# Imprion PoS - system-wide GNOME defaults (Doc 1 sect. 6.1, D7/D9/D10).
# Compiled into /etc/dconf/db/local by hooks/live/0300-dconf-update.
# Every key set here is also locked in locks/00-imprion.

# --- On-screen keyboard (D9) -------------------------------------------
# Forced on: the terminals have no physical keyboard. This is the *enable*
# switch, not a "show it now" switch - with it off, gnome-shell does not
# even construct the keyboard actor (KeyboardManager._syncEnabled), so
# nothing can raise it.
#
# It is NOT the frontend's input method. QA 2026-09-02 (qa3) measured that
# GNOME 48 never raises the OSK for a Chromium form field, although Chromium
# negotiates zwp_text_input_v3 correctly; the PoS frontend therefore brings
# its own in-page keyboard (decision 2026-09-02). What this key buys is the
# manual OSK for every *other* application and web page on the terminal,
# raised from the top-bar button in imprion-shell@imprion.
[org/gnome/desktop/a11y/applications]
screen-keyboard-enabled=true
# --- Everything else in that menu is off, and locked off (F80) ----------
# A tester at the first real-hardware test turned the **screen magnifier** on
# from the top bar and could not turn it off: a magnified till shows a quarter
# of the point of sale, and the menu that would undo it is off the edge of the
# glass. One tap, and a restaurant cannot sell.
#
# So the two remaining switches are set false and locked. A locked key beats
# whatever is in the user database already, which matters here: a terminal that
# has *already* had the magnifier turned on gets it turned off by the next
# `dconf update` and the next login, without anybody having to find the menu.
#
# The indicator itself comes off the panel in imprion-shell@imprion. Both
# halves are needed and neither is enough: the extension removes the way in,
# and these keys are what the terminal falls back to if the extension is ever
# not loaded.
screen-magnifier-enabled=false
screen-reader-enabled=false

# The magnifier's own settings, pinned at "no magnification" so that a
# magnifier turned on by any other route — a GNOME upgrade's default, an
# application, a session started before this policy landed — is a magnifier at
# 1:1 rather than one showing a quarter of the till.
[org/gnome/desktop/a11y/magnifier]
mag-factor=1.0

# The rest of the accessibility menu. Every one of these is a way to make a
# till unusable from a menu the operator has no use for: high contrast repaints
# the PoS, text scaling reflows it, and the keyboard aids turn a touch panel's
# taps into something the frontend does not expect.
[org/gnome/desktop/a11y/interface]
high-contrast=false

[org/gnome/desktop/a11y/keyboard]
stickykeys-enable=false
slowkeys-enable=false
bouncekeys-enable=false
mousekeys-enable=false
togglekeys-enable=false

# "Always show the accessibility menu" — false, so that nothing but the locked
# on-screen keyboard could put the indicator on the panel even if the
# extension were not loaded.
[org/gnome/desktop/a11y]
always-show-universal-access-status=false

[org/gnome/desktop/interface]
text-scaling-factor=1.0

# --- Never go idle (a till is always "in use") -------------------------
[org/gnome/desktop/session]
idle-delay=uint32 0

# --- No screensaver, no lock screen ------------------------------------
# picture-uri/-options are the same ground as the desktop, set for the same
# reason the theme still ships lockscreen/gnome-background.xml: the lock
# screen is disabled by policy, not removed, so if that policy ever changes
# the terminal must not fall back to GNOME's stock adwaita background.
# There is no picture-uri-dark key in org.gnome.desktop.screensaver (checked
# against the schema in this build) - only org.gnome.desktop.background has
# one.
[org/gnome/desktop/screensaver]
lock-enabled=false
idle-activation-enabled=false
picture-uri='file:///usr/share/images/desktop-base/desktop-lockscreen.xml'
picture-options='zoom'
primary-color='#244C5A'

