0)
-
-fail('adb: unknown command ' + ' '.join(args))

tests/page/meta_rows.mjs

@@ -1,43 +0,0 @@
-// The Meta library's rows, run in node against the real functions from ui/index.html.
-// Found in a live test with a real account (2026-10-14): sizes were cut off behind the
-// package name, a required data file Frame Control can't place was not mentioned, and
-// apps and environments were counted as "games".
-import { readFileSync } from "fs";
-const src = readFileSync(new URL("../../ui/index.html", import.meta.url), "utf8");
-const lines = src.split("\n");
-const fail = msg => { console.log("FAIL " + msg); process.exit(1); };
-
-function grab(name) {
-  const start = lines.findIndex(l => new RegExp(`^(?:(?:async )?function ${name}\\(|const ${name} = )`).test(l));
-  if (start < 0) fail(`no top-level ${name} in index.html`);
-  let depth = 0;
-  for (let i = start; i < lines.length; i++) {
-    for (const c of lines[i]) depth += c === "{" ? 1 : c === "}" ? -1 : 0;
-    if (depth <= 0) return lines.slice(start, i + 1).join("\n") + "\n";
-  }
-  fail(`unbalanced ${name}`);
-}
-const els = { metaCount: { textContent: "" }, metaApps: { innerHTML: "" } };
-const metaLib = { connected: true, results: new Map(), apps: [
-  { id: "1", title: "The Climb", package: "com.crytek.climb", version: "666.0", version_code: 666, size: 30639455,
-    data_files: 0, skipped_files: ["main.com.crytek.climb.obb"] },
-  { id: "2", title: "Beat Saber", package: "com.beatgames.beatsaber", problem: "Meta's API said HTTP 500", skipped_files: [] },
-] };
-const render = new Function("$", "metaLib", "androidApps", "installing", "queued",
-  grab("esc") + grab("questSize") + "const META_VERDICT = {};\n" + grab("renderMetaApps") + "renderMetaApps();");
-render(id => els[id], metaLib, [], new Set(["meta:1"]), new Set(["meta:1"]));
-const html = els.metaApps.innerHTML;
-if (els.metaCount.textContent !== "2 apps") fail("count: " + els.metaCount.textContent);
-const climb = html.split('class="item"')[1];
-if (!/<div class="s" title="[^"]*">29 MB · v666\.0 \(666\) · com\.crytek\.climb</.test(climb)) fail("size not first: " + climb);
-if (!/Not installed: 1 required data file \(main\.com\.crytek\.climb\.obb\)/.test(climb)) fail("skipped data not shown: " + climb);
-const saber = html.split('class="item"')[2];
-if (!/<div class="s v-no"[^>]*>Meta&#39;s API said HTTP 500</.test(saber)) fail("problem not on its own line: " + saber);
-if (/Not installed/.test(saber)) fail("warning without skipped files");
-// Waiting in the install queue: marked, and not offered again.
-if (!/<span class="tag">Queued<\/span>/.test(climb) || !/data-meta-install="1" disabled/.test(climb)) fail("queued not shown: " + climb);
-if (/Queued|disabled/.test(saber)) fail("queued on the wrong row: " + saber);
-metaLib.apps = metaLib.apps.slice(0, 1);
-render(id => els[id], metaLib, [], new Set(), new Set());
-if (els.metaCount.textContent !== "1 app") fail("singular count: " + els.metaCount.textContent);
-console.log("ok");

tests/test_apk_artwork.py

@@ -19,7 +19,9 @@ class ArtworkTests(unittest.TestCase):
     def setUp(self):
         with _images._lock:
             _images._urls.clear()
+            _images._tokens.clear()
             _images._cache.clear()
+            _images._dns.clear()
 
     def test_only_registered_source_images_are_fetchable(self):
         with patch.object(_images, 'fetch') as fetch:
@@ -71,9 +73,13 @@ class ArtworkTests(unittest.TestCase):
             _images.remember('https://example.com/a.png', PNG[:8] + b'x' * _images.MAX_IMAGE)
 
     def test_handles_are_bounded(self):
-        for i in range(4100):
-            _images.register('https://example.com/%d.png' % i)
-        self.assertEqual(len(_images._urls),4096)
+        with patch.object(_images, 'MAX_TOKENS', 50):
+            first = _images.register('https://example.com/0.png')
+            for i in range(1, 60):
+                _images.register('https://example.com/%d.png' % i)
+            self.assertEqual((len(_images._urls), len(_images._tokens)), (50, 50))
+            self.assertNotEqual(_images.register('https://example.com/0.png'), first)  # forgotten, so a new handle
+            self.assertEqual(_images.register('https://example.com/59.png'), _images.register('https://example.com/59.png'))
 
     def test_plain_language_verdict_is_evidence_based(self):
         self.assertEqual(search.verdict({})['label'], 'Not yet checked on the Frame')

tests/test_apk_search.py

@@ -122,7 +122,7 @@ class SearchTests(SettingsTest):
                     break
                 time.sleep(.01)
             self.assertTrue(arrived[1]['event'].wait(2))
-        self.assertEqual(arrived[1]['query'], ('second', 50))
+        self.assertEqual(arrived[1]['query'][:2], ('second', 50))
 
     def test_set_enabled_does_not_hold_search_lock_in_source(self):
         free = []

tests/test_control_center.py

@@ -63,6 +63,20 @@ class Coverage(unittest.TestCase):
         self.assertIn('*.js', ui['filter'])
         self.assertIn('*.css', ui['filter'])
 
+    def test_bundle_runs_the_server_on_its_own(self):
+        # The iPhone app and scripts/store-on-frame.sh start ui/server.py from this bundle alone.
+        import io, tarfile, tempfile
+        spec = importlib.util.spec_from_file_location('frame_bundle_run', ROOT / 'ios/scripts/make_frame_bundle.py')
+        bundle = importlib.util.module_from_spec(spec)
+        spec.loader.exec_module(bundle)
+        with tempfile.TemporaryDirectory() as tmp, tarfile.open(fileobj=io.BytesIO(bundle.build()), mode='r:gz') as tar:
+            tar.extractall(tmp)
+            result = subprocess.run([sys.executable, '-I', '-B', '-c',
+                                     'import sys; sys.path.insert(0, "ui"); import server, apk_sources.search; '
+                                     'apk_sources.search.modules()[1] and sys.exit("source modules failed: %r" % apk_sources.search.modules()[1])'],
+                                    cwd=tmp, capture_output=True, text=True, timeout=60)
+        self.assertEqual(result.returncode, 0, result.stderr[-2000:])
+
     def test_status_exposes_kernel_thermal_trips_without_guessing_thresholds(self):
         # Run the real aggregator with every external probe stubbed.
         names = ('read', 'process_names', 'performance', 'os_release', 'battery', 'power_source',

tests/test_frame_android_library.py

@@ -122,6 +122,11 @@ FIXTURES = ROOT / 'tests/fixtures/library'
 
 
 class ArtworkTests(unittest.TestCase):
+    def setUp(self):
+        from apk_sources import _images
+        _images._dns.clear()  # each test answers lookups its own way
+        self.addCleanup(_images._dns.clear)
+
     def test_source_inputs_and_url(self):
         from apk_sources import _images
         data = (FIXTURES / 'icon.png').read_bytes()

tests/test_install_queue.py

@@ -1,127 +0,0 @@
-"""The install queue (server.queue_job): Android, Quest and Meta installs run one after another."""
-import sandbox  # noqa: F401  (first: keeps tests off real data and services)
-from pathlib import Path
-import sys
-import threading
-import time
-import unittest
-from unittest.mock import patch
-
-ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(ROOT / 'ui'))
-import server  # noqa: E402
-
-
-def wait(job, timeout=5):
-    end = time.time() + timeout
-    while time.time() < end:
-        j = server.job_status(f'id={job}')
-        if j['done']:
-            return j
-        time.sleep(0.01)
-    raise AssertionError(f'job {job} never finished')
-
-
-class InstallQueue(unittest.TestCase):
-    def setUp(self):
-        self.assertEqual(server._queue, [])
-
-    def blocker(self):
-        """A queued install that runs until released."""
-        go, started = threading.Event(), threading.Event()
-
-        def work():
-            started.set()
-            go.wait(5)
-            return {'message': 'first done'}
-        job = server.queue_job('Install first', work)['job']
-        self.assertTrue(started.wait(5))
-        self.addCleanup(go.set)
-        return job, go
-
-    def test_runs_in_order_one_at_a_time(self):
-        order, running = [], []
-
-        def work(name):
-            def run(report):
-                running.append(name)
-                self.assertEqual(len(running), 1, 'two installs ran at once')
-                report('Copying', 50)
-                time.sleep(0.02)
-                order.append(name)
-                running.remove(name)
-                return {'message': f'{name} done'}
-            return run
-        first, go = self.blocker()
-        started = [server.queue_job(f'Install {n}', work(n), progress=True) for n in ('a', 'b', 'c')]
-        self.assertEqual([s['queued'] for s in started], [1, 2, 3])
-        self.assertIn('queued, 3 before it', started[2]['message'])
-        q = server.install_queue()['jobs']
-        self.assertEqual([j['label'] for j in q], ['Install first', 'Install a', 'Install b', 'Install c'])
-        self.assertEqual([j['queued'] for j in q], [False, True, True, True])
-        self.assertEqual(q[1]['stage'], 'Queued: 1 install before it')
-        self.assertEqual(q[3]['stage'], 'Queued: 3 installs before it')
-        go.set()
-        self.assertEqual(wait(first)['message'], 'first done')
-        for s, n in zip(started, 'abc'):
-            j = wait(s['job'])
-            self.assertEqual((j['message'], j['error'], j['queued']), (f'{n} done', None, False))
-        self.assertEqual(order, ['a', 'b', 'c'])
-        self.assertEqual(server.install_queue(), {'jobs': []})
-
-    def test_a_failure_does_not_stop_the_rest(self):
-        def fail():
-            raise server.Failure('no room on the Frame')
-        bad = server.queue_job('Install bad', fail)['job']
-        good = server.queue_job('Install good', lambda: {'message': 'ok'})['job']
-        self.assertEqual(wait(bad)['error'], 'no room on the Frame')
-        self.assertEqual(wait(good)['message'], 'ok')
-
-    def test_a_waiting_install_can_be_removed_but_not_a_running_one(self):
-        ran = []
-        first, go = self.blocker()
-        second = server.queue_job('Install second', lambda: ran.append(2) or {})['job']
-        third = server.queue_job('Install third', lambda: ran.append(3) or {})['job']
-        self.assertIn('Removed Install second', server.queue_action({'action': 'remove', 'job': second})['message'])
-        j = server.job_status(f'id={second}')
-        self.assertTrue(j['done'] and j['cancelled'])
-        self.assertEqual(server.job_status(f'id={third}')['stage'], 'Queued: 1 install before it')
-        for body, status in (({'action': 'remove', 'job': first}, 409), ({'action': 'remove', 'job': second}, 409),
-                             ({'action': 'nope', 'job': third}, 400)):
-            with self.assertRaises(server.Failure) as e:
-                server.queue_action(body)
-            self.assertEqual(e.exception.status, status)
-        go.set()
-        wait(third)
-        self.assertEqual(ran, [3])
-
-    def test_runs_only_on_the_headset_it_was_queued_for(self):
-        class Link:
-            device = 'frame-a'
-
-            def active_device(self):
-                return {'id': self.device}
-        link = Link()
-        with patch.object(server, 'LINK', link):
-            first, go = self.blocker()
-            ran = []
-            later = server.queue_job('Install later', lambda: ran.append(1) or {})['job']
-            link.device = 'frame-b'
-            go.set()
-            self.assertIn('switched headsets', wait(later)['error'])
-        self.assertEqual(ran, [])
-
-    def test_installs_from_each_place_are_queued(self):
-        with patch.object(server, 'ensure_master'), patch.object(server, 'queue_job', return_value={'job': 'j'}) as q:
-            server.quest({'action': 'import', 'package': 'com.example.game'})
-            server.meta({'action': 'install', 'app': '123'})
-            with patch.object(server.frame_catalog, 'app'):
-                server.android({'action': 'install', 'package': 'com.example.game'})
-            server.android({'action': 'install', 'package': 'com.example.game', 'url': 'https://f-droid.org/x.apk'})
-            with patch.object(server.apk_search, 'resolve', return_value=(None, {'enabled': True})):
-                server.source_install({'source': 'fdroid', 'id': 'com.example.game'})
-        self.assertEqual(q.call_count, 5)
-
-
-if __name__ == '__main__':
-    unittest.main()

tests/test_server.py

@@ -88,6 +88,12 @@ class ServerGuards(unittest.TestCase):
                 self.assertIn(mime, headers['Content-Type'])
                 self.assertIn(marker, payload)
 
+    def test_store_page_served_with_anti_framing_headers(self):
+        status, headers, payload = self.request("GET", "/store")
+        self.assertEqual(status, 200)
+        self.assertEqual(headers["X-Frame-Options"], "DENY")
+        self.assertIn(b"<title>APK Store</title>", payload)
+
     def test_foreign_host_rejected(self):
         # DNS rebinding: a hostile name pointed at 127.0.0.1.
         for path in ("/", "/api/status"):
@@ -472,11 +478,6 @@ class PageScripts(unittest.TestCase):
         r = subprocess.run(["node", str(ROOT / "tests" / "page" / "store_detail.mjs")], capture_output=True, text=True)
         self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
 
-    def test_meta_library_rows_render(self):
-        """tests/page/meta_rows.mjs runs the real Meta library row rendering from index.html."""
-        r = subprocess.run(["node", str(ROOT / "tests" / "page" / "meta_rows.mjs")], capture_output=True, text=True)
-        self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-
 
 @unittest.skipIf(os.name == "nt", "runs on the Frame (Linux); local-bin/ssh is a POSIX shell script")
 class LocalMode(unittest.TestCase):

tests/test_store_categories.py

@@ -0,0 +1,361 @@
+"""The store's Frame categories (ui/apk_sources/_categories.py): which apps go where, which are
+phone-only and hidden, and how the browse, search and library artwork use them. Offline."""
+import sandbox  # noqa: F401  (first: keeps tests off real data and services)
+import json
+from pathlib import Path
+import sys
+import tempfile
+import types
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / 'ui'))
+from apk_sources import SourceError, _categories, _images, fdroid, search  # noqa: E402
+import test_fdroid_sources as fixtures  # noqa: E402  (a module, so its tests don't run twice)
+FIXTURES, PIN, URL = fixtures.FIXTURES, fixtures.PIN, fixtures.URL
+
+
+def kind(**entry):
+    return _categories.classify(dict({'name': 'App', 'summary': ''}, **entry))
+
+
+class Classify(unittest.TestCase):
+    def test_vr_first_whatever_else_it_is(self):
+        self.assertEqual(kind(vr=True, categories=['Phone & SMS']), {'category': 'vr', 'phone_only': False})
+
+    def test_fine_categories_decide(self):
+        self.assertEqual(kind(categories=['Games', 'Puzzle Game'])['category'], 'games')
+        self.assertEqual(kind(categories=['Games', 'Emulator'])['category'], 'emulators')
+        # A chat app is in Multimedia too; the finer Social Network wins.
+        self.assertEqual(kind(categories=['Multimedia', 'Internet', 'Social Network'])['category'], 'web')
+        self.assertEqual(kind(categories=['Reading', 'Ebook Reader'])['category'], 'read')
+        self.assertEqual(kind(categories=['Multimedia', 'Podcast'])['category'], 'watch')
+
+    def test_broad_categories_alone(self):
+        self.assertEqual(kind(categories=['Multimedia']), {'category': 'watch', 'phone_only': False})
+        self.assertEqual(kind(categories=['Writing']), {'category': 'work', 'phone_only': False})
+
+    def test_phone_only(self):
+        for categories in (['System', 'Launcher'], ['Internet', 'VPN & Proxy'], ['Theming', 'Wallpaper'],
+                           ['Sports & Health'], ['Connectivity'], ['Time', 'Alarm Clock'], ['Habit Tracker']):
+            with self.subTest(categories=categories):
+                self.assertTrue(kind(categories=categories)['phone_only'])
+        self.assertTrue(kind(name='[ROOT] Night Light', categories=['Development'])['phone_only'])
+        self.assertTrue(kind(name='5G Proxy Client', summary='Routes traffic')['phone_only'])
+
+    def test_games_and_media_keep_phone_words(self):
+        # 'Battery' in a game's name or a widget in a music player doesn't hide a game or a player.
+        self.assertFalse(kind(name='Widget Wars', categories=['Strategy Game'])['phone_only'])
+        self.assertFalse(kind(name='Music', summary='with a home screen widget', categories=['Local Media Player'])['phone_only'])
+
+    def test_emulators_by_name_without_categories(self):
+        self.assertEqual(kind(name='RetroArch', summary='Frontend for emulators')['category'], 'emulators')
+
+    def test_unknown_is_neither_hidden_nor_guessed(self):
+        self.assertEqual(kind(name='Thing'), {'category': None, 'phone_only': False})
+        self.assertEqual(kind(categories=['Something New']), {'category': None, 'phone_only': False})
+
+    def test_matches(self):
+        phone = {'category': 'tools', 'phone_only': True}
+        self.assertFalse(_categories.matches(phone))
+        self.assertTrue(_categories.matches(phone, phone=True))
+        self.assertTrue(_categories.matches({'category': 'games', 'phone_only': False}, 'games'))
+        self.assertFalse(_categories.matches({'category': 'watch', 'phone_only': False}, 'games'))
+
+    def test_every_store_category_has_a_label(self):
+        self.assertEqual({c for c, _ in _categories.CATEGORIES}, _categories.IDS)
+        targets = set(_categories.FINE) | {c for c in _categories.BROAD.values() if c}
+        self.assertLessEqual(targets, _categories.IDS)
+        self.assertLessEqual(set(_categories.PRIORITY), _categories.IDS)
+
+
+class FDroidCategories(unittest.TestCase):
+    setUp, fetch, add = fixtures.Repositories.setUp, fixtures.Repositories.fetch, fixtures.Repositories.add
+
+    def index(self, version, categories):
+        raw = json.loads((FIXTURES / ('artwork-' + version + '.json')).read_text())
+        if version == 'v2':
+            raw['packages']['org.example.app']['metadata']['categories'] = categories
+        else:
+            raw['apps'][0]['categories'] = categories
+        path = self.root / ('index-' + version + '.json')
+        path.write_text(json.dumps(raw))
+        if version == 'v1':
+            fdroid._v1(path.read_bytes(), path)
+        return path
+
+    def test_categories_survive_v1_and_v2(self):
+        source = self.add()
+        for version in ('v1', 'v2'):
+            with self.subTest(version=version):
+                apps = fdroid._reduce(self.index(version, ['Games', 'Puzzle Game', 7]), source)
+                self.assertEqual(apps['org.example.app']['categories'], ['Games', 'Puzzle Game'])
+
+    def save(self, source, apps):
+        fdroid._write(fdroid.frame_host.cache_dir('apk-sources', source['id'] + '.json'),
+                      {'version': fdroid.CACHE_VERSION, 'url': URL, 'fingerprint': PIN, 'apps': apps})
+
+    def app(self, pkg, name, updated, categories=(), banner=None):
+        return {'source': 'x', 'id': pkg, 'package': pkg, 'name': name, 'summary': '', 'updated': updated,
+                'categories': list(categories), 'images': {'icon': None, 'banner': banner, 'screenshots': []}}
+
+    def test_browse_shows_artwork_then_newest_and_filters_before_the_limit(self):
+        source = self.add()
+        self.save(source, {a['id']: a for a in (
+            self.app('a.old', 'Aaa', '2020-01-01', ['Puzzle Game']),
+            self.app('b.new', 'Bbb', '2026-01-01', ['Puzzle Game']),
+            self.app('c.art', 'Ccc', '2019-01-01', ['Puzzle Game'], banner=URL + 'b.png'),
+            self.app('d.sms', 'Ddd', '2026-02-01', ['Phone & SMS']))})
+        self.assertEqual([a['id'] for a in fdroid.search(source, '', limit=10)], ['c.art', 'd.sms', 'b.new', 'a.old'])
+        keep = lambda e: _categories.matches(dict(e, **_categories.classify(e)))
+        self.assertEqual([a['id'] for a in fdroid.search(source, '', limit=1, keep=keep)], ['c.art'])
+        self.assertEqual([a['id'] for a in fdroid.search(source, 'a', limit=10)], ['a.old', 'c.art'])  # a query sorts by name
+
+    def test_lookup_reads_the_saved_index_only(self):
+        source = self.add()
+        self.assertEqual(fdroid.lookup(dict(source, id='never-loaded'), ['org.example.app']), {})
+        self.save(source, {'a.b': self.app('a.b', 'A', None)})
+        before = self.fetch_mock.call_count
+        self.assertEqual(list(fdroid.lookup(source, ['a.b', 'missing'])), ['a.b'])
+        self.assertEqual(self.fetch_mock.call_count, before)
+        self.assertEqual(fdroid.lookup(dict(source, enabled=False), ['a.b']), {})
+
+
+def fake_source(entries, kind_='fake', lookup=None):
+    mod = types.SimpleNamespace(KIND=kind_)
+    mod.sources = lambda: [{'id': kind_, 'kind': kind_, 'name': kind_.title(), 'url': 'https://example.org/',
+                            'builtin': True, 'enabled': True, 'trust': 'community'}]
+    mod.search = lambda source, query, limit=50: [dict(e) for e in entries][:limit]
+    mod.details = lambda source, entry_id: next(dict(e) for e in entries if e['id'] == entry_id)
+    if lookup is not None:
+        mod.lookup = lookup
+    return mod
+
+
+ENTRY = {'source': 'fake', 'package': None, 'summary': '', 'free': True, 'downloadable': True,
+         'min_sdk': 24, 'abis': ['arm64-v8a'], 'vr': None}
+
+
+class Search(unittest.TestCase):
+    def setUp(self):
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        p = patch.object(search, 'settings_path', return_value=Path(tmp.name) / 'sources.json')
+        p.start()
+        self.addCleanup(p.stop)
+        for state in (search._running, search._pending, search._status):
+            state.clear()
+            self.addCleanup(state.clear)
+
+    def run_search(self, entries, **kwargs):
+        with patch.object(search, 'modules', return_value=([fake_source(entries)], [])):
+            return search.search(**kwargs)
+
+    def test_category_and_phone_filters(self):
+        entries = [dict(ENTRY, id='g', name='Game', categories=['Puzzle Game']),
+                   dict(ENTRY, id='s', name='Texts', categories=['Phone & SMS']),
+                   dict(ENTRY, id='v', name='Video', categories=['Local Media Player'])]
+        result = self.run_search(entries)
+        self.assertEqual(sorted(a['name'] for a in result['apps']), ['Game', 'Video'])
+        self.assertEqual({a['name']: a['category'] for a in result['apps']}, {'Game': 'games', 'Video': 'watch'})
+        self.assertIn({'id': 'emulators', 'label': 'Emulators'}, result['categories'])
+        self.assertEqual([a['name'] for a in self.run_search(entries, category='games')['apps']], ['Game'])
+        self.assertEqual(len(self.run_search(entries, phone=True)['apps']), 3)
+        with self.assertRaisesRegex(SourceError, 'Unknown category'):
+            self.run_search(entries, category='phones')
+
+    def test_listing_offers_three_screenshots_details_all(self):
+        shots = ['https://example.org/%d.png' % i for i in range(8)]
+        entry = dict(ENTRY, id='g', name='Game', images={'icon': None, 'banner': None, 'screenshots': shots})
+        listed = self.run_search([entry])['apps'][0]['offers'][0]
+        self.assertEqual(len(listed['artwork']['screenshots']), 3)
+        self.assertEqual(len(search.decorate(entry)['artwork']['screenshots']), 8)
+
+    def test_browse_asks_sources_for_more_than_a_search(self):
+        seen = []
+        mod = fake_source([])
+        mod.search = lambda source, query, limit=50: seen.append((query, limit)) or []
+        with patch.object(search, 'modules', return_value=([mod], [])):
+            search.search('')
+            search.search('chess')
+        self.assertEqual(seen, [('', search.BROWSE_LIMIT), ('chess', 50)])
+
+
+class LibraryArtwork(unittest.TestCase):
+    def setUp(self):
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        p = patch.object(search, 'settings_path', return_value=Path(tmp.name) / 'sources.json')
+        p.start()
+        self.addCleanup(p.stop)
+
+    def test_by_package_from_saved_indexes_then_by_name_for_curated_apps(self):
+        icon = {'images': {'icon': 'https://example.org/icon.png', 'banner': None, 'screenshots': []}}
+        repo = fake_source([], 'fdroid', lookup=lambda source, packages: {
+            p: dict(icon, name='x') for p in packages if p == 'org.antennapod'})
+        github = fake_source([dict(icon, id='icosa/open-brush', name='Open Brush')], 'github')
+        bare = fake_source([dict(icon, id='x', name='Elsewhere', package='org.elsewhere')], 'itch')
+        apps = [{'package': 'org.antennapod', 'label': 'AntennaPod'}, {'package': 'com.Icosa.OpenBrush', 'label': 'Open Brush'},
+                {'package': 'org.elsewhere', 'label': 'Elsewhere'}, {'package': 'org.none', 'label': 'None'}]
+        with patch.object(search, 'modules', return_value=([repo, github, bare], [])):
+            found = search.artwork_for(apps)
+        self.assertEqual(sorted(found), ['com.Icosa.OpenBrush', 'org.antennapod'])
+        self.assertTrue(found['org.antennapod']['icon'].startswith('/source-image/'))
+
+    def test_a_failing_source_is_skipped(self):
+        def broken(source, packages):
+            raise SourceError('no')
+        with patch.object(search, 'modules', return_value=([fake_source([], 'fdroid', lookup=broken)], [])):
+            self.assertEqual(search.artwork_for([{'package': 'a.b', 'label': 'A'}]), {})
+
+
+class ImageHandles(unittest.TestCase):
+    def test_same_url_same_handle_without_scanning(self):
+        with _images._lock:
+            _images._urls.clear()
+            _images._tokens.clear()
+        a = _images.register('https://example.org/a.png')
+        self.assertEqual(_images.register('https://example.org/a.png'), a)
+        self.assertNotEqual(_images.register('https://example.org/b.png'), a)
+
+
+
+class Route(unittest.TestCase):
+    def test_search_filters_are_checked(self):
+        import server
+        with patch.object(server.apk_search, 'search', return_value={'apps': []}) as run:
+            server.source_search('q=&category=games&phone=1')
+            self.assertEqual(run.call_args.kwargs['category'], 'games')
+            self.assertIs(run.call_args.kwargs['phone'], True)
+            server.source_search('q=chess')
+            self.assertEqual((run.call_args.kwargs['category'], run.call_args.kwargs['phone']), (None, False))
+            for bad in ('phone=maybe', 'category=' + 'x' * 41):
+                with self.subTest(bad=bad), self.assertRaises(server.Failure):
+                    server.source_search(bad)
+
+
+
+class ReviewCases(unittest.TestCase):
+    """Real index entries (October 2026) that the first rules got wrong."""
+    def test_useful_apps_with_a_phone_side_stay(self):
+        for categories, category in ((['Connectivity', 'Email', 'Internet', 'Writing'], 'web'),  # Thunderbird
+                                     (['Connectivity', 'Internet', 'Multimedia', 'Podcast'], 'watch'),  # FocusPodcast
+                                     (['Contact', 'Email'], 'web'),
+                                     (['Cloud Storage & File Sync', 'File Manager', 'System'], 'tools')):
+            with self.subTest(categories=categories):
+                self.assertEqual(kind(categories=categories), {'category': category, 'phone_only': False})
+
+    def test_phone_side_alone_or_with_a_broad_category_is_hidden(self):
+        for categories in (['Internet', 'VPN & Proxy'], ['App Manager', 'Development', 'System'], ['Navigation']):
+            with self.subTest(categories=categories):
+                self.assertTrue(kind(categories=categories)['phone_only'])
+        self.assertTrue(kind(categories=['Launcher', 'Games'])['phone_only'])  # system ones always
+
+    def test_no_root_needed_is_not_a_root_tool(self):
+        for summary in ('Linux on Android, no root required', 'Linux Without Root Access', 'SSH server without root',
+                        'Works on non-rooted phones', 'Rootless and simple'):
+            with self.subTest(summary=summary):
+                self.assertFalse(kind(summary=summary, categories=['Development'])['phone_only'])
+        self.assertTrue(kind(summary='Needs root to tune the kernel', categories=['Development'])['phone_only'])
+
+    def test_izzyondroid_names(self):
+        self.assertEqual(kind(categories=['Office'])['category'], 'work')
+        self.assertTrue(kind(categories=['Xposed'])['phone_only'])
+
+
+
+class ReviewCasesTwo(unittest.TestCase):
+    """Round two of real entries (October 2026)."""
+    def test_messengers_with_phone_or_push_stay(self):
+        for categories in (['Internet', 'Messaging', 'Phone & SMS'], ['Internet', 'Messaging', 'Push'],
+                           ['Connectivity', 'Messaging', 'Phone & SMS', 'Voice & Video Chat']):
+            with self.subTest(categories=categories):
+                self.assertEqual(kind(categories=categories), {'category': 'web', 'phone_only': False})
+
+    def test_broad_only_sources_can_escape_a_phone_side(self):
+        self.assertEqual(kind(categories=['System', 'Development']), {'category': 'tools', 'phone_only': False})
+        self.assertEqual(kind(categories=['Connectivity', 'Internet']), {'category': 'web', 'phone_only': False})
+        self.assertTrue(kind(categories=['VPN & Proxy', 'Internet'])['phone_only'])  # it has finer ones, none useful
+
+    def test_summary_features_dont_make_a_phone_app(self):
+        self.assertFalse(kind(name='OSS Weather', summary='Forecasts with home screen widgets', categories=['Weather'])['phone_only'])
+        self.assertFalse(kind(name='Digital Calculator', summary='Hardware keyboard support', categories=['Calculator', 'System'])['phone_only'])
+        self.assertTrue(kind(name='Clock Widget', categories=['Clock'])['phone_only'])  # but the name says what it is
+
+    def test_saying_root_isnt_needed(self):
+        for summary in ('VNC server app that does not require root privileges', "Backups that don't need root access",
+                        "It doesn't need root", 'Linux without root', 'Works on non-rooted phones', 'Rootless'):
+            with self.subTest(summary=summary):
+                self.assertFalse(kind(summary=summary, categories=['Remote Access'])['phone_only'])
+        for summary in ('Requires root', 'Needs root access to change the kernel', 'For rooted devices'):
+            with self.subTest(summary=summary):
+                self.assertTrue(kind(summary=summary, categories=['Remote Access'])['phone_only'])
+
+    def test_hardware_the_frame_lacks(self):
+        self.assertTrue(kind(name='IR Blaster Remote', categories=['Multimedia', 'Remote Controller', 'System'])['phone_only'])
+        self.assertTrue(kind(name='Wear Sync for Breezy', summary='Weather on your Wear OS watch', categories=['Connectivity', 'Weather'])['phone_only'])
+
+
+class SearchFindsPhoneApps(unittest.TestCase):
+    setUp, run_search = Search.setUp, Search.run_search
+
+    def test_a_search_finds_what_browsing_hides(self):
+        entries = [dict(ENTRY, id='s', name='Texts', categories=['Phone & SMS'])]
+        self.assertEqual(self.run_search(entries)['apps'], [])
+        found = self.run_search(entries, query='texts')['apps']
+        self.assertEqual([(a['name'], a['offers'][0]['phone_only']) for a in found], [('Texts', True)])
+
+
+
+class ArtworkLookups(unittest.TestCase):
+    """A page of cards asks for dozens of images at once; they mustn't fail for want of a lookup slot."""
+    def setUp(self):
+        _images._dns.clear()
+        self.addCleanup(_images._dns.clear)
+
+    def test_public_answers_are_kept_private_ones_are_not(self):
+        public = [(2, 1, 6, '', ('93.184.216.34', 443))]
+        with patch.object(_images.socket, 'getaddrinfo', return_value=public) as lookup:
+            for _ in range(3):
+                self.assertEqual(_images._resolve('example.org', 443, 5), public)
+        self.assertEqual(lookup.call_count, 1)
+        private = [(2, 1, 6, '', ('10.0.0.5', 443))]
+        with patch.object(_images.socket, 'getaddrinfo', return_value=private) as lookup:
+            _images._resolve('inside.example', 443, 5)
+            _images._resolve('inside.example', 443, 5)
+        self.assertEqual(lookup.call_count, 2)
+
+    def test_waiting_for_a_slot_counts_against_the_budget(self):
+        import threading, time
+        gate = threading.Event()
+        for _ in range(4):  # every slot busy for the whole test
+            _images._resolvers.acquire()
+        threading.Timer(0.06, lambda: [_images._resolvers.release() for _ in range(4)]).start()
+        with patch.object(_images.socket, 'getaddrinfo', side_effect=lambda *a, **k: gate.wait(2) and []):
+            start = time.monotonic()
+            with self.assertRaises(SourceError):
+                _images._resolve('slow.example', 443, 0.1)
+            self.assertLess(time.monotonic() - start, 0.16)
+        gate.set()
+
+    def test_many_at_once_wait_for_a_slot(self):
+        import threading, time
+        public = [(2, 1, 6, '', ('93.184.216.34', 443))]
+        def slow(*a, **k):
+            time.sleep(0.05)
+            return public
+        errors = []
+        def one(i):
+            try:
+                _images._resolve('host%d.example' % i, 443, 5)
+            except SourceError as e:
+                errors.append(e)
+        with patch.object(_images.socket, 'getaddrinfo', side_effect=slow):
+            threads = [threading.Thread(target=one, args=(i,)) for i in range(12)]
+            [t.start() for t in threads]
+            [t.join() for t in threads]
+        self.assertEqual(errors, [])
+
+
+if __name__ == '__main__':
+    unittest.main()

