phase: 09_wall_remote_page

**Phase 09 — final verification pass (all 3 tasks already in `complete/`; phase work was in the working tree, verified, nothing needed fixing)**

**Gates** — `uv run ruff check . && uv run ruff format --check .` → clean; `uv run pyright` → 0 errors; `uv run pytest` → **360 passed, 5 skipped** (only the realdisplay rung), coverage 96% total / 95% app.py; `MIRROR_REALDISPLAY=1 uv run pytest -m realdisplay` → 4 passed, 1 skipped (documented host limitation: no audio source on the real X11 path); `uv run pytest tests/e2e/test_remote_control.py` → 8/8 passed; `node --check` on every `static/*.js` → all pass.

**Completion criteria** — all met: (1) "Show on wall" stages on the display, asserted on display DOM + `/api/kiosk` ✓; (2) Back/Fullscreen + untouched second controller converge (TestConvergence) ✓; (3) `/api/streams` reports `viewers: 0` / `watching: 0` with only `/remote` open (TestACostsNothing) ✓; (4) followers count displays only — 0/1/1 with a second controller (TestFollowers) ✓; (5) controller works with no display: `followers: 0`, state stored (protocol test + e2e) ✓; (6) e2e + full `-m e2e` + realdisplay all green ✓; (7) README + SECURITY.md updated, Silverblue default now `/kiosk` (installer, conf, gnome script, checker) ✓; (8) suite 100% green, coverage >90% on new code ✓; (9) PLAN.md untouched; AGENTS.md changed only for a stale statement ✓.

**Documentation** — README.md reviewed in full against code (page table, quickstart, env-var table vs `config.py`/`debug.py`, presets, keys, deployment, kiosk section): no inconsistencies found. AGENTS.md: fixed the one stale statement introduced by this phase ("Four pages" → "Five pages"); no other staleness, nothing added.

**Decisions** — no repo changes were required; the one realdisplay skip is a pre-documented environment fact, not a failure.

**Next pending phase** — none; `todo/` held only phase 09.

docs/kiosk-silverblue/check-kiosk.sh

@@ -64,9 +64,9 @@ if [ -n "$HOME_DIR" ]; then
               "$HOME_DIR/.config/mirror/kiosk.conf" 2>/dev/null | head -1)
         ok "kiosk URL: ${URL:-<empty>}"
         case "$URL" in
-            */watch) : ;;
+            */watch|*/kiosk) : ;;
             "") bad "kiosk URL is empty" ;;
-            *) warn "kiosk URL is not the /watch wall: $URL" ;;
+            *) warn "kiosk URL is neither wall (/watch or /kiosk): $URL — check DNS and the nginx vhost" ;;
         esac
     else
         bad "kiosk config $HOME_DIR/.config/mirror/kiosk.conf is missing"
@@ -213,8 +213,10 @@ if [ -n "$URL" ]; then
         CODE=$(curl -s -o /dev/null -w '%{http_code}' -m 8 "$URL" 2>/dev/null)
         if printf '%s' "$BODY" | grep -q "Watch · mirror"; then
             ok "$URL serves the mirror watch page (HTTP $CODE)"
+        elif printf '%s' "$BODY" | grep -q "Wall · mirror"; then
+            ok "$URL serves the mirror kiosk page (HTTP $CODE)"
         else
-            warn "$URL answered HTTP $CODE but it is NOT the mirror watch page — the kiosk"
+            warn "$URL answered HTTP $CODE but it is NOT a mirror wall — the kiosk"
             warn "will happily display whatever this is. Check DNS and the nginx vhost."
             info "title: $(printf '%s' "$BODY" | sed -n 's/.*<title>\(.*\)<\/title>.*/\1/p' | head -1)"
         fi

docs/kiosk-silverblue/gnome-kiosk-script

@@ -25,7 +25,7 @@ if [ -r "$CONF" ]; then
     . "$CONF"
 fi
 
-URL="${MIRROR_KIOSK_URL:-https://mirror.reeseapps.com/watch}"
+URL="${MIRROR_KIOSK_URL:-https://mirror.reeseapps.com/kiosk}"
 PROFILE="${MIRROR_KIOSK_PROFILE:-$HOME/.mirror-kiosk}"
 LOG="${MIRROR_KIOSK_LOG:-${XDG_STATE_HOME:-$HOME/.local/state}/mirror-kiosk.log}"
 POLL="${MIRROR_KIOSK_POLL:-5}"

docs/kiosk-silverblue/install-kiosk.sh

@@ -17,7 +17,10 @@ set -eu
 KIOSK_USER="${KIOSK_USER:-kiosk}"
 # The default is for a NEW client only. An existing client keeps its own URL
 # unless the operator names one — see "the URL is the one per-client value" below.
-KIOSK_URL_DEFAULT="https://mirror.reeseapps.com/watch"
+# The default is the DISPLAY endpoint: /kiosk obeys the shared wall state, so
+# a device with a keyboard (the /remote page) can arrange a box that has none.
+# /watch is the operator's page — a wall a person stands at.
+KIOSK_URL_DEFAULT="https://mirror.reeseapps.com/kiosk"
 KIOSK_URL="${KIOSK_URL:-}"
 KIOSK_SESSION="gnome-kiosk-script-wayland"
 HERE=$(cd "$(dirname "$0")" && pwd)

docs/kiosk-silverblue/kiosk.conf

@@ -7,9 +7,12 @@
 # After editing: `sudo systemctl restart gdm` (or log the kiosk user out) to
 # re-read it. The browser is restarted by the kiosk script's own loop.
 
-# The wall of every live mirror. `/` is the Share/Watch chooser and needs a
-# tap to get anywhere, which is wrong for a display nobody is standing at.
-MIRROR_KIOSK_URL="https://mirror.reeseapps.com/watch"
+# The controllable wall. `/kiosk` is the display endpoint: it obeys the shared
+# layout state, so a device with a keyboard (the /remote page, or any
+# `arrange` frame on /ws) decides what is on stage and whether it is
+# fullscreen — a box that has no keyboard can still be arranged. `/watch` is
+# the operator's page: a wall a person stands at.
+MIRROR_KIOSK_URL="https://mirror.reeseapps.com/kiosk"
 
 # Optional overrides (uncomment to change):