# --- Session lockdown ---------------------------------------------------
# The operator must not be able to leave the session. `pos` has no
# password (locked account), so a lock screen would strand the terminal.
#
# `disable-log-out` IS FALSE ON PURPOSE, AND IT IS THE RESTART/POWER OFF KEY
# (F80, second cut). It reads like the "no Log Out entry" switch. It is not:
# in GNOME it is the switch over the whole *end of session*, shutdown and
# reboot included, and it is checked in gnome-session, above and before
# anything logind or polkit has to say.
#
#   gnome-session 48.0 gsm-manager.c, gsm_manager_can_shutdown():
#       shutdown_available = !_log_out_is_locked_down (manager) &&
#               (gsm_system_can_stop (priv->system)
#                || gsm_system_can_restart (priv->system) || ...);
#   and _log_out_is_locked_down() is exactly
#       g_settings_get_boolean (priv->lockdown_settings, "disable-log-out").
#
#   gnome-shell 48.7 misc/systemActions.js (gresource, libshell-16.so):
#       _updateHaveShutdown(): this._canHavePowerOff = await CanShutdownAsync()
#       _updatePowerOff():     POWER_OFF and RESTART .available = _canHavePowerOff
#
# So with this key true the quick-settings power menu offers **Suspend and
# nothing else** - Suspend is the one entry gated on logind's CanSuspend()
# directly and it therefore survives - and the same key makes gnome-session's
# Shutdown() and Reboot() methods answer GSM_MANAGER_ERROR_LOCKED_DOWN. That
# is the whole of the owner's report, and it is why 49-imprion-power.rules
# alone did not fix it: logind already answered "yes" (measured on a lab
# terminal, `busctl ... CanPowerOff` -> "yes" inside the pos session) while
# gnome-session's CanShutdown answered false.
#
# IT IS STILL LOCKED, and locking `false` is not a contradiction: the lock is
# what stops an application or the user database turning it back on. The
# "no Log Out entry" half of the lockdown intent is kept by two other things,
# because this key cannot do it without taking Restart and Power Off with it:
#
#   * the quick-settings Log Out entry is suppressed by imprion-shell@imprion
#     (it forces SystemActions' `logout` action unavailable, which is what the
#     entry's `can-logout` binding reads);
#   * Ctrl+Alt+Delete, GNOME's other way out of a session, is unbound below.
[org/gnome/desktop/lockdown]
disable-log-out=false
disable-user-switching=true
disable-lock-screen=true

# --- Ctrl+Alt+Delete does not end the session (F80, second cut) ---------
# GNOME binds the `logout` media key to <Control><Alt>Delete out of the box.
# With `disable-log-out` false above, gnome-session would honour it, so a
# technician's USB keyboard on a till could drop the operator's session. The
# tills have no keyboard of their own; this is the keyboard somebody brings.
# An empty list is "no binding at all", and it is locked like everything else
# here.
[org/gnome/settings-daemon/plugins/media-keys]
logout=@as []

# --- Printing: the technician never sets a printer up from here (F86) ---
# The terminal's printer handling is the agent's raw-queue flow and nothing
# else (D12, Doc 1 sect. 6.4): a USB printer-class device gets a queue from
# /usr/lib/imprion/printer-event -> the agent's socket, and that is the only
# way a queue is ever created. Settings must not offer a second one.
#
# This key is GNOME's own lockdown switch for the print-setup UI and it is set
# and locked here for the same reason as everything above - but it is NOT what
# takes the Printers panel out of Settings, and the difference was measured
# rather than assumed. With it locked true on a GNOME 48 terminal the panel is
# still in the sidebar, still lists the queues, and still offers "Add
# Printer..."; what it changes is the panel's permission, which then reads
# "Error - some settings cannot be unlocked". The panel itself is removed by
# the Hidden=true shadow of gnome-printers-panel.desktop this package ships in
# /usr/share/gnome/applications/, which is earlier in the session's
# XDG_DATA_DIRS than /usr/share (measured: /usr/share/gnome:/usr/local/share/:
# /usr/share/) - and that is what makes g_desktop_app_info_new() return NULL
# for the panel, which is how gnome-control-center decides a panel exists.
#
# `disable-printing` is deliberately NOT set. That one stops printing, and the
# whole point of the terminal is that it prints.
disable-print-setup=true

# --- Keyboard layout: hr, deliberately not si (D26) --------------------
# The console, GDM, the installer and /etc/default/keyboard all stay on
# `si`; only the GNOME session's input source is `hr`, and only because of
# the on-screen keyboard.
#
# Physically the two are the same layout: xkb `si(basic)` and `hr(basic)`
# both `include "rs(latin)"` and differ only in a few level-3/4 dead keys
# and the tilde key - nothing in the letter block, so an operator typing on
# a Slovenian QWERTZ keyboard cannot tell them apart.
#
# The OSK layout, however, is chosen by this key, and GNOME 48's own
# si.json is QWERTY: q-w-e-r-t-**y**, with z on the bottom row. That is not
# the layout printed on a Slovenian keyboard and not what an operator
# expects. hr.json is the QWERTZ one. (Carons are a long press on the base
# letter in *both* - s->s-caron, d->d-stroke, z->z-caron, c->c-caron; hr
# additionally offers c-acute, z-acute and z-dot. Neither layout puts them
# on a key of their own.) Revisit if the image ever ships its own si.json.
[org/gnome/desktop/input-sources]
sources=[('xkb','hr')]

# --- Power (not in Doc 1; see report) -----------------------------------
# GNOME defaults would suspend the terminal after 20 minutes on AC
# ('suspend' is the upstream default for both sleep-inactive-*-type) and
# suspend on power-button press. Both are wrong for a PoS terminal:
# a suspended till stops selling and drops its network sessions.
# power-button-action='interactive' keeps a deliberate, technician-usable
# shutdown path (a confirmation dialog) without a stray press killing a
# live session.
[org/gnome/settings-daemon/plugins/power]
sleep-inactive-ac-type='nothing'
sleep-inactive-battery-type='nothing'
idle-dim=false
power-button-action='interactive'

