[ymote]

Two defects in how the standalone mobile shell hosts the in-process AppCard module, verified on the OnePlus (bf0a4730).

A — the hosted AppCard painted over the whole window

Root cause. The phone desk records every client into a WindowFrame — a pass of its own — and presents the texture in the client's slot under the shell overlays (src/desk/phone.rs record_capture / present_capture, then draw_overlay). A hosted module draws into that pass like a process's frames land in it, except for everything it draws through begin_overlay_*: the AppCard kit's glass surfaces (kit_shared.rs draws a glass role in an overlay list, GlassLayer, GaussRoundedView), its sheets, popups. WindowFrame::begin (src/dock_warp.rs) never scoped the overlay, so DrawList2d::begin_overlay_inner stored those lists in cx.overlay_id — the WM window's Root overlay — painted last of all, unclipped, over the shade's sheet (controls-now2.png: only the strip above the app rect showed), over the keyboard and the home page after a home swipe, and kept on screen while the tile was no longer being drawn (state-now.png: AppCard's sheet over Home). Remote clients never hit this: their frames are pixels.

Fix (OctoSense only). WindowFrame now owns an Overlay and brackets every recording with the fork's Overlay::begin_nested_for_pass / end_nested (added to the fork for exactly this case, unused until now). Everything the app draws as an overlay composites into the capture, after the frame's body, and the enclosing frame's overlay state comes back untouched. The module is therefore drawn in the client's slot — the app viewport, a split pane, a Recents card, a home tile capture — under island, groups, keyboard and shade, and not at all on Home/Recents/Drawer except as its capture. This is the desktop's rounded window surface and the dock warp too.

Touches. MpModuleView::handle_event forwarded every pointer event to the app's root. It now forwards a press, a new touch or a wheel step only when it begins inside the tile's rect (pointer_start, tested) — the gate a process tile gets from event.hits(cx, self.area) — and only after mobile_app.rs::phone_pointer_at has fed the recognizer and it declined the finger (that gate already existed: a claimed finger returns before ui.handle_event). Moves and releases pass, as for any widget.

B — the card rendered empty under the Android light theme

Not a theme or kit defect: a fresh turn on the same standalone build and the same Android light theme rendered the card completely (rerun-3.png: Beijing, 19°, day rows, the city photo backdrop, all readable). The broken weather-card3.png (16:27) came from a retry turn carrying a "[Conversation summary]" compaction context (2959 completion tokens vs 1779 for the good turns; captured as llm-reqs/req-7.json vs req-2.json) that generated a different card. Its pixels are the light kit's opaque photo wash (l0_card.rs::kit_for, photo_wash for a light mood on a Photo root) with l0_dim captions and dark icons — the card declared a light mood the good turns did not. The 16:27 declaration line has rolled out of logcat and the kernel does not keep the generated DSL on disk, so the two sources could not be diffed; noted as model variance, renderer left alone. The light-mood photo wash with white hero text is a kit look worth a separate look in Octoscript-AppCard, not something this shell can fix.

Card approvals across builds

octos-app pins every admitted card to its runtime bundle and fails closed on a stale receipt, so every new APK drew blank cards until l0-approvals was moved aside by hand. That is the host's explicit deployment action (l0_approval_store::archive_for_reapproval, which octos-app runs itself for MAKEPAD_REAPPROVE_CARDS), so OctoSense now does it: build.rs stamps OCTOSENSE_BUILD_ID (renewed by any source change) and the first launch of a new build on Android archives <files>/.config/octos-app/l0-approvals under the app's own backup name (octosense_appcard::reapprove_cards_for_host_build, tested against a temp store). Desktop builds leave the developer's store alone. docs/android-appcard-build.md describes both this and the capture overlay scope.

Verification

Desktop: cargo test (256), cargo test --features mobile-only (253), cargo test -p octosense-appcard (3) green; cargo check --features mobile-only,app-appcard clean. Desktop standalone build, AppCard hosted in the phone window: hosted-desk-appcard.png (the app in its slot), hosted-desk-shade.png (the controls sheet fully over it, the app's glass pills blurred beneath).

Phone (see the screenshots attached to the report):

• hosted-card-light.png — AppCard in its slot (shell status band above, navigation band below), the Beijing weather card complete: photo backdrop, title, 20°, day rows, all readable, Android light theme (local qwen3.5 turn, 1779 tokens).
• hosted-shade-over-appcard.png — shade pulled from the top band over the card: the controls sheet is fully visible, the card blurred beneath it (before: controls-now2.png, only the strip above the app rect showed).
• hosted-shade-dark.png / hosted-card-dark.png — Dark mode tile toggled from that shade: the shell goes dark, the card keeps its photo backdrop with white text in both appearances.
• hosted-home.png — swipe up from the bottom: the home page, AppCard as a live tile capture (the card's top in the tile), no AppCard chrome over the page (before: state-now.png, AppCard's sheet over everything).
• hosted-reopened.png — the tile reopens the app in its slot; hosted-recents.png — swipe-up-and-hold: AppCard as a Recents card with its Split button.
• The re-approval hook fired on the first launch of the new build (wm: host build 1789430568 is new: card approvals archived to .../l0-approvals-before-studio-1789430568), and the card admitted cleanly afterwards.

Still floating over everything: octos-app's native Android composer — the green "+" FAB is a Java view above the GL surface (cx.show_native_composer() under cfg(mobile)), so it shows over the shade, Home and Recents. That is octos-app's to hide when it is not in front (a host signal it does not have yet), not something the compositor can order.

🤖 Generated with Claude Code

[ymote]

Closing as superseded: every commit in this stack (#22–#28) is already on OctoSense-ROM main, where the phone shell continued. Per ADR 0001 the phone layer moves into the shared crates/shell from that copy when OctoSense-Desktop and OctoSense-ROM are merged into one OctoSense repository, so nothing here is lost. #25's octos-app pin is obsolete: AppCard now comes from OctoSense-System-Apps on octos main. The branches are kept.

🤖 Generated with Claude Code