HydraIssues

Symptom

While streaming rupelmonde-castle-viewer from turbo-pancake to cosmic-pretzel-98 on 2026-04-30, two Windows-side toasts/dialogs were visible to the visitor through the captured display:

1. Windows Update prompt ("Restart to keep getting security fixes for Windows (estimate: 20 min - 1 hr)") — full modal in the middle of the screen, blocking the experience visually.
2. HP Wolf Security toast bottom-right ("Welcome to HP Wolf Security. Please open the security console for an important message.")

These are body-side OS notifications painted on top of the experience's render output. Because Sunshine captures the desktop via DXGI Desktop Duplication, anything the OS draws gets streamed.

Why it matters

Visitors at a kiosk should see the experience and only the experience. Windows-side prompts erode the brand and can look broken or alarming. The body kiosk's kioskoverlay already hides taskbar/icons, but it doesn't (yet) suppress modal toasts and Update prompts.

Proposed fix

1. Disable Windows Update reboot prompts during provisioning: set IsExpedited and RebootDeadline policies via registry (HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings), set NoAutoRebootWithLoggedOnUsers=1, schedule reboots only during off-hours via WUfB policies. Add to recipes/hydrabody-windows.yaml.
2. Disable third-party security suite popups (HP Wolf): either uninstall/disable the suite as part of body provisioning if it's not load-bearing, or apply its own quiet-mode config.
3. Generic suppression: configure Focus Assist to "Alarms only" priority on the kiosk user, blocking all toasts during display capture.

Recipe step:

- name: suppress-os-prompts
  exec: |
    # Update prompt suppression
    reg add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v IsExpedited /t REG_DWORD /d 0 /f
    reg add "HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings" /v NoAutoRebootWithLoggedOnUsers /t REG_DWORD /d 1 /f
    # Focus Assist (alarms only) for the kiosk user — best done via Group Policy
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_TOASTS_ENABLED /t REG_DWORD /d 0 /f
    Write-Host "OS prompts suppressed"

Out of scope

• Disabling the OS update mechanism entirely (we still want security patches; just not user-facing prompts).
• Removing HP Wolf Security if it's a vendor-mandated security feature on cosmic's hardware.

Verification

After the recipe step lands and a body reprovisions: stream any experience, verify no Update modal appears within ≤1 hour of stream start. HP Wolf and similar vendor toasts: file separately if vendor-specific suppression doesn't fit one common toggle.