ui/apk_sources/_categories.py

@@ -0,0 +1,116 @@
+"""Store categories that make sense on a Steam Frame, and which apps only make sense on a phone.
+
+Sources describe apps in their own terms (F-Droid's categories, a VR flag). The store groups
+them for a headset instead: VR first, then games and the flat apps worth having in a panel
+(video, reading, making things). Apps built around a phone's hardware or system (calls and
+SMS, launchers, widgets, keyboards, fitness, root tools) are marked phone_only; the store
+hides them unless asked, since Lepton can run them but they do nothing useful on the Frame.
+"""
+import re
+
+# (id, label), in the order the store shows them.
+CATEGORIES = (
+    ('vr', 'VR'),
+    ('games', 'Games'),
+    ('emulators', 'Emulators'),
+    ('watch', 'Watch & listen'),
+    ('read', 'Read & learn'),
+    ('create', 'Create'),
+    ('work', 'Work'),
+    ('web', 'Web & chat'),
+    ('tools', 'Tools'),
+)
+IDS = {c for c, _ in CATEGORIES}
+
+# F-Droid's category names -> a store category; None = only useful on a phone.
+# F-Droid has broad categories ('Multimedia') and, since 2025, finer ones ('Podcast'); an app
+# usually has both. A finer one decides, since 'Social Network' + 'Multimedia' is a chat app.
+BROAD = {
+    'Games': 'games', 'Multimedia': 'watch', 'Reading': 'read', 'Science & Education': 'read',
+    'Graphics': 'create', 'Writing': 'work', 'Money': 'work', 'Time': 'work', 'Internet': 'web',
+    'Development': 'tools', 'Security': 'tools',
+    'Office': 'work', 'Food': 'read',  # IzzyOnDroid's own names
+    'Connectivity': None, 'Navigation': None, 'Phone & SMS': None, 'Sports & Health': None,
+    'System': None, 'Theming': None,
+}
+FINE = {
+    'emulators': ('Emulator',),
+    'games': ('Action Game', 'Board Game', 'Card Game', 'Casual Game', 'Dice', 'Educational Game', 'Party Game',
+              'Platformer Game', 'Puzzle Game', 'Role-Playing Game', 'Shooter Game', 'Sport Game',
+              'Strategy Game', 'Visual Novel', 'Word Game'),
+    'watch': ('Local Media Player', 'Online Media Player', 'Podcast', 'Radio', 'Cast', 'Lyrics', 'Gallery',
+              'Ambient Sound'),
+    'read': ('Ebook Reader', 'Audiobook', 'News', 'Translation & Dictionary', 'Religion', 'Recipe Manager'),
+    'create': ('Draw', 'Music Practice Tool', 'Recorder'),
+    'web': ('Browser', 'Email', 'Messaging', 'Social Network', 'Forum', 'Voice & Video Chat', 'AI Chat',
+            'Bookmark'),
+    'work': ('Note', 'Task', 'Text Editor', 'Calendar & Agenda', 'Calculator', 'Unit Convertor',
+             'Finance Manager', 'Time Tracker', 'Schedule', 'Inventory'),
+    'tools': ('Code & Forge', 'Password & 2FA', 'File Manager', 'File Encryption & Vault', 'Text Encryption',
+              'Remote Access', 'Remote Controller', 'Cloud Storage & File Sync', 'Network Analyzer',
+              'File Transfer', 'Text to Speech', 'Speech Recognizer', 'Download', 'Game Helper', 'Weather'),
+}
+FINE_TARGET = {name: target for target, names in FINE.items() for name in names}
+# Only make sense as part of a phone's own system: any one of these makes an app phone-only.
+PHONE_SYSTEM = {
+    'Launcher', 'Keyboard & IME', 'Wallpaper', 'Icon Pack', 'Flashlight', 'Battery', 'Notification', 'Volume',
+    'Theming', 'Emergency Action', 'Xposed', 'Automation',
+}
+# Phone things that are often a side of a useful app (Thunderbird is in Contact, FluffyChat in
+# Phone & SMS, Nextcloud in Connectivity, a file manager in System): phone-only unless a useful
+# category says otherwise. A finer one when the source has them; a broad one when it only has
+# broad ones (IzzyOnDroid often does).
+PHONE_SIDE = {
+    'Phone & SMS', 'Push', 'Contact', 'Camera', 'OCR', 'Location Tracker & Sharer', 'Navigation',
+    'Public Transport', 'Workout', 'Diet', 'Medication', 'Health Manager', 'Alarm Clock', 'Pass Wallet',
+    'Wallet', 'VPN & Proxy', 'DNS & Hosts', 'Firewall', 'App Manager', 'App Store & Updater', 'System',
+    'Connectivity',
+}
+PHONE_CATEGORIES = PHONE_SYSTEM | PHONE_SIDE
+# Fine categories that aren't useful on a headset either, but don't make an app phone-only on their own.
+PHONE_LEANING = {'Clock', 'Timer', 'Stopwatch', 'Habit Tracker', 'Shopping List', 'Market & Price',
+                 'Meditation', 'Mental Health', 'Sports & Health'}
+# When an app has several, the one that best describes it on a headset wins.
+PRIORITY = ('emulators', 'games', 'watch', 'read', 'create', 'web', 'work', 'tools')
+
+EMULATOR = re.compile(r'\bemulat(or|ion|es)\b|\b(retroarch|ppsspp|dolphin|dosbox|scummvm|mame|mupen64|melonds|citra|duckstation|flycast)\b', re.I)
+# What an app is, from its name: these are phone parts, whatever the categories say.
+PHONE_NAME = re.compile(r'\b(launcher|home ?screen|widgets?|keyboard|wallpapers?|ringtones?|dialer|sms|mms|'
+                        r'caller id|lock ?screen|status ?bar|step counter|pedometer|5g|4g|lte|hotspot|tethering|'
+                        r'magisk|xposed|battery)\b|\[root\]', re.I)
+# "Doesn't need root" isn't a root tool; taken out before HARDWARE looks for "needs root".
+NOT_ROOT = re.compile(r"\b(no|non|without|not|never|doesn.?t (need|require)|does not (need|require)|don.?t (need|require))[- ]+(the )?root(ed|ing)?\b"
+                      r"|\broot(less|[- ]free| (is )?not (required|needed))\b", re.I)
+# Needs hardware or a device the Frame doesn't have, from the name or summary.
+HARDWARE = re.compile(r'\b(infra-?red|ir (blaster|remote|transmitter)|wear ?os|smart ?watch(es)?|nfc|sim card|'
+                      r'(requires?|needs?|for) (a )?root(ed)?( (access|device|phone))?)\b', re.I)
+
+
+def classify(entry):
+    """{'category': one of IDS or None, 'phone_only': bool} for a store entry."""
+    if entry.get('vr') is True:
+        return {'category': 'vr', 'phone_only': False}
+    name, summary = str(entry.get('name') or ''), str(entry.get('summary') or '')
+    names = [c for c in entry.get('categories') or () if isinstance(c, str)]
+    fine = {FINE_TARGET[c] for c in names if c in FINE_TARGET}
+    broad = {BROAD[c] for c in names if BROAD.get(c)}
+    category = next((c for c in PRIORITY if c in fine), None) or next((c for c in PRIORITY if c in broad), None)
+    if category is None and EMULATOR.search(name + ' ' + summary):
+        category = 'emulators'
+    only_broad = all(c in BROAD for c in names)  # this source has no finer categories for it
+    useful = fine or (broad if only_broad else set())
+    phone = any(c in PHONE_SYSTEM for c in names) or (not useful and any(c in PHONE_SIDE for c in names))
+    if names and category is None and all(c in PHONE_CATEGORIES or c in PHONE_LEANING or BROAD.get(c, 1) is None
+                                          for c in names):
+        phone = True
+    if category not in ('games', 'emulators', 'watch', 'read', 'create'):
+        phone = phone or bool(PHONE_NAME.search(name)) or bool(HARDWARE.search(NOT_ROOT.sub(' ', name + ' ' + summary)))
+    return {'category': category, 'phone_only': phone}
+
+
+def matches(entry, category=None, phone=False):
+    """Whether a classified entry belongs in a browse for this category ('' or None = any). A search
+    shows phone-only apps too (search passes phone=True), so a wrong guess never hides an app."""
+    if entry.get('phone_only') and not phone:
+        return False
+    return not category or entry.get('category') == category

ui/apk_sources/_images.py

@@ -12,7 +12,9 @@ from urllib.parse import urljoin, urlsplit
 from apk_sources import SourceError
 
 _lock = threading.Lock()
-_urls = OrderedDict()
+_urls = OrderedDict()  # token -> URL, oldest first
+_tokens = {}  # URL -> token
+MAX_TOKENS = 16384
 _cache = OrderedDict()
 MAX_IMAGE = 8 * 1024 * 1024
 MAX_CACHE = 64 * 1024 * 1024
@@ -31,24 +33,24 @@ def register(url):
     if not isinstance(url, str) or not valid_url(url):
         return None
     with _lock:
-        for token, known in _urls.items():
-            if known == url:
-                _urls.move_to_end(token)
-                return '/source-image/' + token
+        token = _tokens.get(url)
+        if token in _urls:
+            _urls.move_to_end(token)
+            return '/source-image/' + token
         token = secrets.token_urlsafe(24)
-        _urls[token] = url
-        while len(_urls) > 4096:
-            _urls.popitem(last=False)
+        _urls[token], _tokens[url] = url, token
+        while len(_urls) > MAX_TOKENS:  # a store browse lists a few thousand images
+            _tokens.pop(_urls.popitem(last=False)[1], None)
     return '/source-image/' + token
 
 
-def artwork(entry):
+def artwork(entry, shots=12):
     images = entry.get('images') or {}
     if not isinstance(images, dict):
         images = {}
     return {'icon': register(images.get('icon') or entry.get('icon')),
             'banner': register(images.get('banner')),
-            'screenshots': [path for path in (register(u) for u in (images.get('screenshots') or [])[:12]) if path]}
+            'screenshots': [path for path in (register(u) for u in (images.get('screenshots') or [])[:min(shots, 12)]) if path]}
 
 
 def image_type(data):
@@ -71,12 +73,37 @@ def fetch(url, redirects=3, deadline=None, limit=MAX_IMAGE):
 
 # Lookups that outlast their deadline keep running; cap them so they can't pile up.
 _resolvers = threading.BoundedSemaphore(4)
+# A page of store cards asks for dozens of images from the same few hosts at once: their public
+# addresses are kept for a few minutes, so most requests don't need a lookup (or a slot) at all.
+_dns = {}  # (host, port) -> (addresses, expires)
+DNS_TTL = 300
 
 
 def _resolve(host, port, timeout):
+    with _lock:
+        known = _dns.get((host, port))
+    if known and known[1] > time.monotonic():
+        return known[0]
+    found = _lookup(host, port, timeout)
+    try:
+        public = bool(found) and all(ipaddress.ip_address(a[4][0]).is_global for a in found)
+    except (TypeError, ValueError, IndexError):
+        public = False
+    if public:  # private answers are refused by the caller, and never kept
+        with _lock:
+            _dns[(host, port)] = (found, time.monotonic() + DNS_TTL)
+            while len(_dns) > 256:
+                _dns.pop(next(iter(_dns)))
+    return found
+
+
+def _lookup(host, port, timeout):
     # getaddrinfo has no timeout of its own; a thread keeps a slow resolver inside the budget.
-    if not _resolvers.acquire(blocking=False):
+    # A request waits for a free slot within its own budget rather than failing at once.
+    started = time.monotonic()
+    if not _resolvers.acquire(timeout=max(0, min(timeout, 10))):
         raise SourceError('Too many slow artwork name lookups are still running; try again shortly')
+    timeout -= time.monotonic() - started  # the wait for a slot comes out of the same budget
     found = {}
 
     def run():

ui/apk_sources/fdroid.py

@@ -26,7 +26,7 @@ from frame_apk_sign import _der_parts, _cert_key, der
 from frame_catalog import _IndexReader, _reduce_index, _sha256
 
 KIND = 'fdroid'
-CACHE_VERSION = 2
+CACHE_VERSION = 3  # 3: categories
 TMP_PREFIX = '.download-'  # in the cache folder, then the server's PID, so server.sweep_tmp can clear a stopped run's
 _LOCK = threading.RLock()  # settings only; never held while downloading
 _load_locks = {}
@@ -432,6 +432,7 @@ def _reduce(path, source):
                     name=_text(meta.get('name')) or pkg, summary=_summary(meta.get('summary')),
                     icon=images['icon'], images=images, developer=_text(meta.get('authorName')) or None,
                     page=meta.get('webSite') or source['url'], vr=None, free=True,
+                    categories=[c for c in meta.get('categories') or [] if isinstance(c, str)][:8],
                     license=meta.get('license'), downloadable=bool(latest.get('sha256')),
                     versions=versions, **{k: latest[k] for k in ('version', 'version_code', 'min_sdk', 'abis', 'size', 'updated')})
     return result
@@ -450,6 +451,7 @@ def _v1(content, path):
         localized = app.get('localized', {})
         meta = {k: _text({locale: fields[k] for locale, fields in localized.items() if fields.get(k)}) or app.get(k)
                 for k in ('name', 'summary', 'license', 'webSite', 'authorName')}
+        meta['categories'] = app.get('categories') or []
         for field in ('icon', 'featureGraphic', 'phoneScreenshots', 'sevenInchScreenshots'):
             images = {}
             for locale, fields in localized.items():
@@ -625,16 +627,39 @@ def set_enabled(source_id, enabled):
         _write(_storage(), settings)
 
 
-def search(source, query, limit=50):
+def _showcase(a):
+    """Browse order without a query: apps with real artwork first, then the most recently updated."""
+    images = a.get('images') or {}
+    return (not images.get('banner'), not images.get('screenshots'), not images.get('icon'),
+            ''.join(chr(0x10ffff - ord(c)) for c in str(a.get('updated') or '')))
+
+
+def search(source, query, limit=50, keep=None):
+    """keep: optional filter applied before the limit (the store's category browse)."""
     if not source.get('enabled', True):
         return []
     apps, _ = _load(source)
     words = query.casefold().split()
-    found = [a for a in apps.values() if all(w in (a['id'] + ' ' + a['name'] + ' ' + a['summary']).casefold() for w in words)]
-    found.sort(key=lambda a: (a['id'].casefold() != query.casefold(), a['name'].casefold()))
+    found = [a for a in apps.values() if all(w in (a['id'] + ' ' + a['name'] + ' ' + a['summary']).casefold() for w in words)
+             and (keep is None or keep(a))]
+    if words:
+        found.sort(key=lambda a: (a['id'].casefold() != query.casefold(), a['name'].casefold()))
+    else:
+        found.sort(key=_showcase)
     return [{k: v for k, v in a.items() if k != 'versions'} for a in found[:max(0, limit)]]
 
 
+def lookup(source, packages):
+    """Entries for these packages from the saved index only (never downloads); missing ones are left out."""
+    if not source.get('enabled', True):
+        return {}
+    found = _cached(source, frame_host.cache_dir('apk-sources', source['id'] + '.json'))
+    if not found:
+        return {}
+    apps = found[0]
+    return {p: {k: v for k, v in apps[p].items() if k != 'versions'} for p in packages if p in apps}
+
+
 def details(source, entry_id):
     if not source.get('enabled', True):
         raise SourceError('repository is disabled')

ui/apk_sources/search.py

@@ -15,7 +15,7 @@ import time
 import unicodedata
 
 import frame_host
-from apk_sources import SourceError, SourceLimited
+from apk_sources import SourceError, SourceLimited, _categories as categories
 
 _lock = threading.RLock()
 _running = {}
@@ -23,6 +23,7 @@ _pending = {}  # source id -> newest query waiting for the running one
 _game_data = {}  # package -> downloaded OBB paths waiting for "Add game data"
 _status = {}
 TIMEOUT = 12
+BROWSE_LIMIT = 300  # apps per source when browsing without a query, before grouping
 
 
 def modules():
@@ -158,9 +159,11 @@ def verdict(entry):
     return {'label': 'Not yet checked on the Frame', 'tone': 'unknown'}
 
 
-def decorate(entry):
+def decorate(entry, shots=12):
+    """shots: screenshots to offer; a listing card shows three, the detail page all of them."""
     from apk_sources import _images
-    return dict(entry, fit=fit(entry), verdict=verdict(entry), artwork=_images.artwork(entry))
+    return dict(entry, fit=fit(entry), verdict=verdict(entry), artwork=_images.artwork(entry, shots),
+                **categories.classify(entry))
 
 
 def details(source_id, entry_id):
@@ -178,10 +181,12 @@ def offer_rank(entry):
             entry.get('trust') == 'official')
 
 
-def group(entries, query='', vr=None, installable=False):
+def group(entries, query='', vr=None, installable=False, category=None, phone=False):
     groups = {}
     for entry in entries:
-        entry = decorate(entry)
+        entry = decorate(entry, shots=3)
+        if not categories.matches(entry, category, phone):
+            continue
         if vr is not None and (entry.get('vr') is True) != vr:  # unknown counts as flat
             continue
         if installable and entry['fit']['installable'] is not True:
@@ -195,7 +200,7 @@ def group(entries, query='', vr=None, installable=False):
         offers.sort(key=offer_rank, reverse=True)
         best = offers[0]
         result.append({'name': best.get('name'), 'package': best.get('package'),
-                       'summary': best.get('summary'), 'offers': offers})
+                       'summary': best.get('summary'), 'category': best.get('category'), 'offers': offers})
     q = normalise(query)
 
     def browse(a):  # a headset store: VR first, then apps with artwork, newest first
@@ -215,10 +220,10 @@ def group(entries, query='', vr=None, installable=False):
     return result
 
 
-def _launch(module, source, query, limit):
+def _launch(module, source, query, limit, category=None, phone=False):
     """One search per source at a time; the newest different query runs next."""
     key = source['id']
-    task = {'event': threading.Event(), 'query': (query, limit), 'started': time.monotonic(),
+    task = {'event': threading.Event(), 'query': (query, limit, category or None, bool(phone)), 'started': time.monotonic(),
             'job': (module, source)}
     with _lock:
         old = _running.get(key)
@@ -237,13 +242,17 @@ def _launch(module, source, query, limit):
 
 def _start(key, task):
     module, source = task['job']
-    query, limit = task['query']
+    query, limit, category, phone = task['query']
+    kwargs = {}
+    if (category or not phone) and 'keep' in inspect.signature(module.search).parameters:
+        # Large sources filter before their limit, so a category browse isn't cut to the first few hundred.
+        kwargs['keep'] = lambda e: categories.matches(dict(e, **categories.classify(e)), category, phone)
 
     def run():
         queued = None
         try:
             task['entries'] = [dict(e, source=key, source_name=source['name'], trust=source.get('trust'))
-                               for e in module.search(source, query, limit=limit) if e.get('free') is True]
+                               for e in module.search(source, query, limit=limit, **kwargs) if e.get('free') is True]
             task['stale'] = bool(getattr(module, 'stale', lambda s: False)(source))
         except Exception as e:
             task['error'] = str(e)
@@ -259,14 +268,20 @@ def _start(key, task):
     threading.Thread(target=run, daemon=True).start()
 
 
-def search(query='', vr=None, source=None, installable=False, timeout=TIMEOUT, limit=50):
+def search(query='', vr=None, source=None, installable=False, timeout=TIMEOUT, limit=50, category=None, phone=False):
     items, errors = registry()
     if source and source not in [s['id'] for _, s in items]:
         raise SourceError('Unknown source')
+    if category and category not in categories.IDS:
+        raise SourceError('Unknown category')
+    if not query.strip():
+        limit = max(limit, BROWSE_LIMIT)
+    else:
+        phone = True  # the phone-only guess hides apps from browsing, never from a search for them
     chosen = [(m, s) for m, s in items if s['enabled'] and (not source or s['id'] == source)]
     # Page-only sources (SideQuest) can't be searched; offer a link to browse them instead.
     elsewhere = [{'name': s['name'], 'url': s['url']} for m, s in chosen if s.get('page_only')]
-    tasks = [(s, _launch(m, s, query, limit)) for m, s in chosen if not s.get('page_only')]
+    tasks = [(s, _launch(m, s, query, limit, category, phone)) for m, s in chosen if not s.get('page_only')]
     entries, statuses = [], list(errors)
     for s, task in tasks:
         status = {'id': s['id'], 'name': s['name']}
@@ -281,7 +296,8 @@ def search(query='', vr=None, source=None, installable=False, timeout=TIMEOUT, l
         statuses.append(status)
         with _lock:
             _status[s['id']] = {k: v for k, v in status.items() if k not in ('id', 'name')}
-    return {'apps': group(entries, query, vr, installable), 'sources': statuses, 'elsewhere': elsewhere}
+    return {'apps': group(entries, query, vr, installable, category, phone), 'sources': statuses, 'elsewhere': elsewhere,
+            'categories': [{'id': c, 'label': label} for c, label in categories.CATEGORIES]}
 
 
 def warm():
@@ -291,7 +307,35 @@ def warm():
     items, _ = registry()
     for m, s in items:
         if s['enabled'] and not s.get('page_only'):
-            _launch(m, s, '', 50)  # same as the first browse, so that search reuses it
+            _launch(m, s, '', BROWSE_LIMIT)  # same as the first browse, so that search reuses it
+
+
+def artwork_for(apps):
+    """Store artwork for installed apps ({'package', 'label'} each), from saved indexes only:
+    by package where a source has one, else by name (curated GitHub apps). {package: artwork}."""
+    from apk_sources import _images
+    items, _ = registry()
+    wanted = {a['package']: normalise(a.get('label')) for a in apps if a.get('package')}
+    found = {}
+    for module, source in items:
+        if not source['enabled'] or source.get('page_only'):
+            continue
+        try:
+            if hasattr(module, 'lookup'):
+                hits = module.lookup(source, [p for p in wanted if p not in found])
+            elif module.KIND == 'github':  # a small local list; its entries have names, not packages
+                names = {n: p for p, n in wanted.items() if n and p not in found}
+                hits = {names[normalise(e['name'])]: e for e in module.search(source, '', limit=100)
+                        if normalise(e.get('name')) in names}
+            else:
+                continue
+        except (SourceError, OSError, ValueError, KeyError, TypeError):
+            continue
+        for package, entry in hits.items():
+            art = _images.artwork(entry)
+            if art['icon'] or art['banner'] or art['screenshots']:
+                found.setdefault(package, art)
+    return found
 
 
 def install(source_id, entry_id, version_code=None, progress=None):

ui/frame_android.py

@@ -7,7 +7,7 @@ in the Steam library and gets its own SteamVR panel. Nothing goes through
 Lepton Development, which wipes its apps on exit. See docs/apks.md.
 
