fix: make an existing classroom converge into the Plasma appliance

A real room upgraded to 0.1.45 and came up as stock Debian Plasma with
the old Waybar across the top, mako still catching notifications, and a
lock screen on an account that has no password.

The cause was one line, and it was in the lab: the harness handed the
session under test XDG_CONFIG_DIRS by hand, so every result it had ever
produced was a result about a machine somebody had already configured.
On a machine SDDM starts the session through PAM, PAM does not read
/etc/environment.d, and Debian's own plasma-workspace env.sh then set the
variable from scratch — so the classroom's settings directory was not in
the cascade at all. No layout, no lock policy, no Kiosk restrictions.

The settings now arrive the way Plasma delivers them, through a file in
/etc/xdg/plasma-workspace/env. Around that: the look and feel is
immutable on its own key so a stale profile cannot answer for it; the
palette is composed into the package, because naming a colour scheme does
not produce one and the dark bar had been coming from a technician's
hand; the desktop reset converges another desktop's appearance state and
keeps the room's own; and classroom-migrate stops, deactivates and masks
the old shell, including the D-Bus activation that brought mako back
while the panel was down — found only by killing the panel on a migrated
machine.

device.conf loses COMPOSITOR and comes off the hyprland channel, which
would otherwise have handed the room the experiment back.

The lab stops flattering the package: it restarts the machine, lets SDDM
actually autologin, and asks a fresh install and a machine upgraded from
the Hyprland package the same sixty questions. Both answer identically,
twice, and the panel still comes back from eight SIGKILLs.

Co-Authored-By: Claude Opus 5 <[email protected]>

tools/lab/lab

@@ -35,6 +35,17 @@ outer() {
     session_env -e WAYLAND_DISPLAY="$OUTER" -e SWAYSOCK="$sock" "$NAME" "$@"
 }
 
+# NOTE ON XDG_CONFIG_DIRS.
+#
+# This harness used to hand the session
+# XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg, and every result it
+# produced was therefore a result about a machine somebody had already
+# configured by hand. A real session is started by SDDM through PAM, which
+# does not read /etc/environment.d, and the classroom's settings were not
+# in the cascade at all: the first real upgrade came up as stock Debian
+# Plasma with a lock screen. The variable is deliberately not set here any
+# more. The package has to put it there, the way it has to on a machine.
+
 # Talk to the Plasma session under test.
 inner() {
     session_env -e WAYLAND_DISPLAY=wayland-0 -e XDG_CURRENT_DESKTOP=KDE \
@@ -74,6 +85,55 @@ down)
     echo "lab $NAME is down"
     ;;
 
+reboot)
+    # As close to a room being switched off and on as a container gets:
+    # the same filesystem, a new PID 1, a new user manager, and every
+    # generator and drop-in read again from scratch. The migration work
+    # needs this, because half of what an upgrade changes is only read at
+    # boot.
+    docker restart "$NAME" >/dev/null
+    for _ in $(seq 1 90); do
+        state=$(docker exec "$NAME" systemctl is-system-running 2>/dev/null || true)
+        [[ "$state" == running || "$state" == degraded ]] && break
+        sleep 1
+    done
+    for _ in $(seq 1 30); do
+        docker exec "$NAME" test -S /run/user/1000/bus && break
+        sleep 1
+    done
+    docker exec "$NAME" ln -sf /usr/bin/qdbus6 /usr/local/bin/qdbus
+
+    # SDDM really does autologin here: it authenticates the classroom
+    # through PAM and launches the Plasma session, and then has no display
+    # hardware to draw it on. That is worth having — it is the real login
+    # path, not a reading of a configuration file — so the attempt is left
+    # to happen and its evidence stays in the journal. It is then stopped,
+    # because the harness runs its own session on the nested compositor
+    # and two sessions cannot both own the keyboard.
+    for _ in $(seq 1 30); do
+        docker exec "$NAME" journalctl -u sddm --no-pager 2>/dev/null \
+            | grep -q "Session started" && break
+        sleep 1
+    done
+    docker exec "$NAME" systemctl stop sddm >/dev/null 2>&1 || true
+    docker exec "$NAME" pkill -f sddm-helper >/dev/null 2>&1 || true
+    # -f, not -x. "startplasma-wayland" is longer than the fifteen
+    # characters a process name has, so -x silently matches nothing and
+    # SDDM's session was left winding down underneath the harness's own:
+    # it tore down graphical-session.target sixteen seconds later and took
+    # the panel with it, which cost an afternoon to understand.
+    docker exec "$NAME" pkill -f startplasma-wayland >/dev/null 2>&1 || true
+    docker exec "$NAME" pkill -f plasma-dbus-run-session >/dev/null 2>&1 || true
+    for _ in $(seq 1 20); do
+        state=$(docker exec -u classroom -e XDG_RUNTIME_DIR=/run/user/1000 "$NAME" \
+            systemctl --user is-active graphical-session.target 2>/dev/null || true)
+        [[ "$state" != active ]] && break
+        sleep 1
+    done
+    sleep 2
+    echo "lab $NAME rebooted ($(docker exec "$NAME" systemctl is-system-running 2>/dev/null || true))"
+    ;;
+
 outer-up)
     # A headless compositor has no input devices, and a wl_seat with no
     # pointer capability never gives the session under test a pointer to
@@ -103,7 +163,6 @@ plasma-up)
         -e WAYLAND_DISPLAY="$OUTER" -e XDG_SESSION_TYPE=wayland \
         -e XDG_CURRENT_DESKTOP=KDE -e LIBGL_ALWAYS_SOFTWARE=1 \
         -e QT_LOGGING_RULES="kwin_scripting.debug=true" \
-        -e XDG_CONFIG_DIRS=/etc/ekklesia-classroom/xdg:/etc/xdg \
         -d "$NAME" sh -c 'exec startplasma-wayland > /tmp/plasma.log 2>&1'
     for _ in $(seq 1 60); do
         docker exec "$NAME" pgrep -x plasmashell >/dev/null 2>&1 && break
@@ -114,9 +173,22 @@ plasma-up)
     ;;
 
 plasma-down)
+    # A logout, not a killing. plasmashell and kwin are both services of
+    # the user manager, and killing them only makes it start them again —
+    # the compositor came straight back holding wayland-0 and the next
+    # session could not start at all. The workspace target has to go down
+    # first, and this is what a real logout does too.
+    session_env "$NAME" systemctl --user stop plasma-workspace.target \
+        >/dev/null 2>&1 || true
     docker exec "$NAME" pkill -u classroom -f startplasma-wayland || true
-    docker exec "$NAME" pkill -u classroom -x plasmashell || true
-    docker exec "$NAME" pkill -u classroom -x kwin_wayland || true
+    session_env "$NAME" systemctl --user stop graphical-session.target \
+        >/dev/null 2>&1 || true
+    for _ in $(seq 1 20); do
+        docker exec "$NAME" pgrep -x kwin_wayland >/dev/null 2>&1 || break
+        sleep 1
+    done
+    docker exec "$NAME" pkill -u classroom -x kwin_wayland >/dev/null 2>&1 || true
+    docker exec "$NAME" pkill -u classroom -x plasmashell >/dev/null 2>&1 || true
     sleep 2
     echo "plasma session down"
     ;;
@@ -200,6 +272,7 @@ usage: tools/lab/lab COMMAND
   build            build the lab image
   up               start the lab container (systemd inside)
   down             remove it
+  reboot           restart the machine, let SDDM autologin, then stand down
   session          outer compositor + a Plasma session on top of it
   outer-up         just the outer compositor
   plasma-up        just the Plasma session