Show Deployment Kit

Push PowerPoint decks and video clips from one Ingest laptop to the show rig over SMB, and nothing else. The rig is six graphics machines and two Macs running Mitti, all hard-wired to a private switch.

Drop a deck in a folder and it lands on the GFX machines. Drop media and it lands on the Macs. Transfers retry, every file is verified by size on arrival, and machines that are off are skipped rather than failed. Nothing auto-opens. Runs on Linux, macOS or Windows.

Get the kit

No cloud account, no OAuth, no extra install.

1. Download: https://github.com/mpd2457/show-deploy/releases/latest/download/show-deploy.zip
2. Unzip. You get a folder named show-deploy.
3. Copy that folder onto an exFAT USB stick (Windows and Mac both read exFAT natively).
4. Plug the stick into each machine and double-click the setup file for that machine.

Or clone:

git clone https://github.com/mpd2457/show-deploy.git

Two Ingest options. The Linux laptop is the normal one. A Windows 11 Pro work laptop can take the same role with identical behaviour if the Linux machine is not available — see Windows Ingest.

Running a show, not setting one up? Read CREW-GUIDE.md instead. It covers dropping files in, the one naming rule that matters, and what to do when something doesn't arrive. No technical knowledge needed.

Contents

File	Runs on	What it does
setup-ingest.sh	Linux Ingest	static IP, folders, creds, installs the watcher
restore-ingest.sh	Linux Ingest	undoes the above, puts the laptop back to normal
RUN-ingest.sh / RUN-restore.sh	Linux Ingest	double-click wrappers around the two above
setup-ingest-win.ps1	Windows Ingest	same job as setup-ingest.sh
restore-ingest-win.ps1	Windows Ingest	undoes it, restores the adapter's prior addressing
RUN-ingest-win.bat / RUN-ingest-win-restore.bat	Windows Ingest	double-click wrappers that request elevation themselves
show-watcher.py	Linux Ingest	the push watcher itself
show-watcher.ps1	Windows Ingest	the same watcher, ported (net use + file copy, no extras to install)
show-dashboard.py	Linux Ingest	live status dashboard at http://localhost:8080
show-status.sh	Linux Ingest	quick human-readable status summary in the terminal
show-deploy.desktop	Linux Ingest	double-click launcher for setup-ingest.sh
install-desktop-launcher.sh	Linux Ingest	puts the launcher on the Desktop
setup-gfx.ps1	GFX1-6	Windows deck machines: IP, share, arrival log
RUN-gfx1.bat … RUN-gfx6.bat	GFX1-6	one per machine, so you cannot run the wrong one
setup-mitti.sh	MITTIA/B	Mac video/audio: IP, show account, SMB share, arrival log, self-test
restore-mitti.sh	MITTIA/B	undoes it: old name, old addressing, share and account gone
RUN-mittiA.command / RUN-mittiB.command	MITTIA/B	one per machine
RUN-restore-mitti.command	MITTIA/B	double-click wrapper for restore-mitti.sh
show-watcher-mac.sh	MITTIA/B	the Mac arrival logger
test_watcher.py	any	offline tests for the Linux watcher
test_watcher_win.py	any	offline tests for the Windows watcher
CREW-GUIDE.md	crew	plain-language guide for running a show

Tests need no rig and touch nothing on it: they fake ping and smbclient in a temp directory and run the real watcher against them.

python3 test_watcher.py        # Linux watcher, 85 checks
python3 test_watcher_win.py    # Windows watcher, 88 checks; needs pwsh (PowerShell 7)

The Windows harness fakes ping, points the watcher's share root at a folder on disk (SHOWKIT_SHARE_ROOT) and hooks every copy (SHOWKIT_PUT_HOOK) so a machine can refuse, corrupt or slow a put. SHOWKIT_TEST_SCALE works for both.

Running the tests faster

The watcher is a daemon that never exits on its own, so each scenario runs it for a fixed wall-clock budget and then stops it. Those budgets add up to about three and a half minutes, which is fine but slow to sit through while iterating.

Both knobs below make the suite quicker without weakening it. The default behaviour is unchanged, so a plain python3 test_watcher.py still runs at the original timings.

