fix: put the popup close button in the dock, and clear the printer location

Three things, none of them redesigns.

The close affordance for a secondary Chrome window was a separate
layer-shell surface anchored to that window's corner, repositioned by a
five-per-second poll. Any position change tore the surface down and
built another, so on real hardware it chased the window and flickered.
Removed entirely: the GTK button process, the geometry maths that placed
it, the --close-button mode that spawned it, and the poll loop that
drove it. The window helper no longer imports GTK at all.

The behaviour underneath it was right and is kept. The first Chrome
top-level is the classroom browser, tiled and borderless; later ones
float centred at about three quarters of the output. Creation order is
the only thing that can tell them apart — confirmed on a real session,
where every Chrome top-level shares app_id, shell, PID and a null
transient_for, and sway exposes no window properties for Wayland
toplevels at all. Titles are still not used. It now follows sway's own
window events instead of polling, so dragging a popup costs nothing.

Close moved into the dock, which was already on screen and does not
move, so it cannot chase anything. It appears only while a secondary
window is focused and runs kill on that one container. The helper
publishes which window that is; the dock watches the file rather than
polling. A stock sway title bar has no close button, so restoring the
border would not have solved this either.

Two bugs found by looking rather than by testing state. Chrome
renegotiates the size of a popup opened with explicit dimensions after
the resize returns, which left windows centred for a width they no
longer had; placement now settles and repeats once, at creation only, so
dragging is still free. And the dock's Close button came up empty
because show_all does not recurse into a no-show-all widget.

The printer's Location is now blank. CUPS prints it under the queue name
in every dialog, so "Ekklesia Classroom" was a second line the teacher
had to read past; the identity is one word. The already-configured check
includes Location, so a machine set up before this is corrected rather
than left as close enough.