 Python stdlib only. CLI: python3 ui/frame_android.py
-  install APK [SPLIT.apk ...] [--vr|--flat] [--no-xr-compat] | info APK | versions APK-or-PKG
+  install APK [--vr|--flat] [--no-xr-compat] | info APK | versions APK-or-PKG
   install-obb PKG OBB [OBB ...] | backup-data PKG ARCHIVE | restore-data PKG ARCHIVE
   refresh-art PKG|--all | patch SRC DST [--add NAME=PATH ...] | list | launch PKG | stop PKG | remove PKG | probe PKG
 """
@@ -18,7 +18,7 @@ import frame_artwork
 import frame_host
 import tempfile
 import zipfile
-from frame_apk_vr import add_launcher_category, drop_split_required
+from frame_apk_vr import add_launcher_category
 from frame_apk_sign import repack
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
@@ -142,9 +142,7 @@ def check_installable(info):
                          "(or arm64, or universal) and install that instead")
 
 
-# Installs are rare; one at a time avoids every race. Reentrant so a caller (a Quest import's
-# final checks and data copy) can hold it around install_obb and install, which take it too.
-_install_lock = threading.RLock()
+_install_lock = threading.Lock()  # installs are rare; one at a time avoids every race
 # The slowest transfer a copy is allowed before it times out, in bytes a second (about 4 Mbit/s,
 # a slow or busy Wi-Fi link). A fixed 10 minutes failed any APK over about 300 MB at that rate.
 COPY_MIN_RATE = 512 * 1024
@@ -192,303 +190,7 @@ def _write_meta(d, meta):
 install_hooks = []
 
 
-# Split APK members that belong to the split itself, not the app: never merged.
-SPLIT_OWN = re.compile(r'^(AndroidManifest\.xml|stamp-cert-sha256|META-INF/.*)$')
-# What a mergeable split may add: native libraries and assets, nothing else.
-SPLIT_ADDS = re.compile(r'^(lib/[^/]+/[^/]+\.so|assets/.*[^/])$')
-# Manifest elements a config or install-time asset split carries. Anything else (an
-# activity, service, uses-library...) belongs to a feature split, which needs its manifest.
-SPLIT_TAGS = {'manifest', 'application', 'uses-sdk', 'module', 'delivery', 'install-time', 'fusing'}
-# Every merged byte is held in memory while the APK is repacked and signed (as for every
-# patched APK), so splits are bounded by what's actually inflated, not only the headers.
-MAX_SPLIT_MEMBER = 512 * 1024**2
-MAX_SPLIT_TOTAL = 1024**3
-
-
-def _split_manifest(path, name):
-    """(package, split name) from a split APK's manifest, refusing splits that declare
-    anything the merged app would lose with that manifest."""
-    with zipfile.ZipFile(path) as z:
-        elements = frame_apk.manifest_elements(frame_apk._read(z, 'AndroidManifest.xml', frame_apk.MAX_MANIFEST))
-    attrs = next((a for tag, a in elements if tag == 'manifest'), {})
-    split = (attrs.get('split') or (None, None, None))[2]
-    feature = attrs.get('isFeatureSplit')
-    if feature and feature[1]:
-        raise FrameError(f'{name} ({split or "split"}) is a feature split with its own code and manifest; '
-                         'Frame Control can only merge splits that add native libraries or assets')
-    extra = sorted({tag for tag, _ in elements if tag not in SPLIT_TAGS})
-    if extra:
-        raise FrameError(f'{name} ({split or "split"}) declares <{">, <".join(extra)}> in its manifest; '
-                         'Frame Control can only merge splits that add native libraries or assets')
-    return (attrs.get('package') or (None, None, None))[2], split
-
-
-def split_entries(base, splits):
-    """What merging splits into base adds: {entry name: (split path, entry name, size)}.
-
-    Lepton runs one APK per instance, so a split app is merged into one APK. Only splits
-    that add native libraries (the arm64 ABI split) or install-time assets can be: a split
-    with code, components or resources (screen density, language) needs its own manifest
-    or resource table, which Frame Control doesn't merge, so those are refused."""
-    try:
-        with zipfile.ZipFile(base) as z:
-            taken = set(z.namelist())
-        package = apk_info(base)['package']
-        plan, total = {}, 0
-        for path in splits:
-            name = os.path.basename(path)
-            split_pkg, split_name = _split_manifest(path, name)
-            label = f'{name} ({split_name or "split"})'
-            if split_pkg != package:
-                raise FrameError(f'{name} is not part of {package} (it says {split_pkg or "nothing"})')
-            with zipfile.ZipFile(path) as z:
-                for member in z.infolist():
-                    entry = member.filename
-                    if entry.endswith('/') or SPLIT_OWN.match(entry):
-                        continue
-                    if entry == 'resources.arsc':
-                        # A config split for native code may carry an empty table; any resource needs merging.
-                        if not resources_empty(frame_apk._read(z, entry, frame_apk.MAX_ARSC)):
-                            raise FrameError(f'{label} holds screen-density or language resources; Frame Control '
-                                             'can only merge splits that add native libraries or assets')
-                        continue
-                    if entry.startswith('res/'):
-                        raise FrameError(f'{label} holds screen-density or language resources ({entry}); Frame '
-                                         'Control can only merge splits that add native libraries or assets')
-                    if re.match(r'^classes\d*\.dex$', entry):
-                        raise FrameError(f'{label} contains code ({entry}); Frame Control can only merge splits '
-                                         'that add native libraries or assets')
-                    if not SPLIT_ADDS.match(entry):
-                        raise FrameError(f'{label} contains {entry}; Frame Control can only merge splits that '
-                                         'add native libraries or assets')
-                    if entry in taken:
-                        raise FrameError(f'{name} and another part of the app both contain {entry}')
-                    if member.compress_type not in (zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED):
-                        raise FrameError(f'{entry} in {name} uses a compression Android does not')
-                    if member.file_size > MAX_SPLIT_MEMBER:
-                        raise FrameError(f'{entry} in {name} is {member.file_size / 1024**2:.0f} MB, more than '
-                                         f'Frame Control merges ({MAX_SPLIT_MEMBER // 1024**2} MB)')
-                    total += member.file_size
-                    if total > MAX_SPLIT_TOTAL:
-                        raise FrameError(f'the split APKs add more than {MAX_SPLIT_TOTAL // 1024**3} GB, more than '
-                                         'Frame Control merges')
-                    taken.add(entry)
-                    plan[entry] = (path, entry, member.file_size)
-        return plan
-    except (OSError, zipfile.BadZipFile, struct.error, IndexError, frame_apk.ApkError) as e:
-        raise FrameError(f'could not read the split APKs: {e}') from e
-
-
-def resources_empty(data):
-    """True only for a resource table that provably defines nothing: every type chunk's
-    entries absent. Bags (styles, plurals) count, and anything not understood counts too."""
-    def covered(start, end):
-        chunks, at = [], start
-        for chunk in frame_apk._chunks(data, start, end):
-            if chunk[2] != at:
-                return None
-            chunks.append(chunk)
-            at = chunk[2] + chunk[3]
-        return chunks if at == end else None
-
-    try:
-        if len(data) < 12 or struct.unpack_from('<H', data, 0)[0] != 0x0002:
-            return False
-        top = covered(struct.unpack_from('<H', data, 2)[0], len(data))
-        if top is None:
-            return False
-        for ctype, _, off, size in top:
-            if ctype == 0x0001:  # the global string pool
-                continue
-            if ctype != 0x0200:
-                return False
-            inner = covered(off + struct.unpack_from('<H', data, off + 2)[0], off + size)
-            if inner is None:
-                return False
-            for kind, hs, t, _ in inner:
-                if kind in (0x0001, 0x0202):  # type and key names, type specs
-                    continue
-                if kind != 0x0201:
-                    return False
-                flags, count = struct.unpack_from('<xBxxI', data, t + 8)
-                if flags & 0x01:  # sparse: only present entries are listed
-                    if count:
-                        return False
-                elif flags & 0x02:
-                    if any(o != 0xffff for o in struct.unpack_from(f'<{count}H', data, t + hs)):
-                        return False
-                elif any(o != 0xffffffff for o in struct.unpack_from(f'<{count}I', data, t + hs)):
-                    return False
-        return True
-    except (struct.error, IndexError):
-        return False
-
-
-def _zip64_sizes(extra, usize, csize):
-    """(uncompressed, compressed) with 0xffffffff fields taken from a ZIP64 extra field."""
-    at = 0
-    while at + 4 <= len(extra):
-        kind, length = struct.unpack_from('<HH', extra, at)
-        body = extra[at + 4:at + 4 + length]
-        if kind == 0x0001:
-            values, pos = [], 0
-            for field in (usize, csize):
-                if field == 0xffffffff:
-                    if pos + 8 > len(body):
-                        raise FrameError('truncated ZIP64 extra field')
-                    values.append(struct.unpack_from('<Q', body, pos)[0])
-                    pos += 8
-                else:
-                    values.append(field)
-            return tuple(values)
-        at += 4 + length
-    if 0xffffffff in (usize, csize):
-        raise FrameError('ZIP64 sizes without a ZIP64 extra field')
-    return usize, csize
-
-
-def _has_zip64_extra(extra):
-    at = 0
-    while at + 4 <= len(extra):
-        kind, length = struct.unpack_from('<HH', extra, at)
-        if kind == 0x0001:
-            return True
-        at += 4 + length
-    return False
-
-
-def read_member(path, member):
-    """A split member's bytes, read from its raw data and checked against both headers.
-
-    The local header must name the same file, with the same method and (unless a data
-    descriptor carries them, which is then checked) the same sizes and checksum as the
-    central directory; the data must end before the next member; a stored member must be
-    exactly its size and a deflated stream must end exactly at the end of its data, with
-    nothing after it. Output is bounded by the declared size: never trusts zipfile, which
-    stops early at a smaller declared size."""
-    with zipfile.ZipFile(path) as z:
-        info = z.getinfo(member)
-        starts = sorted({i.header_offset for i in z.infolist()} | {z.start_dir})
-    name, size = f'{member} in {os.path.basename(path)}', info.file_size
-    if info.flag_bits & 1 or info.compress_type not in (zipfile.ZIP_STORED, zipfile.ZIP_DEFLATED):
-        raise FrameError(f'{name} is encrypted or uses a compression Android does not')
-    if size > MAX_SPLIT_MEMBER or info.compress_size > MAX_SPLIT_MEMBER:
-        raise FrameError(f'{name} is larger than Frame Control merges ({MAX_SPLIT_MEMBER // 1024**2} MB)')
-    following = next((o for o in starts if o > info.header_offset), None)
-    with open(path, 'rb') as raw:
-        raw.seek(info.header_offset)
-        header = raw.read(30)
-        if len(header) != 30 or header[:4] != b'PK\3\4':
-            raise FrameError(f'{name}: invalid local ZIP header')
-        flags, method, crc, csize, usize, nl, el = struct.unpack_from('<2xHH4xIIIHH', header, 4)
-        local_name, extra = raw.read(nl), raw.read(el)
-        if local_name != info.orig_filename.encode('utf-8' if flags & 0x800 else 'cp437', 'surrogateescape'):
-            raise FrameError(f'{name}: the local header names {local_name.decode("utf-8", "replace")!r}')
-        if method != info.compress_type or (flags & 0x08) != (info.flag_bits & 0x08):
-            raise FrameError(f'{name} does not match its header (local and central entries differ)')
-        start = info.header_offset + 30 + nl + el
-        compressed = raw.read(info.compress_size)
-        if len(compressed) != info.compress_size:
-            raise FrameError(f'{name} is truncated')
-        if flags & 0x08:
-            # Sizes and checksum follow the data: (signature,) crc, then sizes of 4 bytes each,
-            # or 8 for ZIP64. Streaming writers use the ZIP64 form even for small files when
-            # sizes weren't known up front, so the width isn't implied by the final sizes: take
-            # the layout that matches the central directory and fits before the next entry,
-            # preferring one that ends exactly there, then the width the local header implies.
-            zip64 = 0xffffffff in (csize, usize) or _has_zip64_extra(extra)
-            tail = raw.read(24)
-            if len(tail) < 12:
-                raise FrameError(f'{name}: truncated data descriptor')
-            end = start + info.compress_size
-            fits = []
-            for signed in (True, False):
-                if signed and tail[:4] != b'PK\7\x08':
-                    continue
-                for width in (20, 12):
-                    body = tail[4:4 + width] if signed else tail[:width]
-                    if len(body) < width:
-                        continue
-                    values = struct.unpack_from('<IQQ' if width == 20 else '<III', body)
-                    length = width + (4 if signed else 0)
-                    if values == (info.CRC, info.compress_size, size) and \
-                            (following is None or end + length <= following):
-                        exact = following is not None and end + length == following
-                        fits.append((not exact, (width == 20) != zip64, length))
-            if not fits:
-                raise FrameError(f'{name} does not match its header (local and central entries differ, '
-                                 'or its data descriptor is truncated)')
-            crc, csize, usize = info.CRC, info.compress_size, size
-            descriptor = min(fits)[2]
-        else:
-            usize, csize = _zip64_sizes(extra, usize, csize)
-            descriptor = 0
-    if (crc, csize, usize) != (info.CRC, info.compress_size, size):
-        raise FrameError(f'{name} does not match its header (local and central entries differ)')
-    if following is not None and start + info.compress_size + descriptor > following:
-        raise FrameError(f'{name} overlaps the next ZIP entry')
-    if info.compress_type == zipfile.ZIP_STORED:
-        if info.compress_size != size:
-            raise FrameError(f'{name} does not match its header (stored {info.compress_size} bytes, says {size})')
-        data = compressed
-    else:
-        inflate = zlib.decompressobj(-15)
-        try:
-            data = inflate.decompress(compressed, size + 1)
-        except zlib.error as e:
-            raise FrameError(f'{name} is corrupt: {e}') from e
-        if len(data) != size or not inflate.eof or inflate.unconsumed_tail or inflate.unused_data:
-            raise FrameError(f'{name} does not match its header (its compressed data is not exactly '
-                             f'{size} bytes with nothing after it)')
-    if zlib.crc32(data) != info.CRC:
-        raise FrameError(f'{name} does not match its checksum')
-    return data
-
-
-def merge_splits(base, splits, dst):
-    """One installable APK from a base APK and its splits (see split_entries), re-signed
-    with Frame Control's key, without the base's isSplitRequired flag."""
-    plan = split_entries(base, splits)
-    add, total = {}, 0
-    try:
-        for entry, (path, member, size) in plan.items():
-            data = read_member(path, member)
-            total += len(data)
-            if total > MAX_SPLIT_TOTAL:
-                raise FrameError(f'the split APKs add more than {MAX_SPLIT_TOTAL // 1024**3} GB')
-            add[entry] = data
-        with zipfile.ZipFile(base) as z:
-            original = frame_apk._read(z, 'AndroidManifest.xml', frame_apk.MAX_MANIFEST)
-        manifest = drop_split_required(original)
-        repack(base, dst, replace={'AndroidManifest.xml': manifest} if manifest != original else None, add=add)
-    except (OSError, ValueError, IndexError, struct.error, zipfile.BadZipFile, frame_apk.ApkError) as e:
-        raise FrameError(f'could not merge the split APKs: {e}') from e
-    return {'merged': sorted(os.path.basename(p) for p in splits), 'entries': len(plan)}
-
-
-def split_size(splits):
-    """Bytes a merge adds, from the split headers (merge_splits enforces the real sizes)."""
-    total = 0
-    for path in splits:
-        with zipfile.ZipFile(path) as z:
-            total += sum(m.file_size for m in z.infolist() if SPLIT_ADDS.match(m.filename))
-    return total
-
-
-def install(apk_path, flatscreen=None, name=None, source=None, icon_png=None, xr_compat=None, artwork=None,
-            splits=None):
-    """splits: the rest of a split APK (base first, as apk_path); merged into one APK first."""
-    if splits:
-        start = time.time()
-        with tempfile.TemporaryDirectory(prefix=f'{TMP_PREFIX}{os.getpid()}-') as tmp:
-            merged = os.path.join(tmp, 'merged.apk')
-            try:
-                merge_splits(apk_path, list(splits), merged)
-            except Exception as e:  # reported like any other failed install
-                _after_install(None, None, e, start)
-                raise
-            meta = install(merged, flatscreen, name, source or os.path.basename(apk_path), icon_png, xr_compat, artwork)
-            return meta
+def install(apk_path, flatscreen=None, name=None, source=None, icon_png=None, xr_compat=None, artwork=None):
     start, info = time.time(), None
     try:
         info = apk_info(apk_path)
@@ -571,7 +273,6 @@ def _install(apk_path, info, pkg, flatscreen, name, source, artwork=None):
                                               'source': source or os.path.basename(apk_path)})
         presentation['warnings'] = art_warnings + presentation.get('warnings', [])
         meta = {'package': pkg, 'label': name or info['label'], 'version': info['version'],
-                'version_code': info.get('version_code'),
                 'instance': iid, 'shortcut': shortcut, 'game_id': game_id(shortcut),
                 'vr': info.get('vr', False), 'vr_issues': info.get('vr_issues', []),
                 'launchable': info.get('launchable', False), 'patched': info.get('patched', []),
@@ -658,34 +359,6 @@ except (OSError, ValueError, TypeError, AttributeError):
 """
 
 
-def _apk_parser_script():
-    """Frame-side Python preamble that loads this copy's stdlib APK parser (frame_apk)."""
-    script = 'import sys, types, json, base64\n'
-    for module in ('frame_apk', 'frame_apk_vr'):
-        with open(os.path.join(ROOT, 'ui', module + '.py')) as f:
-            source = f.read()
-        script += f'm = types.ModuleType({module!r}); sys.modules[{module!r}] = m; exec({source!r}, m.__dict__)\n'
-    return script
-
-
-def installed_version_code(pkg):
-    """The version code of pkg's installed app.apk, read on the Frame (only its manifest
-    crosses the link), or None if there is no readable APK. Connection failures raise."""
-    if not PKG_RE.match(pkg or ''):
-        raise FrameError(f'bad package name {pkg!r}')
-    script = _apk_parser_script() + f"""try:
-    code = sys.modules['frame_apk'].apk_info({(APPS_DIR + '/' + pkg + '/app.apk')!r}).get('version_code')
-except Exception:
-    code = None
-print(json.dumps(code if isinstance(code, int) else None))
-"""
-    try:
-        code = json.loads(ssh('python3 -', input=script, timeout=120).strip().splitlines()[-1])
-    except (ValueError, IndexError):
-        return None
-    return code if isinstance(code, int) and not isinstance(code, bool) else None
-
-
 def art_missing(m):
     """True when a Frame Control install has no complete Steam artwork on record."""
     return set((m or {}).get('artwork') or {}) != set(frame_artwork.SLOTS)
@@ -707,7 +380,13 @@ def refresh_art(pkg=None, artwork=None, fill_only=False):
         m = _meta_or_fail(pkg)
         d = f'{APPS_DIR}/{pkg}'
         # Parse the APK on the Frame, transferring only its icon/label, not the APK.
-        script = _apk_parser_script()
+        modules = {}
+        for module in ('frame_apk', 'frame_apk_vr'):
+            with open(os.path.join(ROOT, 'ui', module + '.py')) as f:
+                modules[module] = f.read()
+        script = 'import sys, types, json, base64\n'
+        for module, source in modules.items():
+            script += f'm = types.ModuleType({module!r}); sys.modules[{module!r}] = m; exec({source!r}, m.__dict__)\n'
         script += f"info = sys.modules['frame_apk'].apk_info({(d + '/app.apk')!r})\n"
         script += "info['icon_png'] = base64.b64encode(info.get('icon_png') or b'').decode()\n"
         script += cached_art_script(d) + "info['artwork'] = cached\nprint(json.dumps(info))\n"
@@ -768,22 +447,10 @@ def _clean_meta(m):
     return m
 
 
-def running_instances(strict=False):
-    """Lepton container name -> adb port, for the instances that are running now.
-
-    strict: a failed `podman ps` raises FrameError instead of reading as "nothing running",
-    and containers without an adb port label count too (port None); for callers that must
-    not mistake an error for a stopped instance."""
-    if not strict:
-        out = ssh('podman ps --format "{{.Names}} {{.Labels.adb_port}}" 2>/dev/null || true')
-        return dict(line.split()[:2] for line in out.splitlines() if len(line.split()) >= 2)
-    out = ssh('podman ps --format "{{.Names}} {{.Labels.adb_port}}"')
-    found = {}
-    for line in out.splitlines():
-        cols = line.split()
-        if cols:
-            found[cols[0]] = cols[1] if len(cols) > 1 and cols[1] != '<no' else None
-    return found
+def running_instances():
+    """Lepton container name -> adb port, for the instances that are running now."""
+    out = ssh('podman ps --format "{{.Names}} {{.Labels.adb_port}}" 2>/dev/null || true')
+    return dict(line.split()[:2] for line in out.splitlines() if len(line.split()) >= 2)
 
 
 def list_apps():
@@ -932,11 +599,8 @@ def main():
             r = frame_apk_versions.alternatives(
                 info['package'] if info else args[0], info.get('version_code') if info else None)
         elif cmd == 'install':
-            files = [a for a in args if not a.startswith('--')]
-            if not files:
-                raise FrameError('install requires APK [SPLIT.apk ...]')
-            r = install(files[0], flatscreen=False if '--vr' in args else True if '--flat' in args else None,
-                        xr_compat=False if '--no-xr-compat' in args else None, splits=files[1:])
+            r = install(args[0], flatscreen=False if '--vr' in args else True if '--flat' in args else None,
+                        xr_compat=False if '--no-xr-compat' in args else None)
         elif cmd == 'refresh-art':
             if len(args) != 1:
                 raise FrameError('usage: refresh-art PACKAGE or refresh-art --all')

ui/frame_apk_vr.py

@@ -118,7 +118,7 @@ def detection(data, names):
     info, _ = inspect(data)
     issues = []
     if 'lib/arm64-v8a/libvrapi.so' in names:
-        issues.append("Uses Meta's legacy VrApi, which the Frame doesn't have; it may not run.")
+        issues.append("Uses Meta's legacy VrApi, which the Frame doesn't have; it won't run.")
     if any(n.endswith('/libovrplatformloader.so') for n in names):
         issues.append("Uses Meta's platform SDK; if it checks your Quest store licence it will quit.")
     if 'lib/arm64-v8a/libopenxr_loader.so' in names:
@@ -126,46 +126,3 @@ def detection(data, names):
         issues.append('Uses OpenXR (good).')
     info['vr_issues'] = issues
     return info
-
-
-IS_SPLIT_REQUIRED = 0x01010591  # android:isSplitRequired
-
-
-def drop_split_required(axml_bytes):
-    """The manifest without <application android:isSplitRequired>, for a base APK whose
-    splits were merged into it: Android refuses a lone base that still says it needs them."""
-    chunks = list(frame_apk._chunks(axml_bytes, 8, len(axml_bytes)))
-    pool = next((c for c in chunks if c[0] == 1), None)
-    if pool is None:
-        raise frame_apk.ApkError('AndroidManifest.xml has no string pool')
-    strings = frame_apk._string_pool(axml_bytes, pool[2])
-    resmap = ()
-    for kind, header_size, offset, chunk_size in chunks:
-        if kind == 0x180:
-            resmap = struct.unpack_from('<%dI' % ((chunk_size - header_size) // 4), axml_bytes, offset + header_size)
-    result, changed = bytearray(axml_bytes[:8]), False
-    for kind, hs, off, size in chunks:
-        chunk = bytearray(axml_bytes[off:off + size])
-        if kind == 0x0102 and not changed:
-            name, astart, asize, count = struct.unpack_from('<4xIHHH', chunk, hs)
-            if name < len(strings) and strings[name] == 'application':
-                for i in range(count):
-                    a = hs + astart + i * asize
-                    attr = struct.unpack_from('<I', chunk, a + 4)[0]
-                    known = resmap[attr] if attr < len(resmap) else None
-                    if known == IS_SPLIT_REQUIRED or (known is None and attr < len(strings)
-                                                      and strings[attr] == 'isSplitRequired'):
-                        del chunk[a:a + asize]
-                        struct.pack_into('<I', chunk, 4, len(chunk))
-                        struct.pack_into('<H', chunk, hs + 12, count - 1)
-                        # id/class/style attribute indexes are 1-based positions in the list.
-                        for at in (hs + 14, hs + 16, hs + 18):
-                            index = struct.unpack_from('<H', chunk, at)[0]
-                            struct.pack_into('<H', chunk, at, 0 if index == i + 1 else index - 1 if index > i + 1 else index)
-                        changed = True
-                        break
-        result += chunk
-    if not changed:
-        return axml_bytes
-    struct.pack_into('<I', result, 4, len(result))
-    return bytes(result)

