feat: give every room the broker, one scale, and its own panel back

Little Waders took the Plasma build and reported what a container
cannot. A disc player on a machine with no optical drive, a clock nobody
at the back of the room could read, a browser at half the size of the
panel around it, and Parent Call with no broker to call.

The broker is the same for every classroom, so it is a default now and
not something to fill in room by room. classroom-migrate brings an
existing room to the same place without touching its name, its username
or its password, and Parent Call distinguishes a broker it cannot reach
from one that was never set up: those send somebody to look at
completely different things.

The disc player's detection was right and ran too late — alongside the
session rather than before it, and the panel is built from the layout the
moment a session starts. It runs before the display manager now, and
again from udev when a drive is plugged in.

UI_SCALE had a ceiling of 1.5, which cannot express a 4K television; a
clock pinned at 15 points, which is the same size at every scale; and a
browser that was never told the number at all. All three are fixed and
the room doubles together at 200%.

This also brings 0.1.47's work into the repository, where it had only
ever existed in a build directory under /tmp: the hidden display dialog,
its authenticated writer, the polkit action, and the church's own
wallpaper. One piece of it is deliberately left out. The custom volume
display needed a shell package of our own, and with one selected
plasmashell builds no panel at all — measured twice, with that build's
own files, on a classroom that deletes its panel configuration at every
login by design.

The lab connected to the real church broker the moment the package
defaulted to it. Nothing was left behind, which was checked, but the
guard that should have stopped it had never worked: it used iptables,
which the lab image does not have, and probed with /dev/tcp under dash,
where that always fails. Both reported success.

Co-Authored-By: Claude Opus 5 <[email protected]>

docs/classroom-v2-experiment.md

@@ -1096,6 +1096,111 @@ Measured: `classroom-theme light`, log out, and the bar came back dark.
 The rule is now whose the defaults are: the classroom's are kept, another
 desktop's are removed.
 
+## The rooms themselves: 0.1.48
+
+The first real classroom, Little Waders, took the Plasma build and then
+reported what a lab cannot: a disc player on a machine with no drive, a
+clock nobody could read, a browser at half the size of the panel around
+it, and Parent Call with no broker to call.
+
+### The broker every room shares
+
+There is one, at 10.40.0.2, and every classroom uses it. It is a default
+now rather than something to fill in room by room: a fresh machine is
+pointed at it, and `classroom-migrate` brings an existing one to the same
+place — switched on if it was off, addressed if it was blank, and left
+exactly as it is if somebody deliberately pointed it elsewhere. The room
+name, the username and the password are read by none of it and printed by
+none of it, which `tests/test-classroom-migrate-config.sh` checks against
+the real migration code rather than a copy of it.
+
+The link restarts on `always` rather than `on-failure`, because it exits
+cleanly when it finds no broker configured and a machine set up before
+the church had one would otherwise never pick it up.
+
+Parent Call now says which of the two problems a teacher has. "Cannot
+reach the church network" and "This room has no church network set up"
+send somebody to look at completely different things, and saying the
+first when the truth is the second costs an hour at a router.
+
+### A disc player on a machine with no drive
+
+The detection was right and it ran too late. `classroom-provision` runs at
+boot *alongside* the session rather than before it, and the panel is built
+from the layout the moment a session starts: a room told about its own
+hardware afterwards keeps the wrong bar until the next login.
+`ekklesia-classroom-layout.service` runs it before the display manager
+instead, a udev rule re-runs it when a drive is plugged in or pulled out,
+and the login says so in the journal when the layout and the hardware
+disagree. Measured in a mount namespace with no `/dev/sr*`: the launcher
+is removed and the rebuilt panel has ten applets and no disc.
+
+### One scale, and everything that was not following it
+
+`UI_SCALE` had been packaged, clamped, documented — and applied by an
+autostart entry that only appeared in 0.1.47. Three things were still
+outside it:
+
+* **The ceiling was 1.5.** A 4K television wants 2.0, so a room asking for
+  it silently got 1.5. It is 3.0 now, and the hidden display dialog
+  offers up to it.
+* **The clock was pinned at 15 points**, which is the same size at every
+  scale. It is sized by the bar now, which follows the scale like
+  everything else.
+* **Chrome was not told.** On Wayland it did not follow the compositor's
+  output scale, so the browser was half the size of the panel around it.
+  Both launchers pass `--force-device-scale-factor`, from the one command
+  that owns the number.
+
+Measured at 200% in the lab: the panel, the clock, the notification card,
+Chrome's tab strip and the page itself all doubled together.
+
+### The notification card
+
+A Plasma style, which is the supported way and the reason no QML was
+replaced. A style is a set of pictures and anything the classroom does not
+provide comes from Breeze, so the worst this can do is look wrong — never
+fail to appear. Replacing the notification plasmoid's QML was the other
+route and a QML error there is a room with no notifications at all.
+
+Web pages are blocked from notifying at the policy level, with no prompt:
+a permission dialog in a classroom is a dialog a child can agree to.
+
+### The volume display, and a shell package that costs the panel
+
+The 0.1.47 build replaced Plasma's on-screen volume display with its own,
+through a shell package of its own. Plasma 6.3 does read the display from
+there and from nowhere else — the look and feel is not consulted, which
+was measured — so the mechanism was right.
+
+**With that shell package selected, plasmashell builds no panel at all.**
+Not ours, not the stock one. Measured twice, with the 0.1.47 package's own
+files. The classroom deletes its panel configuration at every login on
+purpose, so every login was one step away from a television showing a
+wallpaper and nothing else.
+
+So it is gone, and the volume display is Plasma's own. It is drawn at the
+room's scale like everything else, which is what the television actually
+needed. `classroom-desktop-reset` also strips a `ShellPackage` line out of
+a profile written while the old build was installed.
+
+The chime stays off, in `plasmaparc`, which is the file Plasma 6 actually
+reads for it.
+
+### What the lab was allowed to reach
+
+Pointing the package at the real broker had an immediate consequence: the
+lab connected to it, under a container id, as a room. Nothing was left
+behind — the broker held no retained status for it afterwards, which was
+checked — but the lab had no business being there.
+
+`tools/lab/lab up` now blackholes both church networks before anything
+starts, and refuses to continue if either is still reachable. The rig had
+carried a guard for this since it was written and it had never once
+worked: it used `iptables`, which is not installed in the lab image, and
+it probed with `/dev/tcp` under `sh`, which is a bash feature and fails
+under dash whatever the network is doing. Both were reported as success.
+
 ## Unresolved risks
 