Co-Authored-By: Claude Opus 5 <[email protected]>

scripts/classroom-chrome-windows

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+
+"""Keep Chrome's first window tiled and make later windows usable popups.
+
+Chrome gives the main browser and its secondary top-level windows the same
+app_id, the same process and often nothing else to tell them apart. The only
+stable fact is creation order, so this remembers the first Chrome container
+and treats every later one as secondary. Page titles are deliberately ignored.
+
+The close affordance for a secondary window lives in the dock. An earlier
+attempt anchored a layer-shell button to the popup's own corner and moved it
+whenever the window moved; on real hardware it chased the window and
+flickered, because every position change meant tearing a surface down and
+building another one. The dock is already on screen, already owns the
+classroom's visual language, and does not move. This publishes which window
+the dock's Close button should act on, and the dock does the rest.
+
+Driven by Sway's own window events rather than a poll, so a window that is
+being dragged costs nothing.
+"""
+
+import fcntl
+import json
+import os
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+sys.path.insert(0, "/usr/local/lib/ekklesia-classroom")
+sys.path.insert(
+    0,
+    os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "lib"),
+)
+
+from classroom_chrome import ChromeRoles, chrome_windows  # noqa: E402
+from classroom_sway import command, windows  # noqa: E402
+
+SECONDARY_SIZE_PERCENT = 76
+
+# Chrome renegotiates the size of a popup that was opened with explicit
+# dimensions, and does it after the resize returns. Centring before that
+# settles leaves the window visibly off to one side, so it is placed
+# once more a moment later. Only ever at creation: after that the window
+# is the teacher's to move, and nothing here touches it again.
+SETTLE_SECONDS = 0.35
+
+# Everything else a window event can report — a title change, an urgency
+# hint, a mark — cannot change which window is which, and Chrome retitles
+# constantly.
+INTERESTING = frozenset(
+    ("new", "close", "focus", "move", "floating", "fullscreen_mode")
+)
+
+RESUBSCRIBE_SECONDS = 2
+
+STATE_NAME = "chrome-close-target"
+
+
+def state_directory():
+    runtime = Path(os.environ.get("XDG_RUNTIME_DIR") or "/tmp")
+    directory = runtime / "ekklesia-classroom"
+    directory.mkdir(parents=True, exist_ok=True)
+
+    return directory
+
+
+def criterion(identifier):
+    return f"[con_id={identifier}]"
+
+
+def configure_primary(identifier):
+    """A promoted remaining window becomes the ordinary classroom browser."""
+    command(f"{criterion(identifier)} floating disable")
+    command(f"{criterion(identifier)} border none")
+    command(f"{criterion(identifier)} focus")
+
+
+def place(target):
+    command(
+        f"{target} resize set width {SECONDARY_SIZE_PERCENT} ppt "
+        f"height {SECONDARY_SIZE_PERCENT} ppt"
+    )
+    command(f"{target} move position center")
+
+
+def configure_secondary(identifier):
+    """Float one exact container; never apply a broad Chrome float rule."""
+    target = criterion(identifier)
+    command(f"{target} floating enable")
+    command(f"{target} border none")
+    place(target)
+    command(f"{target} focus")
+
+    # Let Chrome have its say about the size, then place it again.
+    time.sleep(SETTLE_SECONDS)
+    place(target)
+
+
+def focused_secondary(secondary, chrome):
+    """The secondary window the dock's Close button should act on.
+
+    Only ever a focused one. If the teacher is in the main browser there is
+    nothing to close, and the dock shows no Close button at all.
+    """
+    for identifier in secondary:
+        window = chrome.get(identifier)
+
+        if window and window["focused"] and not window["hidden"]:
+            return identifier
+
+    return None
+
+
+def publish(target, path):
+    """Tell the dock which window to offer to close, atomically."""
+    temporary = path.with_suffix(".tmp")
+
+    try:
+        temporary.write_text("" if target is None else f"{target}\n")
+        os.replace(temporary, path)
+    except OSError as error:
+        print(f"[classroom-chrome-windows] could not publish state: {error}",
+              flush=True)
+
+
+def reconcile(roles, path):
+    current = windows()
+    chrome = {window["id"]: window for window in chrome_windows(current)}
+    changes = roles.update(current)
+
+    if changes["promoted"] is not None:
+        configure_primary(changes["promoted"])
+
+    for identifier in changes["new_secondary"]:
+        configure_secondary(identifier)
+
+    # Reassert the role if something put a secondary back into the tiling
+    # layout — a restore, or an application-initiated geometry change.
+    # Hidden windows are left parked quietly.
+    for identifier in roles.secondary:
+        window = chrome.get(identifier)
+
+        if window and not window["hidden"] and not window["floating"]:
+            configure_secondary(identifier)
+
+    publish(focused_secondary(roles.secondary, chrome), path)
+
+
+def subscribe():
+    try:
+        return subprocess.Popen(
+            ["swaymsg", "-t", "subscribe", "-m", "-r", '["window"]'],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
+            text=True,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+
+
+def watch():
+    directory = state_directory()
+    path = directory / STATE_NAME
+
+    with (directory / "chrome-windows.lock").open("w") as lock:
+        try:
+            fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            return 0
+
+        roles = ChromeRoles()
+
+        try:
+            while True:
+                # Whatever happened while there was no subscription.
+                reconcile(roles, path)
+
+                stream = subscribe()
+
+                if stream is None or stream.stdout is None:
+                    time.sleep(RESUBSCRIBE_SECONDS)
+                    continue
+
+                for line in stream.stdout:
+                    try:
+                        event = json.loads(line)
+                    except ValueError:
+                        continue
+
+                    if event.get("change") in INTERESTING:
+                        reconcile(roles, path)
+
+                # Sway went away or restarted; wait, then pick it back up.
+                stream.wait()
+                time.sleep(RESUBSCRIBE_SECONDS)
+        finally:
+            publish(None, path)
+
+
+def main():
+    return watch()
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/classroom-dock

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 
 import math
+import os
 import subprocess
 import sys
 from datetime import datetime
@@ -11,7 +12,7 @@ import gi
 gi.require_version("Gtk", "3.0")
 gi.require_version("GtkLayerShell", "0.1")
 
-from gi.repository import Gtk, Gdk, GdkPixbuf, GLib, GtkLayerShell
+from gi.repository import Gio, Gtk, Gdk, GdkPixbuf, GLib, GtkLayerShell
 
 sys.path.insert(0, "/usr/local/lib/ekklesia-classroom")
 
@@ -76,6 +77,11 @@ BUSY_SPINNER_SIZE = 38
 THROBBER_FRAMES = 24
 THROBBER_INTERVAL_MS = 80
 
+# Which secondary Chrome window the Close button acts on, published by
+# classroom-chrome-windows. A file rather than a socket because the dock
+# only ever reads it, and Gio can watch it without a poll.
+CLOSE_TARGET_NAME = "chrome-close-target"
+
 BUSY_POLL_MS = 500
 
 # Long enough for a cold Chrome start on classroom hardware, short enough
@@ -231,6 +237,8 @@ class ClassroomShell(Gtk.Window):
         self.dvd_image = None
         self.disc_ready = None
         self.buttons = {}
+        self.close_target = None
+        self.close_monitor = None
 