ui/frame_quest.py

@@ -1,644 +0,0 @@
-"""Import from my Quest: copy games you own off your own Meta Quest onto the Frame.
-
-The Quest is plugged into this computer by USB with developer mode on; its own
-adb copies the APK (and split APKs) into a per-user cache. The APK is checked
-before anything goes to the Frame, then installed through frame_android.install
-like any other APK. Game data (the OBB folder and, if asked, the external
-app-data folder) is copied by a second import while the person has the game
-open, since only a running Lepton instance can take it; Frame Control never
-starts the game itself. The cache is always removed. Games that link Meta's Platform SDK
-(libovrplatformloader.so) install with a warning: linking it doesn't mean the game
-enforces a licence check, but if it does the game may quit or hang on the Frame, and
-Frame Control does not remove the check or work around it. See docs/quest-import.md.
-
-Python stdlib only. CLI: python3 ui/frame_quest.py
-  devices | list [--serial SERIAL] | import PACKAGE [--serial SERIAL] [--data] [--allow-downgrade]
-"""
-import json
-import os
-from pathlib import Path
-import re
-import secrets
-import shlex
-import shutil
-import subprocess
-import sys
-import tarfile
-import threading
-import time
-import zipfile
-
-import frame_android as android
-import frame_host
-
-OBB = '/sdcard/Android/obb'
-DATA = '/sdcard/Android/data'
-OBB_NAME = r'(main|patch)\.[0-9]+\.{}\.obb'
-# Serials of adb connections that aren't a USB headset: Frame Control's own SSH tunnels
-# to the Frame's Lepton instances (127.0.0.1:<port>, server.AdbTunnel) and emulators.
-TUNNEL_RE = re.compile(r'^(127\.0\.0\.1|localhost|\[::1\]):\d+$')
-QUEST_MAKERS = {'oculus', 'meta'}
-META_APPS = ('com.oculus.', 'com.meta.', 'com.facebook.')
-CACHE_TTL = 6 * 3600  # an import left behind by a crash is swept after this
-ADB_TIMEOUT = 30
-PULL_TIMEOUT = 3 * 3600
-READY_TIMEOUT = 150
-BATCH = 15  # packages per adb shell command while listing
-
-# Linking the Platform SDK doesn't mean a game enforces the licence check (Meta's
-# VRC.Quest.Security.1 has only been Recommended since 2021), so it's a warning, not a refusal.
-ENTITLEMENT = ("Uses Meta's licence check (Platform SDK, libovrplatformloader.so); it may quit, hang, or run "
-               "without online features on the Frame. Frame Control won't remove the check.")
-VRAPI = ("Uses Meta's legacy VrApi and no OpenXR loader. The Frame doesn't have VrApi, so it may not run.")
-NO_DEVICE = ("No Quest found on this computer's USB. Connect the Quest with a cable that carries data, "
-             "put the headset on and allow USB debugging. Developer mode must be on first: it needs a Meta "
-             "developer organisation on a verified Meta account (developers.meta.com), then Developer Mode "
-             "switched on for the headset in the Meta Horizon phone app.")
-UNAUTHORISED = ("The Quest hasn't allowed this computer yet. Put the headset on and accept the \"Allow USB "
-                "debugging\" prompt (tick Always allow from this computer), then try again. No prompt? Unplug "
-                "and replug the cable, or switch developer mode off and on.")
-NO_PERMISSIONS = ("This computer sees the Quest but isn't allowed to open it over USB. On Linux, add a udev "
-                  "rule for Meta's USB vendor id 2833 (see docs/quest-import.md), then replug it.")
-OFFLINE = "adb reports the Quest offline. Unplug and replug the cable, or restart the headset."
-GONE = "The Quest was disconnected. Plug it back in, put it on, and try again."
-
-
-class QuestError(android.FrameError):
-    pass
-
-
-def _adb_cmd():
-    try:
-        return [frame_host.adb()]
-    except frame_host.HostError as e:
-        raise QuestError(str(e)) from e
-
-
-def _friendly(out):
-    low = out.lower()
-    if 'unauthorized' in low:
-        return UNAUTHORISED
-    if 'no permissions' in low or 'insufficient permissions' in low:
-        return NO_PERMISSIONS
-    if 'device offline' in low:
-        return OFFLINE
-    if 'no devices/emulators found' in low or re.search(r"device '[^']*' not found", low):
-        return GONE
-    return None
-
-
-def adb(*args, serial=None, timeout=ADB_TIMEOUT):
-    """Run this computer's adb (the one Frame Control already finds) and return stdout."""
-    cmd = _adb_cmd() + (['-s', serial] if serial else []) + list(args)
-    try:
-        r = subprocess.run(cmd, capture_output=True, stdin=subprocess.DEVNULL, text=True, errors='replace',
-                           timeout=timeout)
-    except subprocess.TimeoutExpired:
-        raise QuestError(f'adb {args[0]} took more than {timeout} s; check the Quest is still connected')
-    except OSError as e:
-        raise QuestError(f'could not run adb: {e}')
-    if r.returncode != 0:
-        out = (r.stderr or '').strip() or (r.stdout or '').strip()
-        raise QuestError(_friendly(out) or out[-600:] or f'adb exited {r.returncode}')
-    return r.stdout
-
-
-# ---- Finding the Quest ------------------------------------------------------
-
-def _parse_devices(out):
-    found = []
-    for line in out.splitlines():
-        line = line.strip()
-        if not line or line.startswith('List of devices') or line.startswith('*'):
-            continue
-        parts = line.split(None, 1)
-        serial, rest = parts[0], (parts[1] if len(parts) > 1 else '')
-        state = 'no permissions' if rest.startswith('no permissions') else (rest.split() or ['unknown'])[0]
-        fields = dict(t.split(':', 1) for t in rest.split() if re.match(r'^[a-z_]+:', t))
-        found.append({'serial': serial, 'state': state, 'usb': 'usb' in fields,
-                      'model': fields.get('model', '').replace('_', ' '), 'manufacturer': ''})
-    return found
-
-
-def devices():
-    """Every adb device on this computer, each with a kind: quest, frame, android (another
-    Android device), frame-tunnel (Frame Control's own SSH-tunnelled connection to a Lepton
-    instance, never touched here), emulator, or unknown (not authorised, offline...)."""
-    found = _parse_devices(adb('devices', '-l', timeout=15))
-    for d in found:
-        if TUNNEL_RE.match(d['serial']):
-            d['kind'] = 'frame-tunnel'
-        elif d['serial'].startswith('emulator-'):
-            d['kind'] = 'emulator'
-        elif d['state'] != 'device':
-            d['kind'] = 'unknown'
-        else:
-            try:
-                props = adb('shell', 'getprop ro.product.manufacturer; getprop ro.product.model',
-                            serial=d['serial'], timeout=15).splitlines() + ['', '']
-            except QuestError:
-                d['kind'] = 'unknown'
-                continue
-            d['manufacturer'], d['model'] = props[0].strip(), props[1].strip() or d['model']
-            maker = d['manufacturer'].lower()
-            d['kind'] = ('quest' if maker in QUEST_MAKERS or 'quest' in d['model'].lower()
-                         else 'frame' if maker == 'valve' else 'android')
-    return found
-
-
-def find_quest(serial=None):
-    """The one connected, authorised Quest, or a QuestError saying what to do."""
-    found = devices()
-    if serial:
-        d = next((d for d in found if d['serial'] == serial), None)
-        if not d:
-            raise QuestError(f'No adb device {serial} on this computer. ' + NO_DEVICE)
-        if d['kind'] == 'quest':
-            return d
-        state = {'unauthorized': UNAUTHORISED, 'no permissions': NO_PERMISSIONS, 'offline': OFFLINE}.get(d['state'])
-        what = ' '.join(x for x in (d['manufacturer'] or d['kind'], d['model']) if x)
-        raise QuestError(state or f"{serial} isn't a Meta Quest ({what}).")
-    quests = [d for d in found if d['kind'] == 'quest']
-    if len(quests) == 1:
-        return quests[0]
-    if quests:
-        raise QuestError('Several Quests are connected: ' + ', '.join(f"{d['model']} ({d['serial']})" for d in quests)
-                         + '. Choose one, or unplug the others.')
-    states = {d['state'] for d in found if d['kind'] == 'unknown'}
-    for state, message in (('unauthorized', UNAUTHORISED), ('no permissions', NO_PERMISSIONS), ('offline', OFFLINE)):
-        if state in states:
-            raise QuestError(message)
-    others = [d for d in found if d['kind'] in ('android', 'frame')]
-    if others:
-        raise QuestError(NO_DEVICE + ' (adb sees ' + ', '.join(
-            f"{d['manufacturer']} {d['model']}".strip() for d in others) + ", which isn't a Quest.)")
-    raise QuestError(NO_DEVICE)
-
-
-# ---- What's on it -------------------------------------------------------------
-
-def _package_script(packages):
-    parts = []
-    for p in packages:
-        parts += [f'echo @@{p}', f'pm path {p}', f'du -sk {OBB}/{p} 2>/dev/null', f'du -sk {DATA}/{p} 2>/dev/null']
-    return '; '.join(parts + ['true'])
-
-
-def _parse_packages(out, packages):
-    apps, current = {}, None
-    for line in out.splitlines():
-        line = line.strip()
-        if line.startswith('@@') and line[2:] in packages:
-            current = apps[line[2:]] = {'package': line[2:], 'apks': [], 'obb': None, 'data': None}
-        elif current is None or not line:
-            continue
-        elif line.startswith('package:'):
-            current['apks'].append(line[len('package:'):])
-        else:
-            size, _, where = line.partition('\t') if '\t' in line else line.partition(' ')
-            if size.isdigit():
-                key = 'obb' if where.strip().startswith(OBB + '/') else 'data' if where.strip().startswith(DATA + '/') else None
-                if key:
-                    current[key] = int(size) * 1024
-    result = []
-    for p in packages:
-        app = apps.get(p)
-        if not app or not app['apks']:
-            continue  # removed while listing
-        app['split'] = len(app['apks']) > 1
-        app['meta'] = p.startswith(META_APPS)
-        result.append(app)
-    return result
-
-
-def packages(serial):
-    """Third-party apps on the Quest: APK paths (several means a split APK), and the size
-    in bytes of the OBB and external data folders (None when there is none)."""
-    out = adb('shell', 'pm list packages -3', serial=serial)
-    names = sorted({l.split(':', 1)[1].strip() for l in out.splitlines() if l.startswith('package:')})
-    names = [n for n in names if android.PKG_RE.match(n)]
-    apps = []
-    for i in range(0, len(names), BATCH):
-        batch = names[i:i + BATCH]
-        apps += _parse_packages(adb('shell', _package_script(batch), serial=serial, timeout=120), batch)
-    return apps
-
-
-def package(serial, pkg):
-    apps = _parse_packages(adb('shell', _package_script([pkg]), serial=serial, timeout=60), [pkg])
-    if not apps:
-        raise QuestError(f"{pkg} isn't installed on the Quest")
-    return apps[0]
-
-
-def status(serial=None, with_apps=True):
-    """For the page: the Quest (or why there isn't one), what else adb sees, and its apps."""
-    try:
-        found = devices()
-    except QuestError as e:
-        return {'quest': None, 'devices': [], 'guidance': str(e), 'apps': []}
-    try:
-        quest = find_quest(serial)
-    except QuestError as e:
-        return {'quest': None, 'devices': found, 'guidance': str(e), 'apps': []}
-    return {'quest': quest, 'devices': found, 'guidance': None,
-            'apps': packages(quest['serial']) if with_apps else []}
-
-
-# ---- Checking what was copied ---------------------------------------------------
-
-def inspect(package_name, base, splits=()):
-    """Refuse what can't run on the Frame (32-bit only, Android newer than Lepton's, splits
-    that can't be merged), before anything is copied to it; warn about what may not run."""
-    names = set()
-    for path in [base, *splits]:
-        try:
-            with zipfile.ZipFile(path) as z:
-                names |= set(z.namelist())
-        except (zipfile.BadZipFile, OSError) as e:
-            raise QuestError(f'{os.path.basename(path)} copied from the Quest is not a readable APK: {e}')
-    info = android.apk_info(base)
-    label = info['label']
-    if info['package'] != package_name:
-        raise QuestError(f"The APK copied for {package_name} says it is {info['package']}; not importing it")
-    platform_sdk = any(n.rsplit('/', 1)[-1] == 'libovrplatformloader.so' for n in names)
-    abis = sorted({n.split('/')[1] for n in names if n.startswith('lib/') and n.count('/') >= 2})
-    if abis and 'arm64-v8a' not in abis:
-        raise QuestError(f"{label} is a 32-bit-only build ({', '.join(abis)}). The Frame runs 64-bit ARM "
-                         "(arm64-v8a) apps only; older Quest games are often 32-bit. Ask the developer "
-                         "whether a 64-bit build exists.")
-    android.check_installable(dict(info, abis=abis))  # Android version
-    if splits:
-        android.split_entries(base, splits)  # a split APK Frame Control can't merge fails now
-    warnings = [ENTITLEMENT] if platform_sdk else []
-    openxr = 'lib/arm64-v8a/libopenxr_loader.so' in names
-    if 'lib/arm64-v8a/libvrapi.so' in names and not openxr:
-        warnings.append(VRAPI)
-    return {'package': info['package'], 'label': label, 'version': info['version'],
-            'version_code': info.get('version_code'), 'abis': abis,
-            'vr': bool(info.get('vr') or openxr), 'platform_sdk': platform_sdk, 'warnings': warnings}
-
-
-# ---- Importing ------------------------------------------------------------------
-
-_import_lock = threading.Lock()
-_sleep = time.sleep
-
-
-def cache_root():
-    return Path(frame_host.cache_dir('quest-import'))
-
-
-def sweep_cache(now=None):
-    """Remove imports a crash left behind (older than CACHE_TTL)."""
-    root, now = cache_root(), now or time.time()
-    if root.is_dir():
-        for d in root.iterdir():
-            try:
-                if now - d.stat().st_mtime > CACHE_TTL:
-                    shutil.rmtree(d, ignore_errors=True)
-            except OSError:
-                pass
-
-
-def _safe(name):
-    return re.sub(r'[^A-Za-z0-9._-]', '_', name)[:120] or 'part.apk'
-
-
-def _remote_sizes(serial, paths):
-    out = adb('shell', 'stat -c %s ' + ' '.join(shlex.quote(p) for p in paths), serial=serial)
-    return sum(int(x) for x in out.split() if x.isdigit())
-
-
-def _pull(serial, remote, local):
-    adb('pull', remote, str(local), serial=serial, timeout=PULL_TIMEOUT)
-
-
-def _wait_ready(meta):
-    """Until the app's Lepton instance has finished booting Android."""
-    container = f"lepton-steamlaunch-{int(meta['instance'])}"
-    deadline = time.monotonic() + READY_TIMEOUT
-    while time.monotonic() < deadline:
-        out = android.ssh(f"podman exec {container} /system/bin/sh -c 'getprop sys.boot_completed' "
-                          "2>/dev/null || true", timeout=30)
-        if out.strip() == '1':
-            return
-        _sleep(3)
-    raise QuestError(f"{meta['label']} didn't start on the Frame within {READY_TIMEOUT // 60} minutes, so its "
-                     "game data couldn't be added. Check it opens from the Steam library, then import again.")
-
-
-def push_data(meta, folder):
-    """Stream a pulled /sdcard/Android/data/<package> folder into the running instance as a
-    tar, written straight into the SSH transfer: nothing is staged on this computer."""
-    import frame_android_data
-    pkg = meta['package']
-    container = f"lepton-steamlaunch-{int(meta['instance'])}"
-    script = f'set -eu; mkdir -p {DATA}/{pkg}; cd {DATA}/{pkg}; tar -x -o -f -'
-    read_end, write_end = os.pipe()
-    state = {'count': 0, 'error': None}
-
-    def write():
-        try:
-            with os.fdopen(write_end, 'wb') as out, \
-                    tarfile.open(fileobj=out, mode='w|', format=tarfile.GNU_FORMAT) as tar:
-                for path in sorted(Path(folder).rglob('*')):
-                    if path.is_symlink() or not (path.is_file() or path.is_dir()):
-                        continue  # regular files and folders only
-                    info = tar.gettarinfo(str(path), arcname=path.relative_to(folder).as_posix())
-                    info.uid = info.gid = 0
-                    info.uname = info.gname = ''
-                    if path.is_file():
-                        with path.open('rb') as f:
-                            tar.addfile(info, f)
-                        state['count'] += 1
-                    else:
-                        tar.addfile(info)
-        except (OSError, tarfile.TarError, ValueError) as e:  # ValueError: the reader closed first
-            state['error'] = e
-
-    writer = threading.Thread(target=write, daemon=True)
-    writer.start()
-    try:
-        with os.fdopen(read_end, 'rb') as src:
-            frame_android_data._stream(shlex.join(['podman', 'exec', '-i', container, '/system/bin/sh', '-c', script]),
-                                       src=src)
-    finally:
-        writer.join(60)
-    if state['error']:
-        raise QuestError(f'could not read the app files copied from the Quest: {state["error"]}')
-    return state['count']
-
-
-def space_needed(apk_bytes, merged_bytes, obb_bytes, data_bytes):
-    """Bytes an import needs free on this computer: the APKs as copied, a merged APK and the
-    install's patched copy of it (each up to merged_bytes), the OBB folder and the
-    Android/data folder (streamed to the Frame, never staged twice)."""
-    return apk_bytes + 2 * merged_bytes + obb_bytes + data_bytes
-
-
-def _check_space(work, need, pkg):
-    free = shutil.disk_usage(str(work)).free
-    if need > free:
-        raise QuestError(f'Importing {pkg} needs about {need / 1024**3:.1f} GB free on this computer '
-                         f'({free / 1024**3:.1f} GB available in {work.parent})')
-
-
-def import_game(package_name, serial=None, data=False, progress=None, allow_downgrade=False):
-    """Copy package_name from the Quest to the Frame. progress(stage, percent).
-
-    Frame Control never starts the game itself. Its game data (OBB, and Android/data if
-    asked) can only be written into a running Lepton instance, and there is no way to
-    boot one without its game, so that's a second import: the person starts the game,
-    imports again, and Frame Control copies the data in and closes the game.
-
-    allow_downgrade: replace a newer version on the Frame with the Quest's older one."""
-    if not android.PKG_RE.match(package_name or ''):
-        raise QuestError('invalid package name')
-    report = progress or (lambda stage, percent=None: None)
-    if not _import_lock.acquire(blocking=False):
-        raise QuestError('Another Quest import is running; wait for it to finish')
-    try:
-        report('Looking for your Quest', 1)
-        quest = find_quest(serial)
-        app = package(quest['serial'], package_name)
-        sweep_cache()
-        work = cache_root() / f'{package_name}-{secrets.token_hex(4)}'
-        work.mkdir(parents=True)
-        try:
-            return _import(quest['serial'], app, data, work, report, allow_downgrade)
-        finally:
-            shutil.rmtree(work, ignore_errors=True)
-    finally:
-        _import_lock.release()
-
-
-def _running(pkg):
-    # strict: a failed `podman ps` raises, never reads as "not running".
-    return f'lepton-steamlaunch-{android.instance_id(pkg)}' in android.running_instances(strict=True)
-
-
-def _installed_code(pkg, meta):
-    """The installed version code: from the install record, else (installs made before
-    records kept it) read from the installed app.apk on the Frame; None if unknown."""
-    code = (meta or {}).get('version_code')
-    if isinstance(code, int) and not isinstance(code, bool):
-        return code
-    return android.installed_version_code(pkg) if meta else None
-
-
-def _version(name, code):
-    return ' '.join(x for x in (f'version {name}' if name else '', f'code {code}' if code is not None else 'unknown code') if x)
-
-
-def _check_downgrade(existing, checked, allow):
-    """Refuse to replace a newer install on the Frame with the Quest's older copy."""
-    if not existing or allow:
-        return
-    have, new = _installed_code(existing['package'], existing), checked['version_code']
-    if have is None or new is None:
-        raise QuestError(f"Frame Control can't tell which version of {checked['label']} is on the Frame, so it "
-                         "won't replace it in case that one is newer. Allow replacing a newer version (or "
-                         "--allow-downgrade) to install your Quest's copy anyway.")
-    if int(new) < int(have):
-        raise QuestError(f"The Frame has a newer {checked['label']} ({_version(existing.get('version'), have)}) than "
-                         f"your Quest ({_version(checked['version'], new)}). Frame Control won't replace it with "
-                         "an older version unless you allow it (Allow replacing a newer version, or "
-                         "--allow-downgrade).")
-
-
-def _check_target(pkg, meta, checked):
-    """The install record of the game open on the Frame, if it is this package, in its own
-    instance, at the Quest's exact version code; else a QuestError."""
-    label = checked['label']
-    if (not meta or meta.get('package') != pkg or android._int(meta.get('instance')) != android.instance_id(pkg)):
-        raise QuestError(f"{label} is open on the Frame, but Frame Control has no matching install record for "
-                         'it. Close it, then import again to install it.')
-    have, new = _installed_code(pkg, meta), checked['version_code']
-    if have is None or new is None or int(have) != int(new):
-        raise QuestError(f"{label} is open on the Frame with a different version (Frame: "
-                         f"{_version(meta.get('version'), have)}; Quest: {_version(checked['version'], new)}). "
-                         "Close it, then import again to install the Quest's version.")
-    return meta
-
-
-def _check_android_package(meta, code):
-    """The package Android itself has installed in the instance is this one, at this version."""
-    pkg = meta['package']
-    container = f"lepton-steamlaunch-{int(meta['instance'])}"
-    out = android.ssh(f"podman exec {container} /system/bin/sh -c 'dumpsys package {pkg}' 2>/dev/null || true",
-                      timeout=60)
-    # Only this package's own block (dumpsys can list other packages too).
-    block = re.search(r'^\s*Package \[' + re.escape(pkg) + r'\] \(.*?(?=^\s*Package \[|\Z)', out, re.M | re.S)
-    found = re.search(r'\bversionCode=(\d+)', block.group(0)) if block else None
-    if not found:
-        raise QuestError(f'Android in {container} does not have {pkg} installed')
-    if int(found.group(1)) != int(code):
-        raise QuestError(f'Android in {container} has {pkg} version code {found.group(1)}, not the '
-                         f"Quest's {code}")
-
-
-def _close(pkg):
-    """Stop the game and confirm its instance is gone: (closed, why not)."""
-    try:
-        android.stop(pkg)
-        for _ in range(6):
-            if not _running(pkg):
-                return True, None
-            _sleep(2)
-        return False, 'it is still running'
-    except Exception as e:  # never replaces the error that led here; unconfirmed counts as not closed
-        return False, str(e) or type(e).__name__
-
-
-def _import(serial, app, data, work, report, allow_downgrade=False):
-    pkg = app['package']
-    obb_bytes = app['obb'] or 0
-    data_bytes = (app['data'] or 0) if data else 0
-    apk_bytes = _remote_sizes(serial, app['apks'])
-    _check_space(work, space_needed(apk_bytes, apk_bytes, obb_bytes, data_bytes), pkg)
-    # 1. The APK (and its splits), checked before anything else is copied.
-    local = []
-    for i, remote in enumerate(app['apks']):
-        report(f'Copying the app from your Quest ({i + 1} of {len(app["apks"])})', 5 + 20 * i // len(app['apks']))
-        name = 'base.apk' if os.path.basename(remote) == 'base.apk' else f'{i:02d}-{_safe(os.path.basename(remote))}'
-        _pull(serial, remote, work / name)
-        if not (work / name).is_file():
-            raise QuestError(f'adb did not copy {remote} from the Quest')
-        local.append(work / name)
-    base = next((p for p in local if p.name == 'base.apk'), local[0])
-    splits = [p for p in local if p != base]
-    report('Checking it can run on the Frame', 27)
-    checked = inspect(pkg, str(base), [str(p) for p in splits])
-    warnings = list(checked['warnings'])
-    label = checked['label']
-    # A merge stores what splits compressed: count it uncompressed, now the files are here.
-    merged = base.stat().st_size + android.split_size([str(p) for p in splits])
-    _check_space(work, space_needed(0, merged, obb_bytes, data_bytes), pkg)
-    wants_data = app['obb'] is not None or bool(data and app['data'] is not None)
-    if not _running(pkg):
-        # 2a. Install. The game is never started here: see import_game. Checked and installed
-        # under the shared install lock, so nothing installs or removes it in between.
-        report('Installing on the Frame', 60)
-        with android._install_lock:
-            if _running(pkg):
-                raise QuestError(f'{label} was started on the Frame during the import. Close it, then import again.')
-            _check_downgrade(android.read_meta(pkg), checked, allow_downgrade)
-            meta = android.install(str(base), splits=[str(p) for p in splits], source='Meta Quest (USB)')
-        report('Done', 100)
-        message = f"Imported {meta['label']} from your Quest. It's in the Steam library."
-        if wants_data:
-            what = ' and '.join(x for x in ('its OBB game data' if app['obb'] is not None else '',
-                                            'its Android/data files' if data and app['data'] is not None else '') if x)
-            message += (f" To add {what}, start {meta['label']} from the Steam library, leave it on its first "
-                        "screen, then import it again here: Frame Control copies the data in and closes the game.")
-        note = android.layer_note(meta)
-        return {'message': ' '.join([message, *warnings, *([note] if note else [])]), 'app': meta, 'obb': [],
-                'files': 0, 'warnings': warnings, 'split': bool(splits), 'needs_game_data': wants_data,
-                'closed': None}
-    # 2b. The game is open on the Frame: add its data to exactly this install, never replacing it.
-    _check_target(pkg, android.read_meta(pkg), checked)  # early, before copying the data off the Quest
-    if not wants_data:
-        raise QuestError(f"{label} is already installed and open on the Frame, and has no game data to add. "
-                         'Close it first to install it again.')
-    obb_files = []
-    if app['obb'] is not None:
-        report('Copying game data (OBB) from your Quest', 30)
-        (work / 'obb').mkdir()
-        _pull(serial, f'{OBB}/{pkg}', work / 'obb')
-        folder = work / 'obb' / pkg
-        files = sorted(p for p in folder.iterdir() if p.is_file()) if folder.is_dir() else []
-        obb_files = [p for p in files if re.fullmatch(OBB_NAME.format(re.escape(pkg)), p.name)]
-        skipped = [p.name for p in files if p not in obb_files]
-        if skipped:
-            warnings.append('Not copied, not standard OBB file names: ' + ', '.join(skipped))
-    data_folder = None
-    if data and app['data'] is not None:
-        report('Copying app files from your Quest', 50)
-        (work / 'data').mkdir()
-        _pull(serial, f'{DATA}/{pkg}', work / 'data')
-        data_folder = work / 'data' / pkg if (work / 'data' / pkg).is_dir() else None
-    result = add_game_data(pkg, checked, [str(p) for p in obb_files], data_folder, report, warnings)
-    result['split'] = bool(splits)
-    return result
-
-
-def add_game_data(pkg, checked, obb_files, data_folder, report, warnings=(), source='your Quest'):
-    """Copy game data into the game open on the Frame, then close it: the second step of a
-    two-step install (Import from my Quest, and My Meta library). checked is inspect()'s
-    result for the APK the data belongs to; obb_files are local OBB paths, data_folder a
-    local Android/data/<package> folder or None. Raises QuestError, after closing the game,
-    if anything fails."""
-    warnings = list(warnings)
-    label = checked['label']
-    copied_obb, copied_files, failure = [], 0, None
-    # Fetching the data can take a long time: check the target again, and hold the shared
-    # install lock (install, remove and install_obb take it too) until the game is closed.
-    with android._install_lock:
-        if not _running(pkg):
-            raise QuestError(f'{label} was closed on the Frame during the import. Start it, then import again.')
-        meta = _check_target(pkg, android.read_meta(pkg), checked)
-        closed, why = None, None
-        try:
-            report('Waiting for Android on the Frame', 70)
-            _wait_ready(meta)
-            _check_android_package(meta, checked['version_code'])
-            if obb_files:
-                report('Copying game data (OBB) to the Frame', 80)
-                copied_obb = android.install_obb(pkg, [str(p) for p in obb_files])['obb']
-            if data_folder:
-                report('Copying app files to the Frame', 92)
-                copied_files = push_data(meta, data_folder)
-        except Exception as e:  # any failure, local (OSError) or on the Frame, is reported below
-            failure = e
-        finally:
-            # Whatever happened, even Ctrl-C part-way through a write, the game is closed so it
-            # never runs on half-copied data. A failed close never hides the original error.
-            interrupted = sys.exc_info()[0] is not None
-            closed, why = _close(pkg)
-            if interrupted and not closed:
-                print(f"Frame Control couldn't close {meta['label']} on the Frame ({why}); close it from Steam "
-                      'before playing.', file=sys.stderr)
-    if failure:
-        message = f"Copying {meta['label']}'s game data failed: {failure}."
-        message += (' The game was closed; start it and import again to retry.' if closed else
-                    f" Frame Control also couldn't close the game ({why}): close it from Steam, then start it "
-                    'and import again.')
-        raise QuestError(message) from failure
-    report('Done', 100)
-    message = f"Added {meta['label']}'s game data from {source}"
-    message += ('; the game is closed, start it again from the Steam library.' if closed else
-                f", but Frame Control couldn't close the game ({why}). Close it from Steam before playing, so it "
-                'starts with the new data.')
-    if copied_obb:
-        message += f' Added {len(copied_obb)} OBB file{"s" if len(copied_obb) != 1 else ""}.'
-    if copied_files:
-        message += f' Copied {copied_files} app file{"s" if copied_files != 1 else ""}.'
-    return {'message': ' '.join([message, *warnings]), 'app': meta, 'obb': copied_obb, 'files': copied_files,
-            'warnings': warnings, 'split': False, 'needs_game_data': False, 'closed': closed}
-
-
-def main():
-    cmd, *args = sys.argv[1:] or ['help']
-    serial = args[args.index('--serial') + 1] if '--serial' in args and args.index('--serial') + 1 < len(args) else None
-    try:
-        if cmd == 'devices':
-            r = devices()
-        elif cmd == 'list':
-            r = packages(find_quest(serial)['serial'])
-        elif cmd == 'import':
-            names = [a for a in args if not a.startswith('--') and a != serial]
-            if len(names) != 1:
-                raise QuestError('usage: import PACKAGE [--serial SERIAL] [--data] [--allow-downgrade]')
-            r = import_game(names[0], serial, data='--data' in args, allow_downgrade='--allow-downgrade' in args,
-                            progress=lambda stage, percent=None: print(f'{percent:>3}% {stage}' if percent is not None
-                                                                       else stage, file=sys.stderr))
-        else:
-            sys.exit(__doc__)
-    except (android.FrameError, OSError) as e:
-        sys.exit(f'error: {e}')
-    print(json.dumps(r, indent=1))
-
-
-if __name__ == '__main__':
-    main()

ui/frame_telemetry.py

@@ -512,7 +512,7 @@ def compat_report(report):
         if k in p:
             p[k] = scrub(p[k], n)
     src = str(p.pop('source', '') or '')
-    if src in ('F-Droid', 'meta-store'):  # fixed source tags, never a person's file name
+    if src == 'F-Droid':
         p['source'] = src
     elif src.startswith(('http://', 'https://')) and _scrub_url(src) != '<url>':
         p['source'] = _scrub_url(src)

ui/index.html

@@ -398,9 +398,8 @@
   .cat-card .s { color: var(--muted); font-size: 12px; }
   .cat-card .why { color: var(--muted); font-size: 11.5px; line-height: 1.4; }
   .cat-card .row { margin-top: auto; }
-  .v-works, .v-likely, .item .s.v-works, .item .s.v-likely { color: var(--green-hi); }
-  .v-maybe, .item .s.v-maybe { color: var(--warn); }
-  .v-unlikely, .v-no, .item .s.v-unlikely, .item .s.v-no { color: var(--bad); }  /* over .item .s's grey */
+  .v-works, .v-likely { color: var(--green-hi); } .v-maybe { color: var(--warn); }
+  .v-unlikely, .v-no { color: var(--bad); }
   .vbadge { font-size: 10.5px; letter-spacing: .5px; text-transform: uppercase; white-space: nowrap; margin-left: auto; }
   @media (max-width: 1100px) { .and-grid { grid-template-columns: 1fr; } }
   /* ---- Steam games (owned + store) ---- */
@@ -559,6 +558,95 @@
   .store-badges { display:flex; flex-wrap:wrap; gap:7px; }
   .store-badge { font-size:11px; color:#b7d8ec; background:#6ec9ff14; padding:4px 9px; border-radius:5px; }
   .store-badge.works { color:#b8e2ab; background:#70bb5418; }
+  /* ---- Android: Store and Library ---- */
+  .store-tabs { border-bottom:0; padding-bottom:0; margin-bottom:26px; }
+  .store-switch { display:inline-flex; padding:4px; gap:4px; border-radius:12px; background:#0e1723; border:1px solid #ffffff10; }
+  .store-switch > button { display:inline-flex; align-items:center; gap:9px; height:42px; padding:0 22px; border-radius:9px; font-size:15px; font-weight:600; background:transparent; color:var(--muted); border:0; }
+  .store-switch > button svg { width:19px; height:19px; }
+  .store-switch > button.on { background:linear-gradient(180deg,#2a4763,#203a52); color:var(--bright); box-shadow:0 2px 10px #0006, inset 0 1px 0 #ffffff14; }
+  .store-switch > button:not(.on):hover { color:var(--text); background:#ffffff08; }
+  #andCount { font-size:12px; font-weight:600; color:#c6e2f5; background:#1a9fff2e; border-radius:10px; padding:1px 8px; }
+  #andCount:empty { display:none; }
+  .store-layout { display:grid; grid-template-columns:200px minmax(0,1fr); gap:32px; align-items:start; }
+  .store-side { position:sticky; top:88px; display:flex; flex-direction:column; gap:18px; }
+  .store-cats { display:flex; flex-direction:column; gap:2px; }
+  .store-cats button { display:flex; align-items:center; gap:11px; width:100%; height:38px; padding:0 12px; border-radius:8px; background:transparent; border:0; color:#b5c0cb; font-size:14px; font-weight:500; text-align:left; }
+  .store-cats button svg { width:18px; height:18px; flex:none; opacity:.85; }
+  .store-cats button:hover { background:#ffffff09; color:var(--bright); }
+  .store-cats button[aria-pressed=true] { background:#1a9fff26; color:var(--bright); box-shadow:inset 3px 0 0 var(--blue); }
+  .store-side-opts { display:flex; flex-direction:column; gap:10px; padding:14px 12px 0; border-top:1px solid #ffffff10; font-size:12px; color:#a8b5c2; }
+  .store-check { display:flex; align-items:center; gap:8px; cursor:pointer; }
+  .store-check input { accent-color:var(--blue); width:15px; height:15px; margin:0; }
+  .store-source-select { display:flex; flex-direction:column; gap:6px; }
+  .store-source-select select { max-width:none; width:100%; }
+  .store-main { min-width:0; }
+  .store-toolbar { margin-bottom:20px; }
+  @media(max-width:900px) {
+    .store-layout { display:block; }
+    .store-side { position:static; margin-bottom:18px; gap:12px; }
+    .store-cats { flex-direction:row; overflow-x:auto; scrollbar-width:none; gap:6px; }
+    .store-cats button { width:auto; flex:none; height:34px; border-radius:18px; background:#ffffff07; border:1px solid #ffffff0c; font-size:12px; }
+    .store-cats button[aria-pressed=true] { box-shadow:none; background:#235779; border-color:#5287a5; }
+    .store-side-opts { flex-direction:row; flex-wrap:wrap; align-items:center; gap:14px; border:0; padding:0; }
+    .store-source-select { flex-direction:row; align-items:center; }
+  }
+  .store-shelf { display:grid; grid-auto-flow:column; grid-auto-columns:minmax(220px,calc((100% - 54px)/4)); gap:18px; overflow-x:auto; scroll-snap-type:x mandatory; padding:4px 2px 14px; scrollbar-width:thin; }
+  .store-shelf > * { scroll-snap-align:start; }
+  .store-row-head .see-all { margin-left:auto; font-size:12px; height:28px; padding:0 12px; border-radius:14px; background:#ffffff0a; color:var(--link); border:0; }
+  .store-row-head .see-all:hover { background:#ffffff14; color:var(--bright); }
+  .store-card { display:flex; flex-direction:column; }
+  .store-card-content { display:flex; flex-direction:column; flex:1; min-width:0; width:100%; }
+  .store-card-title strong { min-width:0; }
+  .store-summary { white-space:normal; display:-webkit-box; -webkit-line-clamp:2; -webkit-box-orient:vertical; min-height:2.9em; line-height:1.45; }
+  .store-card-foot { margin-top:auto; padding-top:12px; }
+  .store-art.shots { display:flex; gap:6px; justify-content:center; padding:10px 10px 0; }
+  .store-art.shots > img { position:relative; inset:auto; width:auto; height:100%; max-width:31%; object-fit:cover; object-position:top; border-radius:6px 6px 0 0; box-shadow:0 4px 14px #0008; }
+  .store-art.icon-art > .art-backdrop { position:absolute; inset:-30%; width:160%; height:160%; object-fit:cover; filter:blur(28px) saturate(1.4) brightness(.55); }
+  .store-art.icon-art > .art-mark { position:absolute; z-index:2; left:50%; top:50%; width:34%; aspect-ratio:1; height:auto; transform:translate(-50%,-50%); border-radius:22%; box-shadow:0 8px 24px #0009; object-fit:cover; }
+  .store-art.icon-art .art-initial, .store-art.shots .art-initial { display:none; }
+  .store-cat { color:#a8b5c2; }
+  .store-fit { font-size:11px; font-weight:600; border-radius:4px; padding:2px 7px; }
+  .store-fit.works { color:#c3efb2; background:#59bf4029; }
+  .store-fit.ready { color:#bfe3fa; background:#1a9fff26; }
+  .store-fit.blocked { color:#f3b2a6; background:#d9412629; }
+  .store-vr { font-size:10px; font-weight:700; letter-spacing:.8px; color:#0e141b; background:#c2e7ff; border-radius:4px; padding:2px 6px; }
+  .store-art .store-vr { position:absolute; z-index:3; top:9px; left:9px; box-shadow:0 2px 8px #0007; }
+  .store-hero .hero-meta { display:flex; gap:8px; align-items:center; }
+  /* Library */
+  .lib-head { display:flex; align-items:flex-end; justify-content:space-between; gap:24px; flex-wrap:wrap; margin-bottom:22px; }
+  .lib-head h1 { font-size:clamp(26px,3vw,34px); letter-spacing:-1px; margin:6px 0 6px; color:var(--bright); font-weight:700; }
+  .lib-head p { color:#a8b5c2; margin:0; font-size:14px; max-width:620px; }
+  .lib-tools { display:flex; gap:12px; align-items:center; flex-wrap:wrap; }
+  .lib-tools input[type=search] { width:220px; border-radius:8px; }
+  .lib-grid { display:grid; grid-template-columns:repeat(auto-fill,minmax(250px,1fr)); gap:18px; margin-bottom:36px; }
+  .lib-card { position:relative; display:flex; flex-direction:column; border-radius:10px; background:#1b2938; border:1px solid #ffffff0b; transition:transform .18s,box-shadow .18s; }
+  .lib-card:hover { transform:translateY(-3px); box-shadow:0 12px 28px #0005; background:#203247; }
+  .lib-card .store-art { aspect-ratio:16/9; width:100%; border-radius:10px 10px 0 0; }
+  .lib-card:has(.lib-more[open]) { z-index:5; transform:none; }
+  .lib-card.running { border-color:#59bf4080; box-shadow:0 0 0 1px #59bf4040; }
+  .lib-running { position:absolute; z-index:3; top:9px; right:9px; font-size:11px; font-weight:600; color:#d6f5c8; background:#2d5a1fd9; border-radius:10px; padding:2px 9px; display:inline-flex; align-items:center; gap:6px; }
+  .lib-running::before { content:""; width:7px; height:7px; border-radius:50%; background:#8ef05f; box-shadow:0 0 6px #8ef05f; }
+  .lib-body { display:flex; gap:11px; align-items:center; padding:13px 14px 4px; min-width:0; }
+  .lib-body .store-icon { width:40px; height:40px; border-radius:10px; font-size:19px; }
+  .lib-body strong { display:block; color:var(--bright); font-size:15px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .lib-body small { display:block; color:var(--muted); font-size:12px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .lib-body > div { min-width:0; }
+  .lib-warn { margin:6px 14px 0; font-size:11px; color:#e8c27a; }
+  .lib-actions { display:flex; gap:8px; align-items:center; padding:12px 14px 14px; margin-top:auto; }
+  .lib-actions .play, .lib-actions .stop { flex:1; height:36px; font-size:14px; font-weight:600; border-radius:6px; }
+  .lib-more { position:relative; }
+  .lib-more > summary { list-style:none; display:flex; align-items:center; justify-content:center; width:38px; height:36px; border-radius:6px; background:var(--btn); color:var(--text); cursor:pointer; font-size:18px; line-height:1; }
+  .lib-more > summary::-webkit-details-marker { display:none; }
+  .lib-more > summary:hover, .lib-more[open] > summary { background:var(--btn-hi); }
+  .lib-menu { position:absolute; right:0; bottom:calc(100% + 6px); z-index:20; min-width:190px; padding:6px; border-radius:9px; background:#23364a; border:1px solid #ffffff1a; box-shadow:0 14px 34px #000a; display:flex; flex-direction:column; }
+  .lib-menu button { display:block; width:100%; text-align:left; height:auto; padding:8px 10px; border-radius:6px; background:transparent; font-size:13px; font-weight:400; color:var(--text); border:0; }
+  .lib-menu button small { display:block; color:var(--muted); font-size:11px; margin-top:2px; }
+  .lib-menu button:hover { background:#ffffff12; }
+  .lib-menu button.danger { color:#ff9c8a; }
+  .lib-empty { grid-column:1/-1; text-align:center; padding:48px 20px; border:1px dashed #ffffff1c; border-radius:12px; color:#a8b5c2; }
+  .lib-empty h2 { color:var(--bright); text-transform:none; letter-spacing:-.3px; font-size:20px; margin:0 0 8px; }
+  .lib-section { font-size:13px; text-transform:uppercase; letter-spacing:1.6px; color:var(--muted); margin:0 0 14px; font-weight:700; }
+  .lib-manage { display:grid; grid-template-columns:repeat(auto-fit,minmax(min(100%,360px),1fr)); gap:18px; align-items:start; }
   .store-empty { display:flex; flex-direction:column; align-items:center; text-align:center; padding:58px 20px 70px; }
   .store-empty svg { width:110px; height:90px; color:var(--link); margin-bottom:14px; }
   .store-empty h2 { font-size:23px; color:var(--bright); margin:8px 0; text-transform:none; letter-spacing:0; }
@@ -639,7 +727,14 @@
     .store-hero { height:285px; border-radius:9px; margin-bottom:26px; }
     .hero-copy { padding:26px 22px; } .hero-copy strong { font-size:29px; }
     .hero-copy > span:not(.store-eyebrow):not(.hero-cta) { font-size:13px; max-width:260px; }
-    .store-row-head { display:block; } .store-row-head h2 { font-size:18px; } .store-row-head p { margin-top:3px; }
+    .store-row-head { display:flex; align-items:center; } .store-row-head h2 { font-size:18px; } .store-row-head p { display:none; }
+    .store-heading .store-eyebrow, .store-heading p { display:none; } .store-heading h1 { font-size:26px; margin:0 0 12px; }
+    .store-shelf { grid-auto-columns:minmax(200px,72%); gap:12px; }
+    .store-switch > button { height:38px; padding:0 14px; font-size:14px; }
+    .lib-head { margin-bottom:16px; } .lib-head p { font-size:13px; } .lib-tools, .lib-tools input[type=search] { width:100%; }
+    .lib-grid { grid-template-columns:repeat(2,minmax(0,1fr)); gap:12px; }
+    .lib-body { padding:10px 10px 2px; } .lib-body .store-icon { width:30px; height:30px; font-size:14px; } .lib-body strong { font-size:13px; }
+    .lib-actions { padding:10px; gap:6px; } .lib-actions .play, .lib-actions .stop { height:34px; font-size:13px; }
     .store-card-content { padding:10px; } .store-card-title { gap:6px; } .store-card-title strong { font-size:13px; }
     .store-card-title .store-icon { width:25px; height:25px; font-size:12px; border-radius:6px; }
     .store-card-foot { font-size:10px; margin-top:12px; } .store-summary { font-size:11px; }
@@ -988,79 +1083,33 @@
 
