Record final 10.26.6 release validation

docs/10.26.6-RELEASE-REVIEW.md

@@ -1,10 +1,10 @@
 # Spaced Linux 10.26.6 release review
 
-Reviewed on 23 October 2026, starting from commit `929e8a9`, with the final
-code fixes in `1be10a3`. This is a
-pre-publication review, not a claim that every hardware configuration or
-open issue is resolved. The release, APT repository and website have not
-been published by this review.
+Reviewed on 23 October 2026, starting from commit `929e8a9`, with release
+fixes in `1be10a3` and the wallpaper package revision in `255c6c2`, merged
+through `f54cfe3`. Matching APT packages and the website are published;
+ISO publication is tracked in [#364](https://github.com/crhy/spaced/issues/364).
+This review records the tested configurations and remaining validation limits.
 
 ## Changes made during this review
 
@@ -31,6 +31,8 @@ been published by this review.
   GTK, Caja and terminal screenshots. It refuses installed systems.
 - Aligned website theme names with the chooser: Windows 7 Light and
   Windows 7 Dark.
+- Published the renamed wallpaper catalog as `2026.10-2`, preserving the
+  already published `2026.10-1` package bytes. The artwork is unchanged.
 - Prepared `docs/10.26.6-DISTROWATCH-EMAIL.md`, including the distinction
   between DistroWatch's last identifiable announcement and the latest
   version listing reported by the project's release tracker.
@@ -40,21 +42,23 @@ been published by this review.
 Final rebuilt image: `build/iso/spaced-linux-10.26.6-amd64.iso`.
 
 SHA-256:
-`ce4064c9e76db39884f9bfd159e05ea22024283dc7820d15b88c04845f7130b2`
+`bed3263b2d61f85e292eb86f34bb14969618215b77d667be60139e7436154617`
 
-The image contains Linux `7.2.12+deb14-amd64`, `spaced-meta 10.26.6-1`
-and the Caja and Compiz fixes above. Local logs, JSON reports and screenshots are under
-`build/review-10.26.6/` (ignored build output). Keep these with the release
-artifacts if durable evidence is needed.
+The image contains Linux `7.2.12+deb14-amd64`, `spaced-meta 10.26.6-1`,
+`spaced-wallpapers 2026.10-2`, and the Caja and Compiz fixes above. Local logs, JSON reports and screenshots are under
+`build/review-10.26.6/` (ignored build output). They are packaged as
+`spaced-linux-10.26.6-validation.tar.gz` for the release, with checksums in
+`SHA256SUMS`. Every final runtime report identifies the same ISO checksum,
+expected package versions and a clean package audit.
 
 | Check | Result and scope |
 | --- | --- |
 | Repository checks | `make check` passed: 244 Python unit tests, configuration, script and packaging checks. |
 | GTK runtime tests | Two additional GTK tests passed under Xvfb. |
-| Signed APT repository | Local build and payload checks passed; valid metadata accepted and wrong key/tampered metadata or payload rejected. Not published. |
-| Final ISO, KVM BIOS and UEFI | Live desktop passed in 36 and 49 seconds respectively; all 13 presets passed in each mode. Runtime reports confirm the final release identity and Compiz package. |
+| Signed APT repository | Published as `crhy/spaced-apt` commit `2409587`. Public metadata verified with the pinned signing key; all 15 new package downloads matched the signed index. Local trust tests rejected wrong keys and tampered metadata/payloads. Staged ISO packages match APT bytes. |
+| Final ISO, KVM BIOS and UEFI | Live desktop passed in 42 and 50 seconds respectively; all 13 presets passed in each mode. Runtime reports confirm the final release identity and Compiz package. |
 | Final ISO, VirtualBox BIOS | Default VBoxVGA graphics: desktop passed in 35 seconds and visible installer in another 5 seconds; all 13 presets passed. |
-| Final ISO, VirtualBox UEFI | Default VBoxVGA graphics: desktop passed in 40 seconds and visible installer in another 5 seconds; all 13 presets passed, including the previously failing Windows 7 transition. |
+| Final ISO, VirtualBox UEFI | Default VBoxVGA graphics: desktop passed in 30 seconds and visible installer in another 5 seconds; all 13 presets passed, including the previously failing Windows 7 transition. |
 | KVM BIOS, Caja candidate before restart fix | Live desktop passed in 75 seconds; all 13 presets passed. |
 | KVM UEFI, pre-Compiz-fix image | Live desktop passed in 96 seconds; all 13 presets passed. |
 | KVM full installation, Caja candidate | Calamares completed onto a blank 20 GiB virtual disk; installed account is UID/GID 1000, live user removed, package audit clean, Samba/WSD/Avahi boot links present, home traversal mode 0711. |
@@ -124,15 +128,14 @@ The final image passed all four firmware/hypervisor combinations and all
 52 preset checks. Source CI and the website preview build passed. Publication
 status and links are tracked in [#364](https://github.com/crhy/spaced/issues/364).
 
-- Merge the reviewed changes before closing any fixed issue. Separate Welcome
-  and Bazaar changes require their own repositories and releases.
-- Publish matching packages with `make apt-repo-publish` to `crhy/spaced-apt`
-  together with the release. A GitHub tag without APT packages causes update
-  loops. Never replace already published bytes under the same package version.
+- Release fixes merged through [#365](https://github.com/crhy/spaced/pull/365)
+  and [#366](https://github.com/crhy/spaced/pull/366). Separate Welcome and
+  Bazaar repositories were unchanged.
+- Matching packages published with `make apt-repo-publish`, and public
+  signatures and package checksums verified before tagging the OS release.
 - Publish the tested ISO and its checksum, then verify the public download.
-- Deploy the website and verify both bare and `www` domains. Before this
-  release both domains advertised 10.26.5; the local site says
-  10.26.6 and has 13 themes. The website edits alone do not deploy the site.
+- Both `spacedlinux.com` and `www.spacedlinux.com` now advertise 10.26.6
+  and link to its release and ISO download.
 - Confirm the current DistroWatch listing directly before sending the draft:
   direct retrieval was blocked, so the announcement baseline uses indexed
   evidence and the version-listing baseline is explicitly project-reported.