phase: 01_keyboard_kiosk_control

**Phase 01 final verification pass — complete, 100% green**

- Verified all 4 tasks done (files in `complete/`); implementation review: key router in `watch.js`, share-page router, CSS focus/selection affordances, `?` overlay, pointer-free E2E suite — all sound.
- Gates: `ruff check` + `ruff format --check` ✅ · `pyright` 0 errors ✅ · `uv run pytest` → 223 passed, 2 skipped (realdisplay), 1 pre-existing FastAPI deprecation warning · `MIRROR_REALDISPLAY=1 pytest -m realdisplay` → 2 passed ✅ · `pytest -m e2e` → 51 passed (incl. `test_keyboard_wall.py`, which a meta-test keeps pointer-free) · `node --check` on all static JS ✅.
- Completion criteria: all 6 ✅ (j/k+Enter, f/g/n/p/1–9/m/?/Esc keyboard-only E2E; no hover-only controls via CSS guard + focus-ring E2E; `#name` text-safe; e2e/realdisplay green; key map documented in README "Kiosk client" and `docs/kiosk-silverblue.md`).
- README fixed: added missing env vars `MIRROR_MAX_BITRATE`, `MIRROR_PING_INTERVAL`, `DEBUGPY_WAIT` to the config table; added the one-time `rpm-ostree` layering note before the kiosk install snippet.
- AGENTS.md fixed: removed stale "roadmap is intentionally empty" parenthetical (3 phases pending); coverage ~94% → ~95%. No content added.
- **Unresolved, needs your call:** README/SECURITY.md say `mirror.reeseapps.com`; `docs/kiosk-silverblue.md` (reference-client naming table with real IPs) says `mirror.reeselink.com`. I couldn't verify which is the live deployment domain, so I changed neither — say the word and I'll unify.
- Next pending phase: `02_sharp_capture`.

AGENTS.md

@@ -36,9 +36,6 @@ is a roster and a signaling relay. Linux is the reference platform.
   decision, and record the reason in the same change.
 * A phase is not done until every gate in §4 passes.
 
-*(The roadmap is intentionally empty at the prototype stage: a working prototype
-came first, and the candidate phase list is §7 of `PLAN.md`.)*
-
 ## 3. Locked decisions that are easy to break by accident
 
 | Rule | Why it exists |
@@ -64,7 +61,7 @@ uv run pytest                               # unit + API + browser E2E (~20s)
 MIRROR_REALDISPLAY=1 uv run pytest -m realdisplay    # Linux-native X11 capture
 ```
 
-Coverage is ~94%; the media path is covered by browser assertions, not by unit
+Coverage is ~95%; the media path is covered by browser assertions, not by unit
 tests pretending to be WebRTC.
 
 ## 5. Browser testing rules