   <div class="page" data-page="android">
   <section id="android">
-    <div class="store-tabs" aria-label="Android sections"><button class="on" data-store-tab="browse" aria-pressed="true">Discover</button><button data-store-tab="library" aria-pressed="false">On your Frame <span id="andCount"></span></button><span class="spacer"></span><button id="sourcesOpen" class="small">Sources <span aria-hidden="true">⚙</span></button><button class="small" id="repNew" hidden>+ Report an APK</button></div>
-    <section id="appStore" aria-label="Discover apps">
-      <div class="store-toolbar"><div class="store-heading"><div><div class="store-eyebrow">A little more possibility</div><h1>Find your next favorite.</h1><p>Great games and useful apps. All in one place, all free to explore.</p></div></div>
+    <div class="store-tabs" aria-label="Android sections"><div class="store-switch"><button class="on" data-store-tab="browse" aria-pressed="true"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><path d="M4 7h16l-1.5 12.5a1 1 0 0 1-1 .9H6.5a1 1 0 0 1-1-.9z"/><path d="M8.5 9V6a3.5 3.5 0 0 1 7 0v3"/></svg>Store</button><button data-store-tab="library" aria-pressed="false"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><rect x="3.5" y="4" width="7" height="7" rx="1.5"/><rect x="13.5" y="4" width="7" height="7" rx="1.5"/><rect x="3.5" y="14" width="7" height="7" rx="1.5"/><rect x="13.5" y="14" width="7" height="7" rx="1.5"/></svg>Library <span id="andCount"></span></button></div><span class="spacer"></span><button id="sourcesOpen" class="small">Sources <span aria-hidden="true">⚙</span></button><button class="small" id="repNew" hidden>+ Report an APK</button></div>
+    <section id="appStore" aria-label="Android store">
+      <div class="store-layout">
+      <div class="store-side" role="navigation" aria-label="Store categories">
+        <div id="storeCats" class="store-cats"></div>
+        <div class="store-side-opts">
+          <label class="store-check"><input type="checkbox" id="storeFits"> Only apps that fit the Frame</label>
+          <label class="store-check" title="Apps built around a phone: calls and SMS, launchers, keyboards, widgets, fitness, system tools. Searching always finds them."><input type="checkbox" id="storePhone"> Show phone-only apps</label>
+          <label class="store-source-select"><span>Source</span><select id="sourceFilter"><option value="">All sources</option></select></label>
+        </div>
+      </div>
+      <div class="store-main">
+      <div class="store-toolbar"><div class="store-heading" id="storeHeading"><div class="store-eyebrow">Android apps for your Frame</div><h1>Store</h1><p>VR games, emulators, video and reading apps that work in a panel. Free, from open sources.</p></div>
       <form id="sourceSearch" class="store-search"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><circle cx="10.5" cy="10.5" r="6.5"/><path d="m16 16 5 5"/></svg><input id="sourceQ" type="search" aria-label="Search games and apps" placeholder="Search games and apps"><button type="submit" class="small">Search</button></form></div>
-      <div class="store-filters"><div id="searchFilters" class="store-chips"><button data-filter="all" aria-pressed="true">For you</button><button data-filter="vr" aria-pressed="false">VR experiences</button><button data-filter="flat" aria-pressed="false">Flat-screen apps</button><button data-filter="installable" aria-pressed="false">Fits your Frame</button></div><label class="store-source-select"><span class="sr-only">Filter by source</span><select id="sourceFilter"><option value="">All sources</option></select></label></div>
       <div id="sourceStatus" class="store-notice" role="status" aria-live="polite" hidden></div>
       <div id="searchCount" class="store-result-count" aria-live="polite"></div>
       <div id="searchGrid" aria-busy="false"></div>
-    </section>
-    <div class="and-grid" id="androidLibrary" hidden>
-      <div class="and-col">
-      <div class="panel">
-        <div class="shelf-head"><h2>On the Frame</h2></div>
-        <div class="list" id="andApps"><div class="sub">Loading…</div></div>
-        <div class="hint">Each app runs in its own Lepton instance and keeps its data. It's in the Steam
-          library under its own name and opens in its own panel. Test launches it and records
-          whether it stays up; Report records how it worked for you.</div>
       </div>
-      <section class="panel" id="installQueue" hidden>
-        <div class="shelf-head"><h2>Install queue</h2><span class="count" id="queueCount"></span></div>
-        <div class="list" id="queueList"></div>
-        <div class="hint">Games from the store, your Quest and your Meta library install one after another.
-          Remove takes a game out before it starts.</div>
-      </section>
-      <section class="panel" id="quest">
-        <div class="shelf-head"><h2>Import from my Quest</h2><span class="count" id="questCount"></span><span class="spacer"></span>
-          <button class="small" id="questScan" title="Look for a Meta Quest plugged into this computer by USB">Look for my Quest</button></div>
-        <div class="sub" id="questState" role="status" aria-live="polite">Plug your Quest into this computer by USB, put it on, then Look for my Quest.</div>
-        <label class="sub" style="display:block;margin-top:8px"><input type="checkbox" id="questData"> Also copy each game's files in Android/data (some games keep saves there)</label>
-        <label class="sub" style="display:block;margin-top:4px"><input type="checkbox" id="questOlder"> Allow replacing a newer version on the Frame with the Quest's older one</label>
-        <progress id="questProgress" max="100" hidden aria-label="Import progress" style="width:100%;margin-top:8px"></progress>
-        <div class="list" id="questApps" style="margin-top:8px"></div>
-        <div class="hint">Copies games you own from your own Quest (developer mode on) to the Frame. A game with
-          OBB data takes two imports: the first installs it; start it from the Steam library, then import again to
-          copy its data in. Frame Control never starts the game itself. Games that
-          use Meta's licence check install with a warning: on the Frame that check can't reach Meta, so they may quit,
-          hang, or run without online features. Frame Control won't remove that check. <a href="https://github.com/saphid/frame-control/blob/main/docs/quest-import.md" target="_blank" rel="noopener noreferrer">How it works</a></div>
-      </section>
-      <section class="panel" id="metaLib">
-        <div class="shelf-head"><h2>My Meta library</h2><span class="tag">Experimental</span><span class="count" id="metaCount"></span><span class="spacer"></span>
-          <button class="small" id="metaRefresh" hidden title="Read your Meta library again">Refresh</button>
-          <button class="small" id="metaDisconnect" hidden title="Forget your Meta token on this computer (and sign out of Meta in Frame Control)">Disconnect</button></div>
-        <div class="sub" id="metaState" role="status" aria-live="polite">Off. Nothing is sent to Meta until you connect.</div>
-        <p class="hint" style="color:var(--warn)">Experimental. This uses Meta's undocumented internal API with your own Meta
-          access token. It may stop working whenever Meta changes things, and using it may be against Meta's terms; your
-          account is your responsibility. It only lists and downloads games your account owns, installs them as they are,
-          and never removes a licence check.</p>
-        <div id="metaConnectBox">
-          <label class="sub" style="display:block;margin-top:6px"><input type="checkbox" id="metaAck"> I understand, and want to
-            use my own Meta token with Frame Control</label>
-          <div id="metaSignInRow" hidden style="display:flex;gap:8px;align-items:center;margin-top:6px">
-            <button class="small" id="metaSignIn" disabled title="Opens Meta's own login page in a Frame Control window">Sign in with Meta…</button>
-            <span class="hint" style="margin:0">or paste your token:</span><span class="spacer"></span>
-            <button class="small" id="metaSignOut" title="Clear the Meta sign-in that Frame Control's sign-in window keeps">Sign out of Meta in Frame Control</button></div>
-          <div style="display:flex;gap:8px;margin-top:6px">
-            <input type="password" id="metaToken" autocomplete="off" spellcheck="false" style="flex:1"
-                   placeholder="Your Meta access token (starts with OC or FRL)" aria-label="Meta access token" disabled>
-            <button class="small" id="metaConnect" disabled>Connect</button></div>
-          <div class="hint"><a href="https://github.com/saphid/frame-control/blob/main/docs/meta-library.md#your-token" target="_blank" rel="noopener noreferrer">How to get your token</a>.
-            Sign in with Meta (desktop app) opens Meta's login page in its own Frame Control window and takes the token
-            from there; it never reads your browser.
-            Frame Control checks it with Meta, then keeps it in a private file on this computer (never on the Frame, and
-            never in reports). Disconnect deletes it.</div>
-        </div>
-        <div class="sub" id="metaShare" hidden style="margin-top:6px"></div>
-        <label class="sub" id="metaOlderBox" hidden style="display:block;margin-top:4px"><input type="checkbox" id="metaOlder"> Allow replacing a newer version on the Frame</label>
-        <progress id="metaProgress" max="100" hidden aria-label="Install progress" style="width:100%;margin-top:8px"></progress>
-        <div class="list" id="metaApps" style="margin-top:8px"></div>
-        <div class="hint">Install downloads the game from Meta and installs it like Import from my Quest; a game with OBB
-          data takes a second Install while it is open. Install and test also starts it, adds its data, watches it for
-          about 30 seconds and records whether it ran; Test again does just the test. Results go to the compatibility
-          reports, shared only if you share compatibility results. <a href="https://github.com/saphid/frame-control/blob/main/docs/meta-library.md" target="_blank" rel="noopener noreferrer">How it works</a></div>
-      </section>
+      </div>
+    </section>
+    <div class="lib" id="androidLibrary" hidden>
+      <div class="lib-head"><div><div class="store-eyebrow">On your Frame</div><h1>Library</h1><p id="libSummary">Your Android apps. Each runs in its own Lepton instance, keeps its data, and is in the Steam library under its own name.</p></div>
+        <div class="lib-tools"><div class="store-chips" id="libFilters"><button data-lib="all" aria-pressed="true">All</button><button data-lib="vr" aria-pressed="false">VR</button><button data-lib="flat" aria-pressed="false">Flat</button><button data-lib="running" aria-pressed="false">Running</button></div>
+          <input id="libQ" type="search" aria-label="Filter your apps" placeholder="Filter your apps"></div></div>
+      <div class="lib-grid" id="andApps"><div class="sub">Loading…</div></div>
+      <h2 class="lib-section">Display and reports</h2>
+      <div class="lib-manage">
       <section class="panel disp" id="display">
       <div class="shelf-head"><h2>Android display</h2><span class="count">Lepton</span><span class="spacer"></span>
         <button class="small" id="dispReload" title="Read the current values again">Refresh</button></div>
@@ -1539,8 +1588,6 @@ function applyHostWording(h) {
   // The iPhone app: the server runs on the Frame, and saving goes to the phone's Photos.
   document.body.classList.toggle("mobile", !!h.mobile);
   $("shotsFolder").hidden = !!h.mobile;
-  $("quest").hidden = !!h.mobile;
-  $("metaLib").hidden = !!h.mobile;  // the Quest plugs into a computer; the phone app's server runs on the Frame
   if (!h.mobile) $("shotsFolder").textContent = h.fileManager === "your file manager" ? "Open folder" : `Show in ${h.fileManager}`;
   $("shotsSaveNew").textContent = h.mobile ? `Save all to ${h.computer}` : `Save new to ${h.computer}`;
   $("clipMac").textContent = `Send ${h.computer} clipboard`;
@@ -2693,65 +2740,32 @@ document.body.addEventListener("click", async (e) => {
 // Installs run as server jobs: start one, then poll until it's done. The
 // bottom bar counts what's running; `installing` keeps re-rendered lists from
 // offering Install again for something already on its way.
-// Android installs wait their turn in the server's install queue (queue_job in
-// server.py); `queued` holds the ones still waiting.
-const installing = new Set(), queued = new Set();
+const installing = new Set();
 let jobsRunning = 0;
 function showJobs() {
-  const waiting = queued.size, running = jobsRunning - waiting;
   $("jobs").hidden = !jobsRunning;
-  $("jobsText").textContent = [running ? `${running} install${running === 1 ? "" : "s"} running` : "",
-                               waiting ? `${waiting} queued` : ""].filter(Boolean).join(", ");
+  $("jobsText").textContent = `${jobsRunning} install${jobsRunning === 1 ? "" : "s"} running`;
 }
 async function runJob(label, key, start, onProgress = () => {}) {
   installing.add(key); jobsRunning++; showJobs();
+  log(label + "…");
   try {
-    const started = await start();
-    const { job } = started;
-    log(started.queued ? started.message : label + "…");
-    if (started.queued) { queued.add(key); showJobs(); }
-    if (started.queued != null) loadQueue();
+    const { job } = await start();
     for (let misses = 0; ;) {
       await new Promise(ok => setTimeout(ok, 1500));
       let j;
       try { j = await api(`/api/job?id=${encodeURIComponent(job)}`); misses = 0; }
       catch (e) { if (++misses >= 20 || /no such job/.test(e.message)) throw e; continue; }
-      if (j.queued !== queued.has(key)) { j.queued ? queued.add(key) : queued.delete(key); showJobs(); }
       onProgress(j);
       if (!j.done) continue;
-      if (j.cancelled) { log(`${label}: removed from the install queue`); return null; }
       if (j.error) throw new Error(j.error);
       log(j.message, "ok"); toast(j.message);
       return j.result || {};
     }
   } catch (e) {
     log(`${label} failed: ${e.message}`, "e"); toast(`${label} failed: ${e.message}`, true);
-  } finally { installing.delete(key); queued.delete(key); jobsRunning--; showJobs(); }
+  } finally { installing.delete(key); jobsRunning--; showJobs(); }
 }
-// The install queue as the server has it: also what an earlier visit to this page queued.
-let queueTimer;
-async function loadQueue() {
-  clearTimeout(queueTimer);
-  let jobs;
-  try { ({ jobs } = await api("/api/queue")); } catch { jobs = null; }
-  if (jobs) {
-    $("installQueue").hidden = !jobs.length;
-    $("queueCount").textContent = jobs.length ? `${jobs.length}` : "";
-    $("queueList").innerHTML = jobs.map(j => `<div class="item"><div class="grow"><div class="t">${esc(j.label)}</div>
-        <div class="s">${esc(j.queued ? j.stage || "Queued" : `${j.stage || "Starting"}${j.percent != null ? ` · ${Math.round(j.percent)}%` : ""}`)}</div></div>
-        ${j.queued ? `<button class="small" data-unqueue="${esc(j.job)}">Remove</button>` : `<span class="tag">Installing</span>`}</div>`).join("");
-  }
-  if (!jobs || jobs.length) queueTimer = setTimeout(loadQueue, 2000);
-}
-$("queueList").addEventListener("click", async e => {
-  const b = e.target.closest("[data-unqueue]");
-  if (!b) return;
-  b.disabled = true;
-  try { const d = await api("/api/queue", { action: "remove", job: b.dataset.unqueue }); toast(d.message); }
-  catch (err) { toast(err.message, true); }
-  loadQueue();
-});
-loadQueue();
 const POWER = { suspend: ["Put the Frame to sleep?", "Sleep"], reboot: ["Restart the Frame?", "Restart"],
                 poweroff: ["Shut the Frame down?", "Shut down"] };
 function askPower(what) {
@@ -3290,7 +3304,22 @@ document.body.addEventListener("click", async e => {
 loadOwned();
 
