Fix kiosk mode

docs/TODO.md

@@ -83,11 +83,29 @@ step 8 and §5). Retire/reset the errata afterward. Needs the design-doc source
 
 ## [~] 4. Kiosk mode — autologin + fullscreen Chromium loading a URL
 
-**First cut implemented (2026-06-16) — needs a display to verify.** Wayland
-kiosk + Chromium from EPEL, baked into the root. **cage is NOT packaged for EL9**
-(`dnf install cage` → "Unable to find a match"), so switched to **weston
-kiosk-shell** (weston 8.0.0-10.el9 is in EPEL; kiosk-shell.so landed in weston
-8.0; far lighter than the GDM+gnome-kiosk alternative).
+**WORKING / display-verified 2026-06-17** (kiosk renders Chromium fullscreen on
+the configured URL). Build-flagged OFF by default for now (`enable_kiosk=false`)
+while iterating on boot/network — set `-var enable_kiosk=true` to ship it.
+
+Path to getting here (don't re-discover):
+- **cage is NOT packaged for EL9** (`dnf install cage` → "Unable to find a
+  match"). Tried weston instead.
+- **EPEL 9 ships weston 8.0**, which has NEITHER `kiosk-shell.so` NOR the
+  `[autolaunch]` weston.ini section — both arrived in **weston 9.0**. The first
+  cut wrongly assumed 8.0 had them; `shell=kiosk-shell.so` failed to load.
+  `rpm -ql weston` shows only desktop-shell / fullscreen-shell / ivi-shell.
+- **Resolution: `desktop-shell.so`** (the only packaged shell Chromium's
+  xdg-shell works with — fullscreen-shell needs a client protocol Chromium
+  doesn't speak), stripped bare (`panel-position=none`, black bg, no
+  animation/lock), and Chromium launched by a **wrapper** (kiosk-session) since
+  there's no `[autolaunch]`. Chromium `--kiosk` fullscreens over the shell.
+- **Seat fix (load-bearing):** weston died with `logind: failed to get session
+  seat` → `failed to create compositor backend`. logind's auto-derivation
+  didn't attach a seat; `Environment=XDG_SEAT=seat0` + `XDG_VTNR=1` in the unit
+  (put into the PAM env before pam_open_session) registers the session on
+  seat0/vt1. `/dev/dri/card0` was present all along (not the issue).
+- Tested live without a rebuild: the whole root is `systemd.volatile=overlay`,
+  so /etc AND /usr are writable tmpfs at runtime — drop-in the files + restart.
 - **`enable_kiosk` Packer var — currently `false` by DEFAULT (set 2026-06-17).**
   The whole kiosk provisioner is feature-flagged off while iterating on the
   boot/network stack (DHCP-lease/keep-alive work), for faster builds and a
@@ -99,19 +117,19 @@ kiosk-shell** (weston 8.0.0-10.el9 is in EPEL; kiosk-shell.so landed in weston
 - Provisioner enables EPEL, installs `weston chromium mesa-dri-drivers
   mesa-libEGL mesa-libgbm dejavu-sans-fonts`, creates a passwordless
   unprivileged `kiosk` user (video/input groups).
-- `files/kiosk/kiosk.service` — runs `weston --use-pixman
-  --config=/etc/xdg/weston/weston.ini` as `kiosk` on tty1 via
-  `PAMName=login`+`TTYPath` (gets seat0 for DRM/input), `Conflicts=getty@tty1`,
-  `WantedBy=graphical.target`; default target set to graphical.
-- `files/kiosk/weston.ini` — `shell=kiosk-shell.so`, `idle-time=0`,
-  `require-input=false`, `xwayland=false`, `[autolaunch] path=/usr/local/bin/
-  kiosk-session watch=true`.
-- `files/kiosk/kiosk-session` — Chromium with `--kiosk --ozone-platform=wayland
-  --disable-gpu` + tmpfs profile/cache; URL from `/etc/kiosk/kiosk.env`.
-- **Verify on a VM with a console (Proxmox VNC/SPICE):** weston comes up on
-  tty1, Chromium loads the URL over the booted network. Likely tweak points:
-  Chromium ozone/wayland support, dropping `--disable-gpu` on real GPUs,
-  `/dev/dri` present in the VM (weston needs a DRM device — set Display to
+- `files/kiosk/kiosk.service` — runs `/usr/local/bin/kiosk-session` as `kiosk`
+  on tty1 via `PAMName=login`+`TTYPath`+`Environment=XDG_SEAT=seat0`/`XDG_VTNR=1`
+  (gets seat0 for DRM/input), `Conflicts=getty@tty1`, `WantedBy=graphical.target`;
+  default target set to graphical.
+- `files/kiosk/weston.ini` — `shell=desktop-shell.so`, `idle-time=0`,
+  `require-input=false`, `xwayland=false`; `[shell] panel-position=none`,
+  black `background-color`, `animation=none`, `locking=false`.
+- `files/kiosk/kiosk-session` — `exec`s `weston --use-pixman --socket=wayland-kiosk`
+  in the foreground (owns the seat), and launches Chromium (`--kiosk
+  --ozone-platform=wayland --disable-gpu`, tmpfs profile/cache, URL from
+  `/etc/kiosk/kiosk.env`) in a background crash-restart loop.
+- **Remaining polish (now that it renders):** dropping `--disable-gpu` on real
+  GPUs, `/dev/dri` present in the VM (weston needs a DRM device — set Display to
   VirtIO-GPU/std), and **SELinux AVCs** for the GUI stack (check `ausearch -m
   avc`; the kiosk user is unconfined so likely none — but do NOT set permissive
   if they appear; add a policy module). Admin SSH (the key user) still works for