Open a script app at its manifest's window size; PDF Tools asks for 1536 x 1024

Cargo.toml

@@ -91,7 +91,7 @@ octosense-reference = { path = "apps/reference" }
 makepad-sheets = { git = "https://github.com/OctoSense-org/makepad.git", rev = "d653bc4493619ab979ccff165cf48c0c63b77d19", default-features = false }
 makepad-terminal = { git = "https://github.com/OctoSense-org/makepad.git", rev = "d653bc4493619ab979ccff165cf48c0c63b77d19" }
 octosense-appcard = { path = "apps/appcard/module" }
-octosense-app-hub-app = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "80a64b4557aaba71f7c826c5dc69721c21c0f0fc" }
+octosense-app-hub-app = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "d86101d7206162b73ea873e2a31b48364600a110" }
 makepad-calculator = { git = "https://github.com/OctoSense-org/makepad.git", rev = "d653bc4493619ab979ccff165cf48c0c63b77d19", default-features = false }
 makepad-clock = { git = "https://github.com/OctoSense-org/makepad.git", rev = "d653bc4493619ab979ccff165cf48c0c63b77d19", default-features = false }
 makepad-notes = { git = "https://github.com/OctoSense-org/makepad.git", rev = "d653bc4493619ab979ccff165cf48c0c63b77d19", default-features = false }
@@ -131,17 +131,17 @@ makepad-d3 = { git = "https://github.com/OctoSense-org/Octoscript-Makepad.git",
 octoscript-node = { git = "https://github.com/OctoSense-org/Octoscript-Makepad.git", rev = "6cf2d90aa33ff4ae603f49c7557f3ecf986207f0" }
 # --- App Hub's host service registry the Mail and llm services register
 # into; the same revision as App Hub's app crate (a native app, above).
-octosense-appstore = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "80a64b4557aaba71f7c826c5dc69721c21c0f0fc" }
+octosense-appstore = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "d86101d7206162b73ea873e2a31b48364600a110" }
 # The app policy (resolution, isolate settings, the Splash adapter) and the
 # Hub client the Card runner resolves an app's policy with; the shell's
 # glance tiles run cards under it (crates/shell/src/glance_card.rs).
-octosense-app-policy = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "80a64b4557aaba71f7c826c5dc69721c21c0f0fc" }
-octosense-app-hub = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "80a64b4557aaba71f7c826c5dc69721c21c0f0fc" }
+octosense-app-policy = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "d86101d7206162b73ea873e2a31b48364600a110" }
+octosense-app-hub = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "d86101d7206162b73ea873e2a31b48364600a110" }
 # The app contract (ADR 0005), from crates.io by version: App Hub, the shell
 # and Rinx all depend on `octosense-app-contract = "1"`, so Cargo links ONE
 # 1.x for the whole build (Cargo.lock pins the exact version OctoSense ships)
 # and App Hub and Rinx no longer need the same App Hub commit.
-octosense-app-contract = "1.11"
+octosense-app-contract = "1.12"
 # --- octos: ONE source for every octos crate (reviewed octos#2715 at
 # b0759a57: bounded ledger session-directory names, serialized peer purge
 # against session writes, and provider transport diagnostics that omit
@@ -439,7 +439,7 @@ ruma = { git = "https://github.com/project-robius/ruma.git", branch = "tsp" }
 # -i octos-core` still sees one octos source.
 [patch.crates-io]
 # Keep the contract identical to the pinned SDK for this release candidate.
-octosense-app-contract = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "80a64b4557aaba71f7c826c5dc69721c21c0f0fc" }
+octosense-app-contract = { git = "https://github.com/OctoSense-org/OctoSense-App-Hub", rev = "d86101d7206162b73ea873e2a31b48364600a110" }
 nix = { git = "https://github.com/octos-org/octos.git", rev = "18fcd3f16e527d2b601d7ae244f056fb711bb6b8" }
 
 # pdfcraft's bootstrap PDF stack: its workspace patches these five

apps/README.md

@@ -346,7 +346,8 @@ appcard/                     the native AppCard assistant
 
 ```
 apps/<name>/bundle/
-  manifest.json     id, version, name, capabilities, network.hosts, integrity
+  manifest.json     id, version, name, capabilities, network.hosts, integrity;
+                    optionally window, the desktop window's size (schema_minor 1)
   main.splash       the program
   icon.png|svg      optional launcher artwork; the shell owns the outer shape
   thumbs/ ...       any other files the app loads, as {{assets}}/<path>

apps/README.zh-CN.md

@@ -277,7 +277,8 @@ appcard/                     原生 AppCard 助手
 
