dafka007 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 All notable changes to FramePier are documented here. Versions follow Semantic Versioning.
 
-## [Unreleased]
+## [0.2.3] - 2026-10-12
 
 ### Added
 
@@ -26,14 +26,6 @@ All notable changes to FramePier are documented here. Versions follow Semantic V
 - Replaced the FFmpeg LGPL-3.0 license text with LGPL-2.1, added LAME and winpthreads license texts, the MinGW-w64 runtime text, the FFmpeg build provenance and a source-availability index to `licenses/`.
 - Every yt-dlp process is now created by one helper that always passes `--ignore-config`, `--no-plugin-dirs`, `--no-remote-components` and `--no-js-runtimes`, then enables only the bundled Deno by absolute path for YouTube. User-level yt-dlp configuration, plugins, remotely fetched components and runtimes found on PATH are no longer used.
 
-## [0.2.3] - 2026-09-20
-
-### Changed
-
-- Upgraded FFmpeg from Gyan 8.1.1 (GPL) to BtbN 8.1.2 LGPL-3.0 build (`autobuild-2026-08-31-13-27`), fixing CVE-2026-8461 (CVSS 8.8) and CVE-2026-30999.
-- Updated build script to pin the immutable BtbN release-tag URL with SHA-256 verification on both the archive and extracted binaries.
-- Updated `THIRD_PARTY_NOTICES.md` to document the BtbN provider, build-repo commit, FFmpeg source commit, and LGPL-3.0 licensing.
-
 ## [0.2.2] - 2026-09-05
 
 ### Fixed

diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@ FramePier is an open-source Windows video downloader that works through a browse
 
 Use FramePier only for media you own, have permission to download, or are otherwise legally allowed to save.
 
-Version: **0.2.3**
+Version: **0.2.3** — [latest Windows installer and corresponding source archives](https://github.com/dafka007/FramePier/releases/tag/v0.2.3)
 
 ## Support
 
@@ -15,7 +15,7 @@ Version: **0.2.3**
 
 ## Requirements
 
-The Windows installer includes the FramePier helper, a checksum-verified official `yt-dlp` Windows release, and a shared FFmpeg build (see below). It also includes a pinned, checksum-verified Deno JavaScript runtime, which yt-dlp needs to extract YouTube videos. No Python or other runtime is required after installation.
+The Windows installer includes the FramePier helper, a SHA-256-verified FramePier-built `yt-dlp.exe` from the upstream 2026.08.19 source tag, and a shared FFmpeg build (see below). It also includes a pinned, checksum-verified Deno JavaScript runtime, which yt-dlp needs to extract YouTube videos. No Python or other runtime is required after installation.
 
 ## Install the helper
 
@@ -146,14 +146,21 @@ Use **Installed apps → FramePier → Uninstall** or the FramePier Start Menu s
 
 ## Build from source
 
-From PowerShell on Windows:
+For the v0.2.3 build, first provide the exact verified Windows dependencies in the following local locations:
+
+- `.tools\ytdlp-openssl3\yt-dlp.exe` — FramePier's own build of yt-dlp 2026.08.19 with Python 3.13.16 and OpenSSL 3.5.9. The build checks its pinned SHA-256. See `third-party/ytdlp-openssl3/` and the corresponding-source archive on the v0.2.3 release.
+- `.tools\ffmpeg-shared\` — verified `ffmpeg.exe`, `ffprobe.exe`, and nine DLLs from the shared LGPL FFmpeg/LAME build. The build checks each file's pinned SHA-256. See `third-party/ffmpeg-shared/` and the FFmpeg/LAME corresponding-source archive on the v0.2.3 release.
+
+**The build script does not download these two custom binary builds.** Obtain or rebuild them from the documented source/build materials and verify the expected hashes before running it. A byte-for-byte reproducible toolchain has not been independently established. You may alternatively supply them through `-YtDlpPath` and `-FFmpegSharedDir`.
+
+From PowerShell on Windows, with Inno Setup 6 installed:
 
 ```powershell
 .\scripts\build-icons.ps1 -Source .\assets\framepier-mark.png
 .\scripts\build.ps1
 ```
 
-The build script obtains the current stable Go Windows archive from `go.dev`, validates its official checksum, runs Go tests, builds a static helper, downloads and verifies the two media tools, packages the extension, and compiles the Inno Setup installer. Inno Setup 6 must be installed (`winget install --id JRSoftware.InnoSetup -e`). Build downloads and artifacts live under ignored `.tools` and `dist` directories.
+The build script uses an installed Go SDK or obtains and checksum-verifies the official stable Windows SDK from `go.dev`, runs Go tests, builds the Windows helper, copies and checksum-verifies the supplied yt-dlp and shared FFmpeg binaries, downloads and checksum-verifies bundled Deno 2.9.7, packages the extension, and compiles the Inno Setup installer. Inno Setup 6 must be installed (`winget install --id JRSoftware.InnoSetup -e`). Build downloads and artifacts live under ignored `.tools` and `dist` directories.
 
