fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

config/dbus/fr.emersion.mako.service

@@ -0,0 +1,22 @@
+[D-BUS Service]
+# The old notification daemon, made unstartable.
+#
+# Removing mako's activation from systemd was not enough, and this was
+# measured rather than guessed: during the crash-recovery test on a
+# migrated machine, the panel was killed, something in the session sent a
+# notification while nothing owned org.freedesktop.Notifications, and
+# D-Bus started mako from the file mako-notifier ships. The room would
+# then have had the old shell's popups on a Plasma desktop, from a daemon
+# with no configuration, until the next reboot.
+#
+# This file shadows that one. The session bus searches XDG_DATA_DIRS in
+# order and /usr/local/share comes before /usr/share, which is the same
+# mechanism the classroom already uses to shadow a desktop entry — no
+# Debian file is touched, and mako-notifier can be upgraded or removed
+# without any of this needing to change.
+#
+# /bin/false is what a machine with no notification daemon installed does
+# anyway: the activation fails and the caller is told so. Plasma's own
+# service takes the name at startup and never comes through here.
+Name=org.freedesktop.Notifications
+Exec=/bin/false

config/plasma/env/zz-ekklesia-classroom.sh

@@ -0,0 +1,33 @@
+# Put the classroom's settings into the session's configuration cascade.
+#
+# This is the file the migration failure turned on. Everything the room is
+# — the panel layout, the lock screen that must never appear, the idle
+# behaviour, the Kiosk restrictions — lives in /etc/ekklesia-classroom/xdg
+# and reaches Plasma only if that directory is in XDG_CONFIG_DIRS. It was
+# set in /etc/environment.d, which systemd's user manager reads. Measured
+# on a real machine and then reproduced in the lab: that is not enough.
+#
+# startplasma sources /etc/xdg/plasma-workspace/env/*.sh at session start,
+# and Debian's env.sh there sets XDG_CONFIG_DIRS from scratch when the
+# variable is empty — which it is, because SDDM starts the session through
+# PAM, and PAM does not read /etc/environment.d. startplasma then pushes
+# its own environment into the user manager, so the value from
+# /etc/environment.d was not merely bypassed, it was overwritten for every
+# user service as well. The room came up as stock Debian Plasma: kickoff,
+# a pager, a system tray, the Debian wallpaper, and a lock screen.
+#
+# So the classroom sets it where Plasma itself looks. The name sorts after
+# env.sh, so this appends to Debian's value rather than replacing it, and
+# the whole thing is a no-op if the directory is already there.
+#
+# The /etc/environment.d file stays: it covers user services that start
+# before, or without, a Plasma session.
+
+case ":${XDG_CONFIG_DIRS:-}:" in
+    *:/etc/ekklesia-classroom/xdg:*)
+        ;;
+    *)
+        XDG_CONFIG_DIRS="/etc/ekklesia-classroom/xdg:${XDG_CONFIG_DIRS:-/etc/xdg}"
+        export XDG_CONFIG_DIRS
+        ;;
+esac

config/plasma/xdg/kdeglobals

@@ -48,7 +48,18 @@ XftSubPixel=rgb
 
 [KDE]
 widgetStyle=Breeze
-LookAndFeelPackage=org.ekklesia.classroom.desktop
+# One key, marked immutable on its own rather than by freezing the group.
+#
+# This is the name plasmashell reads to decide which layout script builds a
+# panel for a session that has none, so it decides whether the room comes
+# up as the classroom or as stock Plasma. A migrated machine reached this
+# experiment with a user profile that had been through other desktops, and
+# a user's own kdeglobals sits ahead of every system directory in the
+# cascade. Immutable here means no leftover profile, and no stray write by
+# a settings dialog that does not exist in this room anyway, can answer
+# that question differently. The palette below stays writable, because
+# classroom-theme is allowed to change it.
+LookAndFeelPackage[$i]=org.ekklesia.classroom.desktop
 SingleClick=false
 AnimationDurationFactor=0.5
 

config/plasma/xdg/powermanagementprofilesrc

@@ -1,25 +1,47 @@
-# The desktop half of "the power button does nothing".
+# The classroom never sleeps, never dims, and never locks.
 #
-# PowerDevil takes logind's handle-power-key inhibitor while a session is
-# running, so the logind drop-in on its own would be overruled by
-# whatever this says. 0 is no action.
+# Two failures on real hardware are behind this file. The power button put
+# a room to sleep; and a machine left alone came back to a password prompt
+# on an account that is meant to have no password, which strands the
+# television until somebody arrives with SSH.
 #
-# Immutable, so nothing in the session can put an action back.
+# PowerDevil decides all of it. It also takes logind's handle-power-key
+# inhibitor while a session is running, so the logind drop-in on its own
+# would be overruled by whatever this says.
+#
+# Every profile is marked immutable at the profile level, not just on the
+# subgroups. PowerDevil loads an idle action only when the profile has a
+# group for it, so what matters here is as much what is absent — no
+# DimDisplay, no DPMSControl, no SuspendSession — as what is present, and
+# a writable profile is one a leftover user file can add those back to.
+# classroom-desktop-reset removes the user's copy at every login for the
+# same reason.
 #
 # Every profile gets the same answer. A classroom machine has no battery,
 # but a profile that exists and disagrees is worse than one that does not
 # exist at all.
+#
+# 0 is no action.
+
+[AC][$i]
+icon=battery-charging
 
 [AC][HandleButtonEvents][$i]
 powerButtonAction=0
 lidAction=0
 triggerLidActionWhenExternalMonitorPresent=false
 
+[Battery][$i]
+icon=battery-060
+
 [Battery][HandleButtonEvents][$i]
 powerButtonAction=0
 lidAction=0
 triggerLidActionWhenExternalMonitorPresent=false
 
+[LowBattery][$i]
+icon=battery-low
+
 [LowBattery][HandleButtonEvents][$i]
 powerButtonAction=0
 lidAction=0

config/sddm/ekklesia-classroom.conf

@@ -19,6 +19,11 @@ DisplayServer=wayland
 InputMethod=
 
 [Users]
-MaximumUid=1000
+# Wide enough to include a classroom account that was created after
+# another user. The first migrated room had uid 1001 and would not have
+# appeared in the greeter at all; autologin looks the name up directly and
+# still worked, but a room that ever falls back to the greeter must show
+# the account it is meant to log in as.
 MinimumUid=1000
+MaximumUid=1999
 HideShells=/usr/sbin/nologin,/bin/false

config/systemd/logind-ekklesia-classroom.conf

@@ -32,3 +32,9 @@ HandleRebootKeyLongPress=ignore
 HandleLidSwitch=ignore
 HandleLidSwitchExternalPower=ignore
 HandleLidSwitchDocked=ignore
+
+# logind's own idle timer, which is separate from PowerDevil's and runs
+# whether or not a session is up. ignore is the default, and a classroom
+# is not a machine to leave a default of this importance implicit on.
+IdleAction=ignore
+IdleActionSec=0