Kiosk process owns its display lifecycle: waits for X11, keeps the
fullscreen black canvas below video, stops deterministically on signal.
Supervisor starts it before video, restarts only on process death, and
shuts the whole process group down; X11 downtime never restarts the
supervisor. Per-target opener/template abstractions for future MIPI.
CI caught stopDisplayProcess returning when the direct child died
without proving the group emptied. Escalation tests now ignore SIGINT
from birth (no trap-setup race) and a final group SIGKILL sweep removes
any kiosk surviving an exiting runuser.
This is a good foundation and moves in the intended direction: X11 target is isolated behind Opener/Session/Template, target reconnection is independent of the Ground Station UART supervisor, and the process-group cleanup is properly covered by tests.
Follow-up required before adding flight OSD: the kiosk is deliberately below the separate fpv-video window. That correctly implements the no-WFB fallback, but this same window can never draw an OSD over video. I opened a focused follow-up issue for separate fallback/menu and transparent top-level OSD layers.
Small configuration defect: when display.user is empty, startDisplayProcess prepends configured DISPLAY/XAUTHORITY before os.Environ(). Go exec.Cmd.Env resolves duplicate keys using the last value, so inherited values overwrite the configured ones in this direct-launch path. Default production config uses user: orangepi, so it does not affect the current deployment, but the direct-user path and its test should be corrected before relying on it.
Validation on merged commit 53ab05c: gofmt clean, go test ./... PASS, go vet ./... PASS, both linux/arm64 binaries build successfully.
## Post-merge architecture review
This is a good foundation and moves in the intended direction: X11 target is isolated behind `Opener`/`Session`/`Template`, target reconnection is independent of the Ground Station UART supervisor, and the process-group cleanup is properly covered by tests.
**Follow-up required before adding flight OSD:** the kiosk is deliberately `below` the separate `fpv-video` window. That correctly implements the no-WFB fallback, but this same window can never draw an OSD *over* video. I opened a focused follow-up issue for separate fallback/menu and transparent top-level OSD layers.
**Small configuration defect:** when `display.user` is empty, `startDisplayProcess` prepends configured `DISPLAY`/`XAUTHORITY` before `os.Environ()`. Go `exec.Cmd.Env` resolves duplicate keys using the **last** value, so inherited values overwrite the configured ones in this direct-launch path. Default production config uses `user: orangepi`, so it does not affect the current deployment, but the direct-user path and its test should be corrected before relying on it.
Validation on merged commit `53ab05c`: `gofmt` clean, `go test ./...` PASS, `go vet ./...` PASS, both linux/arm64 binaries build successfully.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Validation
go test -race -count=1 ./...go vet ./...andgofmt -l .git diff --checkand added-lines secrets scanCloses #1
Post-merge architecture review
This is a good foundation and moves in the intended direction: X11 target is isolated behind
Opener/Session/Template, target reconnection is independent of the Ground Station UART supervisor, and the process-group cleanup is properly covered by tests.Follow-up required before adding flight OSD: the kiosk is deliberately
belowthe separatefpv-videowindow. That correctly implements the no-WFB fallback, but this same window can never draw an OSD over video. I opened a focused follow-up issue for separate fallback/menu and transparent top-level OSD layers.Small configuration defect: when
display.useris empty,startDisplayProcessprepends configuredDISPLAY/XAUTHORITYbeforeos.Environ(). Goexec.Cmd.Envresolves duplicate keys using the last value, so inherited values overwrite the configured ones in this direct-launch path. Default production config usesuser: orangepi, so it does not affect the current deployment, but the direct-user path and its test should be corrected before relying on it.Validation on merged commit
53ab05c:gofmtclean,go test ./...PASS,go vet ./...PASS, both linux/arm64 binaries build successfully.