Muhenkan Ubuntu Managed runtime candidate

This private bytecode runtime is part of the user-scoped Ubuntu product bundle.
Use Ubuntu 24.04 distribution CPython 3.12 (/usr/bin/python3), GTK3, IBus and an
existing unlocked Secret Service. Capture currently supports GNOME X11 only.
Follow the outer bundle README.txt for installation and SHA-256 verification.
A successful build or synthetic test is not physical-key or public-release
acceptance. Bytecode and checksums do not provide secret isolation or a
publisher signature.

Open the installed Muhenkan settings window. The default mode is Capture:
press the native Muhenkan key in an input field to open a separate draft,
then press it again to restore and insert. Enter adds a line in the draft;
while restoration is pending, Enter interrupts. Esc cancels. The ordinary
input source stays selected while idle and drafting. Insertion uses IBus,
without copying the output to the clipboard or injecting output keystrokes.
A rejected insertion is not automatically resent. The settings action for
copying the previous original is an explicit recovery action.

First production input startup or license registration shows the terms and
privacy notice. Closing it, or failing to save its local confirmation, starts
neither input nor registration. The receipt contains only the notice version
and UTC time, and survives a same-destination upgrade. The isolated staging
runtime does not record production confirmation. This Ubuntu runtime does not
collect or send optional client usage statistics. Contract, device and quota
accounting are separate. Explicit AI restoration sends the submitted text and
enabled dictionary through Muhenkan/Cloudflare to OpenAI; do not enter
confidential information. Device credentials and dictionaries are protected
by the existing keyring. One recoverable draft is kept in process memory.

In stopped Settings, register with an existing purchased license using the
masked entry. The window also links to purchase, license recovery and contract
management at the runtime's compiled destination. Showing Settings does not
read a credential or start input. Registration and renewal failures with an
unknown result are not automatically retried. A local authentication deletion
is distinct from contract cancellation and requires an explicit confirmation.
Never put a license or credential in argv, environment, a file or chat.

The optional field-checking action enables the desktop accessibility API.
After enabling it, restart Muhenkan input and the test browser, not the OS.
Startup never changes this setting. Observable fields are checked for identity
and edits. If a previously observed field becomes unavailable, insertion is
refused; it does not downgrade to a native-window-only check. Hosts without
that API retain native-window/input-context checks. These checks are not an
atomic DOM insertion acknowledgement.

Production and staging bundles have separate destinations and cannot upgrade
an existing setup across environments. Install updates preserve the saved
setup identity, settings, credentials, dictionary and old installed versions.
No launcher command reboots, logs out, unlocks the desktop, reconnects a
Remote Tunnel, installs packages or changes persistent IBus registration.
The installer does not start input or register a license.

Read-only direct runtime commands:
  /usr/bin/python3 -I -B muhenkan_managed.pyc --describe
  /usr/bin/python3 -I -B muhenkan_managed.pyc --check-imports
  /usr/bin/python3 -I -B muhenkan_managed.pyc --check-native

Direct UI/console entries use the existing non-secret launch descriptor:
  /usr/bin/python3 -I -B muhenkan_managed.pyc --ui --binding-file /absolute/launch.json
  /usr/bin/python3 -I -B muhenkan_managed.pyc --binding-file /absolute/launch.json

The console requires an already confirmed production notice. Use the UI for
first confirmation; there is no command-line bypass. Existing explicit BYOK
choices remain stored, but this product runtime starts only Managed. Normal
startup uses shared Product limits: 2,000 characters, 2,048 UTF-8 input bytes,
16,384 output bytes and at least the 35-second service allowance. Explicit
limits may narrow bounds or lengthen the timeout. Missing, pending, locked or
invalid credentials stop before input activation. Startup does not renew a
device credential; explicit restoration follows the shared renewal contract.

Closing the UI stops and joins only its owned input worker. An in-flight
server operation cannot be promised undone by cancellation. The runtime has a
verified installed-version lease; removal while in use is refused. Import and
native dependency checks never activate input or access a credential.
