Two layers for the button, because one is not enough: while a session is
running PowerDevil holds logind's handle-power-key inhibitor and acts on
the button itself, so a logind drop-in alone would be overruled. logind
covers the machine before the session starts, after it ends, and if
PowerDevil is not running. Verified: after the drop-in is installed and
logind reloaded, it reports ignore for the power, suspend, hibernate and
lid keys, and the running session was not disturbed by the reload.
Holding the button still cuts the power. That is firmware, below any
operating system, and it is deliberately left alone as the only recovery
a person standing at a wedged machine has.
The maintenance terminal is Meta+Ctrl+Alt+Shift+K, declared in the
package rather than seeded into a teacher's configuration, where an
update could not reach it. KGlobalAccel read it and registered the
component; invoking it opened a working shell.
It needed a wrapper. The classroom's Kiosk policy sets shell_access=false
and Konsole honours it — measured: with the classroom configuration in
its cascade Konsole starts and says "Program to run not set." The
restriction is worth keeping everywhere else, so it is lifted for this
one process by leaving the classroom's configuration directory out of
its cascade. It grants no privilege: the classroom user has no sudo
rule, and that restriction was always a barrier in the interface rather
than a privilege boundary.
Konsole's own entry is shadowed and hidden from /usr/local/share, so
nothing is patched and Konsole's package stays maintainable. Nothing is
pinned to the panel; a task button appears only while a terminal is
open, and closing it returns the bar to three launchers.
Co-Authored-By: Claude Opus 5 <[email protected]>
All 1920×1080, captured with grim from a real running session in the
container lab. See ../classroom-v2-experiment.md.
The desktop
v2-idle-desktop
the idle desktop: the wallpaper, one bar, nothing else
v2-from-package
the same desktop, produced by installing the .deb on a clean machine
v2-dark-bar, v2-light-bar
the bar in both themes
v2-theme-compare
the two, one above the other
v2-testpage
a maximised browser, edge to edge above the bar
v2-wonderink
Wonder Ink as an application, in its own profile
Application state
state-1-closed
both launchers closed: no indicator
state-3-behind
one active (teal), one running behind it (grey)
state-4-minimized
minimised — measured identical to behind, which is why minimise was removed as a route
state-5-restored
back
v2-both-apps
both applications, one button each, from the packaged install
labelled-tasks
the labelled task manager, evaluated and rejected: it shows changing page titles rather than application names
Parent Call
pc-icon-vs-notifications
the Parent Call mark beside Plasma's notification bell — the comparison that decided it
pc-mark
the mark at 32, 48 and 64px, beside the two marks it replaced
pc-panel
the whole bar: Parent Call left, applications centre, status right
pc-ready
the card, ready, in approval mode
pc-waiting
waiting for a volunteer to approve
pc-sent
Sent to sanctuary — never "displayed"
pc-rejected
not approved, offering Try again
pc-off
the coordinator's mode is off
pc-nobroker
the broker is unreachable
pc-typed
a name in the field
icon-candidates-2
sixteen Breeze person icons at real panel size, none of which meant Parent Call
DVD
dvd-panel
DVD in the row with the applications, out of the status area
dvd-cover
the DVD launcher's tooltip on the packaged install
v2-dvd-overlay, v2-layershell
the loading cover: a gtk-layer-shell overlay under KWin
Windows
v2-secondary-window
a window a page opened, floating over an untouched browser, with its own close button
v2-print-dialog
the system print dialog, over the page that raised it, offering only Elmer
v2-fullscreen
fullscreen video: the whole display, panel covered
v2-layershell
a gtk-layer-shell overlay under KWin — what the DVD loading cover is made of
v2-notification-crop
a notification card, top right
Reliability and lockdown
recovery-after-8-kills
the panel after eight consecutive SIGKILLs
recovery-after-kwin-kill
the session after KWin was killed twice; the application window survived
recover-panel
the bar rebuilt from the layout script after its configuration was deleted
lock-desktop-rmb
right-clicking the wallpaper: no menu
lock-panel-rmb
right-clicking the bar: no menu
lock-krunner
KRunner asked for, and not there
Failures, kept
—
keyboard injection never reached the nested session, so every interaction in this experiment was driven by the pointer. It is why Parent Call has never had a real key pressed into it, and why that is the first bench test.
m-closed, m-minimized
the pair whose pixels were sampled to show that Plasma draws minimised and closed differently, but minimised and behind the same
