docs(release): record the 1.17.0 execution and publish

docs/archive/NEXT_UPDATE_EXECUTION-1.17.md

@@ -1,8 +1,8 @@
 # OpenBox 1.17.0 — execution record
 
-Status: implementation and CI complete on branch `release/1.17.0`; release not tagged.
+Status: released as `v1.17.0` on 2026-10-18. PR #57 merged; tag pushed from `66fb68d`.
 
-This is the execution record for the approved 1.17.0 plan. It records what was verified, on which platform, and what remains before `v1.17.0` can be published.
+This is the execution record for the approved 1.17.0 plan. It records what was verified, on which platform, and how the release was cut.
 
 ## Shipped
 
@@ -25,16 +25,16 @@ This is the execution record for the approved 1.17.0 plan. It records what was v
 | GitHub CI, draft PR #57 | All checks green, including `windows-latest` (188/188 test files), Linux gates, UI smoke, perf, Flatpak validate, CodeQL |
 | Contract ratchets | 316 routes, 111 settings, 42 definitions, 42 frontend modules, 97 reliability rows |
 | Version sync / i18n | Pass; 100% key coverage in five locales |
+| Release workflow | [v1.17.0](https://github.com/vindeckyy/OpenBoxGL/releases/tag/v1.17.0) published with 20 assets: both AppImages, Windows zip, native host, Flatpak, SBOMs, installers, and signatures |
+| Release smoke | [Run 39161082614](https://github.com/vindeckyy/OpenBoxGL/actions/runs/39161082614): Linux x86_64, Linux aarch64, and Windows all passed; desktop screenshots inspected |
+| Signed definition pack | `community-defs.tar.gz` verified against `community-defs.tar.gz.sig` with `openbox-release.pub` |
 
 Wine ran 177/188 test files. The 11 failures are Wine environment gaps, not new-code failures: Unix symlinks are invisible to Windows `is_symlink()`, `git`/PowerShell executables are absent, the Linux `native_host` fixture is absent, and Wine cannot exercise the Windows updater test. The real Windows CI job passed all 188 files.
 
 The UI smoke's 20k-game search bound was raised from 20 ms to 50 ms after a shared CI runner measured 21.3 ms (local: 5.1 ms). The bound still catches an algorithmic regression.
 
-## Remaining before the tag
+## Release record
 
-1. On a real Windows desktop, import one installed game from each of GOG Galaxy, the EA app, and Ubisoft Connect, launch it, and re-import to confirm no duplicate. Rows 87-92 in `docs/reliability.md` are the manual procedure. This is the only check that can verify the real registry layouts and the `origin2://`/`uplay://` handlers.
-2. Tag `v1.17.0` after the manual check; build and verify the AppImages, Windows zip, Flatpak bundle, SBOM, and signatures.
-3. Run the release-smoke workflow with `tag: v1.17.0` and inspect both Linux screenshots and the Windows desktop screenshot.
-4. Verify the signed `community-defs.tar.gz`, `.sig`, and `index.json` from the tag run.
-
-Until step 1 is done, the release notes' statement that each launcher launches is a fixture-tested claim, not a real-install observation. The known-limits section says so.
+- `release/1.17.0` merged to `master` as PR #57 (`79ce8a3`); tag `v1.17.0` points at `66fb68d`.
+- The owner authorized the tag and publish without the real-launcher desktop pass. The importer is verified by fixtures, the real `windows-latest` suite, and real-`winreg` end-to-end tests; rows 87-92 in `docs/reliability.md` remain the manual follow-up for a desktop with the three launchers installed.
+- One release-workflow bug was fixed during the cut: `ldd --version | head -1` tripped SIGPIPE under `pipefail`; it now uses `sed -n '1p'`.