 ```
 apps/<name>/bundle/
-  manifest.json     id、version、name、capabilities、network.hosts、integrity
+  manifest.json     id、version、name、capabilities、network.hosts、integrity；
+                    可选的 window：桌面窗口的尺寸（schema_minor 1）
   main.splash       程序
   icon.png|svg      可选的启动器图案；外形由 Shell 统一控制
   thumbs/ ...       应用加载的其他文件，路径为 {{assets}}/<path>

apps/pdftools/README.md

@@ -33,14 +33,25 @@ decision that applies.
 | Right panel | Comment: the threads. Fill & Sign: the form's fields and Add text, Add date, Add initials. Edit: the paragraph being edited |
 | Status line | Saved or Edited, and the storage the PDFs use ("14.6 of 64 MB used", "37 KB of 64 MB used") |
 
-The designs are drawn at 1536 x 1024, but the desktop opens every app's
-window at 72% of the desk's width and 76% of its height, at most 1000 x 720
-points (`crates/shell/src/desktop_layout.rs`); in the runs here PDF Tools got
-990 x 603 points. An app has no way to ask for a larger window; the person
-can resize or maximize it. Below 1180 points wide the mode tabs and Save trim
-their padding, both right panels take 320 points, a right panel takes the
-left panel's place, and until the person zooms, the page fits the canvas, up
-to 100%.
+The designs are drawn at 1536 x 1024, and the manifest asks the desktop to
+open the window at that size: `"window": {"width": 1536, "height": 1024}`,
+App Hub's optional window hint, which needs `"schema_minor": 1`. The desk
+clamps it to its own size, less the margins every new window keeps (42
+points left and right, 32 top and bottom). Where the dock floats over the
+desk, as OctoSense's does, the bottom margin is kept above the dock, so the
+zoom bar and the status line are never behind it
+(`crates/shell/src/desktop_layout.rs`). In the hidden shell's 1400 x 897
+window, PDF Tools opens at 1296 x 703 points with an app area of 1292 x 667,
+its wide layout
+([tests/evidence/window-20261010](tests/evidence/window-20261010/README.md)).
+Before the hint it got the default window, 72% of the desk's width and 76%
+of its height, at most 1000 x 720 points: an app area of 990 x 603. A
+shell that predates the hint ignores it and opens the default. The person
+can resize or maximize the window either way. At 1180 points wide and up
+(the wide layout), a right panel opens beside the left panel. Below 1180 the
+mode tabs and Save trim their padding, both right panels take 320 points, a
+right panel takes the left panel's place, and until the person zooms, the
+page fits the canvas, up to 100%.
 
 ## Modes
 
@@ -190,19 +201,30 @@ that refusal.
   (and again with `--budget-ms 1000` while other builds loaded the machine);
   the `missing` and `fixture` runs in card-host, light and dark. `fixture`
   ran with `--budget-ms 1000`: its stand-in engine answers in script, and at
-  64 ms one of its answers overran in the dark pass.
+  64 ms one of its answers overran in the dark pass. Those runs had the
+  default window, an app area of 990 x 603 points.
+- **Verified on 10 Oct 2026 at the window's own size** (macOS, Apple silicon;
+  [tests/evidence/window-20261010](tests/evidence/window-20261010/README.md)):
+  the `shell` run, light and dark, with the real engine at the runtime's 64 ms
+  budget, in the wide layout (an app area of 1292 x 662); and, opened from the
+  shell's menu, a 1296 x 703 window on a 1380 x 845 work area, 32 points
+  above the dock.
 - **Not verified**: the host's file dialog and a real import (a hidden window
   cannot open it); with the real engine, form fields, outlines, Redo, the
   other comment and page operations, password-protected PDFs, the eight-PDF
   cap and the unsaved-changes question (the dev fixture covers their screens);
-  window sizes other than the shell's default and 1536 x 1024; Linux,
-  Windows, phones.
+  the `restart`, `full` and `empty` runs at the window's own size; other
+  screen sizes; Linux, Windows, phones.
 - **Known**: a comment's date is the engine's UTC time read as local time, so
   a comment made in the evening west of UTC shows the next day's date, until
   the pdf service converts it. The status line counts only the PDFs in the
   library: the files service does not report the storage's use. On a heavily
   loaded machine a tap can overrun the 64 ms budget and be lost (seen at load
-  averages of 60 to 150 before `library.json` moved off the tap path).
+  averages of 60 to 150 before `library.json` moved off the tap path). On a
+  screen 900 points tall the app area is about 1292 x 662. There, with two
+  PDFs in Combine, the card's Combine button needs one scroll (85 points
+  short). Home's last caption line (when each PDF was last opened) also sits
+  at the fold.
 - **Not part of this version**: export (no approved design), opening
   password-protected PDFs, keyboard shortcuts (the runtime gives script apps no
   key events), the Edit panel's Alignment and Colour (`pdf.edit_text` takes