         GtkLayerShell.init_for_window(self)
         GtkLayerShell.set_layer(
@@ -355,8 +363,100 @@ class ClassroomShell(Gtk.Window):
                 0,
             )
 
+        # Only ever on screen while a secondary browser window is focused,
+        # so the ordinary dock is exactly what it has always been.
+        close = self.make_button(
+            "close",
+            custom_icon("close.svg", scaled(BROWSER_ICON_SIZE, self.scale))
+            or themed_icon("window-close-symbolic"),
+            self.close_secondary,
+        )
+        close.set_no_show_all(True)
+        close.set_visible(False)
+
+        # show_all() does not recurse into a no-show-all widget, so the
+        # icon has to be shown by hand or the button appears empty when
+        # it is finally revealed.
+        self.buttons["close"]["image"].show()
+
+        dock.pack_start(close, False, False, 0)
+
+        self.watch_close_target()
+
         return dock
 
+    # -- the close affordance for secondary browser windows ---------
+    #
+    # The button lives here rather than on the window because a surface
+    # anchored to a moving window chases it and flickers. The dock does
+    # not move.
+
+    def watch_close_target(self):
+        directory = Path(
+            os.environ.get("XDG_RUNTIME_DIR") or "/tmp"
+        ) / "ekklesia-classroom"
+
+        try:
+            directory.mkdir(parents=True, exist_ok=True)
+
+            self.close_path = directory / CLOSE_TARGET_NAME
+
+            # Watching the directory rather than the file: the state is
+            # published by rename, so the file itself is replaced.
+            self.close_monitor = Gio.File.new_for_path(
+                str(directory)
+            ).monitor_directory(Gio.FileMonitorFlags.NONE, None)
+
+            self.close_monitor.connect(
+                "changed",
+                self.on_close_target_changed,
+            )
+        except (OSError, GLib.Error) as error:
+            print(
+                f"classroom-dock: not watching for browser popups: {error}",
+                file=sys.stderr,
+            )
+            self.close_path = None
+            return
+
+        self.refresh_close_target()
+
+    def on_close_target_changed(self, monitor, changed, other, event):
+        if changed is not None and changed.get_basename() != CLOSE_TARGET_NAME:
+            return
+
+        self.refresh_close_target()
+
+    def refresh_close_target(self):
+        target = None
+
+        if self.close_path is not None:
+            try:
+                text = self.close_path.read_text().strip()
+            except OSError:
+                text = ""
+
+            if text.isdigit():
+                target = int(text)
+
+        if target == self.close_target:
+            return
+
+        self.close_target = target
+
+        entry = self.buttons.get("close")
+
+        if entry is not None:
+            entry["button"].set_visible(target is not None)
+
+    def close_secondary(self, *_):
+        if self.close_target is None or sway is None:
+            return
+
+        # Closes exactly this container. Never the main browser, and
+        # never a Chrome process.
+        sway.command(f"[con_id={self.close_target}] kill")
+
     def make_button(self, name, image, callback):
         button = Gtk.Button()
         button.set_relief(Gtk.ReliefStyle.NONE)

scripts/classroom-printer-setup

@@ -1,24 +1,34 @@
 #!/bin/bash
 set -euo pipefail
 
-# Configure the one explicitly managed classroom printer. The Ricoh Aficio
-# MP C3502 supports PCL 6 as standard; Debian Trixie's compressed Foomatic
+# Configure the one explicitly managed church printer. The Ricoh Aficio MP
+# C3502 supports PCL 6 as standard; Debian Trixie's compressed Foomatic
 # database supplies this generic color PCL 6/PCL XL path without vendor code.
 
-QUEUE="Classroom_Color"
+QUEUE="Elmer"
+LEGACY_QUEUE="Classroom_Color"
+DEFAULT_URI="socket://10.10.0.155:9100"
 DRIVER="foomatic-db-compressed-ppds:0/ppd/foomatic-ppd/Generic-PCL_6_PCL_XL_Printer-pxlcolor.ppd"
-MAKE_MODEL="Ricoh Aficio MP C3502 (Generic PCL 6 Color)"
-LOCATION="Ekklesia Classroom"
+DESCRIPTION="Elmer"
+# Blank on purpose. CUPS shows Location under the queue name in every
+# print dialog, and the teacher-facing identity of this printer is
+# simply "Elmer".
+LOCATION=""
 MAKE_DEFAULT=true
+COMMAND_TIMEOUT=10
 
 usage() {
     cat <<'USAGE'
-Usage: classroom-printer-setup [--no-default] PRINTER-IP-OR-URI
+Usage: classroom-printer-setup [--no-default] [PRINTER-IP-OR-URI]
 