Variable	Default	What it does
SHOWKIT_TEST_SCALE	1	Scales the per-scenario budgets. 0.2 runs the suite in about 50s and is what CI uses. Verified stable across repeated runs; 0.1 starts failing scenarios, so don't go lower without expecting flakes.
SHOWKIT_POLL_SECONDS	2	The watcher's filesystem poll interval. The harness sets this to 0.05 so each poll is cheap. It is a real knob on the watcher itself, not just a test setting — the retry-backoff has one too, via SHOWKIT_BACKOFF.

SHOWKIT_TEST_SCALE=0.2 python3 test_watcher.py   # ~50s instead of ~3m30s

The same two seams exist in the PowerShell watcher (show-watcher.ps1) for the Windows harness.

Network, wired only

192.168.50.0/24, gateway 192.168.50.1. Wi-Fi is never changed. Plug into the rig switch before setup.

INGEST 192.168.50.10 drop files in ~/Desktop/Ingest (mkultra2, or the Windows fallback) GFX1 192.168.50.11 decks GFX2 192.168.50.12 decks GFX3 192.168.50.13 decks GFX4 192.168.50.14 decks GFX5 192.168.50.15 decks GFX6 192.168.50.16 decks MITTIA 192.168.50.21 video/audio MITTIB 192.168.50.22 video/audio

Folders

INGEST ~/Desktop/Ingest drop here. push_log.txt inside. ~/Desktop/Archive copy of every drop. Ingest also has Day 1 through Day 5. GFX C:/Users/Public/Desktop/Ingest plus Day 1 through Day 5 Mitti ~/Desktop/Ingest plus Day 1 through Day 5

Share name is still ShowShare, but it points at that Desktop Ingest folder. Files land straight in Ingest. Day folders stay empty until you drag into them.

Decks go to the GFX machines, media to the Mitti Macs, anything else to everything — see What gets pushed where.

Every machine — GFX and Mac alike — serves the share to a local account called show. The password is asked for at setup, not stored in this repo. Ingest writes it to ~/.config/showkit/smbcreds at mode 600 (on Windows, to %LOCALAPPDATA%\showkit with an ACL for your user only), and the Mac copy to smbcreds-mitti. setup-mitti.sh creates the show account on each Mac itself (hidden, no login shell) so the Mac's real login is never touched.

The share password

The default is password. Press Enter at every prompt to accept it, or type something else at any of them. One password across all nine machines means load-in is not nine invented passwords.

Worth being clear about what it is for. The rig is a closed 192.168.50.0/24 wired network with no route to the internet, so this password is not protecting anything from the internet — it stops a random laptop on the switch from overwriting the decks mid-show. For that, password is fine, and it rotates by accident because the warehouse reimages every machine between events.

Set something stronger if the machines ever see an untrusted network, or if you keep the machines un-reimaged and in use between events. Either way it goes in the repo's history if you commit it, so prefer typing it at the prompt.

What you will see in the log

QUEUED name [DECK] new file seen, waiting to settle OK [DECK] -> \GFX1\ShowShare : name (1 attempt) SKIP [MEDIA] -> \MITTIA\ShowShare : name (machine not present, will check again in 60s) FAIL [DECK] -> \GFX2\ShowShare : name : NT_STATUS_ACCESS_DENIED : retry in 15s, 7 attempt(s) left DONE name every target delivered GONE name you deleted it from Ingest while it was still queued CHANGED name same name, size moved - treated as a new version GIVE UP name : GFX2 (8/8 tries) gave up; re-copy or rename to retry RE-ARMED name a given-up file was re-copied and is being sent again

OK = landed, and the far end confirmed the size. SKIP = machine not here. FAIL = password or share, and it will be retried. DONE means you can stop watching.

See How it stays out of trouble for why these outcomes can be trusted.

Install every show

The warehouse reimages the rig between events, so every machine arrives at a show pristine. Nothing carries over: no static IP, no share, no local account, no watcher, no stored credentials. All nine machines need their setup script run at load-in, every time. This is the normal workflow, not a recovery path.

Run them far-end first and Ingest last, because Ingest is the machine that holds the passwords and it needs the accounts to already exist.

Cable to the switch first.

