feat(display): windows: full-screen, F1 cycles, OS bar (names, front, user); canvas-only (display-owned buffers, 4 max, reused); launchers OPEN (pm per app, terminal own), window caps minted by display; FORGET on launcher death via init courier; raster crate (font, chunked text); F-keys in input; terminal+snake on canvas; REDRAW gone

docs/apps.md

@@ -83,7 +83,7 @@ optional one is simply not granted.
 
 | Capability | What the app gets |
 |---|---|
-| `display` | the display server: the screen, and the keyboard while in focus |
+| `display` | a window of its own, named from its manifest: its pixels, and the keyboard while it is in front |
 | `storage` | the user's `data/<id>/`, read-write (its own folder only) |
 
 ## Decisions
@@ -143,10 +143,9 @@ permission manager:
 
 The user withdraws a capability: the decision changes and the next launch
 gets less. A running app that held it is **stopped**: all its access dies
-at once. (Endpoint capabilities like `display` are copies the permission
-manager cannot take back from one app alone yet; once servers issue
-per-client badges, as storage does, revoking a single capability from a
-running app will not need to stop it.)
+at once. (Capabilities like `display` could now be taken back alone, as
+storage's grants and the display's windows are issued per app; stopping
+the app is still what revoking does.)
 
 ### Not yet