Clarify local Hub rehearsal and record native publisher UI acceptance

desktop/README.md

@@ -259,15 +259,24 @@ App Hub is on by default. Open **App Hub** from the launcher to browse the signe
 
 #### Try your own app before it is published
 
-Publish the bundle into a local catalog with a throwaway anchor (OctoScript-App-Design-Flow's [PUBLISHING §4](https://github.com/OctoSense-org/OctoScript-App-Design-Flow/blob/main/docs/PUBLISHING.md#4-rehearse-the-store-path-locally) gives the `hub keygen`/`certify`/`publish` commands), then point this shell at it:
+For public distribution, open an [App Hub submission issue](https://github.com/OctoSense-org/OctoSense-App-Hub/issues/new?template=submit-app.yml), then add the GitHub release evidence when ready. The normal [GitHub publishing flow](https://github.com/OctoSense-org/OctoSense-App-Hub/blob/main/docs/SUBMITTING.md) requires no separate developer publisher key; a tag or Release alone is not Hub approval.
+
+The following is an **optional local legacy-catalog rehearsal**. Design Flow's [PUBLISHING §4](https://github.com/OctoSense-org/OctoScript-App-Design-Flow/blob/main/docs/PUBLISHING.md#4-rehearse-the-store-path-locally) describes its compatibility bundle and throwaway catalog keys (`hub keygen`/`certify`/`publish`); these are not prerequisites for normal GitHub publishing. Never restamp a GitHub-attested release for this older recipe.
+
+After preparing the mirror, replace the two quoted values below. Always use a fresh profile: a library that already cached the v2 catalog refuses a legacy downgrade. **This revised launch recipe is source-reviewed, not yet run against the newly compatible shell binary.**
 
 ```sh
-OCTOSENSE_HUB=<mirror dir> OCTOSENSE_HUB_ANCHOR=<anchor hex> \
-  OCTOSENSE_HOME=/tmp/octosense-test OCTOSENSE_APP_DATA=/tmp/octosense-test-apps \
+REHEARSAL_MIRROR='/absolute/path/to/your/test-mirror'
+REHEARSAL_ANCHOR='replace-with-test-anchor-public-hex'
+REHEARSAL_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/octosense-hub-rehearsal.XXXXXX")"
+OCTOSENSE_HUB_CATALOG=legacy \
+  OCTOSENSE_HUB="$REHEARSAL_MIRROR" OCTOSENSE_HUB_ANCHOR="$REHEARSAL_ANCHOR" \
+  OCTOSENSE_HOME="$REHEARSAL_ROOT/shell" OCTOSENSE_APP_DATA="$REHEARSAL_ROOT/apps" \
+  OCTOS_APP_CORE_DIR="$REHEARSAL_ROOT/core" \
   cargo run --release -p octosense
 ```
 
-Open **App Hub**, choose the app, **Get**, scroll to **Install**, then **Open**: it runs in the Card runner under its manifest, as a store app would. Verified on macOS on 2026-09-26 with a new script app (in the OctoSense-Desktop repository, before the merge). The two `OCTOSENSE_*` state variables keep the test out of `~/.octosense`.
+Open **App Hub**, choose the app, **Get**, scroll to **Install**, then **Open**: it runs in the Card runner under its manifest. The earlier legacy-catalog UI flow was verified on macOS on 2026-09-26 with a new script app, before the repository merge; that historical result does not verify the new GitHub publisher path. The separate shell/app directories keep this rehearsal out of your normal profile, and the explicit kernel directory prevents copying personal provider settings into it. This local catalog does not submit or publish an app to the official Hub.
 
