Drive two independent visual layers per display target from one shared
video presence signal: the fullscreen fallback/menu canvas below video
and a transparent, input-transparent OSD overlay above video, reserved
as the future flight OSD rendering surface. WFB and video decode stay
out of the UI process; pilot video keeps rendering priority.
CI caught stopDisplayProcess returning when the direct child died
without proving the group emptied. Escalation tests now ignore SIGINT
from birth (no trap-setup race) and a final group SIGKILL sweep removes
any kiosk surviving an exiting runuser.
Kiosk process owns its display lifecycle: waits for X11, keeps the
fullscreen black canvas below video, stops deterministically on signal.
Supervisor starts it before video, restarts only on process death, and
shuts the whole process group down; X11 downtime never restarts the
supervisor. Per-target opener/template abstractions for future MIPI.
piotr