Merge Panama health hardening

config/dot/quickshell/modules/settings/HealthPage.qml

@@ -143,6 +143,7 @@ SettingsPage {
         const checkingLabels = root.descendants(root, "health-checking-label").filter(label => label.visible);
         const confirmationSheets = root.descendants(root, "health-confirmation-sheet:").filter(sheet => sheet.visible);
         const emptyGroups = root.descendants(root, "health-empty-group:").filter(label => label.visible);
+        const fedoraHandoffs = root.descendants(root, "health-fedora-handoff:").filter(row => row.visible);
         return {
             renderedRows: rows.map(row => {
                 const objectName = String(row.objectName);
@@ -162,6 +163,11 @@ SettingsPage {
             focusChain: root.renderedFocusChain(),
             activatedRows: rows.filter(row => row.actionActivationCount > 0).map(row => String(row.objectName)),
             emptyQuietGroups: emptyGroups.map(label => String(label.objectName).slice("health-empty-group:".length)),
+            fedoraHandoffs: fedoraHandoffs.map(row => ({
+                id: String(row.objectName).slice("health-fedora-handoff:".length),
+                label: row.label,
+                action: row.action
+            })),
             confirmationVisible: confirmationSheets.length === 1,
             confirmationId: confirmationSheets.length === 1
                 ? String(confirmationSheets[0].objectName).slice("health-confirmation-sheet:".length)
@@ -384,14 +390,40 @@ SettingsPage {
 
     SettingsCard {
         title: "Fedora system settings"
-        subtitle: "Panels this app does not own, because they configure system services rather than the desktop. Each row opens the panel that actually owns it. Printers and online accounts live with the rest of the network hardware, on Network & Devices."
+        subtitle: "These areas remain owned by Fedora and GNOME's mature system panels."
+
+        Item {
+            width: parent.width
+            implicitHeight: 42
+
+            Text {
+                anchors.left: parent.left
+                anchors.right: gnomeSettingsButton.left
+                anchors.rightMargin: 18
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Use GNOME Settings for the parts of the system this app does not manage."
+                color: Theme.fgDim
+                font.family: Theme.fontFamily
+                font.pixelSize: Theme.fontSizeSmall
+                wrapMode: Text.WordWrap
+            }
+
+            SettingsButton {
+                id: gnomeSettingsButton
+                anchors.right: parent.right
+                anchors.verticalCenter: parent.verticalCenter
+                text: "Open GNOME Settings"
+                activeFocusOnTab: true
+                border.width: activeFocus ? 2 : 1
+                border.color: activeFocus ? Theme.accent : Theme.alpha(Theme.fg, 0.08)
+                onClicked: SystemSettings.openGnomePanel("network")
+                Keys.onReturnPressed: SystemSettings.openGnomePanel("network")
+                Keys.onSpacePressed: SystemSettings.openGnomePanel("network")
+            }
+        }
 
-        // One row per subject rather than a single "Open GNOME Settings"
-        // button. Naming five things and then opening the network panel
-        // regardless reads as a broken button rather than a deliberate
-        // hand-off, and left someone looking for printers to navigate once
-        // GNOME Settings appeared on the wrong page.
         ActionRow {
+            objectName: "health-fedora-handoff:users"
             label: "Users"
             detail: "Accounts, passwords, and automatic login"
             action: "Open users"
@@ -399,6 +431,7 @@ SettingsPage {
         }
 
         ActionRow {
+            objectName: "health-fedora-handoff:sharing"
             label: "Sharing"
             detail: "Remote desktop, media sharing, and remote login"
             action: "Open sharing"
@@ -406,6 +439,7 @@ SettingsPage {
         }
 
         ActionRow {
+            objectName: "health-fedora-handoff:color"
             label: "Colour profiles"
             detail: "ICC profiles for displays, printers, and scanners"
             action: "Open colour"
@@ -413,6 +447,7 @@ SettingsPage {
         }
 
         ActionRow {
+            objectName: "health-fedora-handoff:wellbeing"
             label: "Digital wellbeing"
             detail: "Screen time and break reminders"
             action: "Open wellbeing"

config/dot/quickshell/modules/settings/README.md

@@ -4,6 +4,33 @@ The control centre for everything Panama owns. Anything the system owns —
 hardware, accounts, printers — is delegated to GNOME Settings and labelled as
 such rather than half-reimplemented.
 
+## System Health
+
+The stable internal `services` route renders **System Health**. It is reachable
+from the Settings sidebar and its live 54px footer, the degraded-only bar
+indicator, and Vicinae's **Panama: Check System Health** command. Healthy scans
+reserve no bar space and produce no notification.
+
+`services/Health.qml` owns the last accepted redacted snapshot. It invokes
+`scripts/panama-doctor` for scans and bounded repairs, `wl-copy` only for an
+explicit **Copy Report**, and bounded `notify-send` only when an external repair
+fails. For a concise terminal view, run:
+
+```bash
+~/.config/quickshell/scripts/panama-doctor --summary
+```
+
+The helper diagnoses Panama-owned desktop services, dependencies, links, and
+configured integrations. It does not read secret values, clipboard or
+notification contents, calendar events, SSIDs, addresses, or arbitrary command
+output. Its repair interface is an authored allow-list: it never installs a
+package, runs `sudo`, deletes user data, or repairs a service Panama does not
+own. A repair remains degraded until a fresh scan observes recovery.
+
+The final card is the ownership boundary. Network configuration and the exact
+Users, Sharing, Colour profiles, and Digital wellbeing handoffs open GNOME
+Settings because Fedora's system services own those areas.
+
 ## Adding a setting
 
 One schema entry. That is the whole job.
@@ -83,11 +110,12 @@ slot**, because that is the row's default property, so only the right-hand edge
 becomes clickable. Use `activatable: true` with `onActivated` for a whole-row
 target.
 
-**A copy of the Quickshell config shares the live shell's ID.** Quickshell
-derives the Shell ID from config *content*, not path, so
-`cp -a config/dot/quickshell $tmp && qs -p $tmp kill` kills the running
-desktop, and `qs -p $tmp ipc call …` can drive it. Harnesses that point at a
-single distinct `.qml` file are safe; copying the whole directory is not.
+**A content-identical Quickshell entry can share the live shell's ID.**
+Quickshell derives the Shell ID from config *content*, not path. Runtime
+harnesses therefore create a distinct semantic entry file, address that exact
+file with `qs -p`, and discover its PID from the exact Config path in
+`qs list --all`. They terminate only that recorded PID with `kill`; never use
+`qs kill` from a copied configuration.
 
 ## Where state lives