How to start each script

There is no single answer that covers all nine machines, because each platform has its own gate:

Machine	File	How to start it	Then
GFX1 .11	RUN-gfx1.bat	Double-click	Click Yes on the UAC prompt
GFX2 .12	RUN-gfx2.bat	Double-click	Click Yes on the UAC prompt
GFX3 .13	RUN-gfx3.bat	Double-click	Click Yes on the UAC prompt
GFX4 .14	RUN-gfx4.bat	Double-click	Click Yes on the UAC prompt
GFX5 .15	RUN-gfx5.bat	Double-click	Click Yes on the UAC prompt
GFX6 .16	RUN-gfx6.bat	Double-click	Click Yes on the UAC prompt
MITTIA .21	RUN-mittiA.command	Right-click → Open	Confirm; macOS blocks it otherwise
MITTIB .22	RUN-mittiB.command	Right-click → Open	Confirm; macOS blocks it otherwise
INGEST .10	RUN-ingest.sh	Terminal, or chmod +x then double-click	Type your sudo password

Two details worth knowing before load-in:

Windows — double-click is enough. Do not right-click for "Run as administrator". Each .bat calls -Verb RunAs itself, so the UAC prompt appears on its own. Right-clicking first gives you the same result, just via a longer path. There is one .bat per machine, so the filename tells you which one it is and you cannot run the wrong script.

Mac — right-click → Open, not double-click. Gatekeeper refuses a .command file on first run with "cannot be opened because it is from an unidentified developer". Right-clicking and choosing Open clears it, after which a double-click works normally. Each wrapper passes its own machine name, so RUN-mittiA.command is MITTIA and RUN-mittiB.command is MITTIB.

Linux — needs sudo, so use a terminal. RUN-ingest.sh is a thin wrapper around the same command, so if your file manager will not run it:

cd ~/Desktop/show-deploy
sudo bash ./setup-ingest.sh

Alternatively, run install-desktop-launcher.sh once to put a double-click launcher on the Desktop:

bash ~/Desktop/show-deploy/install-desktop-launcher.sh

After that, Show Deploy Setup appears on the Desktop and can be double-clicked like any other app. It opens a terminal and runs the setup script with a visible password prompt.

What each script asks

All of them prompt for the share password. Press Enter to accept password rather than inventing one per machine — see The share password.

INGEST on mkultra2 (Linux), from the show-deploy folder: sudo bash ./setup-ingest.sh It asks for the GFX password, then whether Macs are on this show and the Mac share password (same show account, same default). Pass the wired interface name as the first argument if auto-detection is wrong: sudo bash ./setup-ingest.sh enp3s0. No reboot. Check: systemctl --user status showwatcher

GFX: double-click RUN-gfx1.bat on the .11 laptop, RUN-gfx2.bat on .12, and so on through RUN-gfx6.bat on .16. UAC Yes. Asks for the share password. Reboot only if it says it renamed the PC — which it does on a freshly imaged machine, since the image will not carry the right name.

Mac: right-click RUN-mittiA.command or RUN-mittiB.command, Open. It asks for the Mac's own admin password (to run as root), then the share password (Enter). It creates the show account, turns File Sharing on over SMB, shares Desktop/Ingest as ShowShare, and ends with a self-test that logs in to the share the way Ingest will. Look for two PASS lines. If either says FAIL, the script prints the System Settings path to fix it by hand (File Sharing > ShowShare, SMB ticked, show ticked under Windows File Sharing) — that was the failure mode of the previous kit, where the folder appeared but Ingest was refused. Reboot — the Mac setup renames the machine the same way, and File Sharing does not reliably come up under the new name until it has. On the first push, click Allow on the Local Network prompt.

GFX and Mitti machines both rename themselves, so expect eight reboots across the rig. Ingest never needs one. Restart them one at a time; the others are independent.

Windows Ingest fallback

Use this when mkultra2 is not available. Same IP, same drop folder, same log, same routing and retry behaviour — show-watcher.ps1 is a port of show-watcher.py, not a simplification, so a show behaves identically whichever laptop is in the van. Subfolder routing (GFX 1 …, GFX 3+4 …, Videos for Playback), Macs-take-media-only, lock-file skipping: all the same.

Sign in as the account that will run the show (it must be an administrator — the setup is per-user and the watcher runs as whoever ran it). Plug into the show switch first (the script refuses to run with no wired link), then double-click RUN-ingest-win.bat and click Yes on the UAC prompt. It asks the same questions as the Linux setup (Enter accepts the defaults), creates Desktop\Ingest, Desktop\Archive and Day 1-5, stores credentials under %LOCALAPPDATA%\showkit, registers a scheduled task that starts the watcher at logon, starts it, and ends with a PASS line once the watcher has written its first log entry. If you see FAIL instead, the line under it is the command to run by hand to see why.