 // ---- Discover apps ----
-const sourceState = { vr: null, installable: false, source: "", apps: [], sources: [], request: 0, detail: null, detailRequest: 0, jobs: new Map() };
+const sourceState = { vr: null, installable: false, source: "", category: "", phone: false, apps: [], sources: [], request: 0, detail: null, detailRequest: 0, jobs: new Map() };
+// The store's categories (ui/apk_sources/_categories.py): what a Frame is good for, not F-Droid's phone-centred list.
+const STORE_CATS = [
+  ["", "Home", "Android apps for your Frame", "VR games, emulators, video and reading apps that work in a panel. Free, from open sources.", '<path d="M4 11.5 12 5l8 6.5V19a1 1 0 0 1-1 1h-4.5v-5h-5v5H5a1 1 0 0 1-1-1z"/>'],
+  ["vr", "VR", "Made for headsets", "OpenXR games and experiences that fill the room, not a panel.", '<path d="M3.5 8.5A1.5 1.5 0 0 1 5 7h14a1.5 1.5 0 0 1 1.5 1.5v6A1.5 1.5 0 0 1 19 16h-3.5l-2-2.5h-3l-2 2.5H5a1.5 1.5 0 0 1-1.5-1.5z"/><circle cx="8" cy="11.5" r="1.5"/><circle cx="16" cy="11.5" r="1.5"/>'],
+  ["games", "Games", "Play in a panel", "Puzzle, strategy, card and action games that play well on a big floating screen.", '<path d="M7 9h10a4 4 0 0 1 3.9 4.9l-.6 2.6a2 2 0 0 1-3.4.9L14.5 15h-5l-2.4 2.4a2 2 0 0 1-3.4-.9l-.6-2.6A4 4 0 0 1 7 9z"/><path d="M8 11.5v3M6.5 13h3"/><circle cx="15.5" cy="12" r=".6" fill="currentColor"/><circle cx="17" cy="13.6" r=".6" fill="currentColor"/>'],
+  ["emulators", "Emulators", "Classic games, big screen", "RetroArch, Dolphin, PPSSPP and friends. Bring your own games.", '<rect x="4" y="5" width="16" height="11" rx="1.5"/><path d="M9 20h6M12 16v4"/><path d="M8 10.5h3M9.5 9v3"/><circle cx="15" cy="10.5" r=".8" fill="currentColor"/>'],
+  ["watch", "Watch & listen", "Your own cinema", "Video players, streaming front-ends, music and podcasts.", '<rect x="3.5" y="5.5" width="17" height="11" rx="1.5"/><path d="m10.5 8.5 4 2.5-4 2.5z" fill="currentColor"/><path d="M8 20h8"/>'],
+  ["read", "Read & learn", "Books, news and more", "E-book and comic readers, news, dictionaries and learning apps.", '<path d="M12 7c-2-1.5-5-2-8-1.5v12c3-.5 6 0 8 1.5 2-1.5 5-2 8-1.5v-12c-3-.5-6 0-8 1.5zM12 7v12"/>'],
+  ["create", "Create", "Make something", "Drawing, photo editing, music and recording.", '<path d="m14.5 5.5 4 4L9 19H5v-4z"/><path d="m12.5 7.5 4 4"/>'],
+  ["work", "Work", "Get things done", "Notes, tasks, documents, calendars and calculators.", '<rect x="4" y="7" width="16" height="12" rx="1.5"/><path d="M9 7V5.5A1.5 1.5 0 0 1 10.5 4h3A1.5 1.5 0 0 1 15 5.5V7M4 12h16"/>'],
+  ["web", "Web & chat", "Stay connected", "Browsers, email, messaging and social apps.", '<circle cx="12" cy="12" r="8"/><path d="M4 12h16M12 4c2.5 2.5 2.5 13.5 0 16M12 4c-2.5 2.5-2.5 13.5 0 16"/>'],
+  ["tools", "Tools", "Handy utilities", "File managers, passwords, remote access and developer tools.", '<path d="M14.5 6.5a4 4 0 0 0-5.3 5.3L4.5 16.5l3 3 4.7-4.7a4 4 0 0 0 5.3-5.3l-2.4 2.4-2.6-.4-.4-2.6z"/>'],
+];
+const storeCat = id => STORE_CATS.find(c => c[0] === (id || "")) || STORE_CATS[0];
+const catIcon = id => `<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linejoin="round" stroke-linecap="round" aria-hidden="true">${storeCat(id)[4]}</svg>`;
 const storeName = s => String(s || "").replace(/ \(demo\)$/i, "");
 const storeHue = name => [...String(name)].reduce((n, c) => (n * 31 + c.charCodeAt(0)) >>> 0, 7) % 360;
 const storeInitial = name => [...String(name || "?")][0].toUpperCase();
@@ -3298,12 +3327,30 @@ const storeText = text => String(text || "").replace(/<[^>]*>/g, " ").replace(/&
 const storeOpenSource = o => o.open_source === true || /^(MIT|Apache|[AL]?GPL|BSD|MPL|ISC|CC0|Unlicense)/i.test(o.license || "");
 function sourcePage(url) { try { const u = new URL(url); return ["https:", "http:"].includes(u.protocol) ? u.href : ""; } catch { return ""; } }
 function storeImage(path, alt, eager=false) { return /^\/source-image\/[\w-]+$/.test(path || "") ? `<img src="${esc(path)}" alt="${esc(alt)}" loading="${eager ? "eager" : "lazy"}" decoding="async">` : ""; }
-function storeArt(o, cls="", eager=false, path=null, alt=null) {
-  const image = path || o.artwork?.banner || o.artwork?.screenshots?.[0];
-  return `<span class="store-art ${cls}" style="--hue:${storeHue(o.name)}"><span class="art-initial" aria-hidden="true">${esc(storeInitial(o.name))}</span>${storeImage(image, alt || `${o.name} artwork`, eager)}</span>`;
+function storeArt(o, cls="", eager=false, path=null, alt=null, extra="") {
+  // Best artwork first: a banner, else phone-style screenshots side by side, else the icon over its own blur.
+  const art = o.artwork || {}, label = alt || `${o.name} artwork`, initial = `<span class="art-initial" aria-hidden="true">${esc(storeInitial(o.name))}</span>`;
+  const valid = u => /^\/source-image\/[\w-]+$/.test(u || "");
+  if (!path && !valid(art.banner) && (art.screenshots || []).some(valid)) {
+    const shots = art.screenshots.filter(valid).slice(0, 3);
+    return `<span class="store-art shots ${cls}" style="--hue:${storeHue(o.name)}" role="img" aria-label="${esc(label)}">${initial}${shots.map(u => storeImage(u, "", eager)).join("")}${extra}</span>`;
+  }
+  if (!path && !valid(art.banner) && valid(art.icon)) {
+    return `<span class="store-art icon-art ${cls}" style="--hue:${storeHue(o.name)}" role="img" aria-label="${esc(label)}">${initial}<img class="art-backdrop" src="${esc(art.icon)}" alt="" loading="${eager ? "eager" : "lazy"}" decoding="async"><img class="art-mark" src="${esc(art.icon)}" alt="" loading="${eager ? "eager" : "lazy"}" decoding="async">${extra}</span>`;
+  }
+  const image = path || art.banner || art.screenshots?.[0];
+  return `<span class="store-art ${cls}" style="--hue:${storeHue(o.name)}">${initial}${storeImage(image, label, eager)}${extra}</span>`;
 }
 function storeIcon(o) { return `<span class="store-icon" style="--hue:${storeHue(o.name)}" aria-hidden="true">${esc(storeInitial(o.name))}${storeImage(o.artwork?.icon, "")}</span>`; }
-document.addEventListener("error", e => { if (e.target.matches?.(".store-art img, .store-icon img")) e.target.remove(); }, true);
+document.addEventListener("error", e => {
+  if (!e.target.matches?.(".store-art img, .store-icon img")) return;
+  const img = e.target;
+  if (!img.dataset.retried) {  // the proxy fetches from the source on first use, which can time out once
+    img.dataset.retried = "1"; setTimeout(() => { img.src = img.getAttribute("src").split("?")[0] + "?retry=1"; }, 1500); return;
+  }
+  const art = img.closest(".icon-art, .shots"); img.remove();
+  if (art && !art.querySelector("img")) art.classList.remove("icon-art", "shots");  // show the initial again
+}, true);
 function sourceMark(s) { const name=storeName(s); return `<span class="offer-mark" style="--hue:${storeHue(name)}" aria-hidden="true">${esc(name === "SideQuest" ? "SQ" : name === "F-Droid" ? "Fd" : name.slice(0,2))}</span>`; }
 function sourceDescription(s) { return s.description || ({fdroid:"Independent, open-source apps",sidequest:"Discover something new in VR",itch:"Games from independent creators",github:"Direct from the people who make it"})[s.kind] || (s.name.includes("GitHub") ? "Direct from the people who make it" : s.name.includes("Droid") ? "Independent, open-source apps" : s.name.includes("SideQuest") ? "Discover something new in VR" : s.name.includes("itch") ? "Games from independent creators" : "Apps shared by this community"); }
 async function loadSources() {
@@ -3314,32 +3361,50 @@ async function loadSources() {
     $("sourcesList").innerHTML = sources.map(s=>`<div class="source-setting">${sourceMark(s.name)}<div class="grow"><strong>${esc(storeName(s.name))}</strong><p>${esc(sourceDescription(s))}</p><small>${esc(({official:"Official store",community:"Community",user:"Added by you"})[s.trust] || "Community")}</small>${s.builtin === false ? `<button class="small" data-remove="${esc(s.id)}" aria-label="Remove ${esc(s.name)}">Remove</button>` : ""}</div><input class="source-toggle" role="switch" type="checkbox" aria-label="Enable ${esc(storeName(s.name))}" data-enable="${esc(s.id)}" ${s.enabled ? "checked" : ""}></div>`).join("") || `<p class="store-notice">Your sources will appear here when they are available.</p>`;
   } catch (e) { $("sourceError").textContent = e.message; }
 }
+const STORE_FIT = { works: "Works on the Frame", ready: "Fits the Frame", blocked: "Won't run" };
+function storeFit(o) { const t = o.verdict?.tone; return STORE_FIT[t] ? `<span class="store-fit ${t}" title="${esc(o.verdict.label)}">${STORE_FIT[t]}</span>` : ""; }
 function storeCard(app) {
-  const i=sourceState.apps.indexOf(app), o=app.offers[0];
-  return `<button class="store-card" data-app="${i}" aria-label="View ${esc(app.name)}">${storeArt(o)}<span class="store-card-content"><span class="store-card-title">${storeIcon(o)}<strong>${esc(app.name)}</strong></span><span class="store-summary">${esc(storeText(app.summary) || "A new addition to your Frame")}</span><span class="store-card-foot"><span>${o.vr ? "VR experience" : o.vr === false ? "Flat-screen app" : "Android app"}</span><b>Free</b></span></span></button>`;
+  const i=sourceState.apps.indexOf(app), o=app.offers[0], c=app.category || o.category;
+  return `<button class="store-card" data-app="${i}" aria-label="View ${esc(app.name)}">${storeArt(o,"",false,null,null,o.vr ? '<span class="store-vr">VR</span>' : "")}<span class="store-card-content"><span class="store-card-title">${storeIcon(o)}<strong>${esc(app.name)}</strong></span><span class="store-summary">${esc(storeText(app.summary) || "A new addition to your Frame")}</span><span class="store-card-foot"><span class="store-cat">${esc(o.phone_only ? "Phone app" : c ? storeCat(c)[1] : o.vr === false ? "Flat-screen app" : "Android app")}</span>${storeFit(o) || "<b>Free</b>"}</span></span></button>`;
+}
+function storeRow(title, subtitle, apps, category) {
+  return apps.length ? `<section class="store-row"><div class="store-row-head"><h2>${esc(title)}</h2><p>${esc(subtitle)}</p>${category !== undefined ? `<button class="see-all" data-cat="${esc(category)}">See all ›</button>` : ""}</div><div class="store-shelf">${apps.slice(0,12).map(storeCard).join("")}</div></section>` : "";
 }
-function storeRow(title, subtitle, apps) { return apps.length ? `<section class="store-row"><div class="store-row-head"><h2>${esc(title)}</h2><p>${esc(subtitle)}</p></div><div class="store-grid">${apps.slice(0,5).map(storeCard).join("")}</div></section>` : ""; }
 function storeEmpty() {
-  return `<div class="store-empty"><svg viewBox="0 0 120 100" fill="none" aria-hidden="true"><rect x="18" y="25" width="60" height="55" rx="12" fill="currentColor" opacity=".08"/><rect x="29" y="18" width="60" height="55" rx="12" stroke="currentColor" opacity=".35"/><circle cx="61" cy="43" r="15" stroke="currentColor" stroke-width="3"/><path d="m72 55 17 18M17 12v10m-5-5h10m79-4v10m-5-5h10" stroke="currentColor" stroke-width="3" stroke-linecap="round"/></svg><h2>A little further to explore.</h2><p>No apps found this time. Try a different name, clear your filters, or explore another source.</p><button class="action" id="storeReset">Explore all apps</button></div>`;
+  return `<div class="store-empty"><svg viewBox="0 0 120 100" fill="none" aria-hidden="true"><rect x="18" y="25" width="60" height="55" rx="12" fill="currentColor" opacity=".08"/><rect x="29" y="18" width="60" height="55" rx="12" stroke="currentColor" opacity=".35"/><circle cx="61" cy="43" r="15" stroke="currentColor" stroke-width="3"/><path d="m72 55 17 18M17 12v10m-5-5h10m79-4v10m-5-5h10" stroke="currentColor" stroke-width="3" stroke-linecap="round"/></svg><h2>A little further to explore.</h2><p>No apps found this time. Try a different name, another category, or turn on phone-only apps.</p><button class="action" id="storeReset">Back to the store</button></div>`;
+}
+function renderCats() {
+  if (!$("storeCats").children.length)  // built once, so a keyboard user keeps focus on the category they chose
+    $("storeCats").innerHTML = STORE_CATS.map(([id, label]) => `<button data-cat="${id}" aria-pressed="false">${catIcon(id)}<span>${esc(label)}</span></button>`).join("");
+  $("storeCats").querySelectorAll("[data-cat]").forEach(b => b.setAttribute("aria-pressed", String(b.dataset.cat === sourceState.category)));
+  const [, label, eyebrow, blurb] = storeCat(sourceState.category);
+  $("storeHeading").innerHTML = `<div class="store-eyebrow">${esc(sourceState.category ? eyebrow : "Android apps for your Frame")}</div><h1>${esc(sourceState.category ? label : "Store")}</h1><p>${esc(blurb)}</p>`;
 }
 function renderStore() {
-  const apps=sourceState.apps, browsing=!$("sourceQ").value.trim() && sourceState.vr === null && !sourceState.installable && !sourceState.source;
-  $("searchCount").textContent = browsing ? "" : `${apps.length} ${apps.length===1 ? "app" : "apps"}${$("sourceQ").value.trim() ? ` for “${$("sourceQ").value.trim()}”` : ""}`;
+  const apps=sourceState.apps, q=$("sourceQ").value.trim(), browsing=!q && !sourceState.category && !sourceState.installable && !sourceState.source;
+  renderCats();
+  $("searchCount").textContent = browsing ? "" : `${apps.length} ${apps.length===1 ? "app" : "apps"}${q ? ` for “${q}”` : ""}${sourceState.category ? ` in ${storeCat(sourceState.category)[1]}` : ""}`;
   if (!apps.length) { $("searchGrid").innerHTML=storeEmpty(); return; }
   if (!browsing) { $("searchGrid").innerHTML=`<div class="store-grid">${apps.map(storeCard).join("")}</div>`; return; }
-  const featured=apps.find(a=>a.offers[0].vr && a.offers[0].artwork?.banner && a.offers[0].verdict?.tone !== 'blocked') || apps.find(a=>a.offers[0].artwork?.banner) || apps[0], o=featured.offers[0];
-  const tested=apps.filter(a=>a.offers.some(o=>o.vr && o.verdict?.tone==='works'));
-  const vr=tested.length ? tested : apps.filter(a=>a.offers.some(o=>o.vr && o.verdict?.tone !== 'blocked'));
-  const popular=[...apps].sort((a,b)=>(b.offers[0].popularity||0)-(a.offers[0].popularity||0));
-  const recent=apps.filter(a=>a.offers.some(o=>o.updated)).sort((a,b)=>String(b.offers[0].updated||'').localeCompare(String(a.offers[0].updated||'')));
-  $("searchGrid").innerHTML=`<button class="store-hero" data-app="${apps.indexOf(featured)}" aria-label="Explore ${esc(featured.name)}">${storeArt(o,"",true)}<span class="hero-copy"><span class="store-eyebrow">Step into something new</span><strong>${esc(featured.name)}</strong><span>${esc(storeText(featured.summary))}</span><span class="hero-cta">Explore ${esc(featured.name)} <span aria-hidden="true">&nbsp; ↗</span></span></span></button>` + storeRow(apps.some(a=>a.offers[0].popularity) ? "Popular apps" : "Explore apps","More ways to make your Frame yours",popular) + storeRow(tested.length ? "VR that works on the Frame" : "Step into VR",tested.length ? "Experiences checked on a Frame" : "A new perspective, a whole new playground",vr) + storeRow("Recently updated","Fresh from their creators",recent);
+  // Home: one featured VR app, then a shelf per category; each app appears once, blocked ones not at all.
+  const ok=apps.filter(a=>a.offers[0].verdict?.tone !== 'blocked'), shown=new Set();
+  const day=Math.floor(Date.now()/864e5), heroes=ok.filter(a=>a.offers[0].vr && a.offers[0].artwork?.banner);
+  const featured=heroes[day % (heroes.length || 1)] || ok.find(a=>a.offers[0].artwork?.banner) || ok[0];
+  if (!featured) { $("searchGrid").innerHTML=storeEmpty(); return; }  // nothing here runs on the Frame
+  const o=featured.offers[0];
+  shown.add(featured);
+  const take=(list)=>{ const out=list.filter(a=>!shown.has(a)).slice(0,12); out.forEach(a=>shown.add(a)); return out; };
+  const rows=STORE_CATS.slice(1).map(([id,label,eyebrow])=>storeRow(label,eyebrow,take(ok.filter(a=>a.category===id)),id)).join("");
+  const recent=take([...ok].filter(a=>a.offers[0].updated && a.offers[0].artwork?.icon).sort((a,b)=>String(b.offers[0].updated).localeCompare(String(a.offers[0].updated))));
+  $("searchGrid").innerHTML=`<button class="store-hero" data-app="${apps.indexOf(featured)}" aria-label="Explore ${esc(featured.name)}">${storeArt(o,"",true)}<span class="hero-copy"><span class="hero-meta">${o.vr ? '<span class="store-vr">VR</span>' : ""}<span class="store-eyebrow">Featured</span></span><strong>${esc(featured.name)}</strong><span>${esc(storeText(featured.summary))}</span><span class="hero-cta">See ${esc(featured.name)} <span aria-hidden="true">&nbsp;›</span></span></span></button>` + rows + storeRow("Recently updated","Fresh from their creators",recent);
 }
-function storeChips() { $("searchFilters").querySelectorAll("button").forEach(b=>b.setAttribute("aria-pressed",b.dataset.filter==='all' ? sourceState.vr===null && !sourceState.installable : b.dataset.filter==='installable' ? sourceState.installable : sourceState.vr===(b.dataset.filter==='vr'))); }
+function storeChips() { renderCats(); $("storeFits").checked = sourceState.installable; $("storePhone").checked = sourceState.phone; }
+function storeCategory(id) { sourceState.category = id || ""; $("sourceQ").value = ""; storeChips(); searchSources(); document.getElementById("android")?.scrollIntoView({block:"start", behavior:"smooth"}); }
 async function searchSources(quiet) {
   const request=++sourceState.request;
   $("searchGrid").setAttribute("aria-busy","true");
   if(!quiet)$("searchGrid").innerHTML=`<div class="store-grid" role="status" aria-label="Finding apps">${Array.from({length:8},()=>'<div class="store-skeleton" aria-hidden="true"></div>').join("")}</div>`;
-  const params=new URLSearchParams({q:$("sourceQ").value,source:sourceState.source,installable:String(sourceState.installable)});
+  const params=new URLSearchParams({q:$("sourceQ").value,source:sourceState.source,installable:String(sourceState.installable),category:sourceState.category,phone:String(sourceState.phone)});
   if(sourceState.vr!==null)params.set("vr",String(sourceState.vr));
   try {
     const result=await api("/api/search?"+params);if(request!==sourceState.request)return;
@@ -3420,7 +3485,6 @@ async function installStoreApp() {
   if(existing&&!existing.done)return;
   const state={stage:'Downloading',percent:null,done:false};sourceState.jobs.set(key,state);updateInstall();
   const result=await runJob(`Install ${o.name}`,key,()=>api('/api/sources/install',{source:o.source,id:o.id,version_code:o.version_code??null}),j=>{Object.assign(state,{stage:j.stage||'Downloading',percent:j.percent??null,error:j.error});updateInstall();});
-  if(result===null){sourceState.jobs.delete(key);updateInstall();return;}  // removed from the install queue
   Object.assign(state,{done:true,result,error:result?null:state.error||"We couldn't finish the installation. Try again."});updateInstall();
   if(result)loadAndroid();
 }
@@ -3433,8 +3497,10 @@ let storeSearchTimer;
 $("sourceQ").oninput=()=>{clearTimeout(storeSearchTimer);storeSearchTimer=setTimeout(searchSources,300);};
 $("sourceSearch").onsubmit=e=>{e.preventDefault();clearTimeout(storeSearchTimer);searchSources();};
 $("sourceFilter").onchange=e=>{sourceState.source=e.target.value;searchSources();};
-$("searchFilters").onclick=e=>{const b=e.target.closest('[data-filter]');if(!b)return;const f=b.dataset.filter;if(f==='all'){sourceState.vr=null;sourceState.installable=false;}else if(f==='installable')sourceState.installable=!sourceState.installable;else sourceState.vr=sourceState.vr===(f==='vr')?null:f==='vr';storeChips();searchSources();};
-$("searchGrid").onclick=e=>{const b=e.target.closest('[data-app]');if(b)openStoreApp(+b.dataset.app);if(e.target.closest('#storeReset')){$('sourceQ').value='';sourceState.vr=null;sourceState.installable=false;sourceState.source='';storeChips();searchSources();}};
+$("storeCats").onclick=e=>{const b=e.target.closest('[data-cat]');if(b)storeCategory(b.dataset.cat);};
+$("storeFits").onchange=e=>{sourceState.installable=e.target.checked;searchSources();};
+$("storePhone").onchange=e=>{sourceState.phone=e.target.checked;searchSources();};
+$("searchGrid").onclick=e=>{const c=e.target.closest('[data-cat]');if(c)return storeCategory(c.dataset.cat);const b=e.target.closest('[data-app]');if(b)openStoreApp(+b.dataset.app);if(e.target.closest('#storeReset')){$('sourceQ').value='';sourceState.vr=null;sourceState.installable=false;sourceState.phone=false;sourceState.category='';sourceState.source='';$('sourceFilter').value='';storeChips();searchSources();}};
 $("detailBody").onclick=e=>{if(e.target.closest('[data-close]'))return $("appDetail").close();if(e.target.closest('#detailInstall'))installStoreApp();const b=e.target.closest('[data-gallery]');if(b)$('detailGallery').scrollBy({left:+b.dataset.gallery*$('detailGallery').clientWidth*.86,behavior:matchMedia('(prefers-reduced-motion: reduce)').matches?'instant':'smooth'});};
 $("detailBody").onchange=e=>{if(e.target.name==='storeOffer'){sourceState.detail.choice=+e.target.value;renderAppDetail();loadOfferDetails();}};
 $("sourcesOpen").onclick=()=>{loadSources();$('sourcesDialog').showModal();};
@@ -3463,6 +3529,7 @@ document.querySelectorAll('[data-store-tab]').forEach(button => button.onclick =
   showAndroidTab(button.dataset.storeTab);
   if (button.dataset.storeTab === 'library') loadAndroid();
 });
+storeChips();
 loadSources().then(()=>searchSources());
 
 // ---- Android apps (own Lepton instance each) + catalogue ----
@@ -3470,237 +3537,61 @@ const VLABEL = { works: "Works on Frame", likely: "Should work", maybe: "Might w
 const cat = { apps: null, q: "", cat: "", v: new Set(["works", "likely"]), shown: 0, results: [] };
 let androidApps = [];
 
+const libState = { filter: "all", q: "" };
+function libCard(a) {
+  const pkg = esc(a.package), name = a.label || a.package;
+  const o = { name, artwork: a.store_art || {} };  // the store's artwork for it, when a source lists it
+  const kind = a.vr && !a.flatscreen ? '<span class="store-vr">VR</span>' : "";
+  const version = String(a.version || "").replace(/^v/i, "");
+  const from = a.source && !/\.apk$/i.test(a.source) ? ` · ${a.source}` : "";
+  const issues = (a.vr_issues || []).filter(n => !/\(good\)\.?$/.test(n));  // frame_apk_vr.py also notes good news
+  const warn = issues.length ? `<div class="lib-warn" title="${esc(issues.join(" "))}">${esc(issues[0])}</div>` : "";
+  return `<article class="lib-card${a.running ? " running" : ""}" data-pkg="${pkg}">
+    ${storeArt(o, "", false, null, `${name} artwork`, kind + (a.running ? '<span class="lib-running">Running</span>' : ""))}
+    <div class="lib-body">${storeIcon(o)}<div><strong title="${esc(name)}">${esc(name)}</strong><small title="${pkg}">${version ? "v" + esc(version) : esc(a.package)}${esc(from)}</small></div></div>${warn}
+    <div class="lib-actions">
+      ${a.running ? `<button class="stop" data-and="stop" data-pkg="${pkg}">■ Stop</button>`
+                  : `<button class="play" data-and="launch" data-pkg="${pkg}">▶ Play</button>`}
+      <details class="lib-more"><summary aria-label="More for ${esc(name)}" title="More">⋯</summary><div class="lib-menu">
+        ${a.art_missing ? `<button data-and="refresh-art" data-pkg="${pkg}" data-name="${esc(name)}">Add artwork<small>Its Steam library tile has none yet</small></button>` : ""}
+        <button data-and="probe" data-pkg="${pkg}">Test<small>Launch it and record whether it stays up</small></button>
+        <button data-and="rate" data-pkg="${pkg}" data-ver="${esc(a.version)}" data-name="${esc(name)}" data-src="${esc(a.source || "")}">Report how it worked<small>Goes to the shared compatibility list</small></button>
+        <button class="danger" data-and="remove" data-pkg="${pkg}" data-name="${esc(name)}">Remove from the Frame</button>
+      </div></details>
+    </div></article>`;
+}
+function renderLibrary() {
+  const q = libState.q.trim().toLowerCase(), f = libState.filter;
+  const shown = androidApps.filter(a => (f === "all" || (f === "vr" ? a.vr && !a.flatscreen : f === "flat" ? !(a.vr && !a.flatscreen) : a.running))
+    && (!q || `${a.label} ${a.package}`.toLowerCase().includes(q)));
+  const vr = androidApps.filter(a => a.vr && !a.flatscreen).length, running = androidApps.filter(a => a.running).length;
+  $("libSummary").textContent = androidApps.length
+    ? `${androidApps.length} ${androidApps.length === 1 ? "app" : "apps"} on your Frame${vr ? `, ${vr} in VR` : ""}${running ? `; ${running} running now` : ""}. Each runs in its own Lepton instance, keeps its data, and is in the Steam library under its own name.`
+    : "Your Android apps. Each runs in its own Lepton instance, keeps its data, and is in the Steam library under its own name.";
+  $("libFilters").querySelectorAll("[data-lib]").forEach(b => b.setAttribute("aria-pressed", b.dataset.lib === f));
+  $("andApps").innerHTML = shown.length ? shown.map(libCard).join("")
+    : androidApps.length ? `<div class="lib-empty"><h2>Nothing matches</h2><p>Try another filter.</p></div>`
+    : `<div class="lib-empty"><h2>No Android apps yet</h2><p>Find VR games, emulators and video apps in the store, or drop an .apk on Send to Frame.</p><button class="action" data-store-go="browse">Open the store</button></div>`;
+}
+$("libFilters").onclick = e => { const b = e.target.closest("[data-lib]"); if (b) { libState.filter = b.dataset.lib; renderLibrary(); } };
+$("libQ").oninput = e => { libState.q = e.target.value; renderLibrary(); };
+$("andApps").addEventListener("click", e => {
+  if (e.target.closest("[data-store-go]")) showAndroidTab("browse");
+  if (e.target.closest(".lib-menu button")) e.target.closest("details").open = false;
+});
+document.addEventListener("click", e => { document.querySelectorAll(".lib-more[open]").forEach(d => { if (!d.contains(e.target)) d.open = false; }); });
 async function loadAndroid() {
   try {
     androidApps = (await api("/api/android")).apps;
   } catch (e) { return failed($("andApps"), e); }
-  if (metaLib.connected) renderMetaApps();  // "On the Frame" marks in My Meta library
-  $("andCount").textContent = androidApps.length ? `${androidApps.length} installed` : "";
-  $("andApps").innerHTML = androidApps.length ? androidApps.map(a => {
-    const c = cat.apps && cat.apps.find(x => x.p === a.package);
-    const icon = c && c.i ? `<img class="and-icon" src="${esc(c.i)}" alt="">` : `<div class="and-icon"></div>`;
-    return `<div class="item and-item">${icon}
-      <div class="grow"><div class="t">${esc(a.label)}</div>
-        <div class="s">${esc(a.package)} · v${esc(String(a.version || "").replace(/^v/i, ""))}</div></div>
-      ${a.running ? `<span class="tag">Running</span>` : ""}
-      <div class="row and-btns">
-        ${a.running ? `<button class="small" data-and="stop" data-pkg="${esc(a.package)}">Stop</button>`
-                    : `<button class="play small" data-and="launch" data-pkg="${esc(a.package)}">▶</button>`}
-        ${a.art_missing ? `<button class="small" data-and="refresh-art" data-pkg="${esc(a.package)}" data-name="${esc(a.label)}" title="Its Steam library tile has no artwork yet">Add artwork</button>` : ""}
-        <button class="small" data-and="probe" data-pkg="${esc(a.package)}" title="Launch it and record whether it stays up">Test</button>
-        <button class="small" data-and="rate" data-pkg="${esc(a.package)}" data-ver="${esc(a.version)}" data-name="${esc(a.label)}" data-src="${esc(a.source || "")}" title="Report how it worked">Report</button>
-        <button class="small danger" data-and="remove" data-pkg="${esc(a.package)}" data-name="${esc(a.label)}">Remove</button>
-      </div></div>`;
-  }).join("") : `<div class="sub">No Android apps yet. Install one from the catalogue, or drop an .apk on Send to Frame.</div>`;
+  $("andCount").textContent = androidApps.length ? String(androidApps.length) : "";
+  renderLibrary();
   const installed = new Set(androidApps.map(a => a.package));
   document.querySelectorAll('#catGrid [data-and="install"]').forEach(b => {
     if (installed.has(b.dataset.pkg)) b.outerHTML = `<span class="tag">Installed</span>`;
   });
 }
 
-// ---- Import from my Quest (frame_quest.py): adb on this computer, never on the Frame ----
-const quest = { serial: null };
-function questSize(bytes) {
-  if (bytes == null) return "";
-  if (bytes >= 1073741824) return `${(bytes / 1073741824).toFixed(1)} GB`;
-  if (bytes >= 1048576) return `${Math.round(bytes / 1048576)} MB`;
-  return `${Math.max(1, Math.round(bytes / 1024))} KB`;
-}
-async function loadQuest() {
-  $("questScan").disabled = true; $("questState").textContent = "Looking for your Quest…"; $("questApps").innerHTML = "";
-  let d;
-  try { d = await api("/api/quest"); }
-  catch (e) { $("questState").textContent = e.message; return; }
-  finally { $("questScan").disabled = false; }
-  quest.serial = d.quest ? d.quest.serial : null;
-  $("questCount").textContent = d.quest ? `${d.apps.length} app${d.apps.length === 1 ? "" : "s"}` : "";
-  if (!d.quest) { $("questState").textContent = d.guidance || "No Quest found."; return; }
-  $("questState").textContent = `${d.quest.model || "Quest"} connected (${d.quest.serial}). Games that use Meta's licence check install with a warning: they may quit or hang on the Frame.`;
-  const installed = new Set(androidApps.map(a => a.package));
-  $("questApps").innerHTML = d.apps.length ? d.apps.map(a => {
-    const bits = [a.split ? `split APK (${a.apks.length} files)` : "single APK"];
-    if (a.obb != null) bits.push(`OBB ${questSize(a.obb)}`);
-    if (a.data != null) bits.push(`Android/data ${questSize(a.data)}`);
-    if (a.meta) bits.push("Meta app: needs Meta's services");
-    return `<div class="item"><div class="grow"><div class="t">${esc(a.package)}</div><div class="s">${esc(bits.join(" · "))}</div></div>
-      ${installed.has(a.package) ? `<span class="tag">On the Frame</span>` : ""}
-      <button class="small" data-quest-import="${esc(a.package)}"${installing.has("quest:" + a.package) ? " disabled" : ""}>${queued.has("quest:" + a.package) ? "Queued" : installed.has(a.package) ? "Import again" : "Import"}</button></div>`;
-  }).join("") : `<div class="sub">No games or apps you installed are on this Quest.</div>`;
-}
-$("questScan").onclick = loadQuest;
-$("questApps").addEventListener("click", e => {
-  const b = e.target.closest("[data-quest-import]");
-  if (!b) return;
-  const pkg = b.dataset.questImport, key = "quest:" + pkg;
-  if (installing.has(key)) return;
-  b.disabled = true; b.textContent = "Queued";
-  const bar = $("questProgress");
-  // Several can be queued: the bar and the status line follow whichever is installing.
-  runJob(`Import ${pkg} from Quest`, key,
-         () => api("/api/quest", { action: "import", package: pkg, serial: quest.serial, data: $("questData").checked, allowDowngrade: $("questOlder").checked }),
-         j => { if (j.queued || j.done) return; b.textContent = "Importing…"; bar.hidden = false; bar.dataset.owner = key;
-                if (j.stage) $("questState").textContent = `${pkg}: ${j.stage}`; bar.value = j.percent ?? 0; })
-    .then(r => { if (bar.dataset.owner === key) bar.hidden = true; if (r && r.app) { b.textContent = "Imported"; $("questState").textContent = r.message || `Imported ${pkg}`; loadAndroid(); }
-                  else { b.disabled = false; b.textContent = "Import";
-                         if (r !== null) $("questState").textContent = `${pkg} wasn't imported; the reason is in the message log below.`; } });
-});
-
-// ---- My Meta library, Experimental (frame_meta.py): the person's own token, games they own ----
-// The token is only ever in the password box until Connect sends it; the server never sends it back.
-const metaLib = { apps: [], results: new Map(), connected: false };
-const META_VERDICT = { works: ["v-works", "Works on Frame"], maybe: ["v-maybe", "Works with problems"], no: ["v-no", "Doesn't work"] };
-function metaShareNote(s) {
-  const box = $("metaShare");
-  if (!metaLib.connected || !s) { box.hidden = true; return; }
-  box.hidden = false;
-  box.innerHTML = s.shared ? "Test results are shared with the compatibility database (Privacy settings)."
-    : s.blocked ? `Test results are saved on this computer only (${esc(s.blocked)}).`
-    : `Test results are saved on this computer only. <button class="small" id="metaShareOn">Share test results</button>`;
-  const on = $("metaShareOn");
-  if (on) on.onclick = async () => {
-    if (!confirm("Share compatibility results?\n\nYour test results (package, version, whether it ran, and why not) go to "
-                 + "Frame Control's shared compatibility database, so everyone sees better verdicts. Never your token, "
-                 + "account or game files. You can turn it off in Privacy settings.")) return;
-    await setTelemetry({ compat: true });
-    loadMeta();
-  };
-}
-function renderMeta(d) {
-  metaLib.connected = !!d.connected;
-  $("metaConnectBox").hidden = metaLib.connected;
-  $("metaDisconnect").hidden = $("metaRefresh").hidden = $("metaOlderBox").hidden = !metaLib.connected;
-  $("metaState").textContent = metaLib.connected
-    ? `Connected${d.user && d.user.name ? ` as ${d.user.name}` : ""}.` : "Off. Nothing is sent to Meta until you connect.";
-  metaShareNote(d.sharing);
-}
-function renderMetaApps() {
-  // Meta lists everything the account owns: games, but also apps and environments.
-  $("metaCount").textContent = metaLib.connected ? `${metaLib.apps.length} app${metaLib.apps.length === 1 ? "" : "s"}` : "";
-  if (!metaLib.connected) { $("metaApps").innerHTML = ""; return; }
-  const installed = new Set(androidApps.map(a => a.package));
-  $("metaApps").innerHTML = metaLib.apps.length ? metaLib.apps.map(a => {
-    // Sizes first: the line is cut short with "…" in a narrow panel, and the package is the least needed.
-    const bits = [a.size ? questSize(a.size) : "", a.data_files ? `OBB ${questSize(a.data_size)}` : "",
-                  a.version ? `v${a.version}${a.version_code != null ? ` (${a.version_code})` : ""}` : "", a.package || "package unknown"];
-    const line = bits.filter(Boolean).join(" · ");
-    const problem = a.problem ? `<div class="s v-no" title="${esc(a.problem)}">${esc(a.problem)}</div>` : "";
-    // Required game data Frame Control can't place as an OBB (data_plan in frame_meta.py): the game may not run without it.
-    const skipped = (a.skipped_files || []).length
-      ? `<div class="s v-maybe" title="${esc(a.skipped_files.join("\n"))}">Not installed: ${a.skipped_files.length} required data file${a.skipped_files.length === 1 ? "" : "s"} (${esc(a.skipped_files.join(", "))}); the game may not run without ${a.skipped_files.length === 1 ? "it" : "them"}.</div>` : "";
-    const v = a.verdict && META_VERDICT[a.verdict.verdict];
-    const verdict = v ? `<div class="s ${v[0]}" title="${esc((a.verdict.lines || []).join("\n"))}">Community: ${v[1]}</div>` : "";
-    const r = metaLib.results.get(a.package);
-    const result = r ? `<div class="s">${esc(r)}</div>` : "";
-    const busy = installing.has("meta:" + a.id) ? " disabled" : "", waits = queued.has("meta:" + a.id);
-    const on = installed.has(a.package);
-    const can = a.package && !a.problem;
-    return `<div class="item"><div class="grow"><div class="t">${esc(a.title)}</div><div class="s" title="${esc(line)}">${esc(line)}</div>${problem}${skipped}${verdict}${result}</div>
-      ${on ? `<span class="tag">On the Frame</span>` : ""}
-      ${waits ? `<span class="tag">Queued</span>` : ""}
-      ${can ? `<button class="small" data-meta-install="${esc(a.id)}"${busy}>${on ? "Install again" : "Install"}</button>
-      <button class="small" data-meta-install="${esc(a.id)}" data-test="1"${busy} title="Install, start it, watch it for about 30 s and record whether it ran">Install and test</button>` : ""}
-      ${on ? `<button class="small" data-meta-test="${esc(a.package)}"${busy} title="Start it again, watch it for about 30 s and record whether it ran">Test again</button>` : ""}</div>`;
-  }).join("") : `<div class="sub">No Quest apps in this Meta account.</div>`;
-}
-async function loadMeta(refresh = false) {
-  let d;
-  try { d = await api("/api/meta"); } catch (e) { $("metaState").textContent = e.message; return; }
-  renderMeta(d);
-  if (!d.connected) { metaLib.apps = []; renderMetaApps(); return; }
-  $("metaState").textContent += " Reading your library…";
-  try { d = await api(`/api/meta?library=1${refresh ? "&refresh=1" : ""}`); }
-  catch (e) { $("metaState").textContent = e.message; return; }
-  renderMeta(d);
-  metaLib.apps = d.apps || [];
-  renderMetaApps();
-}
-// Sign in with Meta: the desktop app only (app/meta-signin.js); a plain browser pastes the token.
-const metaSignInOk = !!(window.frameApp && window.frameApp.meta && window.frameApp.meta.signIn);
-$("metaSignInRow").hidden = !metaSignInOk;
-let metaDisconnecting = false;  // from pressing Disconnect until the server has deleted the token
-$("metaAck").onchange = e => {
-  $("metaToken").disabled = $("metaConnect").disabled = !e.target.checked;
-  $("metaSignIn").disabled = !e.target.checked || metaDisconnecting;
-};
-$("metaSignIn").onclick = async () => {
-  if (!$("metaAck").checked || metaDisconnecting) return;
-  $("metaSignIn").disabled = true;
-  $("metaState").textContent = "Sign in to Meta in the window that opened…";
-  try {
-    const r = await window.frameApp.meta.signIn(true);
-    if (r && r.ok) { toast(r.message || "Connected"); loadMeta(); }
-    else { await loadMeta(); $("metaState").textContent = (r && r.error) || "Sign-in didn't finish."; }
-  } catch (e) { $("metaState").textContent = e.message; }
-  finally { $("metaSignIn").disabled = !$("metaAck").checked || metaDisconnecting; }
-};
-$("metaSignOut").onclick = async () => {
-  try { await window.frameApp.meta.signOut(); toast("Signed out of Meta in Frame Control"); }
-  catch (e) { toast(e.message, true); }
-};
-$("metaConnect").onclick = async () => {
-  const token = $("metaToken").value;
-  $("metaConnect").disabled = true;
-  try {
-    const d = await api("/api/meta", { action: "connect", token, acknowledged: $("metaAck").checked });
-    $("metaToken").value = "";
-    toast(d.message || "Connected");
-    loadMeta();
-  } catch (e) { $("metaState").textContent = e.message; }
-  finally { $("metaConnect").disabled = !$("metaAck").checked; }
-};
-$("metaDisconnect").onclick = async () => {
-  // One Disconnect at a time, guarded from before the confirm until the delete returns.
-  if (metaDisconnecting) return;
-  metaDisconnecting = true; $("metaDisconnect").disabled = $("metaSignIn").disabled = true;
-  if (!confirm("Disconnect your Meta account? Its token is deleted from this computer. Games already installed stay."
-               + (metaSignInOk ? "\n\nThis also signs out of Meta in Frame Control (its Sign in with Meta window), so the next sign-in starts fresh." : ""))) {
-    metaDisconnecting = false; $("metaDisconnect").disabled = false;
-    $("metaSignIn").disabled = !$("metaAck").checked;
-    return;
-  }
-  // No sign-in from here until the token is deleted. Sign-out first: it stops the sign-in
-  // window (and any connect it started) before the account is forgotten.
-  try {
-    if (metaSignInOk) {
-      try { await window.frameApp.meta.signOut(); } catch (e) { toast(`Couldn't sign out of Meta in Frame Control: ${e.message}`, true); }
-    }
-    try { const d = await api("/api/meta", { action: "disconnect" }); toast(d.message || "Disconnected"); }
-    catch (e) { toast(e.message, true); }
-  } finally { metaDisconnecting = false; $("metaDisconnect").disabled = false; }
-  $("metaAck").checked = false; $("metaToken").disabled = $("metaConnect").disabled = $("metaSignIn").disabled = true;
-  metaLib.results.clear(); loadMeta();
-};
-$("metaRefresh").onclick = () => loadMeta(true);
-$("metaApps").addEventListener("click", async e => {
-  const b = e.target.closest("[data-meta-install],[data-meta-test]");
-  if (!b) return;
-  const bar = $("metaProgress");
-  if (b.dataset.metaTest) {
-    const pkg = b.dataset.metaTest, key = "meta:" + (metaLib.apps.find(a => a.package === pkg) || {}).id;
-    if (!confirm("Test it now?\n\nIt opens in the headset for about 30 seconds and records whether it stays up.")) return;
-    b.disabled = true;
-    const r = await runJob(`Test ${pkg}`, key, () => api("/api/meta", { action: "test", package: pkg }));
-    if (r && r.message) metaLib.results.set(pkg, r.message);
-    renderMetaApps(); loadReports();
-    return;
-  }
-  const app = metaLib.apps.find(a => a.id === b.dataset.metaInstall), test = !!b.dataset.test;
-  if (!app || installing.has("meta:" + app.id)) return;
-  if (test && !confirm(`Install and test ${app.title}?\n\nFrame Control starts it in the headset (twice if it has game data to add), `
-                       + "watches it for about 30 seconds and records whether it ran.")) return;
-  b.disabled = true;
-  // Several can be queued: the bar and the status line follow whichever is installing.
-  const r = await runJob(`${test ? "Install and test" : "Install"} ${app.title} from Meta`, "meta:" + app.id,
-    () => api("/api/meta", { action: "install", app: app.id, test, allowDowngrade: $("metaOlder").checked }),
-    j => { renderMetaApps(); if (j.queued || j.done) return; bar.hidden = false; bar.dataset.owner = "meta:" + app.id;
-           if (j.stage) $("metaState").textContent = `${app.title}: ${j.stage}`; bar.value = j.percent ?? 0; });
-  if (bar.dataset.owner === "meta:" + app.id) bar.hidden = true;  // not while another install still shows its progress
-  if (r && r.message) { $("metaState").textContent = r.message; metaLib.results.set(app.package, r.test ? r.test.message : r.message); }
-  else if (r !== null) $("metaState").textContent = `${app.title} wasn't installed; the reason is in the message log below.`;
-  loadAndroid(); renderMetaApps(); if (test) loadReports();
-});
-loadMeta();
-
 async function loadCatalog() {
   try { cat.apps = (await api("/api/android/catalog")).apps; }
   catch (e) { $("catGrid").innerHTML = `<div class="sub">${esc(e.message)}</div>`; return; }

