feat: give every room the broker, one scale, and its own panel back

Little Waders took the Plasma build and reported what a container
cannot. A disc player on a machine with no optical drive, a clock nobody
at the back of the room could read, a browser at half the size of the
panel around it, and Parent Call with no broker to call.

The broker is the same for every classroom, so it is a default now and
not something to fill in room by room. classroom-migrate brings an
existing room to the same place without touching its name, its username
or its password, and Parent Call distinguishes a broker it cannot reach
from one that was never set up: those send somebody to look at
completely different things.

The disc player's detection was right and ran too late — alongside the
session rather than before it, and the panel is built from the layout the
moment a session starts. It runs before the display manager now, and
again from udev when a drive is plugged in.

UI_SCALE had a ceiling of 1.5, which cannot express a 4K television; a
clock pinned at 15 points, which is the same size at every scale; and a
browser that was never told the number at all. All three are fixed and
the room doubles together at 200%.

This also brings 0.1.47's work into the repository, where it had only
ever existed in a build directory under /tmp: the hidden display dialog,
its authenticated writer, the polkit action, and the church's own
wallpaper. One piece of it is deliberately left out. The custom volume
display needed a shell package of our own, and with one selected
plasmashell builds no panel at all — measured twice, with that build's
own files, on a classroom that deletes its panel configuration at every
login by design.

The lab connected to the real church broker the moment the package
defaulted to it. Nothing was left behind, which was checked, but the
guard that should have stopped it had never worked: it used iptables,
which the lab image does not have, and probed with /dev/tcp under dash,
where that always fails. Both reported success.

Co-Authored-By: Claude Opus 5 <[email protected]>

tests/test-deployment-support.sh

@@ -12,6 +12,7 @@ from pathlib import Path
 root = Path(sys.argv[1])
 control = (root / "packaging/debian/control.template").read_text()
 postinst = (root / "packaging/debian/postinst").read_text()
+migrate = (root / "scripts/classroom-migrate").read_text()
 provision = (root / "scripts/classroom-provision").read_text()
 units = "\n".join(path.read_text() for path in (root / "systemd").rglob("*.service"))
 canary = (root / "update_canary.sh").read_text()
@@ -21,7 +22,7 @@ rules = (root / "config/plasma/xdg/kwinrulesrc").read_text()
 restrictions = (root / "config/plasma/xdg/kdeglobals").read_text()
 supervision = (root / "systemd/user/plasma-plasmashell.service.d/ekklesia-classroom.conf").read_text()
 build = (root / "tools/build-release.sh").read_text()
-policy = json.loads(
+chrome_policy = json.loads(
     (root / "config/chrome/policies/managed/ekklesia-classroom.json").read_text()
 )
 
@@ -67,7 +68,8 @@ check("Avahi service and socket are masked", "systemctl mask avahi-daemon.socket
 check("printer setup is not a blocking boot dependency", "classroom-printer-setup" not in units)
 check("printer setup runs automatically in provisioning", "/usr/local/bin/classroom-printer-setup" in provision)
 check("printer provisioning is bounded", "--kill-after=5s 30s" in provision)
-check("Chrome uses the system print dialog", policy.get("DisablePrintPreview") is True)
+check("Chrome uses the system print dialog",
+      chrome_policy.get("DisablePrintPreview") is True)
 
 print()
 print("4. secondary windows are the window manager's business")
@@ -103,10 +105,13 @@ check("settings install to the classroom's own directory",
 # file: it is the session environment drop-in that puts the directory
 # above into the cascade at all. A drop-in directory is built to be
 # added to; a name plasma-workspace already owns is not.
-xdg_paths = re.findall(r'\$STAGE(/etc/xdg/[^"]+)', build)
-check("the only file under /etc/xdg is the session env drop-in",
-      xdg_paths == ["/etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh"])
-check("no settings file takes a name plasma-workspace owns",
+xdg_paths = sorted(re.findall(r'\$STAGE(/etc/xdg/[^"]+)', build))
+check("what the classroom puts under /etc/xdg is two drop-ins",
+      xdg_paths == [
+          "/etc/xdg/autostart/ekklesia-classroom-scale.desktop",
+          "/etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh",
+      ])
+check("and no settings file takes a name plasma-workspace owns",
       not any(path.rsplit("/", 1)[0] == "/etc/xdg" for path in xdg_paths))
 check("and that directory is searched first",
       "XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg" in
@@ -207,6 +212,127 @@ first_rsync = canary.index("rsync -av")
 check("Trixie validation runs before the repository copy", validation < package_copy)
 check("Trixie validation runs before any upload", validation < first_rsync)
 
