phase: 01_keyboard_kiosk_control

**Phase 01 final verification pass — complete, 100% green**

- Verified all 4 tasks done (files in `complete/`); implementation review: key router in `watch.js`, share-page router, CSS focus/selection affordances, `?` overlay, pointer-free E2E suite — all sound.
- Gates: `ruff check` + `ruff format --check` ✅ · `pyright` 0 errors ✅ · `uv run pytest` → 223 passed, 2 skipped (realdisplay), 1 pre-existing FastAPI deprecation warning · `MIRROR_REALDISPLAY=1 pytest -m realdisplay` → 2 passed ✅ · `pytest -m e2e` → 51 passed (incl. `test_keyboard_wall.py`, which a meta-test keeps pointer-free) · `node --check` on all static JS ✅.
- Completion criteria: all 6 ✅ (j/k+Enter, f/g/n/p/1–9/m/?/Esc keyboard-only E2E; no hover-only controls via CSS guard + focus-ring E2E; `#name` text-safe; e2e/realdisplay green; key map documented in README "Kiosk client" and `docs/kiosk-silverblue.md`).
- README fixed: added missing env vars `MIRROR_MAX_BITRATE`, `MIRROR_PING_INTERVAL`, `DEBUGPY_WAIT` to the config table; added the one-time `rpm-ostree` layering note before the kiosk install snippet.
- AGENTS.md fixed: removed stale "roadmap is intentionally empty" parenthetical (3 phases pending); coverage ~94% → ~95%. No content added.
- **Unresolved, needs your call:** README/SECURITY.md say `mirror.reeseapps.com`; `docs/kiosk-silverblue.md` (reference-client naming table with real IPs) says `mirror.reeselink.com`. I couldn't verify which is the live deployment domain, so I changed neither — say the word and I'll unify.
- Next pending phase: `02_sharp_capture`.

README.md

@@ -65,10 +65,13 @@ Environment variables (all optional; a `.env` file is loaded if present):
 | `MIRROR_PORT`          | `8055`  | Bind port.                                           |
 | `MIRROR_ICE_SERVERS`   | `[]`    | JSON array of RTCIceServer objects, if peers cannot reach each other directly. |
 | `MIRROR_MAX_MIRRORS`   | `0`     | Cap on concurrent mirrors (`0` = unlimited).         |
+| `MIRROR_MAX_BITRATE`   | `12000000` | Per-leg WebRTC bitrate cap in bits/s — the mesh uploads N × bitrate per sharer, so this is the ceiling. |
+| `MIRROR_PING_INTERVAL` | `20`    | Seconds between socket liveness pings.               |
 | `MIRROR_ALLOW_CIDRS`   | *(unset)* | Comma-separated source networks allowed to connect, e.g. `10.2.0.0/22,fd00::/64`. Unset means unrestricted. |
 | `MIRROR_TRUSTED_PROXIES` | `127.0.0.0/8, ::1/128` | Which peers may speak for a client via `X-Forwarded-For`. Only a proxy that overwrites the header belongs here. |
 | `DEBUGPY`              | `0`     | `1` opens a debugpy listener on `DEBUGPY_PORT`.      |
 | `DEBUGPY_PORT`         | `5678`  | debugpy port.                                        |
+| `DEBUGPY_WAIT`         | `0`     | `1` blocks the server at start until a debugger attaches. |
 
 ## Platform notes
 
@@ -113,7 +116,9 @@ from this side:
 A wall display is a Fedora Silverblue box running the locked-down GNOME Kiosk
 session, auto-logged in as `kiosk`, with Firefox in `--kiosk` mode pointed at
 `/watch`. It is set up and repaired entirely over SSH — no keyboard, no console,
-no monitor:
+no monitor. A brand-new box layers the kiosk packages once first
+(`rpm-ostree install gnome-kiosk gnome-kiosk-script-session`, then a reboot);
+after that these two commands are both the setup and the repair path:
 
 ```bash
 scp -r docs/kiosk-silverblue client:/var/tmp/ && ssh client \
@@ -128,6 +133,27 @@ peer state for the media, and a probe page for the rendered resolution. The
 runbook records why each file lives where it does on an
 otherwise read-only OS.
 
+**Keys.** The whole wall works from a keyboard — and the box needs no keyboard
+attached to be operated *or* debugged; the keys are there when one is plugged
+in. On `/watch`:
+
+| Key | Action |
+| --- | --- |
+| `j` / `↓` · `k` / `↑` | Select the next / previous mirror (wraps). |
+| `Enter` / `f` | Stage the selected mirror fullscreen (`f` re-enters fullscreen when already staged). |
+| `g` | Back to the wall. |
+| `n` / `p` | Stage the next / previous mirror. |
+| `1`–`9` | Stage the Nth mirror. |
+| `m` | Mute / unmute the staged mirror. |
+| `?` | Show / hide this list on screen. |
+| `Esc` | Close the key list, then leave the stage. |
+
+On `/mirror`: `s` starts a share, `x` stops one, `Esc` stops while live. Keys
+with `Ctrl`/`Cmd`/`Alt` are never intercepted, and a key typed in the display-
+name field is text, not a command. `?` is the only key that needs Shift, and it
+is matched on the character itself — on a layout where `?` is a dead key the
+list is not reachable, so keep this table to hand.
+
 ## Development
 
 ```bash