Nothing to install. The watcher pushes with Windows' own SMB client — a net use \\GFX1\ShowShare with the stored show password, then a plain file copy — and runs on the Windows PowerShell 5.1 that ships with Windows. No smbclient.exe, no PowerShell 7, no extra modules. Pro or Home both work.

Three deliberate differences from the Linux box:

• The drop folder is the signed-in user's own Desktop\Ingest, not the Public desktop the GFX machines use.
• It consumes a share rather than serving one, so there is nothing to turn on in File Sharing.
• The watcher is a scheduled task at logon, so it runs once someone has signed in (the Linux service runs from boot). Lock the screen, don't sign out.

The show IP goes on the wired port with no default gateway, so Wi-Fi keeps carrying internet exactly as on the Linux Ingest.

To undo it, double-click RUN-ingest-win-restore.bat and click Yes on the UAC prompt. It stops the watcher, removes the scheduled task, drops the share connections, deletes the stored credentials and push queue, restores the wired adapter to the exact addressing it had beforehand (saved at first setup, so not merely "assume DHCP"), and cleans the hosts file. Add -Purge to also delete the Ingest and Archive folders.

Log is Desktop\Ingest\push_log.txt, same tags as Linux (OK / SKIP / FAIL / REJECT / GIVE UP / DONE). To watch it live:

Get-Content "$env:USERPROFILE\Desktop\Ingest\push_log.txt" -Wait -Tail 20

A FAIL … share not reachable (service asleep or wrong password): System error 1326 is the share password; System error 53 or 67 is the far machine answering ping but not serving ShowShare (its setup script has not been run).

Show day

Drop a small pptx and a short mp4 into the Ingest folder, then watch the log:

tail -f ~/Desktop/Ingest/push_log.txt        # Linux
Get-Content "$env:USERPROFILE\Desktop\Ingest\push_log.txt" -Wait -Tail 20   # Windows

Look for DONE on both, and both files in ~/Desktop/Archive. If something goes wrong, the log names the machine and the reason.

Every show: power on, cable Ingest, drop files with a new filename each version. Sort into Day 1-Day 5 yourself.

Crew-friendly status tools (Linux Ingest)

Two easier ways to check status without reading the raw log:

Live dashboard — open a browser on the Ingest laptop and go to:

http://localhost:8080

A table shows every file, its status (✅ Done / 🔄 Sending / ❌ Failed / ⏳ Queued), which machines have it, and the recent log. Auto-refreshes every 3 seconds. Started automatically by setup-ingest.sh as a systemd service alongside the watcher. No setup needed by crew.

Quick terminal summary — from anywhere on the Ingest machine:

bash ~/Desktop/show-deploy/show-status.sh

Prints a human-readable summary grouped by status. Useful for a quick sanity check at the top of a session.

Desktop notifications — the watcher fires a toast notification (bottom-right corner) on every DONE, GIVE UP, and expired-machine event. No action needed; they appear automatically.

Logs and rotation

Three logs, all plain text, none of them load-bearing:

Log	Where	Rotates at	Keeps
push_log.txt	Ingest, in the drop folder	5 MB	.1 .2 .3
arrival_log.txt	GFX1-6, C:\ShowScripts\	5 MB	.1
showkit-arrival.log	MITTIA/B, ~/Library/Logs/	5 MB	.1

push_log.txt is the one that matters during a show: it is what tells you a file landed. The other two record what each far end received, which is only useful afterwards if you want to confirm a file arrived by some route other than the push.

What gets pushed where

Extension	Goes to
.pptx .ppt .key .pdf	GFX1-GFX6
.mp4 .mov .mxf .avi .mkv .wav .mp3 .aac .m4a	MITTIA, MITTIB
anything else	GFX1-GFX6 only, logged as UNKNOWN EXT (the Macs only ever take audio/video)

Files dropped loose in Ingest follow that table. Files inside a named subfolder are routed by the folder's name instead, and the rest of the path is recreated on the far end:

Top folder in Ingest	Goes to	Lands as
GFX 1 Main Screen Content/Monday Awards/x.pptx	GFX1 only	Ingest\Monday Awards\x.pptx
GFX 3+4 Confidence Monitor/Tuesday/y.pptx	GFX3 and GFX4	Ingest\Tuesday\y.pptx
Videos for Playback/z.mp4 (or any folder with Playback / Video / Media / Mitti in the name)	MITTIA, MITTIB	Ingest/z.mp4
Videos for Playback/deck.pptx (anything that is not audio/video in a Mac folder)	nowhere — logged REJECT, shown 🚫 REJECTED on the dashboard	—
a folder whose name says nothing (Misc/)	by extension, as above	Ingest\Misc\...

