feat: the power button does nothing, and one chord opens a terminal

Two layers for the button, because one is not enough: while a session is
running PowerDevil holds logind's handle-power-key inhibitor and acts on
the button itself, so a logind drop-in alone would be overruled. logind
covers the machine before the session starts, after it ends, and if
PowerDevil is not running. Verified: after the drop-in is installed and
logind reloaded, it reports ignore for the power, suspend, hibernate and
lid keys, and the running session was not disturbed by the reload.

Holding the button still cuts the power. That is firmware, below any
operating system, and it is deliberately left alone as the only recovery
a person standing at a wedged machine has.

The maintenance terminal is Meta+Ctrl+Alt+Shift+K, declared in the
package rather than seeded into a teacher's configuration, where an
update could not reach it. KGlobalAccel read it and registered the
component; invoking it opened a working shell.

It needed a wrapper. The classroom's Kiosk policy sets shell_access=false
and Konsole honours it — measured: with the classroom configuration in
its cascade Konsole starts and says "Program to run not set." The
restriction is worth keeping everywhere else, so it is lifted for this
one process by leaving the classroom's configuration directory out of
its cascade. It grants no privilege: the classroom user has no sudo
rule, and that restriction was always a barrier in the interface rather
than a privilege boundary.

Konsole's own entry is shadowed and hidden from /usr/local/share, so
nothing is patched and Konsole's package stays maintainable. Nothing is
pinned to the panel; a task button appears only while a terminal is
open, and closing it returns the bar to three launchers.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/test-deployment-support.sh

@@ -119,6 +119,51 @@ for entry in sorted((root / "config/plasma/applications").glob("*.desktop")):
           f'"$ROOT/config/icons/${{icon}}.svg"' in build or icon in build)
     check(f"{icon}.svg exists", (root / f"config/icons/{icon}.svg").is_file())
 
+print()
+print("4b4. the power button does nothing, at both layers")
+logind = (root / "config/systemd/logind-ekklesia-classroom.conf").read_text()
+power = (root / "config/plasma/xdg/powermanagementprofilesrc").read_text()
+# PowerDevil holds logind's handle-power-key inhibitor while a session is
+# running, so one layer without the other is a button that still works.
+for key in ("HandlePowerKey=ignore", "HandleSuspendKey=ignore",
+            "HandleHibernateKey=ignore", "HandleLidSwitch=ignore"):
+    check(f"logind: {key}", key in logind)
+check("PowerDevil: no action on the power button",
+      power.count("powerButtonAction=0") == 3)
+check("PowerDevil: no action on a lid either",
+      power.count("lidAction=0") == 3)
+check("and the session cannot put an action back",
+      power.count("[$i]") == 3)
+check("the logind drop-in is packaged",
+      "/etc/systemd/logind.conf.d/ekklesia-classroom.conf" in build)
+check("the PowerDevil profile is packaged",
+      "powermanagementprofilesrc" in build)
+check("the long hold is left alone on purpose",
+      "firmware" in logind)
+
+print()
+print("4b5. the maintenance terminal is hidden and reachable")
+admin = (root / "config/plasma/applications/ekklesia-admin-terminal.desktop").read_text()
+konsole = (root / "config/plasma/applications-local/org.kde.konsole.desktop").read_text()
+wrapper = (root / "scripts/classroom-admin-terminal").read_text()
+check("the chord is the obscure one",
+      "X-KDE-Shortcuts=Meta+Ctrl+Alt+Shift+K" in admin)
+check("its entry is in no application list", "NoDisplay=true" in admin)
+check("Konsole's own entry is shadowed and hidden",
+      "NoDisplay=true" in konsole)
+check("the shadow is in /usr/local/share, not on top of Konsole's file",
+      "$STAGE/usr/local/share/applications/" in build)
+check("the terminal is launched outside the classroom's restrictions",
+      "XDG_CONFIG_DIRS=/etc/xdg" in wrapper)
+check("and grants no privilege of its own",
+      "sudo" not in wrapper.replace("no sudo rule", ""))
+check("the wrapper is packaged", "classroom-admin-terminal" in build)
+check("Konsole is a dependency, so the route exists on every machine",
+      "konsole" in (root / "packaging/debian/control.template").read_text())
+check("no terminal is pinned to the panel",
+      "konsole" not in (root / "config/plasma/lookandfeel/contents/layouts"
+                        / "org.kde.plasma.desktop-layout.js").read_text().lower())
+
 print()
 print("4c. the teacher cannot reach a command line")
 for restriction in ("run_command=false", "shell_access=false",