# --- The Imprion shell extension (QA 2026-09-02) -----------------------
# /usr/share/gnome-shell/extensions/imprion-shell@imprion/ does exactly two
# things, both of which GNOME 48 has no setting for:
#   * it hides the Activities overview once shell startup completes - gdm
#     autologin finishes the shell startup before pos-frontend.service has
#     mapped Chromium, so without it an unattended till came up in the
#     window picker with the PoS behind it;
#   * it adds a top-bar button that shows and hides the on-screen keyboard,
#     which is the only manual way to raise the OSK on a terminal with no
#     physical keyboard (the a11y menu item is the enable switch, and it is
#     locked on and insensitive here).
# Locked, so the session cannot be left without it.
#
# `disable-user-extensions` is the master switch and it has to be set and
# locked here as well (qa14). GNOME ships
# `org.gnome.Shell-disable-extensions.service` and wires it as
# `OnFailure=` on `org.gnome.Shell@wayland.service`; it runs
# `gsettings set org.gnome.shell disable-user-extensions true`, which writes
# into the `pos` user's own writable dconf. So **one** session crash turns
# every extension off, that write outlives every reboot, and the list above
# goes on being correct and ignored — a till with no top bar button and no
# hidden Activities overview, for ever, with nothing in the system database
# to say why.
#
# Setting it false is not enough on its own: the user database is consulted
# first and would still win. It is the lock that makes GNOME's own recovery
# action a no-op on this terminal, which is the right trade here — an
# extension that fails on a till is one the technician has to fix, not one
# the session may quietly drop.
[org/gnome/shell]
enabled-extensions=['imprion-shell@imprion']
disable-user-extensions=false

# ===========================================================================
# Imprion OS branding (branding phase 4 / 6, design brief sections 4 and 6)
# ===========================================================================

# --- Interface: DARK, teal, Lato ---------------------------------------
# The Imprion 2026 identity ships in its DARK variant (owner, 2026-09-18;
# brand/README.txt, brand/desktop/colors.txt: "color-scheme: prefer-dark -
# this package IS the dark variant"). The ground is the petrol #244C5A and
# the lock-up and body text are white, so dark windows now sit on a dark
# wallpaper rather than fighting a light one - which is exactly what the
# 2026-09-03 decision, taken against the light package, was avoiding.
# color-scheme is still written explicitly and still locked: an application
# (or a GNOME upgrade that changes the schema default) must not be able to
# put the terminal back into light windows on the petrol ground.
#
# accent-color is an ENUM in GNOME 48 - blue teal green yellow orange red
# pink purple slate, verified in org.gnome.desktop.interface.gschema.xml in
# this build's chroot. There is no hex mechanism; `teal` is the brand's own
# nearest-of-nine pick (brand/foundations/palette.txt: accent-gnome: teal).
#
# font-name/document-font-name: Lato is the brand face and ships as
# fonts-lato (OFL) from config/package-lists/imprion-branding-desktop.list.
# The GNOME 48 defaults being replaced are 'Adwaita Sans 11' for both (not
# Cantarell - measured on this build, which settles item 2 of the design
# context pack's "could not verify" list). monospace-font-name is left
# alone: the brand has no monospace face and a technician's terminal is
# better served by the system default.
[org/gnome/desktop/interface]
color-scheme='prefer-dark'
accent-color='teal'
font-name='Lato 11'
document-font-name='Lato 11'

# --- Wallpaper ----------------------------------------------------------
# The URI is the stable ALTERNATIVE path, which is what desktop-base's own
# /usr/share/glib-2.0/schemas/10_desktop-base.gschema.override uses:
#   /usr/share/images/desktop-base/desktop-background.xml
#     -> /etc/alternatives/desktop-background.xml
#       -> active-theme/wallpaper/gnome-background.xml
#       -> (hooks/live/0810) imprion-theme/wallpaper/gnome-background.xml
# Going through the XML rather than a single PNG is what keeps the
# multi-resolution list working (GNOME picks the <size> nearest the panel).
#
# picture-uri-dark is set to the same file, and with color-scheme
# prefer-dark it is now the key GNOME actually reads: desktop-base's own
# override sets only picture-uri, so without this line the dark session
# would show the schema default (/usr/share/backgrounds/gnome/adwaita-d.jpg)
# rather than the Imprion wallpaper.  Both keys naming the same XML is what
# makes the ground identical whichever way the scheme is read.
#
# primary-color is the flat brand ground; it is what shows in the moment
# before the wallpaper is painted and behind any image with transparency.
[org/gnome/desktop/background]
picture-uri='file:///usr/share/images/desktop-base/desktop-background.xml'
picture-uri-dark='file:///usr/share/images/desktop-base/desktop-background.xml'
picture-options='zoom'
primary-color='#244C5A'