Any GFX spelling works: GFX 2, GFX1-3, GFX 5, 6, GFX1 and GFX2. So you can build the whole show tree on the Ingest machine and copy it in as one drop.

Day 1 through Day 5 are the exception: they are sorting bins, never looked inside. Office lock files (~$x.pptx), Finder metadata (._x, .DS_Store) and hidden files are ignored everywhere.

If something fails

FAIL on GFX: smbclient //GFX1/ShowShare -A ~/.config/showkit/smbcreds -c ls FAIL on Mac: smbclient //MITTIA/ShowShare -A ~/.config/showkit/smbcreds-mitti -c ls Windows Ingest: net use \GFX1\ShowShare password /user:show then dir \GFX1\ShowShare

A machine that answers a ping but refuses the share is a FAIL, not a SKIP: the share is asleep or the password is wrong. Give it 8 attempts, then GIVE UP is logged. Copy the file into Ingest again (or rename it) to retry — re-arming is keyed on the file's timestamp moving, not on the file merely still being there.

A file is identified by name and size. Same name with different content and different size is re-sent as a new version. Same name and same size is treated as the same file and left alone — use a new filename when in doubt.

Unsure what is still outstanding: cat ~/.config/showkit/queue.json

How it stays out of trouble

A half-copied file never lands. A file is only pushed after its size and modification time have held still across several polls and nothing has it open. A deck still copying off a USB stick is invisible to the watcher until it stops moving.

Every push is verified. After transferring, Ingest asks the far end how big the file is. A mismatch is a failure and gets retried, so a transfer that dies halfway is caught rather than silently accepted.

Failures retry. Up to 8 attempts with backoff, then GIVE UP. To retry a given-up file, copy it into Ingest again — the watcher remembers the file's timestamp from when it gave up and only starts over once that changes, so leaving a failed file sitting in the folder does not loop it forever. The queue is written to disk, so if Ingest reboots mid-show it resumes instead of starting over. Backoff timers reset on restart, because a restart usually means the rig just came up.

Absence is not failure, but it is not unlimited. A machine that does not answer a ping is SKIPped and re-checked every 60 seconds for 10 minutes, without spending retry attempts. A machine that answers ping but refuses the share is a genuine FAIL — the share is asleep or the password is wrong — and does consume attempts.

One consequence worth knowing: if a machine stays absent for that whole 10 minutes, the watcher stops waiting for it and reports DONE with a note, rather than blocking the file forever. It will not retry that file if the machine later appears. Switch the machine on within the window and it gets the file; past it, re-copy the file.

One slow machine cannot block the others. Pushes run in parallel, so a 20 GB media file does not hold up the decks.

No state is expected to survive a show. The warehouse reimages between events, so there is no "repair the previous show's config" path and no hidden carry-over to reason about. Each show is nine clean machines and a fresh queue.

Wi-Fi is never touched. Every script refuses a wireless adapter outright rather than trusting the operator picked the right cable, and the restore path only ever re-addresses the wired port.

After the event

The warehouse reimages the rig between events, so this kit has no teardown of its own to run. That process is outside this repo and nothing here drives it.

Do pull the logs off before the machines go back. The reimage takes them with it, and push_log.txt is the only record of what actually reached which machine on which attempt.

From the Ingest machine, Linux:

~/Desktop/Ingest/push_log.txt

Copy it somewhere that is not the rig, along with the far-end arrival logs if you want proof of receipt:

arrival_log.txt        C:\ShowScripts\        on GFX1-6
showkit-arrival.log    ~/Library/Logs/        on MITTIA/B

When to use the restore scripts instead

Only when a machine has to be usable before it goes back for imaging, or when it is not going to be imaged at all. Two cases in practice:

The Windows work laptop. If it acted as Ingest, double-click RUN-ingest-win-restore.bat and click Yes on the UAC prompt to get your own laptop back. You want it returned to daily-driver state, not carrying a show image. It stops the watcher and removes its scheduled task, drops the ShowShare connections, deletes the stored SMB passwords and push queue, restores the wired adapter to the addressing it had before setup, and cleans the hosts file. Add -Purge to also delete the Ingest and Archive folders.