apps/pdftools/README.zh-CN.md

@@ -29,11 +29,18 @@ craft 引擎只在桌面版中提供（`craft-engines`）。
 | 右侧面板 | Comment：评论线程。Fill & Sign：表单字段以及 Add text、Add date、Add initials。Edit：正在编辑的段落 |
 | 状态栏 | Saved 或 Edited，以及 PDF 占用的存储（“14.6 of 64 MB used”、“37 KB of 64 MB used”） |
 
-设计图按 1536 x 1024 绘制，但桌面版打开每个应用的窗口时，宽度取桌面的 72%、高度取 76%，
-最大 1000 x 720 点（`crates/shell/src/desktop_layout.rs`）；在这里的运行中 PDF Tools 得到
-990 x 603 点。应用没有办法请求更大的窗口；用户可以调整窗口大小或将其最大化。窗口宽度小于
-1180 点时，模式标签和 Save 会收紧内边距，两种右侧面板都取 320 点宽，右侧面板会取代左侧面板
-的位置；在用户自己缩放之前，页面会适合画布宽度，最大 100%。
+设计图按 1536 x 1024 绘制，清单请求桌面按这个尺寸打开窗口：`"window": {"width": 1536,
+"height": 1024}`，即 App Hub 的可选窗口提示，需要 `"schema_minor": 1`。桌面会把它限制在自身
+尺寸以内，并减去每个新窗口都保留的边距（左右各 42 点，上下各 32 点）。程序坞浮在桌面之上时
+（OctoSense 的程序坞就是这样），底部边距从程序坞上沿算起，所以缩放条和状态栏永远不会位于
+程序坞后面（`crates/shell/src/desktop_layout.rs`）。在隐藏 Shell 的 1400 x 897 窗口中，
+PDF Tools 以 1296 x 703 点打开，应用区域为 1292 x 667，即它的宽布局
+（[tests/evidence/window-20261010](tests/evidence/window-20261010/README.zh-CN.md)）。有这个
+提示之前，它得到的是默认窗口：宽度取桌面的 72%、高度取 76%，最大 1000 x 720 点，应用区域为
+990 x 603。早于这个提示的 Shell 会忽略它，打开默认窗口。两种情况下用户都可以调整窗口大小或将其
+最大化。窗口宽度达到 1180 点及以上时（宽布局），右侧面板在左侧面板旁边打开。宽度小于
+1180 点时，模式标签和 Save 会收紧内边距，两种右侧面板都取 320 点宽，右侧面板会取代左侧面板的
+位置；在用户自己缩放之前，页面会适合画布宽度，最大 100%。
 
 ## 模式
 
@@ -158,13 +165,20 @@ python3 apps/pdftools/dev-fixture/make_fixture.py <card-host app data>/os.pdftoo
   `full` 和 `empty` 运行（在其他构建占用机器时又用 `--budget-ms 1000` 运行了一次）；在
   card-host 中进行的 `missing` 和 `fixture` 运行，浅色和深色。`fixture` 使用了
   `--budget-ms 1000`：它的替身引擎在脚本中作答，按 64 ms 运行时，深色一轮中有一次作答超时。
+  这些运行使用的是默认窗口，应用区域为 990 x 603 点。
+- **已于 2026 年 10 月 10 日在窗口自身尺寸下验证**（macOS，Apple 芯片；
+  [tests/evidence/window-20261010](tests/evidence/window-20261010/README.zh-CN.md)）：使用真实
+  引擎、按运行时 64 ms 的预算，以宽布局（应用区域 1292 x 662）进行的 `shell` 运行，浅色和深色；
+  以及从 Shell 菜单打开时，在 1380 x 845 的工作区上打开的 1296 x 703 窗口，距程序坞 32 点。
 - **未验证**：宿主的文件对话框和真实的导入（隐藏窗口无法打开它）；使用真实引擎时的表单
   字段、大纲、Redo、其他评论和页面操作、受密码保护的 PDF、八个 PDF 的上限以及未保存更改
-  的询问（开发夹具覆盖了它们的界面）；Shell 默认窗口和 1536 x 1024 以外的窗口尺寸；
-  Linux、Windows、手机。
+  的询问（开发夹具覆盖了它们的界面）；窗口自身尺寸下的 `restart`、`full` 和 `empty` 运行；
+  其他屏幕尺寸；Linux、Windows、手机。
 - **已知问题**：评论的日期是引擎的 UTC 时间被当作本地时间读取，因此在 UTC 以西的晚上做的
   评论会显示第二天的日期，直到 pdf 服务完成转换。状态栏只统计资料库中的 PDF：文件服务不
   报告存储的用量。在负载很高的机器上，一次点按可能超出 64 ms 预算而丢失（在 `library.json`
-  移出点按路径之前，于 60 到 150 的平均负载下见到过）。
+  移出点按路径之前，于 60 到 150 的平均负载下见到过）。在 900 点高的屏幕上，应用区域约为
+  1292 x 662：合并中列出两个 PDF 时，卡片的 Combine 按钮需要滚动一次才能看到（差 85 点），
+  首页卡片的最后一行说明（每个 PDF 上次打开的时间）正好在可见区域边缘。
 - **不在这个版本中**：导出（没有已批准的设计）、打开受密码保护的 PDF、键盘快捷键（运行时
   不给脚本应用按键事件）、Edit 面板中的 Alignment 和 Colour（`pdf.edit_text` 只接收文字）。

