fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

tools/build-release.sh

@@ -206,17 +206,32 @@ install -Dm644 \
 
 # Not /etc/xdg: plasma-workspace already owns files by these names there.
 # The classroom's directory goes in front of it in XDG_CONFIG_DIRS instead.
-for setting in kdeglobals kwinrc kwinrulesrc kscreenlockerrc ksmserverrc \
+for setting in kwinrc kwinrulesrc kscreenlockerrc ksmserverrc \
         krunnerrc plasmanotifyrc powermanagementprofilesrc; do
     install -Dm644 \
         "$ROOT/config/plasma/xdg/${setting}" \
         "$STAGE/etc/ekklesia-classroom/xdg/${setting}"
 done
 
+# kdeglobals is composed rather than copied: the session policy plus the
+# dark palette itself. Naming a colour scheme does not produce one, and a
+# room whose user profile had never had a scheme applied came up light.
+install -d "$STAGE/etc/ekklesia-classroom/xdg"
+"$ROOT/tools/build-kdeglobals" > "$STAGE/etc/ekklesia-classroom/xdg/kdeglobals"
+chmod 0644 "$STAGE/etc/ekklesia-classroom/xdg/kdeglobals"
+
 install -Dm644 \
     "$ROOT/config/environment/90-ekklesia-classroom.conf" \
     "$STAGE/etc/environment.d/90-ekklesia-classroom.conf"
 
+# The one that actually reaches a session started by a display manager.
+# startplasma sources this directory; PAM does not read environment.d, so
+# without this file none of the settings above are in the cascade at all
+# and the room comes up as stock Plasma. Measured, on a real machine.
+install -Dm644 \
+    "$ROOT/config/plasma/env/zz-ekklesia-classroom.sh" \
+    "$STAGE/etc/xdg/plasma-workspace/env/zz-ekklesia-classroom.sh"
+
 # The power button does nothing. Two layers, because while a session is
 # running PowerDevil holds logind's inhibitor and would overrule it.
 install -Dm644 \
@@ -260,6 +275,14 @@ install -Dm644 \
     "$ROOT/config/plasma/solid/ekklesia-dvd.desktop" \
     "$STAGE/usr/share/solid/actions/ekklesia-dvd.desktop"
 
+# Shadows the old notification daemon's D-Bus activation. Deactivating its
+# systemd unit is not enough: D-Bus starts it on demand from a file
+# mako-notifier owns, and the crash-recovery test on a migrated machine
+# caught it doing exactly that while the panel was down.
+install -Dm644 \
+    "$ROOT/config/dbus/fr.emersion.mako.service" \
+    "$STAGE/usr/local/share/dbus-1/services/fr.emersion.mako.service"
+
 # Two marks the classroom draws itself, because nothing in Breeze says
 # either thing: a lesson, and fetching a child's grown-up.
 for icon in ekklesia-wonderink ekklesia-parent-call; do
@@ -310,6 +333,12 @@ install -Dm755 \
     "$ROOT/scripts/classroom-theme" \
     "$STAGE/usr/local/bin/classroom-theme"
 
+# Converges a machine that used to run something else. Called from
+# postinst on every install, and by hand by a technician.
+install -Dm755 \
+    "$ROOT/scripts/classroom-migrate" \
+    "$STAGE/usr/local/bin/classroom-migrate"
+
 install -Dm644 \
     "$ROOT/lib/classroom_audio.py" \
     "$STAGE/usr/local/lib/ekklesia-classroom/classroom_audio.py"