 ### Choosing and overriding system apps
 

desktop/README.zh-CN.md

@@ -256,15 +256,24 @@ App Hub 默认开启。从 launcher 打开 **App Hub**，浏览签名目录并
 
 #### 发布前试用自己的应用
 
-用一次性信任锚把应用包发布到本地目录（命令见 OctoScript-App-Design-Flow 的 [PUBLISHING §4](https://github.com/OctoSense-org/OctoScript-App-Design-Flow/blob/main/docs/PUBLISHING.md#4-rehearse-the-store-path-locally)：`hub keygen`/`certify`/`publish`），再让本 Shell 指向它：
+正式分发时，先创建 [App Hub 投稿 issue](https://github.com/OctoSense-org/OctoSense-App-Hub/issues/new?template=submit-app.yml)，准备好后再补充 GitHub 发布证据。常规 [GitHub 发布流程](https://github.com/OctoSense-org/OctoSense-App-Hub/blob/main/docs/SUBMITTING.zh-CN.md)不要求开发者单独管理发布者密钥；创建标签或 Release 不等于获得 Hub 批准。
+
+下文是**可选的本地旧版目录演练**。Design Flow 的 [PUBLISHING §4](https://github.com/OctoSense-org/OctoScript-App-Design-Flow/blob/main/docs/PUBLISHING.zh-CN.md#4-在本地演练商店流程)说明其兼容包与一次性目录密钥（`hub keygen`/`certify`/`publish`）；它们不是常规 GitHub 发布的前置要求。不要为这个旧流程重新写入已附加 GitHub 证明的发布包摘要。
+
+准备好镜像后，替换下方两个带引号的值。始终使用全新的配置目录：已经缓存 v2 目录的库会拒绝降级到旧版目录。**这份修订后的启动配方已经过源码核对，但尚未在新兼容 Shell 二进制上运行。**
 
 ```sh
-OCTOSENSE_HUB=<mirror dir> OCTOSENSE_HUB_ANCHOR=<anchor hex> \
-  OCTOSENSE_HOME=/tmp/octosense-test OCTOSENSE_APP_DATA=/tmp/octosense-test-apps \
+REHEARSAL_MIRROR='/absolute/path/to/your/test-mirror'
+REHEARSAL_ANCHOR='replace-with-test-anchor-public-hex'
+REHEARSAL_ROOT="$(mktemp -d "${TMPDIR:-/tmp}/octosense-hub-rehearsal.XXXXXX")"
+OCTOSENSE_HUB_CATALOG=legacy \
+  OCTOSENSE_HUB="$REHEARSAL_MIRROR" OCTOSENSE_HUB_ANCHOR="$REHEARSAL_ANCHOR" \
+  OCTOSENSE_HOME="$REHEARSAL_ROOT/shell" OCTOSENSE_APP_DATA="$REHEARSAL_ROOT/apps" \
+  OCTOS_APP_CORE_DIR="$REHEARSAL_ROOT/core" \
   cargo run --release -p octosense
 ```
 
-打开 **App Hub**，选中应用，点 **Get**，向下滚动到 **Install**，然后点 **Open**：它会像商店应用一样，在 Card runner 中按其 manifest 运行。已于 2026-09-26 在 macOS 上用一个新的脚本应用验证（当时在仓库合并前的 OctoSense-Desktop 仓库中）。两个 `OCTOSENSE_*` 状态变量让测试不影响 `~/.octosense`。
+打开 **App Hub**，选中应用，点 **Get**，向下滚动到 **Install**，然后点 **Open**：应用在 Card runner 中按其 manifest 运行。早期旧版目录的界面流程已于 2026-09-26 在 macOS 上用一个新的脚本应用验证，当时仓库尚未合并；这条历史记录不验证新的 GitHub 发布者路径。独立的 Shell／应用目录让演练不影响平时的配置，显式指定内核目录可阻止把个人提供商设置复制进去。本地目录不会向官方 Hub 提交或发布应用。
 
