Add parent's operations manual (repo + baked at /usr/share/doc) and

document the Gitea OTA update path (bootc switch + publish routine)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

BUILD-CONSOLE.md

@@ -99,6 +99,35 @@ docker run --rm localhost/bc250-console-gnome:latest rpm -q kernel
 
 First successful build shipped `kernel-7.0.9-ogc3.2.fc44` — fine.
 
+## Publish an update (OTA to the installed console)
+
+The installed console follows `git.lazypugs.com/ckoch/bc250-console-gnome:latest`
+(one-time `bootc switch` after install — see below). To ship an update:
+
+```bash
+# rebuild the image (steps 1–2 above), then:
+docker login git.lazypugs.com          # Gitea token with package write scope
+docker tag localhost/bc250-console-gnome:latest \
+  git.lazypugs.com/ckoch/bc250-console-gnome:latest
+docker push git.lazypugs.com/ckoch/bc250-console-gnome:latest
+```
+
+The console's `uupd` timer picks it up automatically; to force it,
+SSH in and run `sudo bootc upgrade && sudo systemctl reboot`.
+
+**One-time, on the console after first install** (points the OS at the
+registry instead of the offline install source):
+
+```bash
+sudo bootc switch git.lazypugs.com/ckoch/bc250-console-gnome:latest
+```
+
+If the Gitea package is private, the console needs pull credentials first:
+put a read-scope token in `/etc/ostree/auth.json`:
+`{"auths":{"git.lazypugs.com":{"auth":"<base64 of user:token>"}}}` —
+or make the package public in Gitea (Packages → bc250-console-gnome →
+Settings) and skip that.
+
 ## Smoke test + install
 
 1. **VM test**: boot the ISO in a VM (KVM works headless:

OPERATIONS.md

@@ -0,0 +1,64 @@
+# BC-250 Console — Parent's Operations Manual
+
+A copy of this file lives on the console at
+`/usr/share/doc/bc250-console/OPERATIONS.md`.
+
+Accounts: **kid** (plays games, no admin) and **parent** (admin, sudo).
+Both ship with password `bc250console` — **change both immediately**:
+log in (or SSH) as each user and run `passwd`. Parent can also reset the
+kid's password any time: `sudo passwd kid`.
+
+## Connecting remotely
+
+| | Command / client | Works when |
+|---|---|---|
+| SSH (terminal) | `ssh parent@<console-address>` | Always (console is never asleep) |
+| RDP (see the screen) | Any RDP client → `<console-address>:3389` | Only while the kid's session is logged in |
+
+`<console-address>`: the LAN IP, or (recommended) the Tailscale name/IP so it
+works from anywhere. Never port-forward 22/3389 on the router.
+
+## One-time setup after installing
+
+1. On the console, log in as **kid**, open a terminal, run `bc250-remote-setup`
+   (sets up RDP credentials + firewall; SSH is already on).
+2. `sudo tailscale up` — log in with your Tailscale account (daemon already runs).
+3. In Steam (opens automatically in Big Picture): log into the kid's Steam
+   account, enable **Family View** (Settings → Family) and set the PIN.
+4. Change both passwords (see above).
+
+## Installing a game remotely
+
+RDP into the kid's session → unlock Family View with your PIN → Steam →
+Store → install. Downloads continue after you disconnect.
+
+## Updates
+
+- **Automatic**: the console updates the OS image, flatpaks, and Steam on its
+  own (`uupd` timer, runs in the background). Nothing to do.
+- **Force an update now** (SSH): `sudo bootc upgrade && flatpak update -y`
+- **What version am I on?**: `sudo bootc status` (shows image + digest)
+- **Publishing a new OS image** (on the build PC): see
+  `BUILD-CONSOLE.md` → "Publish an update". The console picks it up
+  automatically within a day, or immediately with `sudo bootc upgrade`.
+- **Roll back a bad update**: hold Space at boot and pick the previous entry,
+  or over SSH: `sudo bootc rollback && sudo systemctl reboot`.
+
+## Health checks (SSH)
+
+```bash
+sensors                                       # temps — watch under load
+systemctl status cyan-skillfish-governor-smu  # GPU governor: should be active
+cat /sys/class/drm/card*/device/pp_dpm_sclk   # GPU clock scaling
+df -h /                                       # disk space
+```
+
+## Misc
+
+- Reboot: `sudo systemctl reboot` — Shutdown: `sudo systemctl poweroff`
+- The console never sleeps or locks by design (it must stay reachable).
+- Kid's session opens Steam Big Picture automatically; Esc exits to desktop.
+- RDP refuses to connect → the kid's session probably isn't logged in, or
+  `bc250-remote-setup` hasn't been run yet.
+- Steam misbehaves after an update → try ProtonUp-Qt (installed) to switch
+  the game to Proton-GE.