The Linux Ingest machine, if you need it back early:

cd ~/Desktop/show-deploy && sudo bash ./restore-ingest.sh
sudo bash ./restore-ingest.sh --purge     # also deletes Ingest and Archive

Same job: removes the watcher service and its script, deletes stored SMB credentials and the push queue, returns the wired port to DHCP, cleans the hosts file. Wi-Fi is never touched, and no reboot is needed.

A Mac that is not going back for imaging (your own, or a hire that has to be handed back clean): right-click RUN-restore-mitti.command → Open, or

sudo ./restore-mitti.sh           # keeps Desktop/Ingest
sudo ./restore-mitti.sh --purge   # deletes it too

It reads the state setup-mitti.sh saved before it changed anything (/Library/Preferences/showkit/restore.env) and puts back the old computer name, the wired port's previous addressing (DHCP or whatever manual settings it had), removes ShowShare and the arrival watcher, deletes the show account if setup created it, and turns File Sharing off again only if it was off before. Wi-Fi is never touched. Reboot afterwards so the old name sticks.

All of them keep the Ingest and Archive folders by default, so the show files survive — only --purge / -Purge removes those, and that is the point at which the show files are gone.

Notes

Built for a nine-machine rig on a closed 192.168.50.0/24 network with no internet dependency at show time. The addresses, machine names and share name are defined once per file — show-watcher.py has them near the top, setup-gfx.ps1 and setup-mitti.sh have an IP map. Retargeting the kit to a different subnet means editing those.

The kit assumes the machines arrive from the warehouse already imaged to a clean baseline, which is what makes "run all nine setup scripts at load-in" sufficient. Nothing here provisions the base image, so if the image ever starts carrying stale show config, that is a change to make in the image rather than here.

The scripts assume exFAT or NTFS on the stick and a wired switch. The watchers run unattended once set up, which is what lets the Ingest laptop sit closed on the table: on Linux a systemd user service with linger enabled, so it survives logout and runs before anyone signs in; on Windows a scheduled task at logon. Neither starts on its own if the machine is off — obviously.

Future upgrades (not built yet)

• Windows dashboard. show-dashboard.py runs on the Linux Ingest machine. A matching dashboard for the Windows Ingest fallback (show-watcher.ps1) is not yet built.
• Windows desktop notifications. notify-send toast notifications are Linux-only. Windows Ingest shows no DONE/FAIL toasts yet.

What was recently added

• Windows Ingest fallback actually works. setup-ingest-win.ps1 called a cmdlet that does not exist (Install-Item) and died in a window that closed itself, and show-watcher.ps1 needed smbclient.exe (not on Windows) and ThreadJob (not in Windows PowerShell 5.1). The watcher now pushes with net use + file copy and runspaces, carries the same subfolder routing and Macs-media-only rules as the Linux watcher, and setup ends with PASS/FAIL. No default gateway on the show port, same as Linux. test_watcher_win.py runs 88 checks against it under pwsh.

• Subfolder routing: a folder named for a machine (GFX 1 …, GFX 3+4 …, Videos for Playback) sends its contents to those machines only, keeping the sub-path. Lock files and Finder metadata are skipped. RUN-fix-mitti-share.command repairs a Mac whose ShowShare was invisible to show (traverse rights on ~ and ~/Desktop — smbd hides a share whose path the user cannot reach).

• Six GFX machines (GFX1-6 on .11-.16). Macs moved to .21/.22.

• Mac share actually works. setup-mitti.sh now creates a dedicated show account with the SMB-NT hash enabled, turns File Sharing on from the command line, grants the account write access to Desktop/Ingest, and self-tests the share before declaring success. Previously it created the folder but Ingest could never log in.

• restore-mitti.sh — Mac equivalent of restore-ingest.sh.

• Default share password is now password.

• Live dashboard (show-dashboard.py) — http://localhost:8080, auto-started by setup-ingest.sh, no crew action needed.

• Desktop notifications — notify-send toasts on DONE, GIVE UP, and expired-machine events. Fires automatically from the watcher.

• show-status.sh — human-readable terminal summary of the queue.

• Desktop launcher (show-deploy.desktop) — double-click to run setup-ingest.sh without opening a terminal manually. Install with bash install-desktop-launcher.sh.