Own the network: details, VPN, enterprise Wi-Fi, and a firewall that can also allow

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/sharing-contract

@@ -89,6 +89,52 @@ grep -q 'kitty' "$service" \
 grep -q 'clear-rdp-credentials' "$helper" \
     || fail 'stored credentials cannot be cleared'
 
+# ── The page says the true thing in the right place ─────────────────────────
+#
+# Three copy rules, each of which was a real failure before it was a rule.
+#
+# The failure banner floated above every card as a full-width red bar, so a
+# grdctl error that concerned one row repainted the whole page as broken. It
+# belongs inside the card whose action failed -- the machine card, which is
+# where refresh and the hostname live.
+page_code="$(grep -vE '^\s*//' "$page")"
+python3 - "$page" <<'PY' || fail 'the failure message is not inside the first card, so one row failing reads as the page failing'
+import re
+import sys
+
+lines = open(sys.argv[1], encoding="utf-8").read().splitlines()
+start = next((i for i, line in enumerate(lines) if re.search(r"\bSettingsCard\s*\{", line)), None)
+if start is None:
+    raise SystemExit(1)
+depth = 0
+end = None
+for index in range(start, len(lines)):
+    depth += lines[index].count("{") - lines[index].count("}")
+    if depth <= 0:
+        end = index
+        break
+if end is None:
+    raise SystemExit(1)
+card = "\n".join(lines[start:end + 1])
+raise SystemExit(0 if "Sharing.lastError" in card else 1)
+PY
+
+# The terminal is the mechanism, not the explanation. "Opens kitty" tells
+# somebody the name of a program they did not ask about and still leaves them
+# wondering why a settings page cannot take a password; the reason it cannot is
+# the sentence worth printing.
+! grep -qi 'kitty' <<<"$page_code" \
+    || fail 'the page names the terminal application in text the user reads; that belongs to the service'
+grep -q 'never passes through Panama' <<<"$page_code" \
+    || fail 'the credentials row does not say why the password is set elsewhere'
+
+# A row for software that is not here has to be worth reading. "Not installed"
+# on its own is a dead end; what installing it would give you is not.
+grep -q 'install it and this becomes a switch' <<<"$page_code" \
+    || fail 'the file sharing row does not say what installing Samba would unlock'
+grep -q 'does not install software' <<<"$page_code" \
+    || fail 'the file sharing row does not say that Settings will not install it for you'
+
 # ── The snapshot reflects the machine ───────────────────────────────────────
 command -v jq >/dev/null 2>&1 || { printf 'sharing contract: SKIP (no jq)\n'; exit 0; }
 snapshot="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'