Harden Panama doctor probes

tests/quickshell/fixtures/doctor/bin/busctl

@@ -5,6 +5,10 @@ set -euo pipefail
 if [[ "${PANAMA_DOCTOR_FIXTURE_BUS:-ready}" == "missing" ]]; then
     exit 1
 fi
+if [[ "${PANAMA_DOCTOR_FIXTURE_BUS:-ready}" == "invalid-utf8" ]]; then
+    printf '\377\n'
+    exit 0
+fi
 printf '%s\n' \
     'org.freedesktop.portal.Desktop 1000 portal' \
     'org.kde.kdeconnect 1000 kdeconnect' \

tests/quickshell/fixtures/doctor/bin/pgrep

@@ -5,6 +5,7 @@ set -euo pipefail
 name="${!#}"
 case ",${PANAMA_DOCTOR_FIXTURE_PROCESSES:-}," in
     *",$name:duplicate,"*) printf '4101\n4102\n' ;;
+    *",$name:malformed,"*) printf 'not-a-pid\n' ;;
     *",$name:missing,"*) exit 1 ;;
     *) printf '4101\n' ;;
 esac

tests/quickshell/fixtures/doctor/bin/systemctl

@@ -2,6 +2,10 @@
 
 set -euo pipefail
 
+if [[ -n ${PANAMA_DOCTOR_FIXTURE_PROBE_SECRET+x} ]]; then
+    exit 97
+fi
+
 service="${4:-}"
 case ",${PANAMA_DOCTOR_FIXTURE_STOPPED:-}," in
     *",$service,"*) exit 3 ;;

tests/quickshell/fixtures/doctor/bin/systemd-inhibit

@@ -7,4 +7,7 @@ printf 'Panama %s fixture-user 4101 systemd-inhibit sleep:idle Caffeine block\n'
 if [[ "${PANAMA_DOCTOR_FIXTURE_CAFFEINE:-single}" == "duplicate" ]]; then
     printf 'Panama %s fixture-user 4102 systemd-inhibit sleep:idle Caffeine block\n' "$uid"
 fi
+if [[ "${PANAMA_DOCTOR_FIXTURE_CAFFEINE:-single}" == "malformed" ]]; then
+    printf 'Panama %s fixture-user invalid Caffeine\n' "$uid"
+fi
 printf 'Other %s fixture-secret-token AA:BB:CC:DD:EE:FF fixture clipboard body ignore ignore\n' "$uid"

tests/quickshell/panama-doctor-contract.sh

@@ -134,6 +134,22 @@ assert_schema_and_redaction "$snapshot"
 # A healthy systemd-backed service stays healthy.
 check_status "$snapshot" desktop.hyprpaper ok
 
+# Arbitrary parent environment values are not propagated into probes.
+sealed_environment="$(PANAMA_DOCTOR_FIXTURE_PROBE_SECRET=fixture-secret-token run_doctor --json)"
+assert_schema_and_redaction "$sealed_environment"
+check_status "$sealed_environment" desktop.hyprpaper ok
+
+# An OS-level launch failure is contained as a check result, never a failed
+# doctor invocation or a partial snapshot.
+chmod 0644 "$bin_dir/systemctl"
+if ! launch_failure="$(run_doctor --json)"; then
+    chmod +x "$bin_dir/systemctl"
+    fail 'launch failure prevented the doctor from emitting JSON'
+fi
+chmod +x "$bin_dir/systemctl"
+assert_schema_and_redaction "$launch_failure"
+check_status "$launch_failure" desktop.hyprpaper error
+
 # A missing required executable is an error rather than a crash.
 mv "$bin_dir/qs" "$bin_dir/qs.off"
 missing_qs="$(run_doctor --json)"
@@ -183,6 +199,24 @@ check_status "$duplicated_processes" panama.processes warning
 ! jq -r '.checks[] | select(.id == "panama.processes") | .detail' <<<"$duplicated_processes" | grep -Eq '[0-9]{3,}' \
     || fail 'process detail exposed a PID'
 
+# Invalid output for a non-Quickshell authored process is not a normal zero
+# count that can be hidden by the running Quickshell process.
+malformed_processes="$(PANAMA_DOCTOR_FIXTURE_PROCESSES=hyprpaper:malformed run_doctor --json)"
+check_status "$malformed_processes" panama.processes warning
+
+# Panama/Caffeine-shaped rows that do not satisfy the fixed inhibitor schema
+# are unavailable rather than reported as a healthy no-inhibitor state.
+malformed_caffeine="$(PANAMA_DOCTOR_FIXTURE_CAFFEINE=malformed run_doctor --json)"
+check_status "$malformed_caffeine" panama.caffeine warning
+
+# A decoding error raised inside a concurrent probe is converted to a complete
+# snapshot rather than escaping from Future.result().
+if ! invalid_probe="$(PANAMA_DOCTOR_FIXTURE_BUS=invalid-utf8 run_doctor --json)"; then
+    fail 'unexpected probe exception prevented the doctor from emitting JSON'
+fi
+assert_schema_and_redaction "$invalid_probe"
+check_status "$invalid_probe" desktop.portals warning
+
 # Configured Home Assistant failures route to the exact authored Settings page.
 rm "$config_home/quickshell"
 mkdir -p "$config_home/quickshell/scripts"