Cockpit & ribbon

An app declares the pages it contributes. The cockpit mounts them inside the shared shell, where the ribbon, the ticket list and the assistant are already present. The app does not have to rebuild any of that, and it cannot accidentally replace it.

• Nothing is written to browser storage. An earlier build cached the last-used app name, which poisoned plain cockpit visits with whatever you had opened previously. The fix was to delete the cache, not to add a way to clear it.
• A shape is therefore a link. Bookmark it, send it to a colleague, point a kiosk at it, put it in a runbook — the cockpit that opens is the one you meant.
• Kiosk and focused modes are supported, not improvised: a stripped ribbon around a single app is a real configuration, which is what makes a shared screen or a child's login workable.

App pages mount as in-page views and speak one small message contract: navigate, and tell the ribbon its tools changed. There is no other channel. That boundary is why a third-party package can ship a UI without being able to reach into the rest of the cockpit.