 Examples:
-  sudo classroom-printer-setup 10.20.30.40
+  sudo classroom-printer-setup
+  sudo classroom-printer-setup 10.10.0.155
   sudo classroom-printer-setup socket://printer.example.org:9100
 
+With no address, configures the church Ricoh as Elmer at
+socket://10.10.0.155:9100.
+
 An IP address or hostname uses JetDirect/AppSocket on port 9100. Explicit
 socket://, ipp://, ipps:// and lpd:// URIs are also accepted.
 USAGE
@@ -34,7 +44,7 @@ fail() {
 }
 
 if [[ "${CLASSROOM_PRINTER_SETUP_TESTING:-false}" != "true" && $EUID -ne 0 ]]; then
-    fail "run this command as root: sudo classroom-printer-setup <printer-ip>"
+    fail "run this command as root: sudo classroom-printer-setup"
 fi
 
 if [[ "${1:-}" == "--no-default" ]]; then
@@ -42,13 +52,13 @@ if [[ "${1:-}" == "--no-default" ]]; then
     shift
 fi
 
-if [[ $# -ne 1 || "$1" == "-h" || "$1" == "--help" ]]; then
+if [[ $# -gt 1 || "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
     usage
-    [[ $# -eq 1 ]] && exit 0
+    [[ $# -le 1 ]] && exit 0
     exit 2
 fi
 
-address="$1"
+address="${1:-$DEFAULT_URI}"
 
 case "$address" in
     socket://*|ipp://*|ipps://*|lpd://*)
@@ -65,20 +75,78 @@ case "$address" in
         ;;
 esac
 
-for command in lpadmin lpinfo lpstat cupsenable cupsaccept; do
+for command in timeout lpadmin lpinfo lpoptions lpstat cupsenable cupsaccept; do
     command -v "$command" >/dev/null 2>&1 || \
         fail "$command is missing; reinstall the ekklesia-classroom package"
 done
 
-if ! lpstat -r >/dev/null 2>&1; then
+run_bounded() {
+    timeout \
+        --signal=TERM \
+        --kill-after=2s \
+        "${COMMAND_TIMEOUT}s" \
+        "$@"
+}
+
+disable_discovery() {
+    command -v systemctl >/dev/null 2>&1 || return 0
+
+    # cups-browsed creates local queues for advertised printers. CUPS can also
+    # enumerate DNS-SD destinations through Avahi even without cups-browsed,
+    # so disable both Avahi activation paths on this single-purpose appliance.
+    run_bounded systemctl disable --now cups-browsed.service \
+        >/dev/null 2>&1 || true
+    run_bounded systemctl disable --now \
+        avahi-daemon.socket avahi-daemon.service >/dev/null 2>&1 || true
+    run_bounded systemctl mask \
+        avahi-daemon.socket avahi-daemon.service >/dev/null 2>&1 || true
+}
+
+disable_discovery
+
+if ! run_bounded lpstat -r >/dev/null 2>&1; then
     command -v systemctl >/dev/null 2>&1 && \
-        systemctl start cups.service >/dev/null 2>&1 || true
+        run_bounded systemctl start cups.service >/dev/null 2>&1 || true
+
+    # systemctl can return as the service begins starting. Give the local
+    # scheduler a short, bounded chance to create its socket.
+    for _ in {1..20}; do
+        run_bounded lpstat -r >/dev/null 2>&1 && break
+        sleep 0.25
+    done
 fi
 
-lpstat -r >/dev/null 2>&1 || \
+run_bounded lpstat -r >/dev/null 2>&1 || \
     fail "CUPS is not running; check: systemctl status cups"
 