files/console/usr/share/doc/bc250-console/OPERATIONS.md

@@ -0,0 +1,64 @@
+# BC-250 Console — Parent's Operations Manual
+
+A copy of this file lives on the console at
+`/usr/share/doc/bc250-console/OPERATIONS.md`.
+
+Accounts: **kid** (plays games, no admin) and **parent** (admin, sudo).
+Both ship with password `bc250console` — **change both immediately**:
+log in (or SSH) as each user and run `passwd`. Parent can also reset the
+kid's password any time: `sudo passwd kid`.
+
+## Connecting remotely
+
+| | Command / client | Works when |
+|---|---|---|
+| SSH (terminal) | `ssh parent@<console-address>` | Always (console is never asleep) |
+| RDP (see the screen) | Any RDP client → `<console-address>:3389` | Only while the kid's session is logged in |
+
+`<console-address>`: the LAN IP, or (recommended) the Tailscale name/IP so it
+works from anywhere. Never port-forward 22/3389 on the router.
+
+## One-time setup after installing
+
+1. On the console, log in as **kid**, open a terminal, run `bc250-remote-setup`
+   (sets up RDP credentials + firewall; SSH is already on).
+2. `sudo tailscale up` — log in with your Tailscale account (daemon already runs).
+3. In Steam (opens automatically in Big Picture): log into the kid's Steam
+   account, enable **Family View** (Settings → Family) and set the PIN.
+4. Change both passwords (see above).
+
+## Installing a game remotely
+
+RDP into the kid's session → unlock Family View with your PIN → Steam →
+Store → install. Downloads continue after you disconnect.
+
+## Updates
+
+- **Automatic**: the console updates the OS image, flatpaks, and Steam on its
+  own (`uupd` timer, runs in the background). Nothing to do.
+- **Force an update now** (SSH): `sudo bootc upgrade && flatpak update -y`
+- **What version am I on?**: `sudo bootc status` (shows image + digest)
+- **Publishing a new OS image** (on the build PC): see
+  `BUILD-CONSOLE.md` → "Publish an update". The console picks it up
+  automatically within a day, or immediately with `sudo bootc upgrade`.
+- **Roll back a bad update**: hold Space at boot and pick the previous entry,
+  or over SSH: `sudo bootc rollback && sudo systemctl reboot`.
+
+## Health checks (SSH)
+
+```bash
+sensors                                       # temps — watch under load
+systemctl status cyan-skillfish-governor-smu  # GPU governor: should be active
+cat /sys/class/drm/card*/device/pp_dpm_sclk   # GPU clock scaling
+df -h /                                       # disk space
+```
+
+## Misc
+
+- Reboot: `sudo systemctl reboot` — Shutdown: `sudo systemctl poweroff`
+- The console never sleeps or locks by design (it must stay reachable).
+- Kid's session opens Steam Big Picture automatically; Esc exits to desktop.
+- RDP refuses to connect → the kid's session probably isn't logged in, or
+  `bc250-remote-setup` hasn't been run yet.
+- Steam misbehaves after an update → try ProtonUp-Qt (installed) to switch
+  the game to Proton-GE.