 Run all local checks with:
 

diff --git a/docs/redistribution-gate.md b/docs/redistribution-gate.md
@@ -1,13 +1,13 @@
 # FramePier 0.2.3 redistribution gate
 
-**Status: documentation complete; owner sign-off pending (see Owner decisions).** This file is a repository document; it is not installed. A working build or a source archive is not a compliance finding.
+**Status: FramePier v0.2.3 publicly released on 2026-10-12.** The installer, extension and both corresponding-source archives were confirmed on [the GitHub v0.2.3 release](https://github.com/dafka007/FramePier/releases/tag/v0.2.3) with the previously recorded SHA-256 hashes. The download directions are in its release description. This file is not installed. **Publication does not establish complete legal compliance or independent legal sign-off.** See remaining decisions below.
 
 ## Component status
 
 | Component | Status | Evidence / remaining |
 |---|---|---|
-| FFmpeg + LAME + 9 DLLs | Material ready; publication and owner review pending | `FramePier-0.2.3-FFmpeg-LAME-Source.zip` (SHA-256 `61b8539d5866b899ca173a7edb71502ff78d0b090500990f7442f36b54b1327a`, reproduced byte-identically by `third-party/build-source-bundles.py`) holds the FFmpeg commit, the LAME 3.100 tarball (hash and `COPYING` checked), `BUILD-INSTRUCTIONS.txt`, configuration, package versions, workflow and licenses. Must be attached to the same release as the installer. One build run; not shown to be byte-reproducible. |
-| yt-dlp 2026.08.19 (FramePier build, Python 3.13.16 / OpenSSL 3.5.9) | Source and notices complete; OpenSSL 1.1.1t issue removed | See below. |
+| FFmpeg + LAME + 9 DLLs | Corresponding-source archive published with the v0.2.3 installer; independent legal review not recorded | `FramePier-0.2.3-FFmpeg-LAME-Source.zip` (SHA-256 `61b8539d5866b899ca173a7edb71502ff78d0b090500990f7442f36b54b1327a`, reproduced byte-identically by `third-party/build-source-bundles.py`) holds the FFmpeg commit, the LAME 3.100 tarball (hash and `COPYING` checked), `BUILD-INSTRUCTIONS.txt`, configuration, package versions, workflow and licenses. Verified attached to the same public release as the installer. Both must remain available together. One build run; not shown to be byte-reproducible. |
+| yt-dlp 2026.08.19 (FramePier build, Python 3.13.16 / OpenSSL 3.5.9) | Source archive published with installer; OpenSSL 1.1.1t issue removed | See below. |
 | Deno 2.9.7 | Notices compiled; two input steps recorded below | See below. |
 | winpthreads / MinGW-w64 runtime | Done | License texts match mingw-w64 revision `4564ee4b5063097bf747af3a3f8270a28adff820` byte for byte. |
 | Inno Setup | Closed | `jrsoftware/issrc` `license.txt` permits any purpose "including commercial applications"; the copyright notices in the setup program must stay. The FAQ position was supplied by the owner; the installed version's `license.txt` was not read. |
@@ -32,7 +32,8 @@ Evidence (VERIFIED): the release archive contains only `deno.exe`; the repositor
 
 Notices compiled: `licenses/DENO-2.9.7-CRATE-LICENSES.txt` (all license/notice files of 930 crates that ship them, 574 distinct texts, each listed with the crates it covers; all 1,046 crates accounted for), `licenses/DENO-V8-LICENSES.txt` (V8, rusty_v8 and the build libraries FP16, Highway, fast_float, dragonbox, simdutf, abseil-cpp, ICU, LLVM libc++/libc++abi/libunwind/llvm-libc, Chromium, Rust std; taken from the projects' GitHub repositories, dragonbox at the pinned commit, the others at the default branch because Chromium's git host was not reachable), and `licenses/DENO-2.9.7-CRATE-AUTHORS.txt` (generated by `third-party/deno/collect-missing-crate-authors.ps1` for the 116 crates that ship no license file). Limit: the V8 library texts are not the exact pinned commits except dragonbox; terms are unchanged between them, copyright years may differ.
 
-## Owner decisions
+## Post-publication verification and unresolved decisions
 
-- Review the published release page text (both source zips and directions next to the installer).
-- v0.2.2 remains public with a GPL FFmpeg and no source bundle: leave, replace or withdraw.
+- **Verified:** The v0.2.3 public release has the installer, browser extension, FFmpeg/LAME source ZIP and yt-dlp source ZIP with matching recorded SHA-256 values; the source-download directions are next to the installer. Keep both source archives available without charge for as long as the installer is distributed.
+- **Not independently certified:** The documented Deno/V8 provenance limits above and overall license obligations still warrant owner or qualified legal review; do not treat an uploaded archive or successful automated test as a legal clearance.
+- **v0.2.2 still needs remediation:** Its public installer bundles GPL FFmpeg 8.1.1, but its release lists no exact corresponding-source bundle. Either provide/verify the complete corresponding source and build materials for the exact v0.2.2 distribution, or withdraw the v0.2.2 installer from distribution. The v0.2.3 source archives **do not** cover v0.2.2. This is unresolved until the v0.2.2 release assets are corrected or removed.