+print()
+print("7. one scale, applied everywhere")
+autostart = (root / "config/plasma/autostart/ekklesia-classroom-scale.desktop").read_text()
+policy = (root / "config/polkit/org.ekklesia.classroom.display.policy").read_text()
+settings_entry = (root / "config/plasma/applications/ekklesia-display-settings.desktop").read_text()
+browser = (root / "scripts/classroom-browser").read_text()
+wonderink = (root / "scripts/classroom-wonderink").read_text()
+config_module = (root / "lib/classroom_config.py").read_text()
+# UI_SCALE was packaged, clamped and documented, and nothing ever ran the
+# command that applies it. A 4K television showed a 1080p interface at
+# half size and every part of this section is a piece of that.
+check("the scale is applied at every login",
+      "Exec=/usr/local/bin/classroom-scale" in autostart)
+check("by the session, which is where kscreen-doctor can be asked",
+      "OnlyShowIn=KDE" in autostart)
+check("and the package installs it",
+      "/etc/xdg/autostart/ekklesia-classroom-scale.desktop" in build)
+check("changing it needs an administrator password",
+      "auth_admin" in policy and "classroom-set-scale" in policy)
+check("and there is no way into it from the room",
+      "NoDisplay=true" in settings_entry
+      and "X-KDE-Shortcuts=Meta+Ctrl+Alt+Shift+D" in settings_entry)
+check("2.0 is inside the range a room may ask for",
+      "UI_SCALE_MAX = 3.0" in config_module)
+check("the browser is told the same number",
+      '--force-device-scale-factor="$SCALE"' in browser)
+check("so is Wonder Ink",
+      '--force-device-scale-factor="$SCALE"' in wonderink)
+check("both ask the one command for it",
+      "classroom-ui-scale" in browser and "classroom-ui-scale" in wonderink)
+check("the clock is sized by the bar, not by a number",
+      'autoFontAndSize", true' in layout and "fontSize" not in layout)
+
+print()
+print("7b. the disc player is decided before a session starts")
+layout_unit = (root / "systemd/layout/ekklesia-classroom-layout.service").read_text()
+udev = (root / "config/udev/60-ekklesia-classroom-optical.rules").read_text()
+reset = (root / "scripts/classroom-desktop-reset").read_text()
+check("before the display manager", "Before=display-manager.service" in layout_unit)
+check("started at every boot", "WantedBy=graphical.target" in layout_unit)
+check("enabled by the package", "enable ekklesia-classroom-layout.service" in postinst)
+check("a drive plugged in later is noticed", 'ENV{ID_CDROM}=="1"' in udev)
+check("and the rules are reloaded on install", "udevadm control --reload-rules" in postinst)
+check("the login says so when the layout and the hardware disagree",
+      "the disc player=" in reset)
+
+print()
+print("7c. the room's own popups")
+style = (root / "config/plasma/desktoptheme/dialogs/background.svg").read_text()
+plasmarc = (root / "config/plasma/xdg/plasmarc").read_text()
+notify = (root / "config/plasma/xdg/plasmanotifyrc").read_text()
+policy_notifications = chrome_policy.get("DefaultNotificationsSetting")
+# A Plasma style is a set of pictures with a per-file fallback to Breeze.
+# Replacing the notification plasmoid's QML was the other route and a QML
+# error there is a room with no notifications at all.
+for piece in ("topleft", "top", "topright", "left", "center", "right",
+              "bottomleft", "bottom", "bottomright"):
+    check(f"the card has a {piece}", f'id="{piece}"' in style)
+check("the style is chosen, immutably", "name[$i]=ekklesia" in plasmarc)
+check("and the package installs it", "desktoptheme/ekklesia" in build)
+check("the colour still comes from the session's scheme",
+      "ColorScheme-Background" in style)
+check("notifications stay long enough to read across a room",
+      "PopupTimeout=8000" in notify)
+# The volume display is the one thing the classroom's shell package
+# overrides. Plasma 6.3 loads the on-screen display from the shell
+# package and from nowhere else — the look and feel is not consulted,
+# which was measured — so this is the supported way to replace it. The
+# fallback declaration is what keeps the package this small: without it a
+# shell package loses the desktop's own defaults, and the wallpaper with
+# them, which was also measured.
+# The volume display is Plasma's own. Replacing it needs a shell package
+# — 6.3 reads the on-screen display from there and nowhere else — and a
+# shell package with one selected builds no panel at all. Measured twice,
+# and the panel is rebuilt from the layout at every login on purpose, so
+# the room would have come up empty. The scale makes Plasma's own display
+# the right size on a television, which is what was actually wanted.
+check("no shell package of our own", "plasma/shells" not in build)
+check("and nothing selects one", "ShellPackage" not in build)
+check("the volume chime is off", 'volumeFeedback", false' in layout)
+check("and off in the setting Plasma 6 actually reads",
+      "AudioFeedback[$i]=false"
+      in (root / "config/plasma/xdg/plasmaparc").read_text())
+check("but the display itself is on", 'volumeOsd", true' in layout)
+check("web pages cannot put a notification on the television",
+      policy_notifications == 2)
+check("and cannot ask to",
+      chrome_policy.get("NotificationsAllowedForUrls") == []
+      and chrome_policy.get("NotificationsBlockedForUrls") == ["*"])
+
+print()
+print("7c-ii. the v2 channel is its own")
+v2 = (root / "update_classroom_v2.sh").read_text()
+# A publish script that can reach another channel's manifest is one
+# mistake away from putting the Plasma build on a sway room.
+code = "\n".join(line for line in v2.splitlines()
+                 if not line.lstrip().startswith("#"))
+check("it publishes to classroom-v2", "CHANNEL=classroom-v2" in code)
+check("and names no other channel anywhere it acts",
+      "stable" not in code and "canary" not in code)
+check("the same Trixie gate runs first",
+      code.index("validate-trixie-release.sh") < code.index("rsync"))
+check("and the manifest goes up last",
+      code.rindex("manifest.json") > code.index("packages/"))
+
+print()
+print("7d. the broker every room shares")
+mqtt_unit = (root / "systemd/mqtt/ekklesia-classroom-mqtt.service").read_text()
+parent_call = (root / "lib/classroom_parent_call.py").read_text()
+check("the link is restarted whatever it exits with",
+      "Restart=always" in mqtt_unit)
+check("it is enabled by the package",
+      "enable ekklesia-classroom-mqtt.service" in postinst)
+check("a fresh room points at the church broker",
+      "MQTT_HOST=10.40.0.2" in config_module)
+check("an upgraded one is brought to the same place",
+      'BROKER_HOST = "10.40.0.2"' in migrate)
+check("Parent Call tells a missing broker from an unreachable one",
+      "has no church network set up" in parent_call
+      and "Cannot reach the church network" in parent_call)
+
 print()
 print(f"passed: {passed}  failed: {failed}")
 raise SystemExit(1 if failed else 0)