 In the order I would worry about them.
@@ -1160,7 +1265,17 @@ In the order I would worry about them.
     take it back, and nothing is published there. Until it is, a v2
     machine takes no updates at all. That is deliberate; it is also a
     thing to remember before leaving one in a room.
-15. **Ctrl+Alt+T is still registered.** Konsole's own entry declares it
+15. **Nothing in this pass has been on the classroom machines.** The
+    development host has no route to Little Waders — its SSH refuses this
+    machine's key, and the control computer cannot reach it either — so
+    every result above is the lab's. The package is built and the deploy
+    commands are written down; the room itself is unverified.
+16. **The v2 channel still has no manifest.** `update_classroom_v2.sh`
+    exists now and has not been run. Until it is, a v2 room takes no
+    updates at all, and `classroom-migrate` moves every upgraded machine
+    onto that channel — deliberately, because stable and canary would
+    both hand a Plasma room the sway build back.
+17. **Ctrl+Alt+T is still registered.** Konsole's own entry declares it
     and the registration survives being shadowed. It is inert, because
     Konsole refuses to open a shell under the classroom's
     `shell_access=false` — measured — but it rests on that one
@@ -1260,29 +1375,44 @@ The existing Debian classroom test VM should be kept.
   session's configuration path by hand, it restarts the machine, and it
   asks a fresh install and a machine upgraded from the Hyprland
   experiment the same sixty questions. Both answer them identically.
+* **0.1.47's work brought into the repository**, where it had only ever
+  existed in a build directory: the hidden display dialog behind
+  Meta+Ctrl+Alt+Shift+D, its authenticated writer, the polkit action, the
+  autostart entry that applies the scale, and the church's own wallpaper.
+* **The broker given to every room**, the disc player decided before the
+  session starts, the clock and the browser brought under the one scale,
+  the notification card given a Plasma style of its own, and the shell
+  package that cost the panel taken back out — 0.1.48.
 
 **Next**, in order:
 
-0. **The thirty-second Escape test**, before anything is built on the
+0. **Deploy 0.1.48 to Little Waders and run the list.** Everything in
+   *The rooms themselves* is lab work: the development host cannot reach
+   the classroom machines at all. The deploy and rollback commands are in
+   the report that accompanies this build, and the checks that matter are
+   the panel after a reboot, the clock and the browser at the room's
+   scale, Parent Call with a typed name, the broker, HDMI audio and the
+   volume keys.
+1. **The thirty-second Escape test**, before anything is built on the
    gesture: bind a probe entry to `Escape`, press it in a fullscreen
    video, and see whether the video leaves fullscreen. That settles the
    one thing this pass could not measure.
-1. **On the bench, tonight.** Type a name into Parent Call with a real
+2. **On the bench, tonight.** Type a name into Parent Call with a real
    keyboard. Switch a television on after the computer and listen. Play a
    disc. These three are the only things left that a container cannot
    answer, and each of them is a Sunday-morning path. Add the power
    button and the maintenance chord to that list.
-2. Publish the v2 channel. `classroom-migrate` already moves a migrated
+3. Publish the v2 channel. `classroom-migrate` already moves a migrated
    room onto `CHANNEL=classroom-v2`, and nothing serves that manifest
    yet, so those machines are taking no updates at all. This is now the
    first packaging job rather than a tidy-up.
-3. Take the upgraded VM through the same list by hand:
+4. Take the upgraded VM through the same list by hand:
    `tools/lab/converged-check` is the shape of it, and the things a
    container cannot answer are the lock screen never appearing after an
    hour alone, and the machine still being there on Monday.
-4. Bench-test SDDM on hardware: autologin all the way to a picture, and
+5. Bench-test SDDM on hardware: autologin all the way to a picture, and
    that ending the session brings the classroom back rather than a shell.
-5. When the CEC adapters have been exercised, replace the computer volume
+6. When the CEC adapters have been exercised, replace the computer volume
    applet with a television control, behind the service boundary in
    *Television control, and where CEC will fit*.
-6. Live View, when the rest is quiet.
+7. Live View, when the rest is quiet.