docs(deploy): describe the in-use credential renewal in the kiosk guide

ADR 0056 (Zayin/Ekklesia#94) replaces the fixed 180 days from pairing with
180 days from last use, renewed while the screen is in use; the guide no
longer tells operators to track pairing dates.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/display-kiosk.md

@@ -97,9 +97,10 @@ is always safer for a browser profile.
 3. Within a few seconds the screen collects its credential and starts showing content.
 4. In Signage → **Displays**, name the display and choose its group and audience.
 
-A paired screen stays paired across browser restarts and reboots. The credential lasts **180 days**
-from pairing and is not renewed automatically (ADR 0036); after that the screen returns to its pairing
-code and is paired again the same way. Note the pairing date of each screen.
+A paired screen stays paired across browser restarts and reboots, and for as long as it is in use:
+its credential is renewed each time it checks in, and only expires after **180 days without being
+used** (ADR 0056). A screen that is switched off and stored for longer than that, or that is revoked,
+returns to its pairing code and is paired again the same way.
 
 ## What happens when things go wrong
 
@@ -124,6 +125,6 @@ reachable — nobody needs to touch it.
 - [ ] One systemd unit, no desktop autostart entry, no second launcher.
 - [ ] `--user-data-dir` on persistent storage, not shared, not cleared on exit.
 - [ ] Automatic login of the kiosk user, and screen blanking/power saving disabled.
-- [ ] Paired and named; assigned in Signage; pairing date recorded.
+- [ ] Paired and named; assigned in Signage.
 - [ ] Unplug the network for a minute: content keeps playing, then the note clears on reconnect.
 - [ ] Reboot: the screen comes back paired without anyone touching it.

scripts/lib/deploy-smoke-display.mjs

@@ -14,7 +14,7 @@
 //   stream-failure     the first realtime connection is refused: is realtime re-established?
 //   caching-probe      can a display on the API origin store storage-origin images in Cache Storage?
 //   stream-recycle     one page past the five-minute realtime recycle, with a timestamped timeline
-//   revoke             revoke the paired kiosk while its display is open
+//   revoke             revoke the paired kiosk while its display is open, then pair it again
 //
 // Every DevTools command and every page-side request has its own deadline, and a step has an overall
 // budget. A call that never answers fails the step with a line naming that exact call, because a call
@@ -976,6 +976,32 @@ async function run() {
       result.stopped,
       `a revoked display returns to the pairing screen without a reload (within ${watchMs / 1000}s)`,
     );
+    // Revocation is recoverable: the same screen pairs again and resumes, keeping its place in the
+    // module's roster. It also leaves the kiosk paired for the steps that run after this one.
+    const rosterBefore = moduleId === "signage" ? (await signageViewers(owner.page)).length : 0;
+    if (await page.waitFor(find("display-pairing-code"), "a fresh pairing code after revocation")) {
+      const code = (
+        await page.evaluate(`${find("display-pairing-code")}.textContent`, "reading the code")
+      ).replace(/\D/gu, "");
+      const approved = await owner.page.api("POST", "/api/v1/device-pairing/approvals", {
+        code,
+        deviceName: "Repro kiosk",
+      });
+      check(approved.status === 200, "the owner approves the revoked screen's new code");
+      check(
+        await waitLive(page, "the re-paired display to go live"),
+        "a revoked screen is paired again and resumes without a reload",
+      );
+      if (moduleId === "signage") {
+        const rosterAfter = (await signageViewers(owner.page)).length;
+        check(
+          rosterAfter === rosterBefore,
+          `re-pairing keeps the screen's existing roster entry (${rosterBefore} before, ${rosterAfter} after)`,
+        );
+      }
+    } else {
+      check(false, "a revoked screen shows a fresh pairing code");
+    }
     await page.close();
     kiosk.close();
     await finishOwner(owner);