phase: 08_kiosk_page

**Phase 08 final verification pass — complete, all green.**

**Verified (all 5 tasks already implemented):**
- `static/wall.js` (`createWall` + `installWallKeys`), `kiosk.html`/`kiosk.js`, `GET /kiosk` route — guards: no `$("#…")` in wall.js, one keydown listener, kiosk ids no-collision across 3 pages, no audio field in `arrange`, no header/share link in markup, address gate covers `/kiosk`
- Cross-page e2e: arrival-arrangement, keypress-on-one-display moves the other (asserted on the second display's decoded moving pixels), dead mirror → `data-layout="wall"` on both, `followers` count, pointer-free meta-test

**Gates (exact outcomes):**
- `uv run ruff check . && uv run ruff format --check .` — passed
- `uv run pyright` — 0 errors
- `uv run pytest` — 341 passed, 5 skipped (realdisplay-gated), 96s
- `MIRROR_REALDISPLAY=1 uv run pytest -m realdisplay` — 4 passed, 1 skipped (documented: host has no audio source for real capture)
- Coverage 96% (>90%); only warning is a starlette/httpx third-party deprecation

**Completion criteria:** all 9 ✅ — e2e green incl. `test_kiosk_layout.py` (the one e2e diff is the phase-mandated address-gate extension to `/kiosk`; assertion logic untouched), full suite 100% passing, README documents `/kiosk`, PLAN.md untouched.

**Documentation:**
- README: fixed the Kiosk-client section that implied the display box is permanently pointed at `/watch` — now states the display page is `/kiosk` with the runbook's one-line re-point (installer default still `/watch` this phase, per docs). Rest of README verified against code (routes, config table, CLI flag, presets, key table) — consistent.
- AGENTS.md: fixed 2 stale statements — CDN test moved to `TestPages` (was `TestClientScripts`), suite runtime ~50s → ~95s. No content added.

**Notable:** PLAN.md §6 says "per-leg `maxBitrate` cap (default 12 Mbit/s)" but code/README default is 25 Mbit/s — pre-existing, left untouched (locked file; flagged for a user decision).

**Next pending phase:** `09_wall_remote_page`.

README.md

@@ -9,6 +9,7 @@ your network:
 | ------------ | ------------------ | ----------------------------------------------------------------------- |
 | **Share**    | `/mirror` (also `/share`) | Picks a window, screen, or tab via the OS-native picker and mirrors it.  |
 | **Watch**    | `/watch`           | Shows every screen currently being mirrored; click a tile to take the stage. |
+| **Kiosk**    | `/kiosk`           | A chrome-free wall for an unattended display: no header, no counts — the net pill is the only chrome, and the shared layout state (below) arranges it. |
 | **Index**    | `/`                | Signpost + live count of mirrors.                                        |
 
 Any number of people can mirror at the same time and any number of people can
@@ -30,6 +31,7 @@ Then, from another machine on the LAN:
 ```
 http://<this-machine>:8055/mirror    # to share
 http://<this-machine>:8055/watch     # to watch
+http://<this-machine>:8055/kiosk     # the unattended wall (kiosk display)
 ```
 
 Linux is the primary target. On Linux the native picker is X11/Wayland's own
@@ -67,9 +69,14 @@ field is "no opinion", `"staged": null` is "back to the wall". A change is pushe
 immediately as a `layout` frame to every viewer (and back to the sender), and the
 same object is readable at `GET /api/kiosk` — `curl`-debuggable like `/api/streams`,
 `Cache-Control: no-store`. The state has no audio: sound always traces back to a
-gesture on the device that plays it (see [SECURITY.md](SECURITY.md) §4). The kiosk
-page that follows this state arrives in a later release; the wire and the read
-surface are what any client builds on.
+gesture on the device that plays it (see [SECURITY.md](SECURITY.md) §4). The
+`/kiosk` page is the display that follows this state: a chrome-free wall that
+subscribes to every mirror like `/watch` and does what the state says —
+`Cache-Control: no-store` on the read and on the page itself. If a keyboard is
+plugged in, the same keys as `/watch` work, and every keypress publishes the
+same `arrange` intent, so a controller and a display converge on one state
+(`m` is local-only: a display never becomes audible because another machine
+asked).
 
 ## Configuration
 
@@ -172,8 +179,10 @@ from this side:
 
 A wall display is a Fedora Silverblue box running the locked-down GNOME Kiosk
 session, auto-logged in as `kiosk`, with Firefox in `--kiosk` mode pointed at
-`/watch`. It is set up and repaired entirely over SSH — no keyboard, no console,
-no monitor. A brand-new box layers the kiosk packages once first
+the wall. It is set up and repaired entirely over SSH — no keyboard, no console,
+no monitor. The display page is `/kiosk`; the installer default still opens
+`/watch` and an existing `kiosk.conf` URL wins, so moving a box is the
+one-line re-point in [the runbook](docs/kiosk-silverblue.md#two-endpoints-watch-and-kiosk). A brand-new box layers the kiosk packages once first
 (`rpm-ostree install gnome-kiosk gnome-kiosk-script-session`, then a reboot);
 after that these two commands are both the setup and the repair path:
 
@@ -212,6 +221,10 @@ in. On `/watch`:
 | `?` | Show / hide this list on screen. |
 | `Esc` | Close the key list, then leave the stage. |
 
+The same wall keys work on `/kiosk` too — the unattended display — and a
+change made there (a keypress stages the mirror *and* publishes the same
+`arrange` intent) is what every other display follows.
+
 A staged mirror's caption bar and control cluster are **hidden at rest**, so
 the shared video — a terminal's bottom line included — is never covered by
 them. A pointer move over the stage (a tap, for touch) or any key press