ui/server.py

@@ -57,8 +57,6 @@ import frame_link  # noqa: E402
 import frame_macview  # noqa: E402
 import frame_media  # noqa: E402
 import frame_panels  # noqa: E402
-import frame_quest  # noqa: E402
-import frame_meta  # noqa: E402
 import frame_report  # noqa: E402
 import frame_store  # noqa: E402
 import frame_telemetry  # noqa: E402
@@ -137,7 +135,7 @@ LINK = None  # the connector (frame_link.Link); None on the Frame itself
 # install's clean-up) to the other headset.
 _work_lock = threading.Lock()
 _work = [0]
-NOT_HEADSET_WORK = {"/api/devices", "/api/contact", "/api/contact/prompt", "/api/queue"}
+NOT_HEADSET_WORK = {"/api/devices", "/api/contact", "/api/contact/prompt"}
 
 
 @contextlib.contextmanager
@@ -286,120 +284,40 @@ def backfill_art(apps=(), titles=()):
     return True
 
 
-def _new_job_locked(label, **fields):
+def start_job(label, work, progress=False):
+    """Run work() in the background. It returns a dict with a "message"."""
     now = time.time()
-    for j in [j for j, v in _jobs.items() if v["done"] and now - v["time"] > JOB_TTL]:
-        del _jobs[j]
-    job = secrets.token_hex(8)
-    _jobs[job] = {"label": label, "done": False, "error": None, "message": None, "result": None, "time": now, **fields}
-    return job
+    with _jobs_lock:
+        for j in [j for j, v in _jobs.items() if v["done"] and now - v["time"] > JOB_TTL]:
+            del _jobs[j]
+        job = secrets.token_hex(8)
+        _jobs[job] = {"label": label, "done": False, "error": None, "message": None, "result": None, "time": now}
 
-
-def _run_job(job, label, work, progress):
     def report(stage, percent=None):
         with _jobs_lock:
             _jobs[job].update(stage=stage, percent=percent)
 
-    fields = {}
-    try:
-        result = work(report) if progress else work()
-        fields = {"message": result.get("message") or f"{label}: done", "result": result}
-    except (Failure, frame_android.FrameError) as e:
-        fields = {"error": unreachable(str(e)) or str(e)}
-        frame_telemetry.diagnostic(f"job {label.split()[0]}", e)
-    except SourceError as e:  # already user-readable, and about a store, not the Frame
-        fields = {"error": str(e)}
-    except Exception as e:
-        fields = {"error": f"{type(e).__name__}: {e}"}
-        frame_telemetry.diagnostic(f"job {label.split()[0]}", e)
-    finally:
-        with _jobs_lock:
-            _jobs[job].update(fields, done=True, time=time.time())
+    def run():
+        fields = {}
+        try:
+            result = work(report) if progress else work()
+            fields = {"message": result.get("message") or f"{label}: done", "result": result}
+        except (Failure, frame_android.FrameError) as e:
+            fields = {"error": unreachable(str(e)) or str(e)}
+            frame_telemetry.diagnostic(f"job {label.split()[0]}", e)
+        except SourceError as e:  # already user-readable, and about a store, not the Frame
+            fields = {"error": str(e)}
+        except Exception as e:
+            fields = {"error": f"{type(e).__name__}: {e}"}
+            frame_telemetry.diagnostic(f"job {label.split()[0]}", e)
+        finally:
+            with _jobs_lock:
+                _jobs[job].update(fields, done=True, time=time.time())
 
-
-def start_job(label, work, progress=False):
-    """Run work() in the background. It returns a dict with a "message"."""
-    with _jobs_lock:
-        job = _new_job_locked(label)
-    busy_thread(_run_job, job, label, work, progress).start()
+    busy_thread(run).start()
     return {"message": f"{label}…", "job": job}
 
 
-# ---- The install queue: Android games and apps, one after another ----------
-#
-# Installs from the Android store, Import from my Quest and My Meta library each copy
-# a game into a Lepton instance, and each refuses to start while another is running.
-# Queued, the page can line up several: one worker runs them in order, each as a
-# normal job (/api/job) that reads "queued" until its turn. A queued install can be
-# removed until it starts; each runs on the headset it was queued for, or not at all.
-
-_queue = []  # [job, label, work, progress, headset id], in order; the running one is not here
-_queue_state = {"worker": False, "running": None}
-
-
-def _restage_locked():
-    ahead = 1 if _queue_state["running"] else 0
-    for i, (job, *_) in enumerate(_queue):
-        n = ahead + i
-        _jobs[job]["stage"] = f"Queued: {n} install{'' if n == 1 else 's'} before it" if n else "Queued: next"
-
-
-def queue_job(label, work, progress=False):
-    """Like start_job, but runs after every install queued before it."""
-    device = LINK.active_device()["id"] if LINK else None
-    with _jobs_lock:
-        job = _new_job_locked(label, queued=True, stage=None, percent=None)
-        _queue.append([job, label, work, progress, device])
-        _restage_locked()
-        ahead = len(_queue) - 1 + (1 if _queue_state["running"] else 0)
-        start, _queue_state["worker"] = not _queue_state["worker"], True
-    if start:
-        threading.Thread(target=_drain_queue, daemon=True).start()
-    return {"message": f"{label}: queued, {ahead} before it" if ahead else f"{label}…", "job": job, "queued": ahead}
-
-
-def _drain_queue():
-    while True:
-        with _jobs_lock:
-            if not _queue:
-                _queue_state.update(worker=False, running=None)
-                return
-            job, label, work, progress, device = _queue.pop(0)
-            _queue_state["running"] = job
-            _jobs[job].update(queued=False, stage=None)
-            _restage_locked()
-
-        def guarded(*report, work=work, device=device):
-            with working(device):  # refused if the app switched headsets since it was queued
-                return work(*report)
-        _run_job(job, label, guarded, progress)
-
-
-def install_queue():
-    """The running install and those waiting, in order."""
-    with _jobs_lock:
-        ids = ([_queue_state["running"]] if _queue_state["running"] else []) + [q[0] for q in _queue]
-        return {"jobs": [{"job": j, "label": _jobs[j]["label"], "queued": bool(_jobs[j].get("queued")),
-                          "stage": _jobs[j].get("stage"), "percent": _jobs[j].get("percent")}
-                         for j in ids if j in _jobs]}
-
-
-def queue_action(body):
-    """{"action": "remove", "job"}: take a waiting install out of the queue."""
-    if body.get("action") != "remove":
-        raise Failure("unknown action", 400)
-    job = body.get("job")
-    with _jobs_lock:
-        for i, q in enumerate(_queue):
-            if q[0] == job:
-                del _queue[i]
-                _jobs[job].update(done=True, queued=False, cancelled=True, stage=None, time=time.time(),
-                                  error="Removed from the install queue")
-                _restage_locked()
-                return {"message": f"Removed {_jobs[job]['label']} from the install queue"}
-    raise Failure("that install isn't waiting in the queue (it may have started or finished)", 409)
-
-
 def job_status(query):
     with _jobs_lock:
         job = _jobs.get((parse_qs(query).get("id") or [""])[0])
@@ -1378,7 +1296,7 @@ def android(body):
                 m = frame_apk_versions.install(pkg, url) if url else frame_catalog.install(pkg)
                 message = f"Installed {m['label']}. It's in the Steam library; launching it opens its own panel."
                 return {"message": f"{message} {frame_android.layer_note(m)}".strip(), "app": m}
-            return queue_job(f"Install {pkg}", work)
+            return start_job(f"Install {pkg}", work)
         if action == "refresh-art":
             if not pkg and not body.get("all"):
                 raise Failure('choose a package or all apps', 400)
@@ -1412,149 +1330,6 @@ def android(body):
     raise Failure("unknown action", 400)
 
 
-# ---- Import from my Quest (frame_quest.py, docs/quest-import.md) --------------
-
-QUEST_ON_FRAME = "Import from my Quest runs on your computer, with the Quest plugged into it by USB."
-QUEST_SERIAL = re.compile(r"^[A-Za-z0-9._:\[\]-]{1,128}$")
-
-
-def quest_serial(value):
-    if value in (None, ""):
-        return None
-    if not isinstance(value, str) or not QUEST_SERIAL.match(value):
-        raise Failure("invalid Quest serial", 400)
-    return value
-
-
-def quest_status(query):
-    """The Quest on this computer's USB (or what to do), and the apps on it."""
-    if LOCAL:
-        return {"quest": None, "devices": [], "guidance": QUEST_ON_FRAME, "apps": []}
-    try:
-        return frame_quest.status(quest_serial((parse_qs(query).get("serial") or [None])[0]))
-    except frame_android.FrameError as e:
-        raise Failure(str(e)) from e
-
-
-def quest(body):
-    """{"action": "import", "package", "serial"?, "data"?}: a background job with progress."""
-    if LOCAL:
-        raise Failure(QUEST_ON_FRAME, 400)
-    if body.get("action") != "import":
-        raise Failure("unknown action", 400)
-    pkg = str(body.get("package", ""))
-    if not frame_android.PKG_RE.match(pkg):
-        raise Failure("invalid Android package id", 400)
-    serial, data, older = quest_serial(body.get("serial")), body.get("data", False), body.get("allowDowngrade", False)
-    if type(data) is not bool or type(older) is not bool:
-        raise Failure("data and allowDowngrade must be true or false", 400)
-    ensure_master()
-    return queue_job(f"Import {pkg} from Quest",
-                     lambda report: frame_quest.import_game(pkg, serial, data=data, progress=report,
-                                                            allow_downgrade=older), progress=True)
-
-
-# ---- My Meta library, Experimental (frame_meta.py, docs/meta-library.md) ------
-#
-# Never echoes the token: answers come from frame_meta.status() and _public(), and every
-# error passes through frame_meta.redact().
-
-META_APP_ID = re.compile(r"^[0-9]{1,25}$")
-
-
-def _meta_failure(e):
-    if isinstance(e, frame_meta.SignInCancelled):
-        return Failure(frame_meta.redact(e, 600), 409)
-    status = 400 if isinstance(e, frame_meta.TokenRejected) or "token" in str(e).lower() else 502
-    return Failure(frame_meta.redact(e, 600), status)
-
-
-def meta_sharing():
-    """Whether test results reach the shared compatibility database (Privacy settings)."""
-    blocked = frame_telemetry.blocked()
-    return {"shared": bool(frame_catalog.compat_db.shared() or frame_telemetry.enabled("compat")),
-            "blocked": blocked or None}
-
-
-def meta_status(query):
-    """The connected account (never its token) and, with library=1, the Quest games it owns
-    with any community verdicts."""
-    q = parse_qs(query)
-    out = dict(frame_meta.status(), sharing=meta_sharing())
-    if out["connected"] and q.get("library") == ["1"]:
-        try:
-            apps = frame_meta.with_verdicts(frame_meta.library(refresh=q.get("refresh") == ["1"]))
-            out["apps"] = [frame_meta._public(a) for a in apps]
-        except frame_android.FrameError as e:
-            raise _meta_failure(e) from None
-    return out
-
-
-def meta(body):
-    """{"action": "connect", "token", "acknowledged": true, "attempt"?} | {"action": "disconnect"} |
-    {"action": "cancel-signin", "attempt"} |
-    {"action": "install", "app", "test"?, "allowDowngrade"?} | {"action": "test", "package"}."""
-    action = body.get("action")
-    try:
-        if action == "connect":
-            if body.get("acknowledged") is not True:
-                raise Failure("My Meta library is experimental: tick that you understand the warning first", 400)
-            if not isinstance(body.get("token"), str):
-                raise Failure("paste your Meta access token", 400)
-            attempt = body.get("attempt")
-            if attempt is not None and not (isinstance(attempt, str) and frame_meta.SIGNIN_ATTEMPT.fullmatch(attempt)):
-                raise Failure("invalid sign-in attempt id", 400)
-            return dict(frame_meta.connect(body["token"], attempt=attempt), sharing=meta_sharing(),
-                        message="Connected your Meta account (Experimental)")
-        if action == "cancel-signin":
-            attempt = body.get("attempt")
-            if not (isinstance(attempt, str) and frame_meta.SIGNIN_ATTEMPT.fullmatch(attempt)):
-                raise Failure("invalid sign-in attempt id", 400)
-            return dict(frame_meta.cancel_signin(attempt), sharing=meta_sharing(),
-                        message="Cancelled that Sign in with Meta; it won't be saved")
-        if action == "disconnect":
-            return dict(frame_meta.disconnect(), sharing=meta_sharing(),
-                        message="Disconnected your Meta account; its token was deleted from this computer")
-        if action == "install":
-            app_id, test, older = str(body.get("app", "")), body.get("test", False), body.get("allowDowngrade", False)
-            if not META_APP_ID.match(app_id):
-                raise Failure("invalid Meta app id", 400)
-            if type(test) is not bool or type(older) is not bool:
-                raise Failure("test and allowDowngrade must be true or false", 400)
-            ensure_master()
-
-            def work(report):
-                try:
-                    return frame_meta.install(app_id, test=test, progress=report, allow_downgrade=older)
-                except frame_android.FrameError as e:
-                    raise frame_meta.MetaError(frame_meta.redact(e, 1200)) from None
-                except Exception as e:  # never let an unexpected error's text carry the token
-                    raise frame_meta.MetaError(frame_meta.redact(f"{type(e).__name__}: {e}", 600)) from None
-            return queue_job(f"{'Install and test' if test else 'Install'} {app_id} from Meta", work, progress=True)
-        if action == "test":
-            pkg = str(body.get("package", ""))
-            if not frame_android.PKG_RE.match(pkg):
-                raise Failure("invalid Android package id", 400)
-            ensure_master()
-
-            def test():
-                # run_test's own errors are fixed texts; anything else could carry the game's
-                # log (an ssh error is its output), so it is never shown, not even redacted.
-                try:
-                    return frame_meta.run_test(pkg)
-                except frame_meta.MetaError:
-                    raise
-                except frame_android.FrameError:
-                    raise frame_meta.MetaError(frame_meta.LOG_UNREADABLE) from None
-                except Exception as e:
-                    raise frame_meta.MetaError(f"The test stopped unexpectedly ({type(e).__name__}); "
-                                               "try again.") from None
-            return start_job(f"Test {pkg}", test)
-    except frame_meta.MetaError as e:
-        raise _meta_failure(e) from None
-    raise Failure("unknown action", 400)
-
-
 # Errors that are the APK's own fault, so they belong in the compatibility
 # database as install_failed. Connection trouble and the like don't.
 APK_FAULTS = {"android_installer", "apk_needs_newer_android", "apk_wrong_abi"}
@@ -2404,11 +2179,14 @@ def source_search(query):
     q = args.get('q', [''])[0]
     vr = args.get('vr', [''])[0]
     installable = args.get('installable', [''])[0]
-    if len(q) > 500 or vr not in ('', 'true', 'false', '1', '0') or installable not in ('', 'true', 'false', '1', '0'):
+    category, phone = args.get('category', [''])[0], args.get('phone', [''])[0]
+    if (len(q) > 500 or vr not in ('', 'true', 'false', '1', '0') or installable not in ('', 'true', 'false', '1', '0')
+            or phone not in ('', 'true', 'false', '1', '0') or len(category) > 40):
         raise Failure('Invalid search filters', 400)
     try:
         return apk_search.search(q, vr=None if not vr else vr in ('true', '1'),
-                                 source=args.get('source', [None])[0], installable=installable in ('true', '1'))
+                                 source=args.get('source', [None])[0], installable=installable in ('true', '1'),
+                                 category=category or None, phone=phone in ('true', '1'))
     except SourceError as e:
         raise Failure(str(e), 400)
 
@@ -2424,7 +2202,7 @@ def source_install(body):
             raise SourceError('This source is disabled')
     except SourceError as e:
         raise Failure(str(e), 400)
-    return queue_job('Install ' + entry, lambda report: apk_search.install(source, entry, version, report), progress=True)
+    return start_job('Install ' + entry, lambda report: apk_search.install(source, entry, version, report), progress=True)
 
 
 def source_manage(body):
@@ -2467,7 +2245,7 @@ POST = {
     "/api/agent/approval": agent_approval, "/api/assistant/chat": assistant_chat,
     "/api/input": remote_input, "/api/touch": remote_touch,
     "/api/settings/artwork": frame_steamgriddb.save_settings,
-    "/api/sources": source_manage, "/api/sources/install": source_install, "/api/android/display": android_display, "/api/android": android, "/api/quest": quest, "/api/meta": meta, "/api/queue": queue_action, "/api/titles": titles, "/api/launch": launch, "/api/steam": steam, "/api/volume": set_volume, "/api/clipboard": clipboard,
+    "/api/sources": source_manage, "/api/sources/install": source_install, "/api/android/display": android_display, "/api/android": android, "/api/titles": titles, "/api/launch": launch, "/api/steam": steam, "/api/volume": set_volume, "/api/clipboard": clipboard,
         "/api/flatpak": flatpak, "/api/open": open_thing, "/api/shots/save": save_shots,
         "/api/webinstall/check": webinstall_check, "/api/webinstall/start": webinstall_start,
         "/api/webinstall/cancel": webinstall_cancel,
@@ -2640,6 +2418,9 @@ class Handler(BaseHTTPRequestHandler):
         try:
             if path in ("/", "/index.html"):
                 self.send_bytes((HERE / "index.html").read_bytes(), "text/html; charset=utf-8")
+            elif path == "/store":
+                # The Android store as a headset panel (scripts/store-on-frame.sh).
+                self.send_bytes((HERE / "store.html").read_bytes(), "text/html; charset=utf-8")
             elif path == "/api/settings/artwork":
                 self.send_json(frame_steamgriddb.settings())
             elif path == "/artwork-settings.js":
@@ -2689,11 +2470,12 @@ class Handler(BaseHTTPRequestHandler):
                 ensure_master()
                 apps = frame_android.list_apps()
                 backfill_art(apps=apps)
-                self.send_json({"apps": apps})
-            elif path == "/api/quest":
-                self.send_json(quest_status(url.query))
-            elif path == "/api/meta":
-                self.send_json(meta_status(url.query))
+                try:  # store artwork for the library's cards, from saved indexes only
+                    art = apk_search.artwork_for(apps)
+                except Exception:
+                    art = {}
+                self.send_json({"apps": [dict(a, store_art=art[a['package']]) if a.get('package') in art else a
+                                         for a in apps]})
             elif path == "/api/titles":
                 ensure_master()
                 titles_list = frame_titles.list_titles()
@@ -2711,8 +2493,6 @@ class Handler(BaseHTTPRequestHandler):
                 self.send_json(_input.send([]) if parse_qs(url.query).get("start") == ["1"] else dict(_input.status))
             elif path == "/api/job":
                 self.send_json(job_status(url.query))
-            elif path == "/api/queue":
-                self.send_json(install_queue())
             elif path == "/api/android/displays":
                 self.send_json(android_displays())
             elif path == "/api/android/reports":

