Fix: Teach the update contract about the link-mcp stage

setup/scripts/change-settings

@@ -38,13 +38,33 @@ if [[ -f /etc/udev/rules.d/99-panama-gpu.rules ]]; then
 fi
 
 # The power-key drop-in lands via the same copy; logind reads its config only
-# at start, so without this the button keeps hard-powering-off until the next
+# at start. Restarting logind under a running Wayland or X11 session drops that
-# boot. Restarting logind is what Fedora's own updates do and current systemd
+# session and takes the desktop down with it, so the restart happens only when
-# preserves sessions across it.
+# logind is not already honouring the drop-in AND no graphical session is live.
+# Otherwise the change waits for the next boot, which is harmless: the answer
+# is usually already "ignore" from an earlier run.
+graphical_session_active() {
+  local id
+  for id in $(loginctl list-sessions --no-legend 2>/dev/null | awk '{ print $1 }'); do
+    case "$(loginctl show-session "$id" -p Type --value 2>/dev/null)" in
+      wayland|x11) return 0 ;;
+    esac
+  done
+  return 1
+}
+
 if [[ -f /etc/systemd/logind.conf.d/panama-power-key.conf ]]; then
+  power_key="$(busctl get-property org.freedesktop.login1 /org/freedesktop/login1 \
+    org.freedesktop.login1.Manager HandlePowerKey 2>/dev/null)" || power_key=""
+  if [[ "$power_key" == 's "ignore"' ]]; then
+    log "logind already leaves the power button to the power menu"
+  elif graphical_session_active; then
+    log "A desktop session is running; the power-button change applies at next boot"
+  else
     log "Reloading logind so the power button opens the menu instead of powering off"
     sudo systemctl try-restart systemd-logind 2>/dev/null \
       || log "Could not restart logind; the power-button change applies at next boot"
+  fi
 fi
 
 # The document-portal drop-in lands via the same copy. A user unit's drop-ins

tests/setup/package-provenance-contract

@@ -105,6 +105,13 @@ before_system_flatpak="$(snapshot_file_state /var/lib/flatpak/repo/config)"
 before_system_flathub_key="$(snapshot_file_state /var/lib/flatpak/repo/flathub.trustedkeys.gpg)"
 before_user_flatpak="$(snapshot_file_state "$HOME/.local/share/flatpak/repo/config")"
 before_bashrc="$(snapshot_file_state "$HOME/.bashrc")"
+# A runtime case that escapes its case_root writes a fixture node into the real
+# nvm tree, and the real installer then refuses that unreceipted directory on
+# every later update. Snapshot the listing so the escape fails here instead.
+snapshot_nvm_node() {
+    find "${NVM_DIR:-$HOME/.nvm}/versions/node" -printf '%P %s %T@\n' 2>/dev/null | sort
+}
+before_nvm_node="$(snapshot_nvm_node)"
 
 # Runtime and agent installs must consume the reviewed provenance table. Keep
 # this scan at the public script boundary because a command hidden elsewhere in
@@ -2064,5 +2071,7 @@ STUB_DNF_FAIL_MATCH=terra-release expect_failure run_installer_function terra-dn
     || fail 'repository cases changed the user Flatpak remote'
 [[ "$before_bashrc" == "$(snapshot_file_state "$HOME/.bashrc")" ]] \
     || fail 'repository cases changed the protected bashrc'
+[[ "$before_nvm_node" == "$(snapshot_nvm_node)" ]] \
+    || fail 'runtime cases wrote into the real nvm node tree'
 
 printf 'package provenance contract: PASS\n'

tests/setup/update-command-contract

@@ -36,7 +36,7 @@ note() { findings+=("$1"); }
 tmp="$(mktemp -d -t panama-update-contract.XXXXXX)"
 trap 'rm -rf "$tmp"' EXIT
 
-STAGE_NAMES=(install-packages link-dotfiles link-skills link-user change-settings
+STAGE_NAMES=(install-packages link-dotfiles link-skills link-user link-mcp change-settings
              link-vicinae-scripts setup-server link-server setup-identity
              install-hardware)
 PACKAGE_BEHAVIOR_INPUTS=(
@@ -191,7 +191,7 @@ fi
 
 # ── 2. Exactly the answer-free stages ────────────────────────────────────────
 
-for stage in install-packages link-dotfiles link-skills link-user change-settings link-vicinae-scripts; do
+for stage in install-packages link-dotfiles link-skills link-user link-mcp change-settings link-vicinae-scripts; do
     grep -qx "$stage" <<<"$ran" || note "install --upgrade did not run $stage"
 done
 for stage in setup-identity install-hardware; do
@@ -364,7 +364,7 @@ grep -qx 'link-dotfiles' "$tmp/c/ran" \
 # reason to abandon the machine either. It suppresses the stages that open DNF
 # and the migrations, which are free to run a transaction of their own. Every
 # stage that only links configuration still runs, and the status stays 78.
-SAFE_STAGES=(link-dotfiles link-skills link-user link-vicinae-scripts)
+SAFE_STAGES=(link-dotfiles link-skills link-user link-mcp link-vicinae-scripts)
 DNF_SUPPRESSED=(install-packages change-settings install-hardware)
 
 assert_trust_refusal() {