test: rehearse the stable rooms' upgrade on every canary, and list Sunday's checks

update_canary.sh now also validates the exact package it is about to
publish as an upgrade from whatever stable names — 0.2.2 today, several
releases behind the laptop's canary. A package that upgrades the laptop
and breaks the desktops has to fail before it is published.

The lab print check runs in the Plasma lab as well as a plain container:
its rig lived in /tmp, which is a tmpfs there that docker cp cannot write
into, and its inline-PDF server shared a port with another test server.

docs/testing.md has the physical checks for 0.2.6.1 — paper through
Elmer, the real keyboard's zoom keys, the machine's graphics through
--diagnose, sign-out with a real account — before stable moves.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tools/lab/wonderink-print-check

@@ -19,8 +19,16 @@ COMMAND="${WONDERINK:-/usr/local/bin/classroom-wonderink}"
 
 lab() { docker exec -i "$NAME" bash -c "$1"; }
 
-docker cp "$ROOT/tools/lab/wonderink-print-rig.py" "$NAME:/tmp/wonderink-print-rig.py" >/dev/null
-lab 'chmod a+r /tmp/wonderink-print-rig.py'
+# Not /tmp: in the Plasma lab /tmp is a tmpfs, and docker cp writes into
+# the layer underneath it, where nothing can see the file. Measured — the
+# first run there "failed" every scenario for exactly that reason.
+RIG=/opt/wonderink-check/wonderink-print-rig.py
+lab 'mkdir -p /opt/wonderink-check'
+docker cp "$ROOT/tools/lab/wonderink-print-rig.py" "$NAME:$RIG" >/dev/null
+lab "chmod -R a+rX /opt/wonderink-check && test -r $RIG" || {
+    echo "could not put the rig in the lab" >&2
+    exit 1
+}
 
 # The church's printer network is fenced off inside the lab. Checked, not
 # assumed: a lab job must never be able to reach the real Elmer.
@@ -52,11 +60,16 @@ lpadmin -p Refusing -E -v file:///dev/null -m "$driver" -D "LAB: refuses jobs" 2
 cupsreject Refusing
 id teacher >/dev/null 2>&1 || useradd -m teacher
 install -d -o teacher -m 700 /tmp/teacher-rt
-# An inline PDF, served the way a site shows one rather than sends it.
-mkdir -p /tmp/www
-pgrep -f "http.server 8088" >/dev/null || (cd /tmp/www && setsid python3 -m http.server 8088 >/dev/null 2>&1 &)
+# An inline PDF, served the way a site shows one rather than sends it. Its
+# own port and directory: a lab often has another test server on 8088.
+mkdir -p /opt/wonderink-check/www
 ' || { echo "could not prepare the lab's CUPS" >&2; exit 1; }
 
+# Started detached. A background process started inside a docker exec
+# dies with it in the Plasma lab, whose PID 1 is systemd.
+lab 'pgrep -f "[h]ttp.server 8089" >/dev/null' || \
+    docker exec -d -w /opt/wonderink-check/www "$NAME" python3 -m http.server 8089
+
 passed=0
 failed=0
 
@@ -76,7 +89,7 @@ run() {
     before=$(lab 'lpstat -W all -o 2>/dev/null | wc -l')
     out=$(lab "su teacher -c 'cd /tmp; XDG_RUNTIME_DIR=/tmp/teacher-rt QT_QPA_PLATFORM=offscreen \
         QTWEBENGINE_CHROMIUM_FLAGS=\"--no-sandbox --disable-gpu\" \
-        timeout 120 python3 /tmp/wonderink-print-rig.py $COMMAND $1 2>&1'; echo \"exit=\$?\"")
+        timeout 120 python3 $RIG $COMMAND $1 2>&1'; echo \"exit=\$?\"")
     sleep 3
     jobs=$(lab "lpstat -W all -o | tail -n +$((before + 1)) | awk '{print \$1}' | tr '\n' ' '")
     job_options() { lab "grep -E '\\[Job ${1#*-}\\] argv\\[(4|5)\\]' /var/log/cups/error_log"; }
@@ -92,7 +105,7 @@ scenarios=("$@")
     options bad-range broken cancel page-closes-itself close-window page-prints-again repeat)
 
 # The inline scenario needs a PDF to serve; the worksheet scenario writes one.
-lab 'test -f /tmp/www/ark.pdf' || { run pdf >/dev/null; lab 'cp "/home/teacher/Downloads/Wonder Ink/Colour the Ark.pdf" /tmp/www/ark.pdf; chmod a+r /tmp/www/ark.pdf'; }
+lab 'test -f /opt/wonderink-check/www/ark.pdf' || { run pdf >/dev/null; lab 'cp "/home/teacher/Downloads/Wonder Ink/Colour the Ark.pdf" /opt/wonderink-check/www/ark.pdf; chmod a+r /opt/wonderink-check/www/ark.pdf'; }
 
 for scenario in "${scenarios[@]}"; do
     echo "$scenario"

tools/lab/wonderink-print-rig.py

@@ -121,7 +121,7 @@ elif scenario == "pdf-viewer-button":
     window.open_pdf(worksheet()); view = window.current()
     QTimer.singleShot(2500, lambda: (actions["web"](view), view.page().printRequested.emit()))
 elif scenario == "inline":
-    view = window.open_tab(); view.load(QUrl("http://127.0.0.1:8088/ark.pdf"))
+    view = window.open_tab(); view.load(QUrl("http://127.0.0.1:8089/ark.pdf"))
     QTimer.singleShot(4000, lambda: (stamp(f"inline mime={window._mime.get(view)!r} shows_pdf={window._shows_pdf(view)}"),
         QTimer.singleShot(0, lambda: window.print_view(view)),
         when(ready, lambda: (stamp(f"worksheet tab opened: tabs={window._tabs.count()} current_is_pdf={window.current() in window._pdf_views}"), press_print()), "inline preview")))