 ### 选择与覆盖系统应用
 

desktop/reviews/github-publisher-ui-2026-10-08/README.md

@@ -0,0 +1,52 @@
+# Keyless publisher UI acceptance — 2026-10-08
+
+[简体中文](README.zh-CN.md)
+
+The final packaged macOS shell at `5e1a8414cba4c9c3ab041b5555b6d90bcbad03bb` passed **8/8 checks** in a new native Makepad instrument run with fresh app data. Its [receipt](macos-final-5e1.json) binds the executable and genuine GitHub release packs by SHA-256. The earlier source-`5607e90b` [receipt](macos-5607.json) and captures below remain unchanged; the rebuilt executable has identical bytes, but the final package was actually rerun. This is a focused publishing/install/update test, not extended UX soaking or a release announcement.
+
+The run declined App Hub's optional agent, searched for Publishing Test Notes, installed and opened version 0.1.0, added a note, restarted, updated to 0.1.1, retained that note, added another and removed the first, then reopened the installed app from Library after another restart. The remaining note persisted. All owned shell processes stopped. Four original captures were inspected; no personal accounts, credentials, or private paths appear in them.
+
+| Captured state | Evidence |
+| --- | --- |
+| Search result | [Search](01-search.png) |
+| Installed app with its first note | [Version 0.1.0](02-installed-note.png) |
+| Updated app after editing its notes | [Version 0.1.1](03-updated-notes.png) |
+| Reopened app with retained data | [Library reopen](04-retained-note.png) |
+
+## Proof and catalog boundaries
+
+The genuine developer proofs came from the fixture's [0.1.0 workflow](https://github.com/ymote/octosense-publisher-fixture/actions/runs/37736273522) and [0.1.1 workflow](https://github.com/ymote/octosense-publisher-fixture/actions/runs/37736765473). No developer signing key or repository signing secret was used. The shell installed the sealed release bytes, not a restamped source checkout.
+
+Admission used an **isolated local legacy test catalog**, signed with temporary Hub-only keys that were deleted after both catalog snapshots were prepared. It explicitly selected `OCTOSENSE_HUB_CATALOG=legacy` with new shell, app, and core data directories. It did not mutate the public catalog or submit the fixture to App Hub. This is separate from verification of the production GitHub-attested sequence-11 catalog. A real developer requests publication through an [App Hub submission issue](https://github.com/OctoSense-org/OctoSense-App-Hub/issues/new?template=submit-app.yml); a successful GitHub release alone does not request or approve admission.
+
+## Instrument limitations
+
+Earlier attempts exposed missing driver handling for first-run agent consent, scrolling to the install confirmation, and startup snapshot readiness. They also encountered transient `wait=1` frame-acknowledgement errors after input had already applied. The successful driver queued native input with `wait=0`, then checked the actual UI and stored state; it did not replay ambiguous writes. Read-only screenshot arming retries were bounded to eight seconds. The receipt records these limits and earlier outcomes rather than treating every attempt as a pass.
+
+The custom-drawn optional-agent consent buttons were not in the widget snapshot. The driver used the inspected native screen to choose **Don't allow** and verified the denied consent in its own profile. No agent or model call was required for the tested app.
+
+## Android fixture preparation
+
+The original two packs declare only macOS. New genuine [0.1.2](https://github.com/ymote/octosense-publisher-fixture/actions/runs/37742612574) and [0.1.3](https://github.com/ymote/octosense-publisher-fixture/actions/runs/37742627927) releases declare macOS and Android and use the merged Design Flow generator at `6f4ce207` with App Hub `655114c4943cd2490daaefa2173e7b5aaa20669f`. Their workflows, native proof verification, platform declarations, and hashes passed; see the [preparation receipt](android-fixture-releases.json). This receipt does **not** claim phone UI acceptance. The old packs and evidence remain unchanged.
+
+## Final package and OnePlus 6
+
+The final Mac run repeated all eight checks. Original [installed](final-01-installed-note.png) and [updated](final-02-updated-notes.png) captures were inspected. [Capture hashes](captures-sha256.json) bind the checked-in originals.
+
+The actual OnePlus 6 run at `8afcf35f03649f31b939b822302c132f18feb86e` passed **8/8 functional checks**: search/install/open 0.1.2, add a note, update to 0.1.3 with exact proof and note retained, edit the note list, and restart/Library Open with the final note intact. See its [receipt](android-8af.json) and [original reopened screen](android-24-library-opened.png). Other capture hashes remain in the receipt; raw logs and private profiles are not committed.
+
+**The phone has a visual defect:** “Publishing Test Notes” clips at the right edge. Body text wraps and the tested actions remain reachable. This is a functional pass, not a clean mobile UX pass. The inherited starter-template heading has a separate narrow-window fix; that fix was not applied to these immutable phone releases or claimed phone-tested.
+
+The phone used an isolated debug Home package, scoped ADB input and an ephemeral local legacy catalog. It did not replace normal Home or use personal accounts/models. Its source predates the final packaging-only changes; the receipt retains the actual source and APK hashes. Both Mac and phone test processes were stopped. These are synthetic publisher-fixture results, not acceptance of the separately submitted ymote Notes, Inbox, Calendar or Camera apps.
+
+## Release-candidate phone rerun at 933abbcf
+
+The OnePlus 6 repeated **8/8 publisher checks and 5/5 L0 layout checks** on exact source `933abbcf2737e652acd9cae2a4c9ffc16bfdaec6`, runtime tree `6c080f31adb899611e6ebe132ccfa2eead06cf9b`, and App Hub `ba36df0505e198f998201af312ff5184df98cae9`. The [build receipt](android-933-build.json) records a clean-source, two-job Android build. Both isolated debug-package flows explicitly unset `MAKEPAD_SPLASH_BUDGET_MS`, exercising the normal **64 ms** default. These results supersede the older phone run for this source revision without changing its historical evidence.
+
+The [publisher receipt](android-933-publisher.json) records genuine 0.1.2 → 0.1.3 release installation, exact proof preservation, note editing, and persistence after process restart and Library Open. Its [original final screen](android-933-library-opened.png) shows the retained note. The immutable fixture's title still clips; this remains a functional pass with that visual defect.
+
+The separate [L0 receipt](android-933-l0.json) covers a zero-capability synthetic measured canvas: aligned top markers, initial bottom clipping, one real swipe exposing the final native toggle, and real taps changing it off → on → off. Original OS captures show [the top](android-933-l0-top.png), [the exposed off state](android-933-l0-off.png), [the on state](android-933-l0-on.png), and [the restored off state](android-933-l0-off-again.png). This proves scrolling and native widget hit testing; it does not prove a business reducer, backend write, or persisted toggle state. The measured vertical origin includes the approximately 80-pixel Android status-bar inset, not a separately offset nested host pane.
+
+**Capture limitation:** supplemental Makepad texture readback lagged interactions even after the capture timestamp changed. A capture requested after scrolling still showed the top; one requested after the tap still showed the previous off state. The receipts retain their hashes as diagnostic evidence. Post-scroll and toggle assertions use the current OS screenshots, not those delayed native captures.
+
+Both flows used temporary local legacy test catalogs and separate app data. The publisher packs retain genuine GitHub proofs; the L0 fixture instead has an ephemeral synthetic test signature and was not publicly published. Neither test grants production App Hub admission. Normal Home, personal accounts, and models were untouched; the assigned test package was stopped. This is focused acceptance of a debug Home shell with `dev-mode,app-hub`, not a production Android package or a full device UX soak.