ui/store.html

@@ -0,0 +1,489 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>APK Store</title>
+<!-- Frame Control's Android store as a panel in the headset (docs/apks.md →
+     "The store in the headset"). Served by ui/server.py running on the Frame
+     (FRAME_LOCAL=1), opened by scripts/store-on-frame.sh at 1280×800. The same
+     sources, categories and artwork as the Store in Frame Control (/api/search,
+     ui/apk_sources/_categories.py), drawn for the laser: big targets, pages
+     instead of drag-scrolling (the panel gets mouse clicks, so a drag would
+     select text), the thumbstick (a mouse wheel) turns pages, and an on-screen
+     keyboard for search. -->
+<style>
+  :root {
+    --bg: #0f1722; --rail: #131d2a; --card: #1b2938; --card-hi: #23364a; --line: #ffffff14;
+    --text: #e3e8ee; --bright: #fff; --dim: #93a4ba; --blue: #1a9fff; --link: #66c0f4;
+    --good: #8ed36b; --bad: #ef7a64;
+    --action: linear-gradient(to right, #47bfff 5%, #1a44c2 95%);
+    --play: linear-gradient(to right, #75b022 5%, #588a1b 95%);
+  }
+  * { box-sizing: border-box; }
+  [hidden] { display: none !important; }
+  html, body { margin: 0; height: 100%; background: radial-gradient(ellipse at 70% -20%, #1d3a5a 0%, transparent 60%), var(--bg);
+    color: var(--text); font: 19px/1.35 "Motiva Sans", system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+    overflow: hidden; user-select: none; -webkit-user-select: none; }
+  button { font: inherit; color: inherit; background: #ffffff0d; border: 1px solid var(--line); border-radius: 12px;
+    min-height: 52px; padding: 0 20px; cursor: pointer; }
+  button:hover { background: #ffffff1c; }
+  button:disabled { opacity: .45; cursor: default; }
+  button.primary { background: var(--action); border: 0; font-weight: 600; color: #fff; }
+  button.play { background: var(--play); border: 0; font-weight: 600; color: #fff; }
+  button.danger { color: var(--bad); }
+  svg { width: 22px; height: 22px; flex: none; }
+  .app { display: grid; grid-template-columns: 236px 1fr; height: 100%; }
+  /* Rail */
+  .rail { background: #0c131ccc; border-right: 1px solid var(--line); padding: 18px 12px; display: flex; flex-direction: column; gap: 3px; }
+  .rail h1 { font-size: 22px; margin: 2px 10px 12px; display: flex; align-items: center; gap: 10px; color: var(--bright); }
+  .rail h1 svg { width: 28px; height: 28px; color: var(--blue); }
+  .rail button { display: flex; align-items: center; gap: 12px; width: 100%; min-height: 47px; text-align: left; border: 0;
+    background: transparent; color: #b5c0cb; font-size: 17px; font-weight: 500; padding: 0 12px; border-radius: 10px; }
+  .rail button:hover { background: #ffffff10; color: var(--bright); }
+  .rail button[aria-pressed="true"] { background: #1a9fff2e; color: var(--bright); box-shadow: inset 4px 0 0 var(--blue); }
+  .rail .sep { height: 1px; background: var(--line); margin: 6px 8px; }
+  .rail .n { margin-left: auto; font-size: 13px; color: #c6e2f5; background: #1a9fff2e; border-radius: 10px; padding: 1px 8px; }
+  .rail .n:empty { display: none; }
+  .rail label { margin-top: auto; display: flex; align-items: center; gap: 10px; padding: 10px 12px; font-size: 15px; color: var(--dim); cursor: pointer; }
+  .rail input { width: 22px; height: 22px; accent-color: var(--blue); margin: 0; }
+  /* Main */
+  main { display: flex; flex-direction: column; min-width: 0; padding: 18px 22px; gap: 12px; }
+  .bar { display: flex; gap: 12px; align-items: center; }
+  .search { flex: 1; display: flex; align-items: center; gap: 12px; background: #0c1520; border: 1px solid var(--line);
+    border-radius: 12px; min-height: 54px; padding: 0 18px; color: var(--dim); }
+  .search input { flex: 1; background: none; border: 0; color: var(--text); font: inherit; outline: none; min-width: 0; }
+  .search input::placeholder { color: var(--dim); }
+  .heading { display: flex; align-items: baseline; gap: 14px; min-height: 30px; }
+  .heading b { color: var(--bright); font-size: 25px; letter-spacing: -.4px; }
+  .heading span { color: var(--dim); font-size: 16px; }
+  .heading .note { margin-left: auto; font-size: 14px; color: var(--dim); max-width: 520px; text-align: right; }
+  .content { flex: 1; min-height: 0; display: flex; flex-direction: column; gap: 14px; }
+  .grid { flex: 1; min-height: 0; display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); grid-template-rows: repeat(2, minmax(0, 1fr)); gap: 14px; }
+  .grid.one-row { grid-template-rows: minmax(0, 1fr); }
+  .card { display: flex; flex-direction: column; padding: 0; overflow: hidden; text-align: left; min-height: 0; border-radius: 14px;
+    background: var(--card); border: 1px solid var(--line); }
+  .card:hover { background: var(--card-hi); border-color: #66c0f480; }
+  .card .art { flex: 0 0 52%; }
+  .card .body { display: flex; flex-direction: column; gap: 6px; padding: 10px 12px 12px; min-height: 0; flex: 1; width: 100%; }
+  .card .title { display: flex; align-items: center; gap: 10px; min-width: 0; }
+  .card .title strong { font-size: 17px; color: var(--bright); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; min-width: 0; }
+  .card .sum { color: var(--dim); font-size: 14px; line-height: 1.35; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
+  .card .foot { margin-top: auto; display: flex; justify-content: space-between; align-items: center; gap: 6px; font-size: 13px; color: var(--dim); }
+  /* Artwork: a banner, else screenshots side by side, else the icon over its own blur, else an initial. */
+  .art { position: relative; display: block; overflow: hidden; width: 100%;
+    background: radial-gradient(ellipse at 75% 10%, hsl(var(--hue) 50% 40%), transparent 70%), linear-gradient(140deg, hsl(var(--hue) 35% 18%), #101827); }
+  .art > img { position: absolute; inset: 0; width: 100%; height: 100%; object-fit: cover; }
+  .art .initial { position: absolute; inset: 0; display: grid; place-items: center; font-size: 64px; font-weight: 700; color: #ffffff45; }
+  .art.shots { display: flex; gap: 6px; justify-content: center; padding: 8px 8px 0; }
+  .art.shots > img { position: relative; inset: auto; width: auto; max-width: 31%; height: 100%; object-position: top; border-radius: 6px 6px 0 0; box-shadow: 0 4px 14px #0008; }
+  .art.iconart > .backdrop { position: absolute; inset: -30%; width: 160%; height: 160%; object-fit: cover; filter: blur(28px) saturate(1.4) brightness(.55); }
+  .art.iconart > .mark { position: absolute; left: 50%; top: 50%; width: 36%; height: auto; aspect-ratio: 1; transform: translate(-50%, -50%); border-radius: 22%; box-shadow: 0 8px 24px #0009; object-fit: cover; }
+  .art.shots .initial, .art.iconart .initial { display: none; }
+  .art .vr { position: absolute; z-index: 2; top: 8px; left: 8px; }
+  .icon { position: relative; display: inline-grid; place-items: center; width: 38px; height: 38px; border-radius: 9px; overflow: hidden; flex: none;
+    background: hsl(var(--hue) 35% 28%); color: #fff; font-size: 18px; font-weight: 600; }
+  .icon img { position: absolute; inset: 0; width: 100%; height: 100%; object-fit: cover; }
+  .vr { font-size: 12px; font-weight: 700; letter-spacing: .8px; color: #0e141b; background: #c2e7ff; border-radius: 5px; padding: 2px 7px; }
+  .fit { font-size: 12px; font-weight: 600; border-radius: 5px; padding: 2px 8px; white-space: nowrap; }
+  .fit.works { color: #c3efb2; background: #59bf4029; } .fit.ready { color: #bfe3fa; background: #1a9fff26; } .fit.blocked { color: #f3b2a6; background: #d9412629; }
+  .tag { font-size: 12px; font-weight: 600; color: #d6f5c8; background: #2d5a1f; border-radius: 10px; padding: 2px 9px; white-space: nowrap; }
+  /* Home */
+  .hero { position: relative; flex: 0 0 42%; padding: 0; border: 0; border-radius: 16px; overflow: hidden; text-align: left; isolation: isolate; }
+  .hero .art { position: absolute; inset: 0; height: 100%; }
+  .hero::after { content: ""; position: absolute; inset: 0; z-index: 1; background: linear-gradient(90deg, #081421f0 0%, #08142180 50%, #08142100 85%); }
+  .hero .copy { position: relative; z-index: 2; padding: 26px 30px; max-width: 560px; display: flex; flex-direction: column; gap: 10px; align-items: flex-start; }
+  .hero .eyebrow { display: flex; gap: 10px; align-items: center; font-size: 13px; font-weight: 700; letter-spacing: 1.6px; text-transform: uppercase; color: #c2e7ff; }
+  .hero strong { font-size: 38px; color: #fff; line-height: 1.05; letter-spacing: -.8px; }
+  .hero .blurb { color: #e0e8ef; font-size: 17px; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
+  .hero .cta { margin-top: 4px; background: #ffffff22; border: 1px solid #ffffff44; border-radius: 10px; padding: 9px 18px; font-size: 16px; color: #fff; }
+  /* Pager */
+  .pager { display: flex; justify-content: space-between; align-items: center; gap: 12px; }
+  .pager button { min-width: 180px; }
+  .dots { display: flex; gap: 8px; align-items: center; color: var(--dim); font-size: 15px; }
+  .empty { grid-column: 1 / -1; grid-row: 1 / -1; display: grid; place-items: center; align-content: center; gap: 14px; color: var(--dim); text-align: center; padding: 30px; }
+  .empty h2 { margin: 0; color: var(--bright); font-size: 24px; }
+  .skeleton { border-radius: 14px; background: linear-gradient(100deg, #1b2938 30%, #24364a 50%, #1b2938 70%); background-size: 300% 100%; animation: shimmer 1.4s infinite; }
+  @keyframes shimmer { to { background-position: -150% 0; } }
+  /* Detail sheet and keyboard sit over everything. */
+  .overlay { position: fixed; inset: 0; background: #000b; display: grid; place-items: center; z-index: 10; }
+  .sheet { background: #16212e; border: 1px solid var(--line); border-radius: 22px; width: 1000px; max-height: 740px; overflow: hidden;
+    display: flex; flex-direction: column; box-shadow: 0 30px 80px #000c; }
+  .sheet > .art { flex: 0 0 250px; }
+  .sheet .gallery { flex: 0 0 250px; display: flex; gap: 10px; padding: 14px 14px 0; background: #0c131c; justify-content: center; overflow: hidden; }
+  .sheet .gallery img { height: 100%; width: auto; max-width: 32%; object-fit: cover; object-position: top; border-radius: 10px 10px 0 0; }
+  .sheet .inner { padding: 20px 28px 22px; display: flex; flex-direction: column; gap: 12px; flex: 1; min-height: 0; }
+  .sheet .top { display: flex; gap: 18px; align-items: center; }
+  .sheet .top .icon { width: 72px; height: 72px; border-radius: 16px; font-size: 32px; }
+  .sheet h2 { margin: 0; font-size: 30px; color: var(--bright); line-height: 1.1; }
+  .sheet .meta { color: var(--dim); font-size: 16px; }
+  .sheet .text { font-size: 17px; display: -webkit-box; -webkit-line-clamp: 3; -webkit-box-orient: vertical; overflow: hidden; }
+  .sheet .why { background: #ffffff0a; border-radius: 12px; padding: 10px 16px; font-size: 15px; color: #c5d0db; }
+  .sheet .why ul { margin: 4px 0 0; padding-left: 22px; }
+  .sheet .acts { display: flex; gap: 12px; flex-wrap: wrap; margin-top: 8px; align-items: center; }
+  .sheet .acts .close { margin-left: auto; }
+  .progress { flex: 1; min-width: 260px; display: flex; flex-direction: column; gap: 6px; font-size: 15px; color: var(--dim); }
+  .progress .track { height: 8px; border-radius: 4px; background: #ffffff14; overflow: hidden; }
+  .progress .fill { height: 100%; background: var(--blue); width: 30%; transition: width .3s; }
+  .progress.busy .fill { animation: busy 1.2s ease-in-out infinite; }
+  @keyframes busy { from { margin-left: -30%; } to { margin-left: 100%; } }
+  .kbd { position: fixed; left: 0; right: 0; bottom: 0; background: #131d2af5; border-top: 1px solid var(--line);
+    padding: 12px; display: grid; gap: 8px; z-index: 20; box-shadow: 0 -20px 50px #0009; }
+  .kbd .row { display: flex; gap: 8px; justify-content: center; }
+  .kbd button { min-width: 76px; min-height: 60px; padding: 0 10px; font-size: 21px; }
+  .kbd .wide { min-width: 320px; }
+  .toast { position: fixed; left: 50%; top: 18px; transform: translateX(-50%); background: #0d2236; border: 1px solid var(--blue);
+    border-radius: 14px; padding: 12px 20px; z-index: 30; max-width: 900px; box-shadow: 0 10px 30px #0008; }
+  .toast.bad { background: #3a1416; border-color: var(--bad); }
+</style>
+</head>
+<body>
+<div class="app">
+  <div class="rail" role="navigation" aria-label="Store">
+    <h1><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><path d="M4 7h16l-1.5 12.5a1 1 0 0 1-1 .9H6.5a1 1 0 0 1-1-.9z"/><path d="M8.5 9V6a3.5 3.5 0 0 1 7 0v3"/></svg>APK Store</h1>
+    <div id="cats"></div>
+    <div class="sep"></div>
+    <button data-view="installed" aria-pressed="false"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" aria-hidden="true"><rect x="3.5" y="4" width="7" height="7" rx="1.5"/><rect x="13.5" y="4" width="7" height="7" rx="1.5"/><rect x="3.5" y="14" width="7" height="7" rx="1.5"/><rect x="13.5" y="14" width="7" height="7" rx="1.5"/></svg>Installed<span class="n" id="instN"></span></button>
+    <label title="Apps built around a phone: calls and SMS, launchers, keyboards, widgets, fitness, system tools. Searching always finds them."><input type="checkbox" id="phone"> Show phone-only apps</label>
+  </div>
+  <main>
+    <div class="bar">
+      <label class="search"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><circle cx="10.5" cy="10.5" r="6.5"/><path d="m16 16 5 5"/></svg><input id="q" placeholder="Search games and apps" autocomplete="off" spellcheck="false" aria-label="Search games and apps"></label>
+      <button id="kbdBtn" title="On-screen keyboard">⌨︎ Keyboard</button>
+    </div>
+    <div class="heading"><b id="title">Home</b><span id="count"></span><span class="note" id="note"></span></div>
+    <div class="content" id="content"></div>
+    <div class="pager">
+      <button id="prev">◀ Previous</button>
+      <span class="dots" id="page"></span>
+      <button id="next">Next ▶</button>
+    </div>
+  </main>
+</div>
+
+<div class="overlay" id="detail" hidden><div class="sheet" id="sheet"></div></div>
+<div class="kbd" id="kbd" hidden></div>
+<div class="toast" id="toast" hidden></div>
+
+<script>
+const UI_KEY = new URLSearchParams(location.search).get("key") || "1";
+const $ = id => document.getElementById(id);
+const esc = s => String(s ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+const PER_PAGE = 8;
+// Same ids and order as STORE_CATS in index.html and ui/apk_sources/_categories.py.
+const CATS = [
+  ["", "Home", '<path d="M4 11.5 12 5l8 6.5V19a1 1 0 0 1-1 1h-4.5v-5h-5v5H5a1 1 0 0 1-1-1z"/>'],
+  ["vr", "VR", '<path d="M3.5 8.5A1.5 1.5 0 0 1 5 7h14a1.5 1.5 0 0 1 1.5 1.5v6A1.5 1.5 0 0 1 19 16h-3.5l-2-2.5h-3l-2 2.5H5a1.5 1.5 0 0 1-1.5-1.5z"/><circle cx="8" cy="11.5" r="1.5"/><circle cx="16" cy="11.5" r="1.5"/>'],
+  ["games", "Games", '<path d="M7 9h10a4 4 0 0 1 3.9 4.9l-.6 2.6a2 2 0 0 1-3.4.9L14.5 15h-5l-2.4 2.4a2 2 0 0 1-3.4-.9l-.6-2.6A4 4 0 0 1 7 9z"/><path d="M8 11.5v3M6.5 13h3"/>'],
+  ["emulators", "Emulators", '<rect x="4" y="5" width="16" height="11" rx="1.5"/><path d="M9 20h6M12 16v4M8 10.5h3M9.5 9v3"/>'],
+  ["watch", "Watch & listen", '<rect x="3.5" y="5.5" width="17" height="11" rx="1.5"/><path d="m10.5 8.5 4 2.5-4 2.5z"/><path d="M8 20h8"/>'],
+  ["read", "Read & learn", '<path d="M12 7c-2-1.5-5-2-8-1.5v12c3-.5 6 0 8 1.5 2-1.5 5-2 8-1.5v-12c-3-.5-6 0-8 1.5zM12 7v12"/>'],
+  ["create", "Create", '<path d="m14.5 5.5 4 4L9 19H5v-4z"/><path d="m12.5 7.5 4 4"/>'],
+  ["work", "Work", '<rect x="4" y="7" width="16" height="12" rx="1.5"/><path d="M9 7V5.5A1.5 1.5 0 0 1 10.5 4h3A1.5 1.5 0 0 1 15 5.5V7M4 12h16"/>'],
+  ["web", "Web & chat", '<circle cx="12" cy="12" r="8"/><path d="M4 12h16M12 4c2.5 2.5 2.5 13.5 0 16M12 4c-2.5 2.5-2.5 13.5 0 16"/>'],
+  ["tools", "Tools", '<path d="M14.5 6.5a4 4 0 0 0-5.3 5.3L4.5 16.5l3 3 4.7-4.7a4 4 0 0 0 5.3-5.3l-2.4 2.4-2.6-.4-.4-2.6z"/>'],
+];
+const catLabel = id => (CATS.find(c => c[0] === id) || [])[1] || "";
+const FIT = { works: "Works on the Frame", ready: "Fits the Frame", blocked: "Won't run" };
+// view: "" (home), a category id, or "installed"; jobs: offer key -> {stage, percent, done, result, error}
+// installedFrom: offer key -> package it installed as (GitHub listings have no package);
+// needsData: installed packages still waiting for their game data (any view, while installed)
+const st = { view: "", q: "", phone: false, page: 0, apps: [], installed: new Map(), jobs: new Map(), installedFrom: new Map(),
+             needsData: new Set(), request: 0, loading: false, retry: 0 };
+
+async function api(path, body) {
+  const opts = body === undefined ? { headers: { "X-Frame-UI": UI_KEY } } : {
+    method: "POST", headers: { "Content-Type": "application/json", "X-Frame-UI": UI_KEY }, body: JSON.stringify(body) };
+  const r = await fetch(path, opts);
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(j.error || `HTTP ${r.status}`);
+  return j;
+}
+let toastTimer;
+function toast(msg, bad = false) {
+  const t = $("toast");
+  t.textContent = msg; t.className = "toast" + (bad ? " bad" : ""); t.hidden = false;
+  clearTimeout(toastTimer); toastTimer = setTimeout(() => t.hidden = true, bad ? 8000 : 4500);
+}
+
+// ---- Artwork (only the server's /source-image/ handles are ever used as an image) ----
+const hue = name => [...String(name)].reduce((n, c) => (n * 31 + c.charCodeAt(0)) >>> 0, 7) % 360;
+const initial = name => [...String(name || "?")][0].toUpperCase();
+const valid = u => /^\/source-image\/[\w-]+$/.test(u || "");
+const img = (u, cls = "") => valid(u) ? `<img${cls ? ` class="${cls}"` : ""} src="${esc(u)}" alt="" decoding="async">` : "";
+function art(name, a = {}, extra = "") {
+  const base = `style="--hue:${hue(name)}"`, ini = `<span class="initial" aria-hidden="true">${esc(initial(name))}</span>`;
+  if (valid(a.banner)) return `<span class="art" ${base}>${ini}${img(a.banner)}${extra}</span>`;
+  const shots = (a.screenshots || []).filter(valid).slice(0, 3);
+  if (shots.length) return `<span class="art shots" ${base}>${ini}${shots.map(u => img(u)).join("")}${extra}</span>`;
+  if (valid(a.icon)) return `<span class="art iconart" ${base}>${ini}${img(a.icon, "backdrop")}${img(a.icon, "mark")}${extra}</span>`;
+  return `<span class="art" ${base}>${ini}${extra}</span>`;
+}
+const icon = (name, a = {}) => `<span class="icon" style="--hue:${hue(name)}" aria-hidden="true">${esc(initial(name))}${img(a.icon)}</span>`;
+document.addEventListener("error", e => {
+  const el = e.target;
+  if (!el.matches?.(".art img, .icon img")) return;
+  if (!el.dataset.retried) { el.dataset.retried = "1"; setTimeout(() => { el.src = el.getAttribute("src").split("?")[0] + "?retry=1"; }, 1500); return; }
+  const box = el.closest(".shots, .iconart"); el.remove();
+  if (box && !box.querySelector("img")) box.classList.remove("shots", "iconart");
+}, true);
+const text = s => String(s || "").replace(/<[^>]*>/g, " ").replace(/&nbsp;/g, " ");
+
+// ---- Data ----
+async function loadInstalled() {
+  try {
+    st.installed = new Map((await api("/api/android")).apps.map(a => [a.package, a]));
+    for (const pkg of st.needsData) if (!st.installed.has(pkg)) { st.needsData.delete(pkg); st.jobs.delete("data:" + pkg); }  // removed
+  } catch (e) { toast(`Couldn't list installed apps: ${e.message}`, true); }
+  $("instN").textContent = st.installed.size || "";
+}
+async function search(quiet) {
+  const request = ++st.request;
+  clearTimeout(st.retry);
+  if (st.view === "installed") { st.loading = false; st.page = 0; return render(); }  // a pending search is now stale
+  st.loading = !quiet; if (!quiet) render();
+  const params = new URLSearchParams({ q: st.q, category: st.view, phone: String(st.phone) });
+  try {
+    const result = await api("/api/search?" + params);
+    if (request !== st.request) return;
+    st.apps = result.apps; st.loading = false;
+    const loading = result.sources.filter(s => s.status === "loading").map(s => s.name);
+    $("note").textContent = loading.length ? `Still fetching ${loading.join(" and ")}; more apps will appear.` : "";
+    if (loading.length) st.retry = setTimeout(() => request === st.request && search(true), 6000);
+    if (!quiet) st.page = 0;
+    render();
+  } catch (e) {
+    if (request !== st.request) return;
+    st.loading = false; st.apps = []; render(`Couldn't reach the app shelves: ${e.message}`);
+  }
+}
+const offerKey = app => `${app.offers[0].source}:${app.offers[0].id}`;
+// Always the latest state: an Installed card's own copy goes stale after Stop or Remove.
+function installedOf(app) {
+  const pkg = app.installed?.package || app.package || st.installedFrom.get(offerKey(app));
+  return pkg ? st.installed.get(pkg) : undefined;
+}
+
+// ---- Pages ----
+function list() {
+  if (st.view === "installed") {
+    const q = st.q.toLowerCase();
+    return [...st.installed.values()].filter(m => !q || `${m.label} ${m.package}`.toLowerCase().includes(q))
+      .map(m => ({ installed: m, name: m.label || m.package, package: m.package, summary: m.version ? `v${String(m.version).replace(/^v/i, "")}` : "",
+                   offers: [{ name: m.label, artwork: m.store_art || {}, vr: m.vr && !m.flatscreen }] }));
+  }
+  return st.home ? st.home.rest : st.apps;
+}
+function card(app, i) {
+  const o = app.offers[0], m = installedOf(app), job = st.jobs.get(offerKey(app));
+  const state = m ? `<span class="tag">${m.running ? "Running" : "Installed"}</span>`
+    : job && !job.done ? `<span class="tag">Installing…</span>`
+    : FIT[o.verdict?.tone] ? `<span class="fit ${o.verdict.tone}">${FIT[o.verdict.tone]}</span>` : "";
+  const kind = o.phone_only ? "Phone app" : catLabel(app.category || o.category) || (m ? (o.vr ? "VR app" : "Android app") : "Android app");
+  return `<button class="card" data-i="${i}" aria-label="${esc(app.name)}">${art(app.name, o.artwork, o.vr ? '<span class="vr">VR</span>' : "")}
+    <span class="body"><span class="title">${icon(app.name, o.artwork)}<strong>${esc(app.name)}</strong></span>
+    <span class="sum">${esc(text(app.summary))}</span><span class="foot"><span>${esc(kind)}</span>${state}</span></span></button>`;
+}
+function render(error) {
+  const home = st.view === "" && !st.q;
+  $("title").textContent = st.q ? `Results for “${st.q}”` : st.view === "installed" ? "Installed" : st.view ? catLabel(st.view) : "Home";
+  document.querySelectorAll("[data-view]").forEach(b => b.setAttribute("aria-pressed", String(b.dataset.view === st.view)));
+  const content = $("content");
+  if (st.loading) {
+    content.innerHTML = `<div class="grid">${Array.from({ length: PER_PAGE }, () => '<div class="skeleton"></div>').join("")}</div>`;
+    $("count").textContent = ""; $("page").textContent = ""; $("prev").disabled = $("next").disabled = true; return;
+  }
+  // Home: a featured VR app and four picks, then pages of one app from each category in turn.
+  st.home = null;
+  if (home && st.apps.length) {
+    const ok = st.apps.filter(a => a.offers[0].verdict?.tone !== "blocked");
+    const heroes = ok.filter(a => a.offers[0].vr && valid(a.offers[0].artwork?.banner));
+    const featured = heroes[Math.floor(Date.now() / 864e5) % (heroes.length || 1)] || ok.find(a => valid(a.offers[0].artwork?.banner));
+    const queues = CATS.slice(1).map(([id]) => ok.filter(a => a.category === id && a !== featured));
+    const mixed = [];
+    for (let i = 0; queues.some(q => q[i]); i++) queues.forEach(q => q[i] && mixed.push(q[i]));
+    st.home = { featured, rest: mixed.slice(0, 4 + 5 * PER_PAGE) };  // six pages of picks; the categories have the rest
+  }
+  const items = list();
+  const first = st.home?.featured ? 4 : PER_PAGE;  // the first home page shares its space with the banner
+  const pages = Math.max(1, items.length <= first ? 1 : 1 + Math.ceil((items.length - first) / PER_PAGE));
+  st.page = Math.min(st.page, pages - 1);
+  const start = st.page === 0 ? 0 : first + (st.page - 1) * PER_PAGE;
+  const shown = items.slice(start, start + (st.page === 0 ? first : PER_PAGE));
+  $("count").textContent = home ? "" : `${items.length.toLocaleString()} app${items.length === 1 ? "" : "s"}`;
+  $("page").textContent = `Page ${st.page + 1} of ${pages}`;
+  $("prev").disabled = st.page === 0; $("next").disabled = st.page >= pages - 1;
+  const empty = error ? `<div class="empty"><h2>No connection</h2>${esc(error)}</div>`
+    : st.view === "installed" && !st.q ? `<div class="empty"><h2>Nothing installed yet</h2>Pick an app in the store and press Install.<button class="primary" data-view="">Browse the store</button></div>`
+    : `<div class="empty"><h2>No apps here</h2>Try another category${st.phone ? "" : ", or show phone-only apps"}.</div>`;
+  let html = "";
+  if (st.page === 0 && st.home?.featured) {
+    const f = st.home.featured, o = f.offers[0];
+    html += `<button class="hero" data-feature="1" aria-label="${esc(f.name)}">${art(f.name, o.artwork)}<span class="copy">
+      <span class="eyebrow">${o.vr ? '<span class="vr">VR</span>' : ""}Featured</span><strong>${esc(f.name)}</strong>
+      <span class="blurb">${esc(text(f.summary))}</span><span class="cta">See ${esc(f.name)} ›</span></span></button>`;
+  }
+  html += `<div class="grid${st.page === 0 && st.home?.featured ? " one-row" : ""}">${shown.length ? shown.map((a, i) => card(a, start + i)).join("") : empty}</div>`;
+  content.innerHTML = html;
+}
+function turn(by) {
+  if (by < 0 ? $("prev").disabled : $("next").disabled) return;
+  st.page += by; render();
+}
+
+// ---- Detail sheet ----
+let current = null;  // {app, installed}
+const ver = v => String(v || "").replace(/^v/i, "");
+const size = n => n >= 1e9 ? (n / 1e9).toFixed(1) + " GB" : n >= 1e6 ? Math.round(n / 1e6) + " MB" : Math.max(1, Math.round(n / 1e3)) + " KB";
+function openDetail(app) {
+  current = app; drawDetail(); $("detail").hidden = false;
+  const o = app.offers[0];
+  if (o.source && o.id && !app.detailed) {  // the full entry has all the screenshots
+    api(`/api/sources/details?source=${encodeURIComponent(o.source)}&id=${encodeURIComponent(o.id)}`)
+      .then(full => { if (current === app) { app.offers[0] = { ...o, ...full }; app.detailed = true; drawDetail(); } }).catch(() => {});
+  }
+}
+function drawDetail() {
+  const app = current; if (!app) return;
+  const o = app.offers[0], m = installedOf(app), key = offerKey(app), job = st.jobs.get(key), data = m && st.jobs.get("data:" + m.package);
+  if (app.installed && !m) return closeDetail();  // removed
+  const shots = (o.artwork?.screenshots || []).filter(valid);
+  const top = valid(o.artwork?.banner) ? art(app.name, { banner: o.artwork.banner })
+    : shots.length ? `<div class="gallery">${shots.slice(0, 3).map(u => img(u)).join("")}</div>` : art(app.name, o.artwork || {});
+  const meta = [o.developer, o.source_name, o.version ? `v${ver(o.version)}` : m?.version ? `v${ver(m.version)}` : "", o.size ? size(o.size) : ""].filter(Boolean).join(" · ");
+  const reasons = (o.fit?.reasons || []).filter(Boolean);
+  let acts;
+  const progress = j => {
+    const pct = typeof j.percent === "number" ? Math.max(3, Math.min(100, j.percent)) : null;
+    return `<div class="progress${pct === null ? " busy" : ""}"><span>${esc(j.stage || "Downloading")}${pct === null ? "…" : ` ${Math.round(pct)}%`}</span><div class="track"><div class="fill" style="${pct === null ? "" : `width:${pct}%`}"></div></div></div>`;
+  };
+  const gameData = !(m && st.needsData.has(m.package)) ? "" : data && !data.done ? progress(data)
+    : `<button class="primary" data-act="game-data">Add game data</button><span class="meta">Open it once on the Frame first.</span>`;
+  if (job && !job.done) {
+    acts = progress(job);
+  } else if (m) {
+    acts = gameData + (m.running ? `<button data-act="stop">■ Stop</button>` : `<button class="play" data-act="launch">▶ Open</button>`)
+      + `<button class="danger" data-act="remove">Remove</button>`;
+  } else if (!o.source) {
+    acts = "";
+  } else if (o.downloadable === false) {
+    acts = `<button disabled>Get it from the developer's page</button>`;
+  } else if (o.verdict?.tone === "blocked") {
+    acts = `<button disabled>Won't run on the Frame</button>`;
+  } else {
+    acts = `<button class="primary" data-act="install">Install</button>`;
+  }
+  const blurb = o.description || o.summary || (app.installed ? "" : app.summary);  // an Installed card's summary is its version, already in meta
+  const failed = data?.error || job?.error;
+  const note = failed ? `<div class="meta" style="color:var(--bad)">${esc(failed)}</div>` : "";
+  $("sheet").innerHTML = `${top}<div class="inner">
+    <div class="top">${icon(app.name, o.artwork)}<div><h2>${esc(app.name)}</h2><div class="meta">${esc(meta)}</div></div>
+      ${o.vr ? '<span class="vr" style="margin-left:auto">VR</span>' : ""}</div>
+    ${blurb ? `<div class="text">${esc(text(blurb))}</div>` : ""}
+    ${o.verdict ? `<div class="why"><b>${esc(o.verdict.label)}</b>${reasons.length ? `<ul>${reasons.slice(0, 3).map(r => `<li>${esc(r)}</li>`).join("")}</ul>` : ""}</div>` : ""}
+    ${note}<div class="acts">${acts}<button class="close" data-act="close">Close</button></div></div>`;
+}
+function closeDetail() { current = null; $("detail").hidden = true; }
+
+async function runJob(key, start) {
+  const job = { stage: "Downloading", percent: null, done: false };
+  st.jobs.set(key, job); drawDetail(); render();
+  try {
+    const { job: id } = await start();
+    for (let misses = 0; ;) {
+      await new Promise(ok => setTimeout(ok, 1500));
+      let j;
+      try { j = await api(`/api/job?id=${encodeURIComponent(id)}`); misses = 0; }
+      catch (e) { if (++misses >= 20 || /no such job/.test(e.message)) throw e; continue; }
+      Object.assign(job, { stage: j.stage || job.stage, percent: j.percent ?? null });
+      if (!j.done) { drawDetail(); continue; }
+      if (j.error) throw new Error(j.error);
+      toast(j.message); job.result = j.result || {};
+      break;
+    }
+  } catch (e) { job.error = e.message; toast(e.message, true); }
+  finally {
+    job.done = true;
+    if (!job.error) st.jobs.delete(key);  // a failure stays, so the sheet can say why
+    await loadInstalled(); render(); drawDetail();
+  }
+  return job;
+}
+$("sheet").onclick = async e => {
+  const b = e.target.closest("[data-act]"); if (!b || !current) return;
+  const app = current, o = app.offers[0], m = installedOf(app), act = b.dataset.act, key = offerKey(app);
+  if (act === "close") return closeDetail();
+  if (act === "install") {
+    toast(`Installing ${app.name}. The first time takes a minute…`);
+    const job = await runJob(key, () => api("/api/sources/install", { source: o.source, id: o.id, version_code: o.version_code ?? null }));
+    if (job.result?.package) {
+      st.installedFrom.set(key, job.result.package);
+      if (job.result.game_data) st.needsData.add(job.result.package);
+    }
+    return render(), drawDetail();
+  }
+  if (act === "game-data" && m) {  // its own job, by package: a failed copy keeps the pending data, so it can be tried again
+    const job = await runJob("data:" + m.package, () => api("/api/sources", { action: "game-data", package: m.package }));
+    if (!job.error) st.needsData.delete(m.package);
+    return render(), drawDetail();
+  }
+  const pkg = m?.package; if (!pkg) return;
+  if (act === "remove" && b.dataset.sure !== "1") {
+    b.dataset.sure = "1"; b.textContent = "Remove it and its data?"; return;  // no confirm(): a separate window the laser has to find
+  }
+  b.disabled = true;
+  try {
+    const r = await api("/api/android", { action: act, package: pkg });
+    toast(r.message);
+    if (act === "remove") { st.needsData.delete(pkg); st.jobs.delete("data:" + pkg); }
+    if (act === "launch") closeDetail();
+  } catch (err) { toast(err.message, true); }
+  await loadInstalled(); render();
+  if (current === app) drawDetail();
+};
+$("detail").onclick = e => { if (e.target === $("detail")) closeDetail(); };
+
+// ---- Navigation ----
+$("cats").innerHTML = CATS.map(([id, label, path]) => `<button data-view="${id}" aria-pressed="false"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linejoin="round" stroke-linecap="round" aria-hidden="true">${path}</svg>${esc(label)}</button>`).join("");
+document.addEventListener("click", e => {
+  const v = e.target.closest("[data-view]");
+  if (v && !e.target.closest("#sheet")) {
+    st.view = v.dataset.view; st.q = ""; $("q").value = "";
+    if (st.view === "installed") loadInstalled().then(() => search()); else search();
+    return;
+  }
+  if (e.target.closest("[data-feature]")) return openDetail(st.home.featured);
+  const c = e.target.closest(".card[data-i]");
+  if (c) openDetail(list()[+c.dataset.i]);
+});
+$("phone").onchange = e => { st.phone = e.target.checked; search(); };
+$("prev").onclick = () => turn(-1);
+$("next").onclick = () => turn(1);
+// The thumbstick arrives as a mouse wheel: one notch, one page.
+let wheelAt = 0;
+document.querySelector("main").addEventListener("wheel", e => {
+  e.preventDefault();
+  if (!$("detail").hidden || Date.now() - wheelAt < 350 || Math.abs(e.deltaY) < 4) return;
+  wheelAt = Date.now(); turn(e.deltaY > 0 ? 1 : -1);
+}, { passive: false });
+let qTimer;
+$("q").oninput = e => { clearTimeout(qTimer); qTimer = setTimeout(() => { st.q = e.target.value.trim(); search(); }, 250); };
+document.addEventListener("keydown", e => { if (e.key === "Escape") { closeDetail(); $("kbd").hidden = true; } });
+
+// ---- On-screen keyboard (a text field on a panel may not bring up Steam's) ----
+const ROWS = ["1234567890", "qwertyuiop", "asdfghjkl", "zxcvbnm"];
+$("kbd").innerHTML = ROWS.map(r => `<div class="row">${[...r].map(k => `<button data-k="${k}">${k}</button>`).join("")}</div>`).join("")
+  + `<div class="row"><button data-k="clear">Clear</button><button class="wide" data-k=" ">space</button><button data-k="back">⌫</button><button data-k="done" class="primary">Done</button></div>`;
+$("kbd").onclick = e => {
+  const b = e.target.closest("[data-k]"); if (!b) return;
+  const k = b.dataset.k, q = $("q");
+  if (k === "done") { $("kbd").hidden = true; return; }
+  q.value = k === "clear" ? "" : k === "back" ? q.value.slice(0, -1) : q.value + k;
+  q.dispatchEvent(new Event("input"));
+};
+$("kbdBtn").onclick = () => $("kbd").hidden = !$("kbd").hidden;
+
+loadInstalled().then(() => search());
+</script>
+</body>
+</html>