[ymote]

Add three ordinary App Hub samples using shared host services and app-bound provider authorization:

• GitHub Notes: Rinx article writer layout with icon controls, desktop split preview and phone formatting bar; repository/file/branch selection, retained drafts and reviewed GitHub saves with conflicts. Rejected draft loads remain protected until an explicit valid replacement.
• Inbox Assistant: durable important-mail decisions, interactive Glance, one shared Reply/Chat draft and native send review. The list now refreshes local monitoring status every three seconds with in-flight/account guards, without fetching mail or triggering models.
• Google Calendar: calendar selection, synchronized event viewing/editing, app-agent tools and Glance reopening the originating event.

Each includes its manifest, tools, fictional data, native validation and bilingual documentation. Provider tokens, personal mail/calendar data, model profiles and signing keys are excluded.

Dependencies

Requires OctoSense #347 and App Hub #119, pinned at 5c7a13f92fa25d36ba1fe7fb99dc9fb1b235f8d3. Standalone card-host admission does not supply provider services, Rinx or an agent. The companion runtime fixes first-review editor overlap and Android Enter composition loss.

Acceptance

All three current bundles pass admission, signed private-catalog install/reopen and tamper refusal. Native Makepad instrument drives real installed widgets and production host paths; provider transport/vault are synthetic.

• Notes: all 10 installed provider cases pass on the final source. Original Rinx writer captures and wide/narrow native interaction checks validate the layout. A 36-cycle/601.819s run precedes the rejected-load guard; a final 12-cycle/10.272s regression and oversized-draft recovery test follow it. Both soaks preserve exact drafts and make zero provider writes. The separate OnePlus 6 test app verifies the new icon UI, real keyboard input, unobstructed toolbar, floating navigation hiding/restoration and cold recovery; no live GitHub connection is configured.
• Calendar: 8 installed cases plus 36 soak cycles/620 seconds: 36 review cancellations, three synthetic saves/readbacks, three conflict refusals and four cold restarts. Separate full-shell and actual DeepSeek receipts verify Glance routing and admitted event tools.
• Inbox: real DeepSeek v4 Flash publishes the clinic card, keeps the newsletter quiet and changes the persisted reply to 10:30 Pacific with read-back. The repaired source completes 33 functional cycles/610 seconds plus exact cold recovery, with zero sends. Two frame-submission acknowledgement errors remain; input was not replayed and recovery/state assertions passed. The original overlapping review and earlier failures remain in evidence.

Each soak has a reusable driver, original PNGs, source/binary hashes and detailed timing/memory records. Functional completion is separated from visual inspection and rendering errors. Memory grew during these finite tests; leak-free operation is not established. Instrument timing is not FPS or display latency.

Companion validation passed 956 shell tests and desktop/Home checks and graphs for the final editor/IME changes; the earlier Enter repair passed 96 ROM tests and setup/patch validation. Admission, links (0 broken/0 pending), Python syntax, diff and privacy checks pass. No private profiles, credentials or raw logs were committed.

Remaining acceptance — keep draft

Live OAuth, real provider effects/delivery, physical Gmail approval, MiniMax and Android background operation are not verified. Shared Google authorization on Android needs a native adapter. Linux vault/GUI and native Windows acceptance remain open. The Inbox Makepad frame-submission errors and longer memory profiling remain unresolved; no numeric UX score is claimed.

The bundles remain unsigned and unpublished with explicit publisher placeholders. Ephemeral test signing does not publish them. Public release still requires actual publisher/privacy/platform review.