apps/pdftools/bundle/manifest.json

@@ -1,8 +1,10 @@
 {
   "schema": 1,
+  "schema_minor": 1,
   "id": "os.pdftools",
   "version": "0.2.0",
   "name": "PDF Tools",
   "integrity": { "bundle_blake3": "" },
-  "capabilities": ["storage", "files", "pdf"]
+  "capabilities": ["storage", "files", "pdf"],
+  "window": { "width": 1536, "height": 1024 }
 }

apps/pdftools/tests/evidence/window-20261010/README.md

@@ -0,0 +1,49 @@
+# PDF Tools at its own window size — 2026-10-10
+
+English | [简体中文](README.zh-CN.md)
+
+PDF Tools' manifest asks the desktop to open its window at the designs'
+1536 x 1024 points (`"window"`, with `"schema_minor": 1`). The shell clamps
+that to the desk, less the margins every new window keeps. OctoSense's dock
+floats over the desk instead of reserving a strip, so the bottom margin is
+kept above the dock. A hidden desktop shell built from this branch showed
+it, with the real `pdf` engine (macOS, Apple silicon;
+[receipt.json](receipt.json) holds the binary's digest, the commands, the
+numbers and the findings). Each run had a fresh `OCTOSENSE_HOME` and started
+from a Terminal.app tab with `MAKEPAD_HIDE_WINDOWS=1` and
+`MAKEPAD_REMOTE=127.0.0.1:8915`, one instance on the machine. Each was
+driven over the remote bridge and ended with `/quit`. Frames are `/g` grabs
+at one pixel per point.
+
+- [opened-from-the-menu.png](opened-from-the-menu.png): the whole hidden
+  window, after the shell's menu, "pdf tools", Return. The 1400 x 897 shell
+  has a 1380 x 845 work area whose bottom 78 points the dock covers. The
+  window opens at 1296 x 703 points, 32 points above the dock, and the app
+  gets 1292 x 667. Before this change the app got the default window, an app
+  area of 990 x 603 ([v2-20261010](../v2-20261010/README.md)).
+- [wide/](wide): [ui.py](../../ui.py)'s `shell` run, unchanged, light and
+  then dark, with PDF Tools opened at startup (`MAKEPAD_WM_TEST_APP`). The
+  window was 1296 x 698, sized on the shell's startup proportions as every
+  window opened before the desk's first draw is, and the app had 1292 x 662.
+  That is its wide layout (1180 points and up), where a right panel opens
+  beside the left panel. Every step of both passes passed at the runtime's 64 ms script
+  budget, with no script errors. The frames are the app's area: Home,
+  Reading, Find, Comment with a highlight, Combine (before and after one
+  scroll), Edit, and Reading in the dark pass. In every frame the status line
+  ("Saved" or "Edited", and the storage used) and the zoom bar sit above the
+  dock.
+
+What the run showed:
+
+- **Combine:** with two PDFs listed, the card's own Combine button is 85
+  points below the fold at this size. [06-combine.png](wide/06-combine.png)
+  ends at "One PDF of 5 pages". One scroll shows the name and the button
+  ([06a-combine-end.png](wide/06a-combine-end.png)).
+- **Home:** the cards' third caption line (when each PDF was last opened)
+  sits at the fold, with 2 of its 18 points showing.
+- Both come from height. Keeping the window above the dock costs 78 points on
+  this 898-point-tall window. Before that change the app area was 740 points
+  tall: Home's captions fitted and the Combine button was about 7 points
+  short.
+- A comment made on 10 Oct (PDT) is dated 11 Oct: the known UTC reading in
+  the [README](../../../README.md#status).