Check shipped libraries against the Frame; keep OpenSSL out of the bundle (iteration 2, step 7)

package-release.sh refuses a package whose ELF files need newer glibc or
OpenSSL symbol versions than the Frame has (D35); only the version needs
section counts. The Qt bundler resolved libmosquitto's dependencies and
shipped Debian's OpenSSL 3.5; libssl/libcrypto are now excluded, since
SteamOS provides OpenSSL 3. Phase 3 of iteration 2 is done; PROGRESS.md
has the manual checklist for phase 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DESIGN.md

@@ -514,6 +514,12 @@ excluded from the Qt bundler, licence in `share/doc/frameassistant/`).
    of MQTT (D17).
 6. Guard: `package-release.sh` checks with `readelf -V` that shipped libraries need no newer
    symbol versions than the Frame has (today at most `OPENSSL_3.2`, `GLIBC_2.39`).
+   Implemented for every ELF file in the package, reading only the version *needs* section
+   (a library's own definitions, e.g. libssl's `OPENSSL_3.5.0`, gave false positives).
+7. Found when building the bundled package: the bundler resolves dependencies recursively,
+   also through excluded libraries, and shipped Debian's `libssl`/`libcrypto` (OpenSSL 3.5)
+   for libmosquitto. `cmake/Mosquitto.cmake` now excludes them too: OpenSSL comes from
+   SteamOS (3.2.1; libmosquitto needs `OPENSSL_3.0.0`).
 
 ## Test strategy
 

docs/PROGRESS.md

@@ -22,11 +22,26 @@ CLAUDE.md ("Working rules").
 
   The error itself is covered off the device by `tst_config`. Checks 3 and 4 run in the next
   session on the Frame (iteration 2 testing needs it too).
-- **Implementation** follows the order in DESIGN.md (steps 1–7). Steps 1 (libmosquitto in
-  CMake and the containers), 2 (`MqttClient`, `MosquittoClient`, `tst_mqtt`) 3
-  (`HaEntity`, `HaSensor`, `HaDevice`, unit tests) and 4 (app wiring, `--desktop-novr`,
-  UI-1) 5 (TLS) and 6 (app commands, `--ha-remove`, `uninstall.sh`) done; next: step 7
-  (packaging check, docs).
+- **Implementation (phase 3) done:** steps 1–7 of DESIGN.md. **Next: phase 4 (testing)**
+  with the manual checklist below, from the PC against the user's HA and broker; then on the
+  Frame.
+- **Manual checklist for iteration 2 (phase 4):**
+
+  | # | Check | Where | Result |
+  |---|---|---|---|
+  | 1 | Settings file for the PC (own device name, the user's broker), `--desktop-novr --config …`: tab shows "Connected" | PC | open |
+  | 2 | HA: device appears with the "Uptime" sensor (diagnostic), value rises every 10 s; HA log has no MQTT discovery warnings (NFR-7); `~` base topic accepted | PC + HA | open |
+  | 3 | Close the window → HA shows the entities unavailable at once (graceful exit) | PC + HA | open |
+  | 4 | `kill -9` → unavailable (last will) | PC + HA | open |
+  | 5 | Broker restart → tab "Not connected" + error, then "Connected"; HA values current again | PC + HA | open |
+  | 6 | HA restart → device republished after the birth message | PC + HA | open |
+  | 7 | Two settings files with different device names → two HA devices | PC + HA | open |
+  | 8 | Login and, if the broker offers it, TLS against the user's broker | PC + HA | open |
+  | 9 | `--ha-remove --config …` → device gone from HA | PC + HA | open |
+  | 10 | Package on the Frame: starts with SteamVR, connects, tab shows the status; "Quit app" → unavailable | Frame | open |
+  | 11 | `uninstall.sh` on the Frame removes the device from HA; `install.sh` brings it back | Frame | open |
+  | 12 | Iteration 1 checks 3 and 4 (settings errors when started by SteamVR) | Frame | open |
+
 
 ## Next steps
 
@@ -185,6 +200,18 @@ Known limitation: the bundled-Qt package does not support WebEngine in this iter
   unregisters. Checked end to end against a local mosquitto, without a display: retained
   discovery, availability, state and entity availability before, none after (exit 0);
   broker down → exit 1 after 10 s; missing settings → exit 1.
+- Step 7: `package-release.sh` checks the symbol versions of every shipped ELF file against
+  the Frame (glibc 2.39, OpenSSL 3.2.1; D35); a test with a too low limit names the files
+  and refuses the package. Building the bundled package showed two problems, both fixed:
+  the check read version *definitions* too (false positives from libssl), and the bundler
+  shipped Debian's OpenSSL 3.5 for libmosquitto (now excluded; SteamOS provides OpenSSL).
+  Checked:
+  - system-Qt package 5.0 MB (`lib/libmosquitto.so.1`, its copyright file; the binary is
+    12 MB, 11 MB of it debug info); bundled package 45 MB, no OpenSSL, libmosquitto once;
+    both need at most `GLIBC_2.38`, `OPENSSL_3.0.0`.
+  - generated `uninstall.sh` with a stub binary and a stub `pkill`: stop, `--ha-remove`,
+    unregister; a failing `--ha-remove` prints the warning and still unregisters.
+  - `container-test.sh` 13/13, no Vulkan validation messages.
 
 ### 2026-10-05: requirements approved