-models="$(lpinfo -m)" || fail "CUPS could not list installed printer drivers"
+if run_bounded lpstat -p "$LEGACY_QUEUE" >/dev/null 2>&1; then
+    log "removing legacy ${LEGACY_QUEUE} queue"
+    run_bounded lpadmin -x "$LEGACY_QUEUE" || \
+        fail "CUPS could not remove legacy queue ${LEGACY_QUEUE}"
+fi
+
+device="$(run_bounded lpstat -v "$QUEUE" 2>/dev/null || true)"
+status="$(run_bounded lpstat -p "$QUEUE" 2>/dev/null || true)"
+accepting="$(run_bounded lpstat -a "$QUEUE" 2>/dev/null || true)"
+default="$(run_bounded lpstat -d 2>/dev/null || true)"
+details="$(run_bounded lpstat -l -p "$QUEUE" 2>/dev/null || true)"
+options="$(run_bounded lpoptions -p "$QUEUE" -l 2>/dev/null || true)"
+
+if grep -Fq ": ${uri}" <<< "$device" \
+        && grep -Fq "printer ${QUEUE}" <<< "$status" \
+        && grep -Fq " enabled " <<< " ${status} " \
+        && grep -Fq "${QUEUE} accepting requests" <<< "$accepting" \
+        && grep -Fq "system default destination: ${QUEUE}" <<< "$default" \
+        && grep -Fq "Description: ${DESCRIPTION}" <<< "$details" \
+        && grep -Eq '^[[:space:]]*Location:[[:space:]]*$' <<< "$details" \
+        && grep -Eq '^PrintoutMode/.*:.*\*Normal([[:space:]]|$)' <<< "$options" \
+        && grep -Eq '^ColorModel/.*:.*\*Color([[:space:]]|$)' <<< "$options"; then
+    log "${QUEUE} is already correctly configured."
+    exit 0
+fi
+
+models="$(run_bounded lpinfo -m)" || \
+    fail "CUPS could not list installed printer drivers"
 
 if ! grep -q "^${DRIVER} " <<< "$models"; then
     fail "the Debian generic color PCL 6 driver is not installed"
@@ -88,18 +156,34 @@ log "configuring ${QUEUE} at ${uri}"
 
 # Repeating this command updates the same named queue; it never creates a
 # second destination. None of these operations connects to the printer.
-lpadmin \
+run_bounded lpadmin \
     -p "$QUEUE" \
     -v "$uri" \
     -m "$DRIVER" \
-    -D "$MAKE_MODEL" \
+    -D "$DESCRIPTION" \
     -L "$LOCATION" || fail "CUPS could not configure ${QUEUE}"
 
-cupsenable "$QUEUE" || fail "CUPS could not enable ${QUEUE}"
-cupsaccept "$QUEUE" || fail "CUPS could not accept jobs for ${QUEUE}"
+# CUPS on Trixie does not reliably retain PPD choices supplied in the same
+# request that selects the driver. Apply the physically verified defaults in a
+# second request after the PPD exists.
+run_bounded lpadmin \
+    -p "$QUEUE" \
+    -o PrintoutMode=Normal \
+    -o ColorModel=Color || fail "CUPS could not set the color defaults for ${QUEUE}"
+
+options="$(run_bounded lpoptions -p "$QUEUE" -l 2>/dev/null || true)"
+
+grep -Eq '^PrintoutMode/.*:.*\*Normal([[:space:]]|$)' <<< "$options" \
+    || fail "CUPS did not retain PrintoutMode=Normal for ${QUEUE}"
+grep -Eq '^ColorModel/.*:.*\*Color([[:space:]]|$)' <<< "$options" \
+    || fail "CUPS did not retain ColorModel=Color for ${QUEUE}"
+
+run_bounded cupsenable "$QUEUE" || fail "CUPS could not enable ${QUEUE}"
+run_bounded cupsaccept "$QUEUE" || fail "CUPS could not accept jobs for ${QUEUE}"
 
 if [[ "$MAKE_DEFAULT" == true ]]; then
-    lpadmin -d "$QUEUE" || fail "CUPS could not make ${QUEUE} the default"
+    run_bounded lpadmin -d "$QUEUE" || \
+        fail "CUPS could not make ${QUEUE} the default"
 fi
 
 log "${QUEUE} is configured, enabled and accepting jobs."
@@ -108,4 +192,5 @@ if [[ "$MAKE_DEFAULT" == true ]]; then
     log "${QUEUE} is the system default printer."
 fi
 
+log "Print defaults: PrintoutMode=Normal, ColorModel=Color."
 log "The printer may remain offline until it is reachable; this does not affect boot."

scripts/classroom-provision

@@ -37,6 +37,18 @@ else
     log "WARNING: sudo classroom-dvd-css-setup"
 fi
 
+# The site printer is configured entirely through the local CUPS scheduler;
+# its being powered off or unreachable does not matter. Still bound the whole
+# step so a broken scheduler can never hold classroom provisioning open.
+if timeout --signal=TERM --kill-after=5s 30s \
+        /usr/local/bin/classroom-printer-setup; then
+    :
+else
+    log "WARNING: the Elmer printer queue is not configured."
+    log "WARNING: Provisioning will try again at the next boot, or run:"
+    log "WARNING: sudo classroom-printer-setup"
+fi
+
 log "finished"
 
 # Provisioning is best-effort by design.
@@ -46,4 +58,4 @@ if [[ "$chrome_ok" != true ]]; then
     exit 1
 fi
 
-exit 0
+exit 0