Close desktop safety gaps

tests/quickshell/wallpaper-service-contract

@@ -15,6 +15,8 @@ active_state="$fixture/active.json"
 control="$fixture/control"
 shell_log="$fixture/quickshell.log"
 harness_pid=""
+quoted_home="$fixture/home's"
+quoted_wallpaper="$quoted_home/Pictures/Wallpapers/quoted.jpg"
 
 fail() {
     printf 'wallpaper service contract: %s\n' "$1" >&2
@@ -46,9 +48,18 @@ cleanup() {
 }
 trap cleanup EXIT
 
-mkdir -p "$config_home/panama" "$state_home" "$test_bin"
+mkdir -p "$config_home/panama" "$state_home" "$test_bin" \
+    "$quoted_home/Pictures/Wallpapers"
 cp -a "$repo_dir/config/dot/quickshell" "$config_path"
-printf '%s\n' '{}' >"$config_home/panama/settings.json"
+printf 'quoted wallpaper\n' >"$quoted_wallpaper"
+cat >"$config_home/panama/settings.json" <<'JSON'
+{
+  "displays": {
+    "DP-2": {"mode":"[email protected]","scale":1.5,"transform":0,"x":0,"y":0,"primary":true},
+    "HDMI-A-1": {"mode":"[email protected]","scale":1,"transform":0,"x":3000,"y":0,"primary":false}
+  }
+}
+JSON
 printf '%s\n' '{}' >"$active_state"
 : >"$command_log"
 : >"$control"
@@ -92,6 +103,7 @@ qs_for_harness() {
         XDG_CONFIG_HOME="$config_home"
         XDG_STATE_HOME="$state_home"
         PATH="$test_bin:$PATH"
+        HOME="$quoted_home"
         PANAMA_WALLPAPER_COMMAND_LOG="$command_log"
         PANAMA_WALLPAPER_ACTIVE_STATE="$active_state"
         PANAMA_WALLPAPER_CONTROL="$control"
@@ -113,6 +125,18 @@ wait_idle() {
     fail "wallpaper transaction did not settle: $status"
 }
 
+wait_for_scan() {
+    local status=""
+    for _ in $(seq 1 80); do
+        status="$(qs_for_harness ipc call wallpaper-service-test status)"
+        jq -e --arg path "$quoted_wallpaper" \
+            '.scanning == false and (.available | index($path) != null)' \
+            <<<"$status" >/dev/null && return
+        sleep 0.1
+    done
+    fail "argument-safe wallpaper scan did not discover the quoted HOME image: $status"
+}
+
 qs_for_harness --daemonize >"$shell_log" 2>&1 || fail 'isolated service harness did not launch'
 for _ in $(seq 1 60); do
     harness_pid="$(instances_for_harness | head -1)"
@@ -123,6 +147,7 @@ for _ in $(seq 1 60); do
     sleep 0.1
 done
 [[ "$harness_pid" =~ ^[0-9]+$ ]] || fail 'isolated service harness process did not start'
+wait_for_scan
 wait_idle >/dev/null
 
 : >"$command_log"